Personal Data Protection Policy (GDPR)

I. Introductory Provisions

For the purposes of this Policy, the following definitions apply:

• Operator – Savroa s. r. o., ID No.: 50189298, with registered office at Brezová 1146/65A, 900 23 Viničné, Slovakia.
• Personal Data – includes your first and last name, e-mail address, telephone number, billing address, delivery address, IP address, cookies, and information about having reached the age of 16.
• Participant – a natural person who purchases goods and services from the Operator.

The operator of the e-shop www.hruskaglass.com, as the controller of personal data, hereby informs you of the manner and extent of the processing of Personal Data, including the extent of the Participant’s rights (as defined below) related to the processing of their Personal Data.

The Operator processes Personal Data in accordance with the following legislation:

• Act No. 18/2018 Coll. on the Protection of Personal Data;
• Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter the “Regulation”).

We process Personal Data for the purpose of selling goods and services to the end customer. In connection with the above, we process Personal Data:

• to the extent that it was provided in connection with ordering the Operator’s products and/or services, or during negotiations on the conclusion of a contract with the Operator, as well as in relation to the concluded contract;
• for the purpose(s) listed below in Article II.

The e-shop is not intended for children under 16 years of age. A person under the age of 16 may use our e-shop only if their legal guardian (parent or guardian) agrees to this. In the event of disagreement, please inform us via the contact form.

II. Purposes and Duration of Personal Data Processing

The Operator processes Personal Data for the following purposes:

• Performance of the contract or another obligation and the provision of services:
  • Personal Data will be processed during negotiations on the conclusion of the contract between the Operator and the Participant for the purpose of concluding the contract, as well as throughout the duration of the contractual relationship;
  • sending satisfaction questionnaires in order to improve the services provided to customers following a created order, reservation, or direct sale – the processing time of Personal Data is 3 years in this case;
  • marketing campaigns – to carry out a marketing campaign, evaluate it, conclude it, deliver a prize, etc. Processing time: for the duration of the marketing campaign.
• Compliance with a legal obligation (in particular accounting, tax, and archiving obligations, and providing cooperation to administrative authorities, the police, courts, etc.):
  • the tax document will be kept for 10 years from the termination of the contract – in order to fulfil the statutory obligation to archive accounting documents pursuant to Act No. 563/1991 Coll. on Accounting, as amended, Personal Data is further processed and kept for 10 years from the year following the year in which the contract between the Operator and the Participant was concluded;
  • performance of duties in connection with the exercise of rights arising from liability for defects, and providing cooperation to administrative authorities, the police, and courts – the Operator is entitled to process the customer’s basic personal, identification, and contact details, product data, and communication data with the customer for 4 years from the expiry of the warranty period for the goods.
• The legitimate interests of the Operator and the protection of the rights and protected interests of the Operator:
  • effective defence in the event of a dispute – the processing time here is set at 4 years from the expiry of the warranty period for the goods and is extended by the length of time the dispute is conducted;
  • a further legitimate interest of the Operator is the sending of commercial communications (offers and individual offers) in accordance with Section 7(3) of Act No. 480/2004 Coll. on Certain Information Society Services and in accordance with Recital 47 of the Regulation, where the Operator obtained the electronic contact details in connection with the sale of goods and services to the Participant. A legitimate interest arises following a customer order created in our e-shop.
• Provision of marketing and commercial services:
  • bulk sending of product and service offers – sending general advertising communications without targeting a specific group of recipients. The processing time of Personal Data is 3 years in this case;
  • individual offer – sending advertising communications after evaluating certain personal aspects relating to a natural person. The Operator does not carry out profiling within the meaning of Article 22 of the Regulation, as this is not automated processing but the manual creation of individual offers. The processing time of Personal Data is 3 years in this case;
  • cookies – short text files generated by a web server and stored on a computer through a browser. Two types are distinguished. First, there are cookies necessary to ensure the functioning and analysis of the site (ensuring the transmission of electronic communications over an electronic communications network; the use of these cookies cannot be refused). Second, there are cookies that evaluate certain personal aspects relating to a particular individual. The use of the second type of cookies requires the Participant’s consent. The processing time is 3 years in this case.

For remarketing purposes, cookies are passed on to another processor only if they have been approved for this purpose, with a maximum validity period of 540 days. If consent to advertising cookies is withdrawn, it is not technically possible to immediately remove cookies that have already been passed on to the processor. The cookie is removed from the processor automatically after its validity period expires. An immediate way to prevent the processor’s remarketing activities is to delete the cookies from the browser.

III. Privacy Protection and Processing Information

1. If the Participant fails to provide their Personal Data, it is not possible to conclude a contract with the Operator and/or to provide the service by the service provider. Personal Data is, in this context, necessary for the provision of a specific service or product by the Operator.
2. After the expiry of the periods referred to in Article II, the Operator deletes or anonymises the Personal Data.
3. The Participant is obliged to provide the Operator only with true and accurate Personal Data. The Participant is responsible for the correctness, accuracy, and truthfulness of the Personal Data provided. The Operator is not responsible for the accuracy of the data provided.
4. The Operator will make every effort to prevent unauthorised processing.
5. Personal Data is and will be processed electronically, in a non-automated manner.

IV. Rights of the Participant

Rights of the Participant in relation to the protection of personal data:

1. to request access to their Personal Data from the Operator;
2. to have the Personal Data provided corrected;
3. to have the Personal Data provided erased;
4. to restrict the processing of Personal Data;
5. to lodge a complaint with the Office for Personal Data Protection;
6. the right to transfer personal data to another controller;
7. the right to object to the processing of personal data;
8. the right to withdraw consent.

The Participant may exercise their rights under paragraph (1) of this Article via the link provided in the e-mail sent by the Operator, by a request through the contact form, or, in the case of a registered customer, in the customer section on the e-shop website.

The rights under paragraph (1) of this Article, points (c) and (d), cannot be exercised to the extent and for the purposes referred to in points II. (1) (a), (b), and (c), with the exception of point (ii) (c) of Article II, where all the rights referred to in point one may be exercised.

If the Participant believes that the Operator processes their Personal Data contrary to the protection of their private and personal life or in violation of the applicable legislation, in particular if the Personal Data is inaccurate with regard to the purpose of its processing, they may:

• ask the Operator for an explanation via the contact form;
• object to the processing and, via the contact form, request that the Operator be given the opportunity to remove the resulting situation (for example, by blocking, supplementing, correcting, or erasing the Personal Data). The Operator shall decide on the objection without delay and inform the Participant accordingly. If the Operator does not comply with the objection, the Participant has the right to contact the Office for Personal Data Protection directly. This provision is without prejudice to the Participant’s right to contact the Office for Personal Data Protection directly on their own initiative.

If the Participant exercises a right under this Article, the Operator is obliged to respond within 30 days of the request being delivered to the Operator.

The acceptance of an application to exercise a right under Article IV, point 1 (a) and (f) is possible only through a data message or a letter with an officially authenticated signature sent to the address of the company’s registered office. The application must contain an e-mail address to which a verification e-mail will subsequently be sent to confirm the applicant’s identity.

If the Participant exercises any of the rights under Article IV, paragraph 1, the Operator has the right to require proof of the Participant’s identity. A request for access to personal data must therefore be sent from the applicant’s e-mail address. If the request is submitted in a different form or from a different e-mail address, the Operator is entitled to require additional verification by replying to the verification e-mail. If the applicant does not prove their identity within 14 days of the verification e-mail being sent, their application to exercise the rights under Article IV, paragraph 1 will not be accepted.

In the event of a repeated and unjustified request to provide a physical copy of the processed Personal Data, the Operator is entitled to charge a reasonable fee for the associated administrative costs.

V. Final Provisions

All legal relationships arising from the processing of Personal Data are governed by the laws of the Slovak Republic, regardless of where access to them has been made. The competent Slovak courts have jurisdiction to resolve any disputes arising in connection with the protection of privacy between the Participant and the Operator.

The data subject has the right to contact the Office for Personal Data Protection (dataprotection.gov.sk).

Transfer of Personal Data to Third Parties

The carrier you choose would never be able to deliver the ordered goods if we did not pass on the details of where and to whom the goods should be delivered. We provide these data to the carrier exactly as you fill them in on the order. We cooperate with the following companies:

• DHL Express (Slovakia) spol. s r. o. – Registered office: Letisko M. R. Štefánika, 820 01 Bratislava; ID No.: 31342876, registered in the Commercial Register of the District Court Bratislava I, Section: Sro, Insert No. 4400/B.
• Slovenská pošta, a. s. – Registered office: Partizánska cesta 9, 975 99 Banská Bystrica; ID No.: 36631124, registered in the Commercial Register of the District Court Banská Bystrica, Section Sa, Insert No. 803/S.
• Inspekta Slovakia, a. s. (FedEx) – ID No.: 31340911, registered in the Commercial Register of the District Court Bratislava I, Section Sa, Insert No. 502/B.
• ReMax CourierService, spol. s r. o. – ID No.: 35825456, registered in the Commercial Register of the District Court Bratislava I, Section Sa, Insert No. 25438/B.
• Direct Parcel Distribution SK s. r. o. – ID No.: 35834498, registered in the Commercial Register of the District Court Bratislava I, Section: Sro, Insert No. 26367/B.

As a buyer, I am aware that I am entitled to withdraw the above consents in writing at any time. As a buyer, I declare that I have been informed, pursuant to Section 15(1), of the conditions for the processing of personal data by the operators, which are published on the website www.hruskaglass.com.

Accounting

We use the services of an external accounting firm to process our accounting:

• Calculon, s. r. o. – Registered office: Lošonec 191, 919 04 Lošonec; ID No.: 47368799, registered in the Commercial Register of the District Court Trnava, Section Sro, Insert No. 322970/T.

Payment Gateways

In the case of card payment, we use the services of a payment gateway:

• PayPal – for more information, see PayPal’s official website paypal.com.

As a buyer, I declare that I have been informed of the conditions for the processing of personal data by the operators, which are published on www.hruskaglass.com.

This Policy enters into force on 25 May 2018.