1. Basic provisions

1.1 The controller of personal data according to Art. 4, point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: “GDPR”) is Gabriela Repková, MS; ID: 03486150 with registered office in Prague – Nové Město, Školská 689/20, postal code: 110 00; registered in the Commercial Register at the Municipal District of City of Prague 1; not a VAT payer (hereinafter: the “Administrator”).

1.2 The contact details of the Administrator are: e-mail: gabriela.repkova@startes.cz; telephone: 720 970 569

1.3 Personal data is any information about an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, a network identifier or to one or more specific elements of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1.4 The Controller has not appointed a Data Protection Officer.

2. Sources and categories of personal data processed

2.1 The Controller processes personal data that you have provided to the Controller or that the Controller has obtained as a result of the fulfilment of your order.

2.2 The Data Controller processes your identification and contact data and the data necessary for the performance of the contract.

3. Legal basis and purpose of the processing of personal data

3.1 The lawful reason for processing personal data is: The lawful basis for processing personal data is Performance of the contract between you and the controller pursuant to Article 6(1)(b) of the GDPR, the controller’s legitimate interest in direct marketing (in particular, for sending commercial communications and newsletters, e-mail questionnaires within the framework of the Verified by Customers programme) pursuant to Article 6(1)(f) of the GDPR, your consent to processing for the purposes of direct marketing (in particular, for sending commercial communications and newsletters) pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 7(2) of Act no. 480/2004 Coll., on certain information society services without an order for goods or services.

3.2 The purpose of processing of personal data is: to process your order and to exercise the rights and obligations arising from the contractual relationship between you and the data controller; when placing an order, personal data are required that are necessary for the successful processing of the order (name and address, contact), the provision of personal data is a necessary condition for the conclusion and performance of the contract, without the provision of personal data it is not possible to conclude or perform the contract by the data controller, to send commercial communications and to perform other marketing activities.

3.3 There is no automatic individual decision making by the data controller within the meaning of Art. 22 GDPR.

4. Data retention period

4.1 The Controller will keep the personal data: for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and the Controller and to enforce any claims arising from such contractual relationship (for a period of 10 years from the termination of the contractual relationship), for the period until the consent to the processing of personal data for marketing purposes is withdrawn, but no longer than 10 years if the personal data are processed on the basis of consent.

4.2 At the end of the retention period, the Controller shall delete the personal data.

5. Recipients of personal data (subcontractors of the data controller)

5.1 Recipients of personal data are persons: involved in the delivery of goods / services / execution of payments on the basis of the contract, providing e-shop operation services and other services in related to the operation of the e-shop, providing marketing services (ComGate.cz, Heureka.cz, Mailchimp.com, PPL.cz, Zasilkovna.cz, Ceskaposta.cz, Hosting-zdarma.cz).

5.2 The data controller intends to transfer personal data to a third country (a country outside the EU) or an international organisation. The recipients of personal data in third countries are mail service providers / cloud service providers (Google.com).

6. Your rights

6.1 Under the conditions set out in the GDPR, you have: the right to access your personal data pursuant to Art. 15 GDPR, the right to rectification of personal data pursuant to Art. 16 GDPR, or restriction of processing pursuant to Art. 18 GDPR the right to erasure of personal data pursuant to Art. 17 GDPR, the right to object to processing pursuant to Art. 21 GDPR, the right to data portability pursuant to Art. 20 GDPR, the right to withdraw consent to processing in writing or electronically to the address or email of the Controller referred to in Art. III of these terms and conditions.

6.2 You also have the right to lodge a complaint with the data protection authority if you believe that your data protection rights have been violated.

7. Personal data security conditions

7.1 The Controller declares that it has taken all appropriate technical and organisational measures to protect personal data.

7.2 The controller has taken technical measures to secure data the storage and storage of personal data in paper form, in particular the use of anti-virus programs and secure access passwords.

8. Customer satisfaction programme

8.1 We measure your satisfaction with your purchase through email questionnaires as part of the Verified by Customers programme in which our e-shop participates. We will send them to you each time you make a purchase from us, if, in accordance with § 7 para. 3 of Act No. 480/2004 Coll. on certain services of the information society, you cannot refuse to receive them.

8.2 The processing of personal data for the purpose of sending questionnaires as part of the “Verified by Customers” programme is based on our legitimate interest in determining your satisfaction with your purchase from us.

8.3 We use the portal operator to send questionnaires, evaluate your feedback and analyse our market position. Heureka.cz; for this purpose, we may transfer information about the goods you have purchased and your e-mail address. Your personal data will not be shared with third parties for their own purposes when sending e-mail questionnaires.

8.4 You may object to receiving email questionnaires under the Customer Verified Programme at any time by refusing to receive further questionnaires via the link in the email containing the questionnaire. If you opt out, we will not send you the questionnaire.

9. Final terms

9.1 By submitting an order via the online order form you confirm that you are aware of and accept this Privacy Policy in its entirety.

9.2 You agree to be bound by these terms and conditions by ticking the consent box via the online form. By ticking the consent box, you confirm that you are aware of the Privacy Policy and that you accept it in its entirety.

9.3 The Administrator has the right to change these Terms and Conditions. It will post the new version of the Privacy Policy on its website or send you a new version of the Privacy Policy to the email address you have provided to the Administrator.

These terms and conditions will be effective from 01.06.2020.

Thank you for your trust!