PRINCIPLES OF PROCESSING PERSONAL DATA

At Sweet Pop, sro
Pod Párovcami 1370/81 921 01 Piešťany, Slovak Republic

ID: 55457819

VAT number: 2121996404

VAT ID: SK 2121996404 (hereinafter referred to as " we ") process personal data when operating the online store www.sweetpop.sk.

Below in this document we aim to provide you with all the necessary information about the processing of your personal data in accordance with Regulation No. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the " GDPR ").

If you still have any questions or would like to exercise your rights, please contact us, for example by email at info@sweetpop.sk

Personal data processed, purpose, legal basis and period of processing

Creating and managing a user account

Category of people: Customers

Purpose of processing personal data: Creation and management of user account

Legal basis and processed personal data: The legal basis is your consent, which you express by registering. Identification data (first name, last name), registration data (email).

Processing time: Until you cancel your account. If you do not use your account for a long period of time, we may send you an email stating that if you do not log in to your account within a certain period of time after receiving it, your account will be canceled.

Solving a problem within the ordering process

Category of people: Customers

Purpose of processing personal data: Solving a problem within the ordering process

Legal basis and processed personal data: If you start filling in your personal data during the ordering process and for any reason this process fails and you are unable to complete the order, for example in the event of a technical problem, we will immediately send you an e-mail if you fill in your e-mail address, with the saved cart and the data you have filled in. You will be able to complete the purchase within 1 day.

The legal basis is primarily our legitimate interest in resolving the problem and completing the order, coupled with a secondary interest in taking steps prior to entering into a contract.

Processing time: 30 days from the date of incomplete order process.

Conclusion and fulfillment of contracts with customers

Category of people: Customers

Purpose of processing personal data: Conclusion and performance of contracts with customers

Legal basis and processed personal data: The legal basis is the necessity for the performance of the contract.

Identification data (name, surname), contact data (delivery address and permanent address, e-mail, telephone), accounting data (billing address, card number, bank account number), order history, user account data, data related to any complaints (product identification, product defects, solution).

Providing personal data is a contractual requirement and your obligation; without it, it is not possible to conclude a contract and deliver goods or provide a service.

Processing time: During the duration of the contractual relationship and the warranty period, which is in most cases 2 years.

Making claims after termination of the contract

Category of people: Customers

Purpose of processing personal data: Exercising claims after termination of the contract

Legal basis and processed personal data: The legal basis is our legitimate interest in the right to enforce any receivables and other claims that may have arisen, as well as to be able to demonstrate that our obligations under the contract have been properly fulfilled.

Identification data (name, surname), contact data (delivery address and permanent address, e-mail, telephone), accounting data (billing address, card number, bank account number), order history, user account data, data related to any complaints (product identification, product defects, solution).

Processing period: For a period of 5 years from the termination of the contractual relationship, in the case of legal proceedings for the entire duration of the proceedings.

Fulfillment of obligations arising from accounting and tax regulations

Category of people: Customers

Purpose of processing personal data: Fulfillment of obligations arising from accounting and tax regulations

Legal basis and processed personal data: The legal basis is the fulfillment of a legal obligation imposed on us by accounting and tax regulations.

Identification data (name, surname), contact details (delivery address and permanent address, e-mail, telephone), accounting data (bank account number and other information on tax documents), as well as copies of contracts.

Processing period: For a period of 10 years from the end of the year in which the contract was performed.

Direct marketing

Category of people: Customers

Purpose of personal data processing: Direct marketing

Legal basis and processed personal data: In the case of direct marketing via SMS or email, the legal basis is your consent, which you express on our online store and by subsequently clicking on the link in the confirmation email.

Identification (name, surname) and contact details (delivery address and permanent residence address, e-mail, telephone).

Processing period: Minimum 4 years and maximum 5 years from the withdrawal of consent or objection.

Rating

Category of people: Customers

Purpose of processing personal data: Evaluation

Legal basis and processed personal data: The legal basis is your consent.

Identification data (name, surname), registration data (email). We will publish the evaluation without your personal data, i.e. anonymized (maximum name, surname initial and country).

We may ask you for a rating after your purchase by sending you an email. The legal basis for sending this email is our legitimate interest in improving our products, but you have the option to opt out of this during the purchase process.

Processing time: Until the moment of anonymization, which will occur within 30 days of your evaluation or reference.

Internal analysis, development and improvement of our e-commerce and service quality, planning.

Category of persons:

Purpose of processing personal data: Internal analyses, development and improvement of our e-commerce and service quality, planning.

Legal basis and personal data processed: The legal basis is our legitimate interest.

Your personal data that we have based on another purpose or legal basis.

Processing period: For the period during which we process them based on another purpose or legal basis. After this period, only in anonymized form, when it will no longer be personal data.

Handling suggestions, inquiries and questions

Category of people: Anyone

Purpose of processing personal data: Handling suggestions, inquiries and questions

Legal basis and processed personal data: The legal basis is our legitimate interest, as well as your consent.

Identification data (name, surname), contact data (address, email, telephone), IP address and cookies, question asked via form, email, chat, via social networks or by phone.

Processing time: Until completion, but no longer than 30 days after completion, or longer if you give your consent.

Regular sending of business and marketing announcements by email

Category of people: Newsletter subscribers

Purpose of processing personal data: Regular sending of commercial and marketing communications by e-mail

Legal basis and processed personal data: The legal basis is your consent, which you express by registering for the newsletter on our online store and then clicking on the link in the confirmation email.

Email.

Processing time: Until consent is revoked.

Organization and evaluation of the competition

Category of people: Competitors

Purpose of processing personal data: Organization and evaluation of the competition

Legal basis and personal data processed: The primary legal basis is the consent of the contestant, which he/she expresses by participating in the competition. Providing personal data is a condition for participation in the competition, without which participation is not possible.

The secondary legal basis is also the performance of the contract, i.e. the fulfillment of our rights and obligations arising from the rules of the competition, and after fulfillment, our legitimate interests in informing about the result of the competition by publishing the winner's profile in a comment on the competition post and having the ability to demonstrate that our obligations have been properly fulfilled. Participation in the competition, as well as granting consent to the processing of personal data for this purpose, are voluntary and consent can be revoked at any time. By revoking consent, the processing of personal data and participation in the competition will be terminated.

Who do we share your personal data with?

In limited cases, we provide your personal data to other entities (recipients), in most cases to our service providers. This may include the following cases:

Provision to third parties where permitted or required by law , for example disclosure to government authorities in accordance with law, in the event of a sale of our business or in the event of our legal protection through legal representation.

Provision to our suppliers (so-called intermediaries) who provide us with various services under contract, within the framework of which your personal data is processed. These are mainly companies that provide or provide an ERP system (enterprise software for managing and coordinating internal resources), payment gateway, marketing, emailing, e-commerce platform, web chat, reviews, IT development and IT support, fulfillment (storage, transportation), package management and delivery, accounting services, application integration, and cookies (more in the Cookies section below).

We only cooperate with service providers who provide adequate security guarantees and whom we contractually oblige to process your personal data only in accordance with our instructions and to maintain the confidentiality of your personal data.

Automated individual decision-making, including profiling

We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

Personal data of children under 16 years of age

Our online store is not intended for children under the age of 16. Children under the age of 16 may only use our online store if their legal guardian, in particular a parent, has given their consent.

Transfer of personal data outside the EU/EEA

Within the European Union/European Economic Area, there is free movement of personal data.

If we transfer personal data to third countries, we will do so in accordance with the GDPR. This may include countries that the European Commission has decided ensure an adequate level of protection of personal data, or where the service provider we use has committed to comply with standard contractual clauses adopted by the European Commission, or a combination of both.

We currently plan to transfer personal data only to the USA if the service provider is part of the Privacy Shield Framework and we have a contract with them that contains standard contractual clauses.

Cookies

We use cookies on our online store.

Your rights

Under the GDPR, you have several rights. These include the right to access your personal data, to rectify it, to erase it, to restrict processing, to object to processing, to data portability, to withdraw your consent to the processing of your personal data, and to lodge a complaint with a supervisory authority.

Right of access

You have the right to obtain from us confirmation as to whether or not your personal data is being processed and, if so, you have the right to access this data. We will therefore provide you with all information regarding the processing of your personal data upon request.

Right to correction

You have the right to have us correct your incorrect personal data and complete it if it is incomplete.

Right to erasure (right to be “forgotten”)

We will delete your personal data if it is no longer necessary for the purposes for which it was collected or if you withdraw your consent on the basis of which we processed it. However, this right is not absolute. There are cases where we must retain personal data, for example for accounting purposes.

Right to restrict the processing of personal data

You have the right to restrict processing where (i) you have contested the accuracy of the personal data, within a period allowing for the verification of the accuracy of the personal data, (ii) the processing is unlawful and you object to the erasure of the personal data and request the restriction of their use instead; (iii) we no longer need the personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims; (iv) you object to processing, pending verification of whether our legitimate grounds override your legitimate grounds.

Right to object to processing

You have the right to object at any time to the processing of your personal data which is carried out (i) on the legal basis of necessity for the purposes of the legitimate interests pursued by us or a third party, (ii) for profiling purposes, and (iii) for direct marketing purposes.

Right to data portability

You have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit these data to another controller without hindrance from us, if the processing of personal data is based on your consent or on a contract and the processing is carried out by automated means.

Right to withdraw consent

If the processing is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal.

Right to file a complaint

If you believe that the processing of your personal data is in violation of the GDPR, you have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27, e-mail: statny.dozor@pdp.gov.sk .