Privacy policy
INFORMATION FOR THE DATA SUBJECT REGARDING THE COLLECTION AND PROCESSING OF PERSONAL DATA
provided by the company operator to the data subject when collecting personal data from the data subject
The company operator, by Article 13(1) and (2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (from now on referred to as the "Regulation"), provides the following information to the data subject from whom the company operator obtains personal data concerning them:
Identity and contact details of the company operator:
The company operator is PUELLAvone s.r.o., with its registered office at Rovníková 1457/7, 040 12 Košice - Nad Jazerom, Slovakia, ID: 53 991 893, registered in the Commercial Register of the District Court Košice I, Section: Sro, Insert No .: 52158/V, VAT ID: SK2121542665, statutory body: Martin Švenk - executive, email: Support@PUELLAscents.com
Contact details of the responsible Person:
No responsible person has been appointed.
Processed personal data:
The company operator processes the following personal data: name, surname, address, delivery address, phone number, email address, IP address, cookie files, bank account number, bank name, and signature.
Purposes of processing the data subject's data:
The purposes of processing the data subject's data are:
- a) processing of accounting documents
- b) fulfilment and recording of contracts
- c) recording of clients and contractual partners to conclude and perform contracts
- d) archiving of documents according to legal regulations
- e) correspondence and communication data
- f) for marketing purposes of the company operator
Legal basis for the processing of the Data Subject's data:
The legal basis for processing the Subject's data depends on the specific type of personal data and the purpose of their processing, the fulfilment of the Operator's legal obligation or the contract's completion by the contractual party to which is the Person concerned. In the case of processing personal data for marketing purposes, the personal data of the Person concerned will be processed based on the consent of the Person concerned.
Specification of legitimate interests pursued by the Operator or a third party: Not applicable.
Recipients or categories of recipients of personal data:
The recipient of the Subject's data may be the Company operator employees and associates, the Company operator's body and members of the Company operator's bodies, the Company operator's business partners, suppliers and contractors, in particular: an accounting company, a company providing legal services to the Company operator, a company providing services related to the creation and maintenance of software, courier companies or other companies delivering goods to the Company operator's customers.
In the cases provided for by law, the recipient of personal data will also be the tax authorities, courts, law enforcement authorities and other state authorities.
Information about the intended transfer of personal data to a third country: not applicable.
Retention period of personal data:
The personal data will be kept for the necessary period by the law for the performance of the contract and their subsequent archiving. In processing personal data for marketing purposes, the Subject's data will be processed and archived for one calendar year.
Instructions regarding the relevant rights of the Data Subject:
The Person concerned shall have, among other things, the following rights:
- a) The legal right of the Subject to access their data under Article 15 of the Regulation. This includes:
(i) The Subject has the legal right to request confirmation if the Company operator processes the Person concerned data;
(ii) If the personal data is processed, the Subject has the legal right to access them and obtain information such as:
- information on the purposes of the processing;
- information on the categories of personal data concerned;
- Information on the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations;
- Information on the expected period of storage of personal data. If it is impossible to provide, the criteria for its determination should be provided.
- information on the existence of the legal right to request from the Data Controller the rectification of personal data relating to the Data Subject or their erasure or restriction of processing and on the existence of the right to object to such processing;
- information on the legal right to complain with the supervisory authority;
- If the Person's concerned data was not collected, then any available information as to its source;
- Information on automated decision-making, including profiling, as referred to in Articles 22(1) and (4) of the Regulation. In such cases, meaningful information on the procedure used and the significance and anticipated consequences of such processing of personal data should be provided.
(iii) The legal right to be informed of the adequate safeguards under Article 46 of the Regulation relating to the transfer of personal data where personal data are transferred to a third country or an international organisation;
(iv) The legal right to be provided with a copy of the personal data being processed, provided, however, that the right to be provided with a copy of the personal data being processed shall not adversely affect the rights and freedoms of others;
- b) The legal right of the Person concerned to rectification under Article 16 of the Regulation, which includes:
(i) The legal right for the immediate correction of incorrect personal data relating to the Data Subject without undue delay;
(ii) The legal right to supplement incomplete personal data of the Person concerned, including by providing an additional statement of the Person concerned;
- c) The legal right for the Person concerned to delete personal data (the so-called "right to be forgotten") according to Article 17
Regulations, the content of which is:
(i) The legal right to obtain from the Company operator without undue delay the deletion of personal data relating to the Person concerned if any of the following reasons are met:
- The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- The Person concerned shall withdraw the consent based on which the processing is carried out, subject to the following condition: There is no other legal basis for the processing of the personal data;
- The Person concerned objects to the processing of personal data under Article 21(1). Regulation and no overriding legitimate grounds for processing personal data or the Data Subject objects to processing personal data under Article 21(2). Regulation;
- The personal data has been processed unlawfully;
- The personal data must be erased to comply with a legal obligation under European Union law or the law of a Member State to which the Company operator is subject;
- The personal data was collected in connection with offering information society services under Article 8, paragraph 1 of the Regulations.
(ii) The legal right for the Company operator who has disclosed the Personal Data of the Person concerned to take appropriate measures, including technical measures, taking into account the available technology and the costs of implementing the standards, to inform other Operators who carry out the processing of personal data that the Data Subject requests them to delete all links to these personal data, their copy or replicas;
At the same time, the right to delete personal data, including the defined claims and rights according to Article 17 par. Regulations 1 and 2 [i.e. with the content of rights according to (i) and (ii) of this letter c) point J. of this document] will not arise if the processing of personal data is necessary:
- To exercise the legal right to freedom of expression and information;
- In adherence to legal requirements mandated by the European Union or any of its member states, or when fulfilling public duties or exercising public authority, the Operator may be obligated to process certain information.
- By the Regulation, personal data may be processed for public health purposes as outlined in Article 9(2)(h) and (i) and Article 9(3) in the interest of the community.
- In some instances, there may be a need to process personal data for archival, scientific or historical research, or statistical purposes as outlined in Article 89, paragraph 1 of the Regulations. However, it is essential to consider whether such processing could potentially hinder or complicate achieving these goals or serve any other purposes, as for:
- To provide evidence, make the claims, or in a manner of protection, use it to defend legal claims;
- d) It is within the legal rights of the concerned Person in question to request limitations on processing their data, as stated in Article 18 of the applicable Regulation, whose content is:
(i) The legal right for the Company operator to limit the processing of personal data in one of the following cases:
- The Person concerned contests the correctness of the personal data during the period allowing the Company operator to verify the correctness of the personal data;
- The processing of personal data exceeds the agreed and set conditions between the company operator and the Person concerned, which is unlawful and beyond the agreement, and the Person concerned express opposition to removing their personal information and requests that restrictions be placed on its processing;
- The Company operator no longer needs the personal data for processing, but the Person concerned needs them to prove, exercise or defend legal claims;
- The concerned person in question has objected to processing their data per Article 21. However, the Company operator must verify whether their legitimate reasons outweigh those of the Person concerned.
(iii) To ensure compliance with privacy regulations by point (i) of this letter. d) point J. of this document, obtaining consent from the Person concerned for the restricted processing of personal data or deleting them is necessary. Exceptions may be made in cases where such processing is necessary to exercise legal rights, defend legal claims, or for reasons of substantial public interest.
(iv) The legal right to be informed in advance about the cancellation of the limitation of personal data processing;
- e) The right of the Person concerned to fulfil the notification obligation towards the recipients according to Article 19 of the Regulation, the content of which is:
(i) The legal right for the Company operator to notify each recipient to whom personal data has been provided of any correction or deletion of personal data or restriction of processing carried out under Article 16, Article 17 par. 1. and Article 18 of the Regulation, unless it proves to be impossible or requires disproportionate effort;
(ii) The legal right for the Operator to inform the Data Subject about these recipients if the Data Subject requests it;
- f) The Person concerned has a legal right to data portability according to Article 20 of the Regulation, the content of which is:
(i) The legal right to collect personal data relating to the Person concerned and provide it to the Company operator in a structured, commonly used and machine-readable format and the right to transfer this data to another operator without the Operator preventing it if:
- The processing is based on the concerned Person's consent according to Article 6 par. 1. letter a) Regulation or Article 9 par. 2. letter a) Regulations, or on the contract according to article 6 par. 1. letter b) Regulations, and at the same time:
- The processing is carried out by automated ways and means, and at the same time:
- The legal right to collect personal data in a structured, commonly used and machine-readable format and the right to transfer this data to another operator without the Company operator preventing it will not have adverse consequences on the rights and freedoms of others;
(ii) The legal right to transfer personal data directly from one Operator to another operator, as long as it is technically possible;
- g) The legal right of the Person concerned to object according to Article 21 of the Regulation, the content of which is:
(i) The legal right to object at any time, for reasons related to the Data Subject's specific situation, to the processing of personal data concerning him, which is carried out based on Article 6 par. 1. letter e) or f) of the Regulation, including objecting to profiling based on these provisions of the Regulation;
(ii) [in the case of exercising the right to object at any time for reasons related to the specific situation of the Data Subject against the processing of personal data concerning him, which is carried out based on Article 6 par. 1. letter e) or f) of the Regulation, including objection to profiling based on these provisions of the Regulation] the right that the Operator does not further process the Personal Data of the Data Subject unless he proves the necessary legitimate reasons for processing that outweigh the interests, rights and freedoms of the Data Subject, or reasons for establishing, exercising or defending legal claims
(iii) The legal right to object at any time to the processing of personal data concerning the Data Subject for direct marketing, including profiling to the extent that it is related to direct marketing; it also applies if the Data Subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes;
(iv) (in connection with the use of information society services) the right to exercise the right to object to the processing of personal data by automated means using technical specifications;
(v) The legal right to object, for reasons related to the Data Subject's specific situation, to the processing of personal data concerning the Data Subject if the personal data are processed for scientific or historical research or statistical purposes under Article 89 paragraph 1. Regulations, but except cases where the processing is necessary for the performance of the task for reasons of public interest;
- h) The Data Subject's right related to automated individual decision-making according to Article 22 of the Regulation, the content of which is:
(i) The legal right not to be subject to a decision based solely on automated processing of personal data, including profiling, and which has legal effects that concern or similarly significantly affect the Data Subject, except cases under Article 22 par. 2. Regulations [i.e. except cases where the decision is: (a) necessary for the conclusion or performance of the contract between the Data Subject and the Operator, (b) permitted by the law of the European Union or the law of the Member State to which the Operator is subject and which also establish appropriate measures guaranteeing the protection of rights and freedoms and legitimate interests of the Data Subject or (c) based on the express consent of the Data Subject].
Instruction on the Data Subject's right to withdraw consent to the processing of personal data:
The Person concerned is entitled to withdraw his consent to the processing of personal data at any time without this affecting the legality of the processing of personal data based on the permission granted before its withdrawal.
The Person concerned can withdraw his consent to processing personal data at any time - in whole or part. Partial withdrawal of consent to processing personal data may relate to a specific processing operation/processing operation. In contrast, the legality of personal data processing in the scope of the remaining processing operations remains unaffected. Partial revocation of consent to the processing of personal data may relate to a specific purpose of personal data processing / certain specific purposes of personal data processing. In contrast, the legality of personal data processing for other purposes remains unaffected.
The Data Subject can exercise the right to revoke consent to the processing of personal data in paper form at the address of the Operator entered as its registered office in the commercial register at the time of the withdrawal of consent to the processing of personal data or in electronic form using electronic means (by sending an email to the email address of the Operator specified when identifying the Operator in this document or by filling out the electronic form published on the Operator's website).
Instruction on the legal right of the Person concerned to file a complaint with the supervisory authority:
The Person concerned has the right to file a complaint with the supervisory authority, in particular in the Member State of his habitual residence, place of work or place of the alleged violation, if he believes that the processing of personal data concerning him is contrary to the Regulation and that all without prejudice to any other administrative or judicial remedies. The supervisory authority in the Slovak Republic is the Personal Data Protection Office of the Slovak Republic, with headquarters at Hraničná 12, 820 07 Bratislava, ID: 36 064 220, email: statny.dozor@pdp.gov.sk, telephone: 02/3231 3214.
Information on the existence/non-existence of the Data Subject's obligation to provide personal data:
The Operator informs the Affected Person that the provision of personal data of the Affected Person is necessary for the conclusion of the contract and its fulfilment. The Operator informs the Affected Person that the Affected Person is not obliged to provide personal data, nor is he obliged to grant consent to their processing. The consequence of not providing personal data and not giving permission to process personal data will be that the Operator will not be able to conclude and fulfil the contract.
Information related to automatic decision-making, including profiling: Is not applicable