Privacy Policy

Privacy Policy

I.

Basic provisions

Pursuant to Article  4 (7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter: the 'GDPR'), the personal data controller is SPUR a.s CRN 46900098 based in třída Tomáše Bata 299, Louky, 763 02 Zlín, registered in the Commercial Register by the Regional Court in Brno, Section B, file no. 819 (hereinafter: the 'controller').

1. The controller's contact details are:

Address: třída Tomáše Bati 299, Louky
763 02 Zlín

Email address: eshop@spur.cz

Tel. no.: +420 577 601 201

1. Personal data is any information about an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to a specific identifier, such as a name, identification number, location data, network identifier or one or more specific elements of physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

The administrator did not appoint a data protection officer.

II

Sources and categories of processed personal data

1. The controller processes personal data you have provided, or personal data that the controller has acquired on the basis of a concluded contract:

• Name and surname
• Email address
• Postal address
• Telephone number
• CRN
• TIN
• Company name

1. The controller processes your identification information and contact details, as well as data necessary for contract performance.

III

Lawful basis and purpose of personal data processing

1. The lawful basis and purpose of personal data processing is:

• the performance of a contract concluded between you and the controller pursuant to Art. 6, par. 1, subpar. b) of the GDPR
• fulfillment of the controller's legal obligation pursuant to 6, par. 1, subpar. c) of the GDPR
• the controller's legitimate interest in providing direct marketing (especially for sending commercial messages and newsletters) pursuant to Art. 6, par. 1, subpar. f) of the GDPR
• your consent to the processing for the purpose of providing direct marketing (especially for sending commercial messages and newsletters) pursuant to Art. 6, par. 1, subpar. a) of the GDPR in conjunction with § 7, par. 2 of Act no. 480/2004 Coll., on certain information society services in the event that no goods or services have been ordered.

1. Personal data are processed for the purpose of:

• performance of a concluded contract and exercise of rights and obligations arising from the contractual relationship between you and the controller; when a contract (order) is concluded, personal data that are necessary for successful performance of the contract are required (name and address, contact details). The personal data are a necessary requirement for concluding and fulfilling the contract; without them it is not possible to conclude the contract or for the controller to fulfil it
• fulfillment of legal obligations to the government
• sending commercial messages and other marketing activities

1. The controller makes automatic individual decisions pursuant to Art. 22 of the GDPR. You have given your express consent to the data processing.

IV

Data retention period

1. The controller retains personal data:

• for the time necessary to exercise the rights and obligations arising from the contractual relationship between you and the controller, and to assert claims arising from these contractual relationships (for a period of 15 years from the termination of the contractual relationship)
• until you revoke your consent to the processing of your personal data for marketing purposes, for no longer than 2 years, if the personal data are processed based on your consent

1. The controller will erase the personal data after the expiry of the data retention period.

V

Personal data recipients (the controller's subcontractors)

1. Personal data recipients are persons:

• involved in delivering goods/services/payment transactions on the basis of a contract
• who operate the e-store (Shoptet) and provide other services associated with operating the e-store
• who provide marketing services

1. The controller intends to transfer the personal data to a third country (a non-EU country) or an international organization. Personal data recipients in third countries are mailing service/cloud service providers.

VI

Personal data processors

1. The personal data are processed by the controller, but the following processors may also process personal data for him:

• provider of ECOMAIL service, Heureka.cz, MonkeyData s.r.o.,
• MIUZA
• another provider of processing software services and applications that the controller is currently not using

VII

Your rights

1. Under the conditions in the GDPR, you have the right:

• of access to your personal data pursuant to Art. 15 of the GDPR
• the right to rectification of your personal data pursuant to Art. 16 of the GDPR, or to restrict processing pursuant to Art. 18 of the GDPR
• the right to erasure of your personal data pursuant to Art. 17 of the GDPR
• the right to object to the processing pursuant to Art. 21 of the GDPR
• the right to data portability pursuant to Art. 20 of the GDPR, and
• the right to revoke your consent to the processing with a written or electronic request sent to the controller's postal address or email address listed in Art. III to the this Privacy Policy

1. You also have the right to file a complaint with the Office for Personal Data Protection if you believe that your right to personal data protection has been violated, or to settle it in court.

VIII

Terms of personal data security

1. The controller declares that he has adopted all appropriate technical and organizational measures to secure the personal data.
2. The controller has adopted technical measures to secure data repositories and personal data repositories in paper form.
3. The controller declares that only persons authorised by him have access to the personal data.

IX

Final provisions

1. By sending an order via the online order form, you confirm that you are familiar with the conditions of personal data protection and that you accept them in full.
2. You agree to these terms by checking the box in the online form. By checking the agreement box, you confirm that you are familiar with the conditions of personal data protection and that you accept them in full.
3. The controller is entitled to change this Privacy Policy. Any new version of this Privacy Policy will be published on the controller's website, and he will also send a new version of this Privacy Policy to the email address you provided.

This Privacy Policy shall come into effect on 6 September 2020.