Personal data protection in the e-shop - GDPR

General information about the processing of personal data

1. Data subject – buyer/website visitor,

Operator – SentopEU, sro, Vyšný Koniec 79, 023 54 Turzovka, Company ID: 53 765 699

2. Recipients of personal data
Aplicomp, sro , J. Ťatliaka 1785/6 Dolný Kubín 026 01, Company ID: 44823070

BaseLinker s.r.o. , Rohanské nábřeží 678/23, Karlín, 186 00 Prague, ID: 11963417
Direct Parcel Distribution SK sro , Pri letisku 5, 821 04 Bratislava – Ružinov city district, Company ID: 35834498
ECOMAIL.cz, sro , Na Zderaze 1275/15, 120 00 Prague 2, ID: 02762943
FAVI a.s. , Vodičkova 710/31, Nové Město, 110 00 Prague 1, ID: 04857402
FedEx Express Slovakia, sro , Pri starom letisku 14, 830 06 Bratislava 36, Company ID: 31351603
Fio banka, as , Dunajská 1, 811 08 Bratislava, Company ID: 36869376
Frogman, sro , Komenského 25, 76302 Zlín, ID: 49434624
GLS General Logistics Systems Slovakia, sro , Lieskovská cesta 13, 962 21 Lieskovec, Company ID: 36624942
GOPAY, sro , Pražská tř. 1247/24, 370 04 České Budějovice 3, ID: 26046768
Heureka Group as , Karolinská 706/3, 186 00 Prague 8 – Karlín, ID: 07822774
PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg, ID: B118349
Revolut Ltd. , Konstitucijos ave. 21B, Vilnius, 08130 Republic of Lithuania, ID: 08804411
Slovak Post, as , Partizánska cesta 9, 975 99 Banská Bystrica, Company ID: 36631124
Smartsupp.com, sro , Šumavská 31, 602 00 Brno, ID number: 03668681

Slovak Parcel Service, sro , Senecká cesta 1, 900 28 Ivanka pri Dunaji, Company ID: 31329217
TNT Express Worldwide spol. sro , Pri starom letisku 14, 830 06 Bratislava 36, Company ID: 31351603

UPS Slovakia sro , Mokráň záhon 4, 821 04 Bratislava – Ružinov city district, Company ID: 54387876

3. Due to the scope and subject of its activities, the operator is not obliged to designate a responsible person pursuant to Section 44 of Act No. 18/2018 Coll. on the Protection of Personal Data. However, if you have any questions regarding your personal data, please write to us at: info@sentop.sk, or call: +421 940 609 415, or visit us in person at the above-mentioned address of the operator.

The website operator is responsible for the processing of personal data pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as GDPR). The data subject has the right, upon written request from the operator, to request information about their personal data that are the subject of processing or to have their personal data erased or corrected by the operator.

4. The data subject is obliged to provide true and up-to-date personal data. The rights of the data subject are regulated by Chapter 3 of the GDPR. The data subject has the right to: lodge a complaint with the supervisory authority, object to processing, request from the controller access to personal data concerning the data subject, to rectify or erase or restrict the processing of personal data, as well as the right to data portability.

Information about the rights of the data subject

The data subject has the right, upon written request, to require the controller to:

a) confirmation of whether or not personal data about him/her are being processed,

b) in a generally understandable form, information on the processing of personal data in the information system to the extent of the identification data of the controller and the processor (if established); the purpose of the processing of personal data; the list or scope of the processed personal data; instructions on the voluntariness or obligation to provide the requested personal data, the validity period of the consent or a notification of which legal regulation imposes the obligation to provide personal data; third parties, if personal data are to be provided to them; the group of recipients, if personal data are to be made available to them; the form of disclosure of personal data, if personal data are to be disclosed; third countries, if personal data are to be transferred to these countries,

c) in a generally understandable form, precise information about the source from which the controller obtained his or her personal data for processing,

d) a list of their personal data that are subject to processing in a generally understandable form,

e) correction or destruction of his/her incorrect, incomplete or outdated personal data that are the subject of processing,

f) destruction of his/her personal data, the purpose of processing of which has ended; if the subject of processing is official documents containing personal data, you may request their return,

g) destruction of their personal data that are the subject of processing if there has been a violation of the law,

h) blocking of her personal data due to withdrawal of consent before the expiry of its validity, if the operator processes personal data based on her consent. The above-mentioned request or information about the leakage of personal data or other serious facts regarding the processing of personal data by the operator can be addressed to the operator at the above-mentioned address or at the tel. number: +421 940 609 415 , or at the e-mail address: info@sentop.sk

Right to access personal data

As a data subject, you have the right to obtain confirmation from the controller as to whether or not personal data concerning you are being processed. If so, you have the right to obtain:

confirmation that your personal data is being processed,
access to this data,
information about:

- the purpose of processing personal data,
- categories of personal data processed,
- the recipients or categories of recipients to whom the data have been or will be disclosed (in particular if they are recipients in a third country or an international organisation)
- appropriate safeguards in the event of data transfer to a third country or international organisation,
- the period of retention of personal data, or the criteria for determining it,
- right to request correction, deletion or restriction of processing of personal data,
- to object to the processing of personal data,
- just file a motion to initiate proceedings on the protection of personal data,
- the source of personal data, if it was not obtained from you.

Where automated individual decision-making, including profiling, is carried out, you have the right to obtain information about the process used, as well as the significance and foreseeable consequences of such processing for you. Profiling is any form of automated processing of personal data which evaluates personal aspects of a natural person, in particular his/her work performance, economic situation, health, personal preferences, interests, behavior, reliability, location or movements.

The controller is obliged to provide you with the personal data it processes. For repeated provision of data, it may charge a reasonable fee corresponding to administrative costs. Personal data must be provided in the manner requested by you, and the exercise of this right must not adversely affect the rights and freedoms of other natural persons.

Right to rectification of personal data

As a data subject, you have the right to have the controller rectify inaccurate personal data concerning you without undue delay. Depending on the purpose of the processing of personal data, you have the right to have incomplete personal data completed.

Right to object to the processing of personal data

You have the right to object to the processing of your personal data on grounds relating to your particular situation, where the controller is profiling or processing your personal data on the following legal grounds:

- the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,

- the processing of personal data is necessary for the purposes of the legitimate interests pursued by the controller or a third party. The controller may not further process your personal data unless it demonstrates compelling legitimate interests in the processing of personal data which override your rights or interests or grounds for exercising a legal claim. You have the right to object to the processing of personal data concerning you for the purpose of direct marketing, including profiling to the extent that it is related to direct marketing. If you object to the processing of personal data for the purpose of direct marketing, the controller may not further process the personal data for the purpose of direct marketing. You have the right to object to the processing of personal data concerning you on grounds relating to your particular situation, where your personal data are processed for scientific purposes, for historical research purposes or for statistical purposes, except where the processing of personal data is necessary for the performance of a task carried out for reasons of public interest.

Right to erasure of personal data

As a data subject, you have the right to obtain from the controller the erasure of personal data concerning you without undue delay. If you request the controller to erase your personal data, the controller is obliged to erase them in the following cases:

a) the personal data are no longer necessary for the purpose for which they were collected or otherwise processed,

b) you withdraw the consent on the basis of which the controller processes your personal data and there is no other legal basis for the processing of personal data,

c) you object to the processing of personal data and there are no overriding legitimate reasons for the processing of personal data or you object to the processing of personal data for the purpose of direct marketing, including profiling to the extent that it is related to direct marketing,

d) personal data are processed unlawfully,

e) the reason for deletion is the fulfillment of an obligation stipulated by law,

f) the personal data were collected in connection with the offer of information society services pursuant to Section 15(1) of the Act. If the controller has made your personal data public and is obliged to erase them under the above conditions, it is also obliged, taking into account available technology and costs, to inform other controllers who process your personal data so that these controllers erase links to your personal data and copies or transcripts thereof. The controller is not obliged to erase your personal data if necessary

- to exercise the right to freedom of expression or the right to information,
- to fulfill an obligation under the law or an international treaty or to fulfill a task carried out in the public interest or in the exercise of public authority vested in the controller,
- for reasons of public interest in the field of public health,
- for archiving purposes, scientific purposes, historical research purposes or statistical purposes, where erasure is likely to render impossible or seriously impair the achievement of the objectives of such processing, or
- to assert a legal claim.

Right to restrict the processing of personal data

You have the right to have the controller restrict the processing of your personal data if

a) you object to the accuracy of your personal data; the operator will limit the processing of your personal data for the period of verification of their accuracy,

b) the processing of your personal data is unlawful and instead of deletion, you request restriction of its use,

c) the controller no longer needs the personal data for the purpose of processing the personal data, but you need them to exercise a legal claim, or

d) you object to the processing of personal data;

e) the operator will restrict the processing of your personal data until it is verified whether the legitimate grounds on the part of the operator outweigh your legitimate grounds. If the processing of personal data has been restricted, in addition to storage, the operator may process personal data only with the consent of the data subject or for the purpose of exercising a legal claim, for the protection of persons or for reasons of public interest. The operator is obliged to inform you before the restriction of the processing of personal data is lifted.

Notification obligation in connection with the correction, erasure or restriction of processing of personal data

The controller is obliged to notify the recipient (anyone to whom your personal data have been provided) of the rectification of your personal data, erasure of personal data or restriction of processing of personal data, unless this proves impossible or does not involve disproportionate effort. If you request it, the controller will inform you about these recipients.

Right to personal data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit these personal data to another controller, if technically feasible and if the processing of your personal data is carried out by automated means (i.e. electronically), and the personal data are processed either

a) based on your consent,

b) or are necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. This right may not adversely affect the rights of other persons. The exercise of the right to data portability shall not affect the right to erasure of personal data. The right to data portability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The right to file a motion to initiate proceedings on the protection of personal data

If your rights under the Personal Data Protection Act are directly affected, you have the right, pursuant to Section 100 of this Act, to submit a proposal to the Office for Personal Data Protection of the Slovak Republic to initiate proceedings on the protection of personal data. The purpose of the proceedings is to determine whether the rights of natural persons have been violated in the processing of their personal data or whether the law has been violated and, if deficiencies are found, to impose corrective measures or a fine for violating the law, if justified and expedient. The Office publishes a sample proposal on its website. The application for initiation of proceedings must contain evidence to support the claims stated in the application and a copy of the document or other evidence proving the exercise of the right with the controller (right of access to personal data, right to request correction of personal data, right to erasure or restriction of processing of personal data, right to object to processing of personal data, right to portability of personal data), if the data subject has exercised such a right, or a statement of reasons worthy of special consideration for the non-execution of the right in question.

The above rights (except for the right to file a motion to initiate proceedings on the protection of personal data) can be exercised by e-mail or in writing by post to the controller who supervises the processing of personal data. The controller can also be notified of a personal data breach or other serious facts regarding the processing of personal data by the controller.

If the data subject suspects that his or her personal data is being processed unlawfully, he or she may file a motion to initiate personal data protection proceedings with the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27, Slovak Republic, or contact the office via its website http://www.dataprotection.gov.sk .

If the person concerned does not have full legal capacity, his rights may be exercised by a legal representative. If the person concerned is not alive, his rights under this Act may be exercised by a close person.

The operator shall process the request of the data subject under the Personal Data Protection Act free of charge, except for a payment in an amount that may not exceed the amount of reasonably incurred material costs associated with making copies, obtaining technical media and sending information to the data subject, unless a special law provides otherwise. The operator is obliged to process the request of the data subject in writing no later than 30 days from the date of receipt of the request. The operator shall notify the data subject and the Personal Data Protection Office of the Slovak Republic in writing of any restriction of the rights of the data subject under the Personal Data Protection Act without undue delay.

The operator hereby informs you, as the data subject, about the protection of your personal data and instructs you about your rights in relation to the protection of personal data within the scope of this written information obligation.

Processing of personal data for the purpose of placing an order and making a complaint

1. Purposes of processing personal data: issuing a tax document, contacting the customer regarding the order, fulfilling the contract, handling liability claims for defects in products sold - resulting from the performance of the contract.

2. Legal basis for processing personal data: (a) Processing of personal data (name, surname, title, street and number, postal code, city) is necessary pursuant to a special regulation or international agreement by which the Slovak Republic is bound. In particular, pursuant to Act No. 222/2004 Coll. on Value Added Tax; (b) Processing of personal data (e-mail, telephone contact) is necessary for the performance of the contract.

3. Personal data retention period – ten years.

4. The provision of personal data is a contractual obligation.

Processing of personal data for the purpose of sending marketing information

The general information on the processing of personal data above applies to the processing of personal data for the purpose of sending marketing information, as well as:

1. Purposes of processing personal data: sending marketing information

2. Legal basis for processing personal data: Article 6(1)(a) GDPR – the data subject has consented to the processing of their personal data for one or more specific purposes

3. Personal data retention period – until consent is revoked or a maximum of 3 years from the last order.

4. The provision of personal data in the case of a legitimate interest is mandatory to achieve this legitimate interest. In the case of processing based on consent, the provision of personal data is voluntary.

Newsletter and marketing communication

By submitting your order, you consent to us sending newsletters and commercial communications to your email address. This consent is voluntary and you can withdraw it at any time without giving a reason:

- By clicking on the "Unsubscribe" link in each newsletter sent

- By sending an e-mail to info@sentop.sk

- By contacting us at the phone number listed on our website

Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal of consent.

Automated individual decision-making, including profiling

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Processing of personal data for the purpose of processing cookies

For the processing of personal data for the purpose of processing cookies, the general information on the processing of personal data above applies, as well as:

1. Purposes of processing personal data: Aplicomp, sro, BaseLinker sro, Direct Parcel Distribution SK sro, ECOMAIL.cz, sro, FAVI as, FedEx Express Slovakia, sro, Fio banka, Frogman, sro, GLS General Logistics Systems Slovakia, sro, GoPay sro, Google analytics, Heureka Group as, PayPal, Revolut, Slovenská pošta, as, Smartsupp.com, sro, Slovak Parcel Service sro, TNT Express Worldwide spol. s ro, UPS Slovakia, sro

Cookies are small amounts of data that servers send to the browser. The browser stores them on the user's computer. The browser then sends this data back to the server each time the site is visited.

2. Legal basis for processing personal data: Article 6(1)(a) GDPR – the data subject has consented to the processing of their personal data for one or more specific purposes

3. Retention period of personal data: The cookies used on our website can be divided into two basic types in terms of their durability. Short-term so-called "session cookies", which are only temporary and remain stored in your browser only until you close the browser, and long-term so-called "persistent cookies", which remain stored on your device for a longer period of time or until you manually delete them, while the duration of keeping cookies on your device depends on the settings of the cookie itself and your browser settings.

4. The provision of personal data is necessary to achieve the purpose.

Conditions and method of processing personal data of data subjects

The operator processes the personal data of the data subjects in its information systems by automated and non-automated means of processing. The operator does not disclose the processed personal data, except in cases where this is required by a special legal regulation or a decision of a court or other state authority. The operator will not process your personal data without your explicit consent or another legal basis for any other purpose, nor to a greater extent than stated in this information and the registration sheets in the operator's individual information systems.

Automated individual decision-making including profiling Cookies

The operator uses an analytical tool to monitor its websites, which prepares a data chain and tracks how visitors use the pages on the Internet. When someone browses the site, the system generates cookies to record information related to the visit (pages visited, time spent on our site, browsing data, leaving the site, etc.), but this data may not be linked to the person of the visitor. This tool is a tool to improve the ergonomic design of the website, to create a user-friendly website and to enhance the online experience of visitors. Most Internet browsers accept cookies, but visitors have the option to delete them or automatically reject them. Since each browser is different, visitors can set their preferences regarding cookies individually using the browser toolbar. If you choose not to accept cookies, you will not be able to use some functions on our website.

The operator uses the Google AdWords advertising program, through which it has the ability to create online advertisements and reach people precisely when they are interested in the products and services that the operator provides. The Remarketing or Similar audiences functions in AdWords allow us to reach people who have previously visited your website. It allows the display of advertisements in search, on YouTube and in emails. Dynamic remarketing allows users to display advertisements for products or services that they have previously viewed. Website visitors can disable cookies that provide remarketing codes by appropriately setting their browser.

The operator can also be contacted via Facebook . The purpose of data management is to share the content of the operator's websites and the operator's presentation. Guests can learn about news, current special offers at the operator via the Facebook page and also view photos from selected orders of the operator. By clicking "like" on the operator's Facebook page, the subjects agree that the operator will post its news and offers on their Facebook wall. The operator also publishes photos/videos from various events on its Facebook page.

The operator publishes this data of natural persons only if their written consent has been obtained in advance. Further information on the management of data from the Facebook page can be found in the manual and rules for the protection of personal data at www.facebook.com. For the purpose of presentation, the operator also has its profile on the social network Instagram, where it presents photos from selected orders along with a description. By clicking "follow", you agree to the display of photos published by the operator.

Cookie type:

1. Absolutely necessary/essential
Usage:
- for the most important functions of the website, enabling the website to function properly
- remembers your username, which will provide you with quick login the next time you visit the site
- these cookies do not collect any information about you that could be used for marketing purposes
Cookie validity: 1 year

2. Functional
Usage:
- used to improve the service for the user, customize the user interface
- preference information is recorded based on content selection
- cookies can remember items you have placed in your e-shop shopping cart or errors you have encountered
Cookie validity: After leaving the site

3. Performance cookies and targeting cookies – analytical cookies
- third-party analytics tools (google analytics) are used to improve quality. Statistical data is collected, such as the number of visits to the website and links to our site, and the number of visits
Usage:
- help understand how website visitors behave
- cookies are used to improve website performance
- these cookies do not collect any information to determine your identity - they are anonymous
Cookie validity: Deleted automatically after 2 years from the last visit to the website

4. Sharing on social networks
Usage:
- use of third-party social media that allows you to share content on social media from our site, using the "like" and "share" buttons
- cookies are required for easier use of their services
- record data about your activity on the Internet and on the websites you use
Cookie validity: Deleted automatically after 2 years from the last visit to the website

5. High-quality display
Usage:
- built-in cookies that improve performance for faster content loading and help with compatibility
Cookie validity: Deleted when the browser is closed

6. Site owner
Usage: according to the given page settings
- can only be "read" by a given website (number of visitors to the site, where they come from and which parts of the site they visited)
Cookie validity: 1 year