GDPR- Veloportal-Stores.com

Privacy Policy and Personal Data Protection System under the GDPR

prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, pursuant to Articles 13 and 14 of the Regulation (hereinafter referred to as the "GDPR"), and Act No. 18/2018 Coll. on Personal Data Protection (hereinafter referred to as the "Personal Data Protection Act").

Controller

Company name: VELOPORTAL STORES s. r. o.
Registered office: M. Falešníka 6, 971 01 Prievidza
Company ID (IČO): 53329139
Represented by: Zuzana Potočníková
Telephone: +421949109342
E-mail: tomaspotocnik123@gmail.com

(hereinafter referred to as the "Controller")

The Controller is not required to appoint a Data Protection Officer (DPO).

Basic Definitions

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to a generally applicable identifier, another identifier such as a name, surname, identification number, location data, or an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Processing of personal data means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Data subject means any natural person whose personal data is being processed.

Controller means the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data and processes personal data on its own behalf.

Processor means any natural or legal person who processes personal data on behalf of the Controller.

Recipient means any natural or legal person to whom personal data is disclosed, regardless of whether that person is a third party.

Data Protection Officer (DPO) means a person designated by the Controller or the Processor to perform the duties set out in the applicable data protection legislation.

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person's work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organisational measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person.

Information system means any structured set of personal data accessible according to specific criteria, regardless of whether such a set is centralised, decentralised, or dispersed on a functional or geographical basis.

Third party means a natural or legal person, public authority, agency, or other body other than the data subject, the Controller, the Processor, and persons who, under the direct authority of the Controller or the Processor, are authorised to process personal data.

Purpose and Legal Basis of Processing

Compliance with a Legal Obligation

Article 6(1)(c) of the GDPR

Accounting and taxation: Processing and archiving invoices, delivery notes, and other accounting documents in accordance with accounting legislation and tax regulations.

Consumer protection: Handling complaints, conducting complaint procedures, and processing product batch data in the event that dangerous products must be withdrawn from the market in accordance with consumer protection legislation.

Records management: Maintaining records of incoming and outgoing correspondence and managing filing records.

Performance of a Contract and Pre-contractual Relations

Article 6(1)(b) of the GDPR

E-shop and retail: Processing data necessary to create and manage a customer account, receive and process orders, issue invoices, deliver goods, and communicate with customers.

Business and distribution activities: Communication and performance of contracts with brand representatives and manufacturers of cycling components, such as Shimano, as well as with business partners, including bicycle service centres and bicycle retailers.

Legitimate Interest

Article 6(1)(f) of the GDPR

CRM and relationship development: Maintaining a contact database of business partners for the purpose of developing wholesale cooperation in the Czech and Slovak markets.

Consent of the Data Subject

Article 6(1)(a) of the GDPR

Marketing and analytics on the website: Use of optional analytics and marketing cookies and tracking technologies on the website.

Retention Period

Personal data is retained for the period necessary to exercise the rights and fulfil the obligations arising from contractual relationships and subsequently for the periods prescribed by applicable legislation and the records retention and disposal schedule.

For example:

Accounting and tax documents, including e-shop invoices, are retained for 10 years.

Customer accounts in the e-shop and loyalty programme are retained for the duration of the registration. Inactive accounts are deleted after 3 years without a purchase.

Recipients of Personal Data

Processors and contractual partners: An external accounting company, transport and courier companies such as DPD SK, Packeta, and Toptrans, the e-shop platform provider, analytics and marketing tools or review portals such as Google, Heureka, and Zboží.cz, and customer support tools such as Smartsupp.

Public authorities: The Slovak Trade Inspection, the Czech Trade Inspection Authority, the Office for Personal Data Protection of the Slovak Republic, the Financial Administration or tax authority, the Labour Inspectorate, courts, or the police on the basis of a lawful and authorised request.

Automated Decision-making and Profiling

Basic profiling takes place within the e-shop and loyalty programme, for example customer segmentation based on purchase history for the purpose of assigning a discount level.

However, these procedures do not produce legal effects concerning you and do not similarly significantly affect you within the meaning of Article 22 of the GDPR.

We do not carry out fully automated individual decision-making.

Cross-border Transfers of Personal Data

As part of our main activities, personal data is processed primarily within the European Union or the European Economic Area.

Personal data may be transferred to third countries only in the following cases:

When communicating with or placing orders with foreign suppliers or manufacturers of cycling components located in third countries, for example in Asian or other non-European markets. As a rule, this does not involve the transfer of end-customer data.

When using global IT and marketing services, such as Google Analytics, where appropriate safeguards are ensured in accordance with the GDPR, in particular on the basis of an adequacy decision under the EU–US Data Privacy Framework or through the application of Standard Contractual Clauses.

Personal Data Security Measures

The Controller declares that it has adopted appropriate personnel, technical, and organisational measures to ensure the protection of personal data.

The Controller has implemented technical measures to secure data storage systems and repositories containing personal data in paper form.

The Controller declares that personal data may be accessed exclusively by persons authorised by the Controller.

Your Rights

Right of Access

You have the right to know whether we process your personal data.

Where we process your personal data, you may request access to it. On the basis of your request, we will provide you with confirmation containing information about the processing of your personal data.

Right to Rectification

You have the right to ensure that the personal data we process about you is accurate, complete, and up to date.

Where your personal data is inaccurate or outdated, you may request that it be corrected or completed.

Right to Erasure

Right to Be Forgotten

Under certain circumstances, you have the right to request that we erase your personal data.

You may request the erasure of your data at any time. We will erase your personal data where:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

• the data subject withdraws consent where the processing is based on the data subject’s consent;

• the data subject objects to the processing;

• the personal data has been processed unlawfully;

• the personal data must be erased in order to comply with a legal obligation;

• you are a child, or the parent of a child, who consented to the processing of personal data through the internet.

Právo na omezení zpracování

Můžete nás požádat, abychom omezili zpracování vašich osobních údajů. Pokud vaší žádosti vyhovíme, budeme vaše osobní údaje pouze uchovávat a nebudeme je dále zpracovávat. Ke zpracování vašich údajů dojde pouze v omezeném rozsahu, pokud:

- nám oznámíte, že vaše osobní údaje jsou nesprávné, a to po dobu, než ověříme jejich správnost;

- zpracováváme vaše osobní údaje protiprávně, avšak vy nesouhlasíte s jejich výmazem a místo toho požadujete pouze omezení jejich zpracování;

- vaše údaje již nepotřebujeme, ale potřebujete je vy pro určení, výkon nebo obhajobu svých právních nároků;

- vznesete námitku proti zpracování osobních údajů, a to do doby, než ověříme, zda naše oprávněné zájmy převažují nad vašimi důvody.

Právo na přenositelnost údajů

Máte právo požadovat, abychom vám poskytli vaše osobní údaje v elektronické podobě (např. v souboru XML nebo CSV), která vám umožní snadno přenést údaje jiné společnosti. Můžete nás také požádat, abychom vaše osobní údaje předali přímo vámi zvolené společnosti. Vaší žádosti vyhovíme, pokud jste nám osobní údaje poskytli přímo vy a udělili jste souhlas s jejich zpracováním.

Právo vznést námitku

Máte právo vznést námitku proti zpracování vašich osobních údajů. Pokud vaše osobní údaje zpracováváme:

- z důvodu našeho oprávněného zájmu;

- za účelem vytváření zákaznického profilu;

- můžete proti jejich zpracování vznést námitku, máte-li k tomu důvody související s vaší konkrétní situací.

Právo nebýt předmětem automatizovaného individuálního rozhodování včetně profilování

Máte právo nebýt předmětem rozhodnutí založeného výlučně na automatizovaném zpracování, které pro vás má právní účinky nebo se vás obdobným způsobem významně dotýká.

Vaše právo zahrnuje:

-          právo na lidský zásah ze strany správce

-          právo vyjádřit své stanovisko

-          právo takové rozhodnutí napadnout

výjimky z tohoto práva jsou možné, pokud je rozhodnutí:

-          nezbytné pro uzavření nebo plnění smlouvy

-          povoleno právem Evropské unie nebo členského státu

-          založeno na výslovném souhlasu

Jak můžete tato práva uplatnit?

Se svou žádostí se na nás můžete obrátit některým z následujících způsobů:

e-mailem: tomaspotocnik123@gmail.com

telefonicky: +421949109342

nebo poštou na korespondenční adresu: M. Falešníka 6, 971 01 Prievidza

Tyto Zásady ochrany osobních údajů nabývají platnosti a účinnosti jejich zveřejněním na webových stránkách.