Personal Data Protection Terms
Personal Data Protection Terms
I.
General Provisions
- The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: “GDPR”) is papelote s.r.o., Company ID (IČ): 28944895, with its registered office at Kozí 1002/8, Praha 1 - Staré Město, 110 00 (hereinafter: the “controller”).
- The controller’s contact details are
address: papelote s.r.o., Kozí 1002/8, Praha 1 - Staré Město, 110 00
email: denisa.havrdova@papelote.cz
phone: 608 823 278
- Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- The controller has not appointed a data protection officer.
II.
Sources and Categories of Processed Personal Data
- The controller processes personal data that you have provided to it or personal data that the controller has obtained in the course of fulfilling your order.
- The controller processes your identification and contact data and data necessary for the performance of the contract.
- To provide personalised advertising, we use third-party marketing tools (e.g. Seznam.cz and Meta Platforms), to which some data about your activity on our website may be transferred.
III.
Legal Basis and Purpose of Personal Data Processing
- The legal basis for the processing of personal data is
- the performance of a contract between you and the controller pursuant to Article 6(1)(b) GDPR,
- the controller’s legitimate interest in providing direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6(1)(f) GDPR,
- your consent to processing for the purposes of direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6(1)(a) GDPR in conjunction with Section 7(2) of Act No. 480/2004 Coll., on Certain Information Society Services, where no order for goods or services has been placed.
- For marketing reasons, in order to better target advertising campaigns, customer personal data (email, phone, address) are sent to the servers of a third party – Google. The personal data are encrypted using the SHA-256 hashing algorithm and the data are not handled in any other way. You can find more information HERE.
- The purpose of personal data processing is
- processing your order and exercising the rights and obligations arising from the contractual relationship between you and the controller; when placing an order, the personal data necessary for successful order processing are required (name and address, contact), providing personal data is a necessary requirement for concluding and performing the contract, and without providing personal data it is not possible to conclude the contract or for the controller to perform it,
- sending commercial communications and carrying out other marketing activities.
- sending commercial communications, carrying out other marketing activities or collecting feedback by the organisation Zachraň jídlo, s.z. in the case of the purchase of the product Papírová spižírna and its variants.
- The controller does not engage in automated individual decision-making within the meaning of Article 22 GDPR.
IV.
Use of Cookies
Cookies are text files containing a small amount of information that are downloaded to your device when you visit our website. Cookies are then sent back to the website, or to another website that recognises them, on each subsequent visit.
Cookies perform various functions, for example they enable efficient navigation between web pages, remember your preferences and generally improve the user experience. They can also ensure that advertisements displayed online are better tailored to you and your interests.
On our website we use the following cookies:
- Technical cookies: without these cookies our website will not work. They are required for the operation of the website, enable you to go through the shopping cart, compare products and other basic functions. This category of cookies cannot be disabled.
- Preference and enhanced functions: so that you do not have to set everything up again. Thanks to these cookies we can make working with our website even more pleasant. We can remember your settings, they can help you fill in forms, and they allow us to display services such as chat and the like. We run these files only with your prior consent.
- Analytical/statistical cookies: so that we know how you behave on the website and can continue to improve it. They allow us, for example, to recognise and count visitors and to monitor how our visitors use the website. They help us improve the way the website works, for example by allowing users to easily find what they are looking for. These cookies allow us to measure the performance of our website and of our advertising campaigns. With their help we determine the number of visits and the sources of visits to our website. We process the data obtained through these cookies in aggregate and anonymously, so we are unable to identify specific users of our website. We run them only with your prior consent.
- Marketing cookies: so that we do not bother you with inappropriate advertising. Marketing cookies are used by us or our partners so that we can show you suitable content or advertisements both on our website and on third-party websites. We run these files only with your prior consent.
Please note that third parties (including, for example, external service providers) may also use cookies and/or access data collected by cookies on the website.
V.
Data Retention Period
- The controller retains personal data
- for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and the controller and to enforce claims arising from such contractual relationships (for 15 years after the termination of the contractual relationship).
- until consent to the processing of personal data for marketing purposes is withdrawn.
VI.
Recipients of Personal Data (the Controller’s Subcontractors)
- The recipients of personal data are persons
- involved in the delivery of goods / services / the processing of payments under the contract (carriers and fulfilment companies – Fulfillment CZ s.r.o., Zásilkovna s.r.o., General Logistics Systems s.r.o.),
- providing services for the operation of the e-shop (Shopio) and other services in connection with the operation of the e-shop,
- providing marketing services.
- The controller does not intend to transfer personal data to a third country (a country outside the EU) or to an international organisation.
VII.
Your Rights
- Under the conditions laid down in the GDPR, you have
- the right of access to your personal data pursuant to Article 15 GDPR,
- the right to rectification of personal data pursuant to Article 16 GDPR, or restriction of processing pursuant to Article 18 GDPR.
- the right to erasure of personal data pursuant to Article 17 GDPR.
- the right to object to processing pursuant to Article 21 GDPR and
- the right to data portability pursuant to Article 20 GDPR.
- the right to withdraw consent to processing in writing or electronically at the address or email of the controller stated in Article III of these terms.
- You also have the right to lodge a complaint with the Office for Personal Data Protection (Czech Republic) if you believe that your right to the protection of personal data has been infringed.
VIII.
Personal Data Security Conditions
- The controller declares that it has taken all appropriate technical and organisational measures to secure personal data.
- The controller has taken technical measures to secure data storage and storage of personal data in paper form.
- The controller declares that only persons authorised by it have access to personal data.
IX.
Final Provisions
- By submitting an order via the online order form, you confirm that you have read the personal data protection terms and that you accept them in their entirety.
- You agree to these terms by ticking the consent box in the online form. By ticking the consent box, you confirm that you have read the personal data protection terms and that you accept them in their entirety.
- The controller is entitled to change these terms. It will publish the new version of the personal data protection terms on its website and will also send you the new version of these terms to the email address you provided to the controller.
These terms take effect on 25 May 2018.