Personal data processing principles

Dear Customers,

We would like to inform you about how we process your personal data, about all processing activities and about the privacy policy of data subjects.

With this website/document, we are fulfilling our information obligation to you in accordance with Articles 12, 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as "GDPR") and our obligations under Act No. 101/2000 Coll., on the protection of personal data, as amended. The content of the GDPR can be found at the following address: http://eur-lex.europa.eu/legal-content/CS/TXT/PDF/?uri=CELEX:32016R0679&qid=1503598706724&from=CS.

I. Introductory provisions

• Personal data controller: Doypacky s.r.o., with registered office at Roháčova 145/14, 130 00 Praha 3, ID: 06281061 VAT: CZ06281061, registered in the Commercial Register kept at the Municipal Court in Prague, Section C, Insert 279413 (hereinafter referred to as "Administrator", "we", "us", "us", "our" or "we are")
• Contact details of the data controller: address for delivery: Doypacky s.r.o., Roháčova 145/14, 130 00 Prague 3 telephone number: +420 722 10 10 80, contact e-mail: info@doypacky.cz
• The controller has not appointed a data protection officer.
• The data subject (or data subject is an identified or identifiable natural person, where an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to a specific identifier, such as a name, an identification number, location data, a network identifier or to one or more specific elements of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person) who has concluded a contract with us for the provision of services or goods via the doypacky.cz or at the company's registered office and premises, we generally process the following personal data:
  • identification data (name, surname)
  • contact data (delivery or residential address, e-mail, telephone)
  • accounting data (credit card number, bank account number)
  • registration data for the account you are logging into
  • information from the complaint form (product identification, product defects)
  • order history
  • IP address
  • cookies
• In the case of a data subject who has not entered into a service contract with us, we process the following personal data:
  • email address
  • data from the contact form and the sample order form
  • IP address
  • cookies.

 

II. Purposes and periods of processing of Personal Data

We process personal data for clearly defined purposes:

• performance, execution of contracts concluded with customers and provision of services:
  • The legal basis is the performance of the contract. For this purpose, personal data may be processed for the duration of the contractual relationship and the warranty period.
• the fulfilment of a legal obligation (in particular accounting, tax and archiving obligations, the provision of assistance to administrative authorities, police, courts, etc.);
  • The legal basis is the fulfilment of a legal obligation imposed on us by legislation such as the Accounting Act or the Value Added Tax Act.
  • The tax document will be kept for 10 years from the termination of the contract: In order to fulfil the legal obligation to archive accounting documents on the basis of Act No. 563/1991 Coll., on Accounting, as amended, the Personal Data will be further processed and kept for 10 years starting from the year following the year in which the contract between the Operator and the Participant was concluded.
• performance of obligations in connection with the exercise of rights arising from defective performance, provision of assistance to administrative authorities, police, court:
  • The legal basis is the legitimate interest of the Administrator consisting in the right to enforce claims, damages and other claims that may have arisen during the duration of our contractual relationship.
  • The Controller is entitled to process basic personal, identification and contact data of the customer, data about the goods and data from customer communications for a period of 4 years from the date of expiry of the warranty period for the goods.
• periodically sending commercial communications in the form of technical information and reports, marketing materials, offers of our goods or services to customers by e-mail
  • The legal basis is the legitimate interest of the Controller to provide and offer to the Participant similar goods that meet their needs, on the basis of a common business relationship.
  • The processing of Participants' identification and contact personal data is carried out for the purpose of disseminating commercial communications.
  • For this purpose, personal data may be processed for the duration of the contractual relationship or until consent is withdrawn.
• Sending Heureka questionnaires - verified by customers:
  • The legal basis is the legitimate interest of the Controller in order to improve the quality of the services provided to customers.
  • In the context of satisfaction assessments and other surveys, we transfer personal data in the scope and email address to a third party processor - Heureka Shopping s.r.o. The period of processing of personal data in this case is 3 years.
• sending a reply to a website visitor's enquiry
  • The legal basis is the performance of the contract or the consent of the Participant. We process identification data (first name, last name), contact data (address, e-mail, telephone), IP address and cookies, query made via form. For this purpose, the personal data may be processed until the query from the contact form has been processed, but no longer than 30 days or the period for which the consent to processing lasts.
• sending samples on the basis of a completed form - SAMPLES
  • The legal basis is the performance of the contract or the consent of the Participant. We process identification data (name, surname), contact data (address, e-mail, telephone), IP address and cookies and text in the form. For this purpose, personal data may be processed for a period of 2 years.
• periodic sending of commercial communications to site visitors by e-mail
  • The legal basis is the consent given by the Subscriber when registering for the newsletter. We process identification data (name and surname), contact data (e-mail). For this purpose, personal data may be processed until the consent is withdrawn.

 

III. Data protection and processing information

• If you do not provide us with your Personal Data, it is not possible to enter into a contract with you and/or to provide you with the services resulting from it. In this context, Personal Data is necessary for the provision of a specific service or product by the Controller.
• After the expiry of the time limits set out in Article II. We will delete or anonymize the Personal Data.
• The Participant is obliged to provide only true and accurate Personal Data to the Administrator. The Participant is responsible for the accuracy, precision and truthfulness of the Personal Data provided. The Administrator is not responsible for the accuracy of the information provided.

The Controller shall use its best endeavours to prevent unauthorised processing of Personal Data.

IV. Recipients of Personal Data and transfer of Personal Data outside the European Union

• To the extent necessary for the performance of the contract or other obligations, we are entitled to transfer your Personal Data to other parties. We do not transfer Personal Data to any other person.
• Your personal data may be disclosed to the following entities in the following situations:
  • To companies or other organizations we have used to provide our services, such as payment processors (credit card, quick bank transfer) web hosting companies, mail and shipping carriers, analytics service providers, and information technology providers;
  • companies providing your purchase satisfaction rating: for the Heureka web portal,
  • companies providing development and administration of the e-shop at www.doypacky.cz - external programmers
  • companies that send commercial communications
  • to any law enforcement authorities, courts, regulatory authorities, government agencies or other third parties where we believe it is necessary to comply with legal or regulatory obligations or otherwise protect our rights, the rights of any third parties or the personal safety of individuals, or to detect, prevent or otherwise address fraud or security incidents.
  • periodically sending commercial communications to site visitors by email
• Your personal data will not be transferred to countries outside the European Union.

 

V. Cookies

• When you first visit our site, our server sends a small amount of data to your computer and stores it there. Your browser will then send this data back to the server on each subsequent visit to the site. This small file is called a "cookie" and is a short text file containing a specific string of characters with unique information about your browser. We use cookies to improve the quality of our service and to better understand how people use our site. To do this, we store user preferences in cookies and use them to track user trends and how people browse and behave on our site.
• Most browsers are set up to accept cookies. However, you have the option to set your browser to block cookies or to notify you when cookies are sent. However, some services or features will not work properly without cookies.
• Our website only uses "first party" cookies, i.e. cookies used only by our website (hereinafter referred to as first party cookies) and "third party" cookies (i.e. cookies originating from third party websites).We use first party cookies to store user preferences and data needed during your visit to the website (e.g. the contents of your shopping cart).We use third party cookies to track user trends and behaviour patterns, target advertising, with the help of third party web statistics providers. Third-party cookies used to track trends and behaviour patterns are used only by our website and web statistics provider and are not shared with any other third party.
• In particular, we use the following cookies:
  • Technical
  • GoogleAnalytics
  • GoogleAdWords
  • Sklik
  • Zboží.cz
  • Smartsupp
  • Heureka

 

VI. Principles of personal data processing

• Legality
  • We process your personal data in accordance with applicable law, in particular the GDPR.
• Consent of the data subject
  • We only process personal data in the manner and to the extent that you have given your consent, if consent is the title of the processing.
• Minimisation and restriction of the processing of personal data
  • We only process personal data to the extent necessary to achieve the purpose of processing and for no longer than necessary to achieve the purpose of processing.
• Accuracy of the personal data processed
  • We process personal data with an emphasis on its accuracy using available measures. And we process personal data up-to-date using reasonable means.
• Transparency
  • Through this Policy and the contact person, you have the opportunity to learn about the way in which we process your personal data, as well as its scope and content.
• Purpose limitation
  • We only process personal data to the extent necessary to fulfil the stated purpose and in accordance with that purpose.
• Security
  • We process personal data in a manner that ensures its appropriate security, including protection by appropriate technical or organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage.

 

VII. Automated individual decision-making and profiling

• The processing of personal data does not involve automated individual decision-making, even on the basis of profiling.

 

VIII. Rights of the Participant related to processing

• 1. Rights of the Participant in relation to the protection of personal data:
  • Request access to his Personal Data from the Controller;
  • to rectify the Personal Data provided;
  • to erasure of the Personal Data provided;
  • to restrict the processing of Personal Data;
  • lodge a complaint with the Office for Personal Data Protection.
  • The right to transfer Personal Data to another controller
  • The right to object to the processing of Personal Data
  •  
• (2) The participant may exercise his/her rights under paragraph 1 of this Article by request to info@doypacky.cz.
• 3. In the event that the Participant believes that the Controller carries out processing of his Personal Data that is contrary to the protection of his private and personal life or contrary to applicable law, in particular if the Personal Data are inaccurate with regard to the purpose of their processing, he may:
  • request an explanation from the Data Controller, by e-mail to info@doypacky.cz
  • object to the processing and request, by email to info@doypacky.cz, that the Controller ensure that the situation so arising is remedied (e.g. by blocking, rectifying, supplementing or destroying the Personal Data). The Controller shall promptly decide on the objection and inform the Participant. If the Administrator does not comply with the objection, the Participant has the right to contact the Data Protection Authority directly. This provision shall be without prejudice to the Participant's right to address his/her complaint directly to the Data Protection Authority.
• 4. If the Participant exercises the right under this Article, the Controller shall respond within 30 days of receipt of the request by the Controller.
• 5. Receipt of a request to exercise a right under Article VIII, points 1. and 7. shall only be possible by means of a data message or a letter with a certified signature to the address of the registered office of the Company. The request must include an e-mail address, to which a verification e-mail will then be sent to confirm the identity of the applicant.
• 6. If the Participant exercises any of the rights in Article VIII, paragraph 1, the Administrator has the right to request proof of the Participant's identity. Thus, the request for access to personal data must be sent from the e-mail address of the applicant. If the request is made in a different form or from a different email address, the Controller shall have the right to request additional verification in the form of a reply to the verification email. In the event that the applicant does not prove his/her identity within 14 days of the sending of the verification e-mail, his/her request to exercise the rights under Article VIII, paragraph 1 will not be accepted.
• 7. The Controller shall be entitled to charge a reasonable fee for the administrative costs involved in the event of repeated and unjustified requests for a physical copy of the Personal Data processed.

 

IX. Final provisions

• All legal relations arising in connection with the processing of Personal Data shall be governed by the laws of the Czech Republic, regardless of where the Personal Data was accessed. The Czech courts are competent to resolve any disputes arising in connection with the protection of privacy between the Participant and the Controller.
• The Data Subject has the right to contact the Office for Personal Data Protection (www.uoou.cz).

 

This Policy shall take effect on 25 May 2018.