HOW DO WE PROCESS YOUR PERSONAL DATA?

This information applies to the processing of personal data when shopping in our e-shop.

1. Who are we?

The controller of your personal data is the business company: VALTEC spol. s r. o., with its registered office at: Lieskovská cesta 13, 962 21 Lieskovec, Company ID No.: 36 628 484, registered in the Commercial Register of the District Court Banská Bystrica, Section: Sro, Insert No.: 9516/S (hereinafter referred to as the “Controller” or “we”). 
When processing your personal data, we comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR”), as well as the relevant provisions of Act No. 18/2018 Coll. on the Protection of Personal Data and on amendments to certain acts (hereinafter referred to as “PDPA”), which apply to us.

2. How can you contact us?

You may exercise your rights by e-mail or by post through the contact person:

• e-mail: info@valtec-shop.com
• postal address: VALTEC spol. s r. o., Lieskovská cesta 13, 962 21 Lieskovec

If you have any questions, you may contact us by phone at: +421 918 760 086

3. Why do we process personal data (i.e. for what purposes) and on what legal basis?

When processing personal data, we pursue our legitimate interests, which include:

• defending our legal claims – for the purpose of: ensuring the protection of rights and legally protected interests
• protection of health and property – for the purpose of: protection of the Controller’s property and the property and health of visitors (by monitoring premises via a camera system)
• effective promotion of our products – for the purposes of:
  • sending newsletters (commercial information about products and promotions) to the Controller’s customers, 
  • providing personalized offers and targeted advertising through the sending of e-mail notifications to the Controller’s customers
• improving the level of our services – for the purposes of:
  • responding to inquiries and related communication (by phone, via e-mail, chat, LinkedIn, and social networks – Facebook, Instagram)
  • customer reviews of goods and services
• proper fulfilment of contractual relationships – for the purpose of: communication with contractual partners through their contact persons.

5. What categories of personal data do we process?

We primarily process ordinary personal data:

• identification data: first name, last name
• registration data: username, password, and account settings, if you registered before making a purchase,
• contact details: delivery address, e-mail address, and phone number, employer (name, address, Company ID, Tax ID), job position or function, professional department
• order data: order history, purchased products and their prices, discounts provided, shopping cart data if you are considering purchasing products,
• banking, financial, and transaction data: bank account details, payment details,
• online identifiers: IP address, cookies,
• metadata related to communication: location,
• data on reading our newsletter: whether messages were delivered to you, time of opening messages, content that interested you, links in messages that you clicked on, and data obtained through cookies and similar technologies,
• records of e-mail, chat, and other communication (e.g. messages on social networks),
• image recordings (without sound) from your personal visit to the store, 
• data on your behaviour on the website: in particular the products you view, links you click on, the way you move around our website and scroll the screen, as well as data about the device from which you browse our website, such as IP address and location derived from it, device identification, its technical parameters such as operating system, its version, screen resolution, browser used and its version, as well as data obtained from cookies and similar technologies for device identification,
• data on your behaviour when reading messages we send to you: primarily the times when messages are opened and also data about the device on which you read the messages, such as IP address and location derived from it, device identification, its technical parameters such as operating system, its version, screen resolution, browser used and its version, as well as data obtained from cookies and similar technologies,
• derived data, meaning personal data derived from your settings, from data about products you purchase from us, from data about your behaviour on the website, and from data about your behaviour when reading messages we send to you: in particular, this includes data about your location, purchasing behaviour, and relationship to various goods and services.

In exceptional cases, we may process special categories of personal data, e.g. personal data relating to injuries of store visitors. We process personal data concerning health only for the fulfilment of our obligations in the field of labour law and social security, or where processing is necessary for the establishment, exercise, or defence of legal claims.

6. From whom do we obtain personal data?

Most of the personal data we process is obtained directly from you, for example when you contact us, enter into a purchase contract with us, or act on behalf of another natural or legal person (e.g. if you work for them).

We also obtain personal data from other sources, for example if your personal data is contained in documentation submitted to us by our contractual partner, from recording devices, or from publicly available sources or public authorities.

In the event that we obtain a child’s personal data in connection with information society services, in accordance with Article 8 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the processing of a child’s personal data is lawful if the child is at least 16 years old. If the child is under 16 years of age, the processing of his or her personal data is only possible on the basis of the consent of his or her legal guardian.

7. Are you required to provide us with personal data? 

If you are our customer or our contractual partner, or wish to become one, the provision of most personal data is a so-called contractual requirement and a requirement necessary for entering into a contract. Their provision is not mandatory; however, failure to provide them will result in the inability to enter into a contract with you. 

Personal data that we process in order to fulfil our legal obligations must be provided by you, as the provision of personal data is a legal requirement.

If personal data is obtained on the basis of consent, you are not obliged to provide us with such personal data; however, in that case we will not be able to provide you with information about news and offers relating to our goods and services.

If we process your personal data on the basis of our legitimate interest, you may object to the processing of your personal data and we will assess whether we are entitled to continue processing the personal data in accordance with the GDPR.

8. To whom do we provide your personal data?

We provide your personal data to other parties only to the extent necessary. Your personal data is provided to our employees, to other controllers who independently determine the purposes and means of processing personal data, as well as to processors who process personal data on our behalf.

Your personal data may be provided, during processing, to the following categories of recipients:

• carriers and postal service providers,
• marketing agencies,
• IT service providers,
• providers of online services and social networks,
• law firms, accountants, auditors, and tax advisors, experts, bailiffs, courts, and law enforcement authorities,
• supervisory, regulatory, and other public authorities in the performance of their duties under specific legal regulations (e.g. the Slovak Trade Inspection, the Personal Data Protection Office, tax authorities, etc.).

9. Do we transfer personal data to a third country or an international organization?

If you provide consent for analytics and measurement purposes, personal data may be transferred to recipients outside the European Union and the European Economic Area by Google Ireland Limited (hereinafter referred to as “Google”). More detailed information about the legal frameworks complied with by Google can be found HERE in the section “Legal frameworks for data transfers.” When using services provided by Meta Platforms Ireland Limited, i.e., social networks Facebook and Instagram, personal data is also transferred to third countries. More detailed information about the processing of personal data, including international transfers, can be found in the Facebook Privacy Policy – HERE in the section “How Do We Transfer Information?” and in the Instagram Privacy Policy – HERE in the section “How Do We Transfer Information?”. When using the LinkedIn social network, personal data is also transferred to third countries. More detailed information about the processing of personal data, including international transfers, can be found in the LinkedIn Privacy Policy – HERE in the section “Cross-border data transfers.”

10. Cookies

We use cookies on our website. More information about how we use cookies can be found HERE.

11. How long do we retain personal data? 

We retain personal data only for as long as necessary for the purposes for which the personal data is processed. Personal data forms part of records management files, which we retain for the retention period in accordance with the Archives Act. The retention period is set so as to allow us access to records management files for the entire time during which we will need them for our activities, including the periods established for the enforcement of rights and fulfilment of obligations under specific legal regulations. The retention period begins on the first day of the year following the year in which we close the file (i.e. a set of records management documents created in connection with the handling of the same matter). 

If you object at any time to the processing of your personal data for direct marketing purposes, we will stop processing your personal data for this purpose.

Cookies are stored until their specified expiration date, which is explained in more detail in our Cookie Policy.

More detailed information on the retention periods for the erasure of personal data is contained in a separate document – Record of Processing Activities, in conjunction with a separate document – Records Management Plan.

12. Do we carry out automated decision-making, including profiling? 

We do not carry out automated decision-making or profiling.

13. What rights do you have in connection with the processing of your personal data?

In connection with the processing of your personal data, you have rights that you should be aware of. Your rights depend on the purpose for which we process your personal data.

a) Right of access to personal data:

You have the right to obtain confirmation from us as to whether we process your personal data and, if we do process your personal data, you have the right to access them under the conditions set out in the GDPR. We will provide you with a copy of the personal data we process about you, provided that this does not adversely affect the rights and freedoms of others. For any additional copies you request, we may charge a reasonable fee corresponding to administrative costs. If you submit the request electronically, the information will be provided to you in a commonly used electronic format, unless you request another method of delivery.

b) Right to rectification:

You have the right to have inaccurate personal data concerning you rectified by us without undue delay. With regard to the purposes of processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

c) Right to erasure (right “to be forgotten”):

Under certain circumstances, you have the right to have your personal data erased by us without undue delay if:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
• you withdraw consent to the processing of personal data in cases where consent is required and there is no other legal basis for the processing,
• you object to the processing of your personal data (where personal data is processed for the purposes of legitimate interests) and there are no overriding legitimate grounds for the processing, or if the data subject objects to the processing of personal data for direct marketing purposes,
• the personal data has been processed unlawfully,
• the personal data must be erased in order to comply with a legal obligation under European Union law or the law of the Slovak Republic,
• the personal data was collected in connection with the offer of information society services to a child (i.e. where personal data was processed on the basis of the child’s consent in connection with information society services).

The right to erasure shall not apply under the conditions set out in the GDPR if the processing of personal data is necessary, for example, for compliance with our legal obligation under European Union law or the law of the Slovak Republic, or for the establishment, exercise, or defence of legal claims.

d) Right to restriction of processing:

You have the right to request that we restrict the processing of your personal data in any of the following cases:

• for the period during which we verify the accuracy of the personal data, if you contest the accuracy of the personal data, 
• the processing is unlawful and you request the restriction of the use of the personal data instead of erasure,
• if we no longer need the personal data for the purposes of processing, but you require it for the establishment, exercise, or defence of your legal claims,
• pending the verification of whether our legitimate grounds for processing personal data override your legitimate grounds, if you object to the processing of personal data (where personal data is processed for the purposes of legitimate interests).

If the processing of personal data has been restricted, such personal data shall, with the exception of storage, be processed only with your consent or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or the Slovak Republic.

e) Right to data portability:

You have the right to obtain your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller if:

• the processing of your personal data is based on consent or on a contract, and
• the processing is carried out by automated means.

The right to data portability must not adversely affect the rights and freedoms of others.

g) Right to withdraw consent to the processing of personal data:

If processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

h) Right to lodge a complaint with the Personal Data Protection Office of the Slovak Republic:

You have the right to lodge a complaint at any time with the Personal Data Protection Office of the Slovak Republic.

14. Additional information on the processing of personal data

More detailed information on the categories of personal data processed by us, the categories of data subjects, and the recipients to whom personal data is provided, as well as further information, is contained in a separate document – Record of Processing Activities (see point 11).

15. Changes to the Information Obligation

The protection of personal data is not a one-time matter for us. The information that we are obliged to provide to you in connection with our processing of personal data may change or become outdated. For this reason, we reserve the right to amend and update the information on the processing of personal data at any time. If we make material changes to this information, we will bring such changes to your attention, for example by a general notice on our website or by a separate notice via e-mail.