🔥 The sale is on! While stocks last — don’t miss out!

Privacy

PERSONAL DATA PROTECTION PRINCIPLES

 

The right to personal data protection, which under the Constitution of the Slovak Republic is an inseparable part of fundamental human rights and freedoms, has been incorporated into our procedures and measures that we, in the position of controller, apply when processing personal data.

 

The Personal Data Protection Principles (hereinafter referred to as the “Principles”) will provide you in particular with information about how we handle your personal data and how you can contact us if necessary. The Principles are intended for customers who shop through the controller’s websites (for example www.rukahore.sk, www.merch.sk). The Principles, which follow the General Terms and Conditions, also focus on the processing of personal data through social networks (Facebook, Instagram, etc.) and the use of cookies.

 

When processing personal data, we proceed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), Act No. 18/2018 Coll. on the Protection of Personal Data and on amendments and supplements to certain acts (hereinafter referred to as the “Personal Data Protection Act”), and other generally binding legal regulations.

 

In connection with the processing of personal data, we have prepared information for users of the websites (hereinafter referred to as the “data subject”) whose personal data we process in connection with providing our services, concerning personal data protection pursuant to Articles 13 and 14 of the General Data Protection Regulation.

  • CONTROLLER

 

The controller Merch s.r.o., Slávičia 10 , 903 01 Senec, Company ID: 47 608 803 operates websites (in particular www.rukahore.sk) where customers can purchase products sold by the controller or products whose sale the controller intermediates. The terms and the sales process are governed by the General Terms and Conditions.

 

 

  • PROCESSING OF PERSONAL DATA

 

The processing of personal data is carried out in accordance with several generally binding legal regulations governing personal data protection. The key regulations are in particular the General Data Protection Regulation and the Personal Data Protection Act.

 

The processing of personal data by Merch s.r.o. is also carried out on the basis of special regulations that further govern the conditions of processing, in particular on the basis of:

  • Act No. 22/2004 Coll. on Electronic Commerce and on amendments and supplements to Act No. 128/2002 Coll. on State Control of the Internal Market in Matters of Consumer Protection and on amendments and supplements to certain acts as amended by Act No. 284/2002 Coll.,
  • Act No. 351/2011 Coll. on Electronic Communications as amended,
  • Act No. 513/1991 Coll. Commercial Code as amended,
  • Act No. 40/1964 Coll. Civil Code as amended,
  • Act No. 102/2014 Coll. on Consumer Protection in the Sale of Goods or Provision of Services on the basis of a distance contract or a contract concluded outside the seller’s business premises and on amendments and supplements to certain acts,
  • Act No. 250/2007 Coll. on Consumer Protection and on amendment to the Act of the Slovak National Council No. 372/1990 Coll. on offences as amended.

 

  • DPO

 

The person responsible for the protection of personal data processed by Merch s.r.o. will answer any questions regarding the processing of your personal data. You can contact the responsible person via the following contact details:

  • e-mail address: [email protected]
  • registered office address: Merch s.r.o., Slávičia 10 , 903 01 Senec, Company ID: 47 608 803.

 

In the case of a written request sent to the registered office address of Merch s.r.o., please state on the envelope the text “GDPR – responsible person”.

 

  • IDENTIFICATION AND CONTACT DETAILS OF THE CONTROLLER:

 

Personal data of data subjects are processed by the controller:

Merch s.r.o.

Slávičia 10 , 903 01 Senec

Company ID: 47 608 803

registered in the Commercial Register of the District Court Bratislava 1, Section: Sro, Insert No. 95409/B.:

(also hereinafter referred to as “Merch s.r.o.” or the “controller” or “we”)

 

Your personal data are obtained and further processed by Merch s.r.o. (controller), which is responsible for the correctness and lawfulness of processing. As a data subject, you may exercise against Merch s.r.o. the rights set out below.

 

Merch s.r.o. is in the position of controller except in cases in which it processes personal data on the instructions of other controllers and on their behalf, when it assumes the position of processor.

 

 

  • PERSONAL DATA WE PROCESS ABOUT YOU

 

Merch s.r.o. processes only such personal data on the basis of which we are able to ensure and provide you with professional services with due professional care, while the scope of such personal data is determined in accordance with the purposes of personal data processing.

 

Merch s.r.o. processes personal data by automated as well as non-automated means. Automated processing of personal data is carried out through secure devices designated for this purpose.

 

Merch s.r.o. declares that only expressly authorized and instructed persons have permitted access to personal data.

 

Merch s.r.o. ensures protection of personal data against damage, destruction, loss, alteration, unauthorized interference and disclosure, provision or publication, and against any other impermissible methods of processing. In connection with such safeguarding, appropriate technical and organizational measures corresponding to the method of personal data processing have been adopted.

 

Information on the nature of the personal data provided

 

If the legal basis for processing personal data is a contract, the provision of personal data is a contractual requirement. The data subject is obliged to provide personal data; if such data are not provided, it is not possible to conclude a contractual relationship.

 

If the legal basis for processing personal data is law, the provision of personal data is a legal requirement. The data subject is obliged to provide personal data; otherwise, proper fulfillment of the controller’s obligations arising from the relevant generally binding legal regulations is not possible.

 

If the legal basis for processing personal data is the legitimate interestpursued by the controller or a third party, the purpose of processing specifies what legitimate interest it is.

 

The personal data we process are in particular:

  • identification and contact details, meaning title, first name and surname, permanent residence address, delivery address, contact telephone number, e-mail address, bank details; your identification data form part of the contract being concluded that you enter into with us in accordance with the terms and conditions,
  • transaction data, meaning data on received and sent payments,
  • communication and interaction data, meaning e.g. data from using the web application, data from business communication or data from mutual contact through relevant contact points,
  • purchase data, meaning information about which products you purchased,
  • shopping behavior data, meaning the history of your purchases and preferences,
  • complaint data, meaning the data contained in your complaint,
  • marketing data, meaning the data displayed about you on our fan pages on social networks, cookies, as well as data about your preferences relating to personalized marketing offers.

 

 

  • PURPOSES AND LEGAL BASES FOR PROCESSING PERSONAL DATA

 

We process your personal data to the necessary extent, while most processing activities are justified by the fact that this personal data is required to provide the requested services or is related to providing our services.

 

We process your personal data for the following purposes:

 

  1. user registration “rukahore”

We process personal data for the purpose of registering a natural person who is interested in registering on the website www.rukahore.sk. By registering, Merch s.r.o. enables the customer (data subject) unlimited access to their account content, where it is possible to track orders, their history and complaints, as well as other benefits in accordance with the general terms and conditions. Purchasing goods is not conditional upon customer registration on the portal www.rukahore.sk. Creating a customer account is voluntary. The legal basis for processing is the preparation of concluding and performance of a contract on the basis of which the controller’s services will be provided to the data subject. In the event of cancellation of registration, personal data that are not necessary to retain will be disposed of within 3 years from the date of customer registration.

 

  1. performance of the contract when purchasing goods sold by the controller

We process personal data for the purpose of selling goods and providing services by Merch s.r.o. to a registered or unregistered customer (data subject) after payment of the fee. Documents related to the purchase of goods are kept for a period of 10 years following the year of conclusion of the contract.

 

  1. performance of the contract when intermediating the sale of goods of the controller’s business partner

We process personal data for the purpose of intermediating the sale of goods sold by our partner. In the case of this form of purchase, you conclude an intermediation contract with us. Our company will issue you an invoice for postage and packaging. The invoice for the goods will be issued by the partner. Documents related to this form of purchase of goods are kept for a period of 10 years following the year of conclusion of the contract.

 

  1. handling complaints or grievances

You can submit complaints and grievances on the website of Merch s.r.o. or through customer service in accordance with the General Terms and Conditions. In the case of a complaint, we need your identification and contact details. Complaints will be handled in accordance with the General Terms and Conditions and pursuant to applicable legislation. We process personal data in accordance with legal regulations. Documents related to a complaint or grievance are kept for a period of 10 years following the year of completion of the complaint or handling of the grievance.

 

  1. organizing and evaluating consumer contests

On exceptional occasions, Merch s.r.o. organizes contests in which a natural person may participate and win prizes. Information about an ongoing contest is available on the website of Merch s.r.o. or on social networks (e.g. Facebook). If you participate in a contest and provide us with your personal data, this personal data will be processed exclusively for the purpose of the contest, its evaluation and sending the prize. We process your personal data on the legal basis of your consent. More detailed information is provided in the statutes or rules of individual contests.

 

  1. assertion or defense of our legal claims

In some cases, we are forced to turn to the courts in order to assert our rights and legally protected interests, or we are forced to participate in court proceedings for the purpose of protecting our rights and legally protected interests. Most often, claims arising from non-performance of contractual obligations are pursued. The retention period of personal data for this processing purpose is 10 years from the final decision of a court or other public authority.

 

  1. marketing in the form of sending information about news or other useful information related to the controller’s services

Merch s.r.o. has a legitimate interest in contacting you (as a customer) and sending you business offers and information about its own products or services, via your e-mail address, or providing these business offers and information to you by phone. The legitimate interest is informing customers about news and other important facts related to the services of Merch s.r.o. The data subject can freely set subscription or unsubscription from these e-mail messages in their user account on the controller’s website, or if they do not have an account, they can do so in the newsletter preference settings (separate website). The retention period for this purpose is 3 years from the date of the last login to the user account or from the date of the last purchase of goods.

 

  1. marketing based on the use of cookies

For the purpose of creating personalized (tailor-made) marketing offers, we also use cookies. Personal data are processed on the basis of the data subject’s consent pursuant to Art. 6(1)(a) of the General Data Protection Regulation. The retention period for this purpose is 3 months from the date of the last access to our websites.

 

  1. third-party cookies

Third-party cookies are created by companies whose services Merch s.r.o. uses when operating the websites. Some websites may contain content from other websites (YouTube, Facebook, etc.), which may create their own cookies stored by the browser on the data subject’s computer or similar device. In particular, identification data (IP address) and data about the data subject’s activities and preferences within their visit to our websites are collected. Personal data are processed on the basis of the data subject’s consent pursuant to Art. 6(1)(a) of the General Data Protection Regulation, which the data subject grants to the third party. The retention period for this purpose is determined by the third party.

 

  1. operation of fan pages created on social networks

In order to simplify communication between Merch s.r.o. and its customers or supporters, we have set up fan pages on social networks (e.g. Facebook). Personal data are processed for the purpose of preparing or performing a contract pursuant to Art. 6(1)(b) of the General Data Protection Regulation or on the basis of the data subject’s consent pursuant to Art. 6(1)(a). The retention period for this purpose corresponds to the duration of the contract or the granted consent.

 

  1. keeping accounting records

Merch s.r.o. as a regulated entity is subject to tax and accounting obligations arising from legal regulations. In order to fulfill these obligations towards regulators, we process your personal data. The retention period is 10 years following the year to which payments associated with the given user relate.

 

  1. handling data subject requests

In order to respond to your request, it is necessary that you identify yourself. We keep the data subject’s request for 5 years following the year in which the request was handled.

 

  1. verified by customers

This concerns the provision of the “Verified by customers” service, which for the controller is ensured by Heureka ShoPPing s.r.o., Karolinská 650/1, Karlín, 186 00 Prague 8. The purpose of the service is to obtain an evaluation of the quality of services provided by the controller within the Heureka.sk portal and to provide this evaluation to the controller and other users of the Heureka.sk portal. The legitimate interest is obtaining evaluations from customers of the controller’s web portals for the purpose of improving services. We keep evaluations for 5 years following the year in which the evaluation was provided.

 

Merch s.r.o. also processes personal data on the basis of legitimate interest. In this case, Merch s.r.o. takes steps so that the impact on your privacy is minimized and so that processing does not disturb the balance between the legitimate interests of Merch s.r.o. and your privacy.

 

 

  • AUTOMATED INDIVIDUAL DECISION-MAKING INCLUDING PROFILING 

 

The controller processes the data subject’s personal data also by automated means of processing; however, the result is not decisions that would have legal effects on the data subject or similarly significantly affect them. Personal data will not be used for automated individual decision-making including profiling within the meaning of Art. 22 of the General Data Protection Regulation.

 

 

  • PERSONAL DATA PROTECTION

 

Your personal data are processed by automated as well as non-automated means of processing within information systems that are protected and secured in accordance with relevant security standards and legal regulations dealing with personal data protection.

 

Within the personnel structure of Merch s.r.o., only persons authorized by the controller, who have been duly familiarized with the controller’s instructions and instructed about the possible consequences of non-compliance with these instructions, are authorized to handle personal data.

 

Merch s.r.o. declares that it complies with the principle of data minimization and processes only such personal data as are necessary to achieve the purpose of processing. Personal data are processed for predefined purposes and are not processed for any other purpose.

 

When processing personal data, Merch s.r.o. proceeds in accordance with its internal policy governing personal data protection and information system security. Merch s.r.o. assesses and continuously evaluates whether the given personal data processing would pose a high risk for data subjects and would interfere with their privacy in a disproportionate manner. Based on this observation, a detailed risk and privacy impact assessment is performed, the result of which is taken into account when setting and implementing the controller’s procedures.

 

To secure personal data against unauthorized or accidental disclosure to a third party, we use appropriate and suitable security technical and organizational measures. Technical measures consist in applying technologies that prevent unauthorized access by third parties to personal data. For maximum protection, encryption of personal data and password protection of access to the internal systems of Merch s.r.o., or access to personal data stored on the servers of Merch s.r.o., is used. Organizational measures consist of a set of rules of conduct for our employees, which are incorporated into the controller’s internal regulations. The internal regulations of Merch s.r.o. are considered confidential.

 

 

  • RECIPIENTS OF PERSONAL DATA

 

In exceptional cases, your personal data may be provided to third parties, in particular where such a procedure is permitted by the relevant legal regulation.

 

 

 

 

Suppliers and business partners

Some processing activities are also performed through our suppliers. When selecting suppliers, we primarily consider their professional, technical, organizational and personnel capability so that the security of processed personal data is guaranteed.

 

Our suppliers and business partners include in particular, but not only:

  • providers of server services,
  • providers of programming services,
  • providers of accounting and legal services,
  • providers of services ensuring complaint handling and goods packaging,
  • agencies ensuring management of social networks and advertising campaigns,
  • the company ensuring the “Verified by customers” service.

 

Authorities entrusted with performing supervision

In connection with inspection or supervision, your personal data may be provided to authorities that by law supervise the performance of our activities, e.g. the Office for Personal Data Protection of the Slovak Republic, the Slovak Trade Inspection, and others.

 

Enforcement of claims and exercising rights:

In connection with enforcing our rights and legally protected interests, in justified cases we provide your personal data to competent courts, enforcement officers, notaries, law firms, court experts, or other external entities that deal with the enforcement of claims or exercising rights.

 

Public administration authorities:

On the basis of special legal regulations, we provide personal data to certain entities to which we are obliged to provide such data on the basis of their request for cooperation, e.g. state administration authorities, courts, prosecutor’s offices, law enforcement authorities, or the Financial Administration of the Slovak Republic.

 

Other authorities, institutions and entities:

Social Insurance Agency, health insurance company, audit company, archive, and others.

 

 

  • RETENTION PERIOD OF PERSONAL DATA

 

We retain and protect your personal data for the period set by applicable legal regulations. If we retain your personal data on the basis of your consent, we retain personal data for the period for which you granted us your consent. Retention periods of personal data differ depending on the specific purpose for which personal data are processed. The set retention period is based on the principle of storage minimization.

 

 

  • RIGHTS OF DATA SUBJECTS

 

As a data subject, you have the following rights:

 

Right of access to data pursuant to Art. 15 of the General Data Protection Regulation

You have the right to obtain from us information as to whether we process your personal data. If we process your personal data, you have the right to obtain access to this personal data, to the extent of: purpose of processing, category of personal data, recipients of personal data, duration of processing of personal data, and information about the source from which we obtained your personal data. You also have the right to be provided with a copy of your personal data; however, you must explicitly state this in your request. If you request further copies, we have the right to charge a reasonable fee for issuing additional copies. The rights of third parties, including other persons who provided personal data to Merch s.r.o., cannot be restricted by this, and thus Merch s.r.o. cannot disclose other persons’ personal data to you in this way.

 

Right to rectification or completion pursuant to Art. 16 of the General Data Protection Regulation

You have the right to request the rectification of inaccurate personal data or completion of incomplete personal data that we process about you. By exercising this right in a proper manner, you will help keep your personal data correct and up to date.

 

Right to erasure (right “to be forgotten”) pursuant to Art. 17 of the General Data Protection Regulation

You have the right to request that your personal data be erased without undue delay if one of the following reasons is met:

  1. the personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
  2. the data subject withdraws consentpursuant to Article 6(1)(a) or withdraws explicit consentpursuant to Article 9(2)(a) of the General Data Protection Regulation, and there is no other legal ground for processing,
  3. the data subject objects to processingpursuant to Article 21(1) of the General Data Protection Regulation (objection to legitimate or public interest), and there are no overriding legitimate grounds for processing, or the data subject objects to processingpursuant to Article 21(2) (objection to direct marketing),
  4. the personal data have been processed unlawfully,
  5. the personal data must be erased to comply with a legal obligationunder Union law or the law of a Member State to which Merch s.r.o. is subject,
  6. the personal data were collected in relation to the offer of information society servicespursuant to Article 8(1) of the General Data Protection Regulation (child’s consent).

 

Merch s.r.o. has no obligation to erase your personal data where processing is necessary:

  1. for exercising the right of freedom of expression and information,
  2. for compliance with a legal obligation which requires processing under Union law or the law of a Member State to which Merch s.r.o. is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in Merch s.r.o.,
  3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) as well as Article 9(3) of the General Data Protection Regulation,
  4. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) of the General Data Protection Regulation, insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of such processing, or
  5. for the establishment, exercise or defense of legal claims.

 

Right to restriction of processing pursuant to Art. 18 of the General Data Protection Regulation

You have the right, on the basis of a request to block your personal data (restriction of processing of your personal data to their storage; other processing operations during the blocking are not permitted) in the following cases:

  1. restriction of processing of your personal data while verifying their accuracy,
  2. if your personal data are processed unlawfully and at the same time you request only restriction of their processing (storage only) instead of erasure of your personal data,
  3. you need your personal data for the establishment, exercise or defense of legal claims,
  4. you have objected to processing pursuant to Article 21(1) of the General Data Protection Regulation (legitimate interest or public interest), until it is verified whether the legitimate grounds on the part of Merch s.r.o. override your legitimate interests.

 

If the processing of personal data were to be restricted, Merch s.r.o. may further only store or process personal data:

  1. for the purposes of the establishment, exercise or defense of legal claims,
  2. for the protection of the rights of another natural or legal person,
  3. for reasons of important public interest of the Union or a Member State,
  4. with the consent of the data subject.

 

If a situation arises that would lead to the lifting of the restriction of processing of personal data, Merch s.r.o. will inform the data subject of this fact in advance.

 

Right to data portability pursuant to Art. 20 of the General Data Protection Regulation

You have the right to obtain your personal data that you have provided to us in a structured, commonly used and machine-readable format. You have the right to request that we transfer your personal data from Merch s.r.o. to another controller specified in your request, provided that it is technically feasible.

 

The right to personal data portability applies in cases where:

  1. processing is based on the legal ground of consent or contract,
  2. processing is carried out by automated means.

 

Right to object pursuant to Art. 21 of the General Data Protection Regulation

You have the right to object at any time to the processing of your personal data if the legal basis for processing personal data is legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation, by sending a written request to the e-mail address [email protected], by post, or by personal delivery of a written request at the registered office of Merch s.r.o.

 

After receiving the objection, we will dispose of your personal data, except for the following cases:

  1. if Merch s.r.o. demonstrates compelling legitimate grounds for processing which override your interests, rights and freedoms, or
  2. if it is demonstrated that Merch s.r.o. needs your personal data for the establishment, exercise or defense of legal claims;

 

Your objections do not affect the processing of your personal data prior to the delivery of your objections.

 

Automated individual decision-making including profiling pursuant to Art. 22 of the General Data Protection Regulation

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

 

This right does not apply if the decision is:

  1. necessary for entering into or performance of a contract between the data subject and Merch s.r.o.,
  2. authorized by Union law or the law of a Member State to which Merch s.r.o. is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests,
  3. based on the data subject’s explicit consent.

 

When providing our services, automated individual decision-making within the meaning of the General Data Protection Regulation does not take place.

 

Right to withdraw consent pursuant to Art. 7 of the General Data Protection Regulation

If the processing of your personal data is based on your consent as the legal ground, you have the right to withdraw your consent at any time. Consent may be withdrawn under the same conditions under which it was granted. The data subject may also withdraw consent in the following ways:

  1. by e-mail message sent to [email protected]
  2. by sending a written request to the registered office address of Merch s.r.o. stating “GDPR – withdrawal of consent” on the envelope.

Withdrawal of consent does not affect the lawfulness of processing of personal data based on consent given before its withdrawal (for example contests).

 

Right to lodge a complaint with a supervisory authority pursuant to Art. 77 of the General Data Protection Regulation

If you believe that your rights relating to personal data have been violated or that the processing of your data has been violated, you have the right to contact the supervisory authority, which is:

 

Office for Personal Data Protection of the Slovak Republic

Hraničná 4826/12

820 07 Bratislava 27

 

tel. no.:          +421 2 3231 3214

e-mail:[email protected]

 

Exercising your rights pursuant to Art. 12 of the General Data Protection Regulation

Merch s.r.o. will provide information regarding the processing of personal data only on the basis of a data subject’s request when exercising their rights, provided that it is demonstrably able to identify the data subject.Without successful verification of your identity, Merch s.r.o. is not obliged to provide any information regarding the processing of personal data. Merch s.r.o. thereby prevents unauthorized access to your personal data and violation of your rights by an unauthorized person.

 

You may exercise your rights relating to personal data in the following ways:

  1. in person at the registered office of Merch s.r.o.,
  2. by post,
  3. by email sent to [email protected].

 

You may also submit the completed and signed request in person directly at our registry office at the registered office address of Merch s.r.o. The request must contain all necessary information and attachments required for its handling and for assessing your claims regarding the processing of personal data. If your request is incomplete, we will contact you in order to supplement it.

 

 

  • FINAL PROVISIONS

 

Merch s.r.o. reserves the right to any update of this information obligation, in particular in connection with changes in legislative processes. The current version will always be available on the website www.rukahore.sk and other websites operated by the controller. If there is a material change in personal data protection, in particular in the method of processing personal data, Merch s.r.o. will fulfill its information obligation by visibly publishing a notice before implementing the changes.

 

With these Principles, we want to assure you that we approach personal data with the utmost care and respect, guided by applicable legal regulations and using the available level of technical protection. If you have questions regarding personal data protection that you did not find answered in this document, write to the e-mail address [email protected]

 

In Senec on 10.7.2019