Statement on the processing of personal data

The protection of personal data of the buyer, who is a natural person, is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council, on the protection of natural persons in connection with the processing of personal data and on the free movement of such data, and on the repeal of Directive 95/46/EC (General Regulation on personal data protection) (hereinafter referred to as "GDPR").

The purpose of this document is to inform you, as a buyer, if you are purchasing goods as a natural person, about the processing of your personal data by our company as a seller and your related rights, in accordance with Article 12 et seq. GDPR.

This document also applies to the processing of your personal data based on your consent.

The processing of so-called cookie files, with the exception of your rights, is governed by a separate statement of the administrator published on the administrator's website.

I. Administrator of personal data

The controller of your personal data is the company PECKA-MODELÁŘ s.r.o., with its registered office at Vajdova 1047/25, Prague 10, IČO: 27114295, DIČ: CZ27114295, registered in the commercial register kept at the Municipal Court in Prague, section C, file 97301, (hereinafter referred to as " administrator "), which is also the seller.

II. Personal data processed and their sources

The administrator processes personal data obtained directly from you, as a buyer, which you filled in the order form in connection with the conclusion of a contractual or other legal relationship between you and the administrator (in particular, this is a purchase contract), or when registering in your user account on the administrator's website. These are your following personal data:

first and last name;
identification number, tax identification number;
delivery address (if personal collection of goods is not agreed);
telephone number;
electronic mail address (e-mail address).

Based on your consent to the processing of personal data, the administrator further processes your personal data:

date of birth;
phone number a
electronic mail address (e-mail address).

III. Purpose of personal data processing and legal basis of personal data processing

The administrator processes your personal data for the purposes included in the framework of your consent to the processing of personal data, negotiating the contractual relationship and fulfilling the contract, fulfilling the legal obligations that apply to the administrator, and protecting the rights and other important interests of the administrator (e.g. the recovery of the administrator's claims). .

The administrator processes your personal data for the following purposes:

Your name, surname, identification number, tax identification number for the purpose of concluding a purchase contract with you and its fulfillment, fulfilling legal obligations (e.g. keeping accounts, fulfilling obligations according to tax regulations) and protecting the rights and other important interests of the administrator (e.g. debt collection ),
delivery address for the purpose of fulfilling the contract (delivery of the shipment ordered by you),
telephone number for the purposes of fulfilling the contract (contacting in case of any problems with the shipment) and for marketing purposes (i.e. offering products and services of the seller or third parties) including sending business communications in accordance with Act No. 480/2004 Coll., on certain information services company, especially so-called birthday offers (a discount on the seller's goods sent to the buyer in connection with his birthday),
e-mail address for the purpose of fulfilling the contract (for the purpose of sending a confirmation of receipt of your order), for marketing purposes (i.e. offering products and services of the seller or third parties) including sending business communications in the sense of Act No. 480/2004 Coll., on certain information society services, in particular so-called birthday offers (a discount on the seller's goods sent to the buyer in connection with his birthday) and the purposes of sending the "Verified by customers" satisfaction questionnaire ( www.heurekashopping.cz ) and
date of birth for the purpose of sending a so-called birthday offer (a discount on the seller's goods sent to the buyer in connection with his birthday).

These personal data of yours are a requirement for the proper performance of the concluded purchase contract:

Your name, surname, identification number, tax identification number - without this data it will not be possible to conclude a purchase contract with you,
delivery address - without this information it will not be possible to deliver the goods to you,
telephone number - without this information, the administrator will not be able to contact you if necessary and
e-mail address - without this information, the administrator will not be able to accept your order.

The legal basis for the processing of your personal data is the fulfillment of the contract you have concluded with the controller, as well as the legitimate interests of the controller (mainly for the purpose of recording contractual relationships and statistical purposes, for the purpose of protecting the rights of the controller against illegal activity, including IT security, enforcement of the controller's claims) and the fulfillment of legal requirements (especially fulfillment of requirements according to regulations on personal data protection (e.g. GDPR), bookkeeping, fulfillment of obligations according to tax regulations).

The separate legal basis for the processing of your personal data is your consent, for the purposes specified in this consent. This consent of yours is voluntary and failure to grant it does not affect the fulfillment of your order.

If the legal reason for the processing of your personal data is your consent, you can revoke this consent at any time free of charge by contacting the administrator's contact details below. However, revocation of your consent does not affect the legality of the processing based on your consent, which was given before its revocation. The withdrawal of consent also does not affect the processing of your personal data, which the administrator processes on the basis of a different legal basis than your consent.

IV. Recipients of personal data

Your personal data is mainly processed by the administrator, who does not use the services of any personal data processor, with the exception stated below.

Your personal data can thus be accessed by the administrator's employees and other cooperating persons, in particular entities that participate in the fulfillment of your order (e.g. transport companies), entities providing legal and accounting services, the entity managing for the website administrator (e-shop) and further the entity managing the administrator's accounting system. Based on your consent, the company Heureka Shopping s.r.o., IČO 02387727 (www.heurekashopping.cz) may have access to your e-mail address for the purpose of sending the satisfaction questionnaire "Verified by customers".

The administrator hereby informs you that your personal data will not be transferred by the administrator or other recipients of personal data to a country that is not a member state of the European Union or to an international organization. The exception is cases where you require the ordered goods to be delivered to a country that is not a member state of the European Union - then the transfer of personal data to this country is the obligation of the administrator resulting from the contract concluded with you in terms of the obligation of the administrator to properly fulfill the contract. The controller then transfers your personal data to the transport company responsible for delivering the goods to this country, and this company is obliged to take all appropriate measures to ensure that your personal data are not misused and are protected throughout their processing.

The administrator declares that there is no automated decision-making, including profiling, in relation to your personal data.

V. Method of processing and protection of personal data

The processing of your personal data is carried out by the administrator through its employees, or other cooperating persons at the controller's headquarters, its establishments and branches. The processing takes place through computer technology, or also manually for personal data in paper form, subject to compliance with all security principles for the management and processing of personal data. For this purpose, the administrator has adopted technical and organizational measures to ensure the protection of personal data, in particular measures to prevent unauthorized or accidental access to your personal data, their change, destruction or loss, unauthorized transfers, their unauthorized processing, as well as other misuse of your personal data data.

All entities to which your personal data may be made available respect your right to privacy and are obliged to proceed in accordance with applicable legal regulations regarding the protection of personal data.

VI. Time of personal data processing

Your personal data will be processed for a reasonable period of time with regard to the purpose of the processing.

For the purposes of recording contracts and received services, the administrator will record your personal data for a period of 3 years from the due date of payment of the purchase price.

The administrator will process your personal data for the purpose of sending business communications (newsletters) and birthday offers until you express your disagreement with such sending, for a maximum period of 5 years from your last purchase.

Your e-mail address will be processed by the administrator for the purpose of sending the satisfaction questionnaire "Verified by customers" until it is handed over to Heureka Shopping s.r.o.

Processing of your personal data after the expiration of the above periods, or revocation of your consent, the administrator will carry out to the extent necessary to demonstrate the legitimacy of the processing of your personal data, in cases of raising probable legal claims and fulfilling legal obligations (e.g. § 31 of Act 563/1991 Coll., on accounting, or § 35 of Act No. 235 /2004 Coll., on value added tax).

VII. Rights of data subjects

As a data subject, you have the following rights according to the GDPR, about which the controller is obliged to inform you explicitly:

Right of access to personal data

You have the right to obtain confirmation from the controller as to whether or not the personal data concerning you is being processed by the controller and, if so, you have the right to obtain access to such personal data and the following information:

for what purposes the administrator processes your personal data;
that your personal data is processed by the administrator;
to whom your personal data is made available;
time of processing your personal data;
the existence of the right to request from the administrator the correction or deletion of your personal data or the limitation of their processing or to object to their processing;
the right to file a complaint with a supervisory authority;
any available information about the source of your personal data, unless it was obtained from you;
whether automated decision-making takes place, including profiling, referred to in Article 22 paragraphs 1 and 4 of the GDPR, and if so, you have the right to obtain information regarding the procedure used, as well as the meaning and expected consequences of such processing for your person.

Requests for access to your personal data will be handled by the administrator free of charge. However, if your request is clearly unfounded or unreasonable, especially because it is repeated, the administrator may refuse to comply with your request or charge you a reasonable fee taking into account the administrative costs associated with providing the requested information.

The right to correct personal data

You have the right to have the administrator correct your inaccurate personal data without undue delay. You also have the right to have the administrator complete your personal data without undue delay if they are incomplete.

The right to erasure of personal data

You have the right to have the administrator delete your personal data without undue delay if one of the following reasons is given:

The administrator no longer needs your personal data for the purposes for which they were processed;
you withdraw your consent to the processing of personal data, in the case of personal data for which your consent is necessary for processing, and at the same time the administrator has no other reason why he does not need to continue processing this data (e.g. for the purpose of collecting claims against you);
you exercise your right to object to the processing (see letter f) below) of your personal data processed on the basis of the administrator's legitimate interests, and the administrator no longer finds any legitimate interests that would justify the processing;
you will exercise your right to object to processing (see letter f) below) for your personal data processed for the purpose of direct marketing by the controller;
the processing of your personal data is no longer in accordance with applicable legal regulations.

The right to erasure does not apply in cases where the processing of your personal data is still necessary for the fulfillment of the controller's legal obligations (typically imposed by law), for archiving purposes in the public interest, for scientific, historical or statistical purposes, or for the determination, exercise or defense of legal administrator's claims (e.g. enforcement of administrator's claims).

The right to restrict the processing of personal data

You have the right that the administrator does not process your personal data for a limited period of time if one of the following conditions is met:

you deny the accuracy of your personal data for the time required before the administrator verifies the accuracy of your personal data;
if the administrator processes your personal data without a sufficient legal basis, but you request a restriction of processing and not their deletion (see letter c) above);
the controller no longer needs to process your personal data, but you require it for the determination, exercise or defense of your legal claims;
for the period of verification of the legitimacy of your objection to the processing of your personal data for the purposes of the administrator's legitimate interests (see letter f) below).

The right to portability of personal data

You have the right to demand that the administrator hand over your personal data, which he obtained from you for the conclusion of the contract with you and its performance, or for the processing of which you have given consent. However, you can only obtain personal data if the administrator processes it automatically in electronic form. Your personal data will then be transferred to you in a structured, commonly used and machine-readable format.

The right to object to processing

You have the right to object to the processing of your personal data if the controller processes it based on its legitimate interests. The administrator will comply with your objection if he does not demonstrate serious legitimate reasons for the processing of your personal data.

You have the right to object to the processing of your personal data if the controller processes it for the purposes of its direct marketing (typically the promotion of its goods or services). The administrator will always comply with your objection in this case.

The right to file a complaint

You have the right, regardless of all the above-mentioned rights, to file a complaint against the processing of your personal data by the controller with the Office for the Protection of Personal Data, which is located at the address Pplk. Sochora 27, 170 00 Prague 7 (more at www.uoou.cz), especially if you believe that your personal data is being processed in violation of generally binding legal regulations.

VIII. Instructing data subjects

If it is likely that a certain case of violation of the security of your personal data will result in a high risk for your rights and freedoms, the administrator will notify you of this violation without undue delay. However, this notification is not mandatory in cases where:

the administrator has implemented appropriate technical and organizational protection measures and these measures have been applied to your personal data affected by the breach of personal data security;
the controller has taken follow-up measures to ensure that a high risk to your rights and freedoms is unlikely to occur again;
it would require a disproportionate effort on the part of the administrator. In such event, you will be notified by means of a public notice or similar measure.