Identity and Contact Details of the Data Controller

1.1. The controller of your personal data is the company České lavičky s.r.o., with registered office at Dolní Chvatliny 35, 281 44 – Zásmuky, company ID: 054 70 391 (hereinafter referred to as the “Controller”).

1.2. The contact details of the Controller are as follows: mailing address Dolní Chvatliny 35, 281 44 – Zásmuky, email address info@ceskelavicky.cz.

Legal Basis for Processing Personal Data

2.1. The legal basis for processing your personal data (scope: first name, last name, telephone number, email address, company name, company ID, VAT ID, billing, delivery, and correspondence addresses provided in the order) in the case of an order is that such processing is necessary for the performance of a contract between you and the Controller, or for taking steps at the Controller’s request prior to entering into such a contract, in accordance with Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, “GDPR”).

2.2. The legal basis for processing your personal data (scope: as above) in the case of registration on the website is your consent given to the Controller in accordance with Article 6(1)(a) GDPR.

2.3. Furthermore, the legal basis for processing your personal data (scope: as above) in the case of an order is the legitimate interest of the Controller to process the personal data for better communication with the customer, including in relation to repeat orders, pursuant to Article 6(1)(f) GDPR.

Purpose of Personal Data Processing

3.1. In accordance with Article 6(1)(f) GDPR, the Controller may use a data processor, e.g., Heureka.cz, to send surveys, evaluate your feedback, and analyze market position. For this purpose, the Controller may provide information about purchased goods and your email address. Your personal data will not be shared with any third party for their own purposes. You can object to receiving surveys in the “Verified by Customers” program at any time by clicking the unsubscribe link in the survey email. Upon objection, no further surveys will be sent.

3.2. The Controller does not engage in automated individual decision-making as defined in Article 22 GDPR.

Data Retention Period

4.1. Your personal data will be retained by the Controller for 7 years from your last purchase, or until you withdraw your consent to processing (for this purpose). For website registration, your personal data will be stored until you withdraw your consent.

Additional Recipients of Personal Data

5.1. Additional recipients of your personal data may include shipping companies and other entities involved in the delivery of goods or the processing of payments under the purchase contract, and, with your consent, entities providing marketing services for the Controller.

5.2. The Controller does not intend to transfer your personal data to a third country (outside the EU) or to an international organization.

Rights of the Data Subject

6.1. Under the conditions specified in the GDPR, you have the right to request access to your personal data, rectification or erasure, restriction of processing, objection to processing, and the right to data portability.

6.2. You have the right to withdraw your consent to personal data processing at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.

6.3. If you believe that your personal data has been or is being processed in violation of the GDPR, you have the right to file a complaint with a supervisory authority.

6.4. You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling, if such profiling relates to direct marketing. Upon objection, your personal data will no longer be processed for these purposes.

6.5. Providing your personal data is not mandatory. However, it is necessary for entering into and fulfilling the contract; without providing your personal data, the Controller cannot conclude or fulfill the contract.