White s.r.o. declares that all personal data of customers is processed in accordance with applicable legislation of the Czech Republic, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter referred to as “GDPR”) and Act No. 110/2019 Coll., on Personal Data Processing, as amended.
1. Data we process
1.1 If you shop on our website or contact us through it, we particularly need to know the following information in order to successfully complete the contract or to reply to you:
- Your name and surname, or a company name,
- place of business,
- company registration number and tax registration number,
- telephone number,
- e-mail address,
- records of behaviour on websites managed by the Controller obtained from cookies if the cookies are enabled in the web browser,
- bank details.
1.2 Failure to provide us with personal data for the purpose of performing the contract or for the purpose of answering your questions or giving the information you requested may result in the non-conclusion of the contract or failure to answer your questions, as the requested personal data is our contractual requirement in this case.
1.3 If you create a password-protected customer account on our website, we also process personal data obtained through this customer account, including the history of your purchases with us, in order to manage the customer account, create a list of favourite products and send offers of our goods.
1.4 If you purchase products on our website, we may use your name, surname, e-mail address and telephone number to send you commercial messages regarding products and services that may be of interest to you with respect to previous purchases. You can unsubscribe from commercial messages at any time by clicking the link in e-mails or by contacting us at firstname.lastname@example.org.
1.5 If you give us your consent on our website, we will also process the personal data you provide, including your purchase history, for the following purposes:
- performing marketing analyses and statistics, including profiling;
- sending commercial messages regarding the goods and services of the Controller and the goods and services of its partners to your e-mail, taking into account your purchases, preferences, or otherwise tailored to select the goods and services that best suit your needs.
Based on the provided data, we can then offer you other special services that are intended only for selected customers. Granting this consent is voluntary and no legal regulation requires you to provide it. You can revoke your consent at any time without affecting the legality of the processing of personal data before its revocation.
1.6 After logging in to the e-shop www.erebosdrink.cz, you can edit or delete your personal data. (It is not possible to edit billing data for accounting reasons.) In case you want to cancel your registration completely, just send an e-mail to email@example.com.
2. Who will have access to your personal data
2.1 We process your personal data as the Controller. Your personal data may be passed on to our business partners for the above purposes, so that they may process them for us. Personal data may be transmitted to:
- transport partners who ensure the delivery of the goods ordered by you,
- partners who operate payment systems for the purpose of arranging the payment, in particular in connection with card payments,
- external accounting companies,
- external law firm,
- processors who provide us with web, cloud, server and IT services.
3. Period for which we process your personal data
3.1 We will process your personal data for the period during which we will provide you with our services or fulfil a mutual contract, or for the time necessary to fulfil archiving obligations under applicable legislation, such as the Accounting Act, the Archiving and Record Management Act or the Value Added Tax Act.
3.2 We also process your personal data after the fulfilment of the contract (payment of the price and delivery of the goods) due to our legitimate interests, which is the protection of our claims, for the necessary period, but no longer than 12 years; in the case of litigation, this period shall not end earlier than 1 year after the end of the legal or the subsequent distress proceedings.
3.3 We will process personal data that is processed on the basis of your consent until your consent is revoked. You can revoke your consent by sending an e-mail with a request to firstname.lastname@example.org.
3.4 You can refuse the processing of your personal data for the purpose of receiving commercial messages at any time by sending a request to the e-mail email@example.com or via the link in the sent e-mail; this refusal will not affect our other relations.
4. Your rights arising from the processing of personal data
4.1 In connection with the processing of your personal data carried out by us, you have the following rights:
- the right of access to personal data, where the access to personal data means the right of the Data Subject to obtain information from the Controller (confirmation) whether or not their personal data is processed and if processed, the Data Subject has the right to obtain such personal data as well as the following information:
- processing purposes,
- categories of the personal data concerned,
- recipients or categories of recipients to whom the personal data has been or will be provided,
- planned period for which the personal data will be stored,
- existence of the right to request the Controller to rectify or erase personal data, the right to object,
- the right to lodge a complaint with the supervisory authority,
- all available information on the source of the personal data, if not obtained from the Data Subject,
- the fact that there is automated decision-making, including profiling.
If the Controller does not process any data on a natural person, then the inquirer is informed that their personal data is not subject to the processing of personal data by the Controller. As part of the right of access, you can ask us for a copy of the processed personal data, with the first copy being provided free of charge and any other copy for a fee.
- the right to rectification, which means that if you find that your personal data we process is incomplete or inaccurate, you have the right to have it rectified or completed without undue delay.
- the right to erasure (“right to be forgotten”) means that we will erase your personal data,
- if it is no longer needed for the purposes for which it was collected or otherwise processed,
- it its processing is illegal,
- if you object to the processing and there are no overriding legitimate reasons for the processing, or
- if we are required to do so by law.
- the right to restriction of data processing, which means that until we resolve any issues regarding the processing of your personal data, we must limit the processing of your personal data so that we can only have it stored and, if necessary, it may be used to determine, enforce or defend legal claims.
- the right to object to the processing means that you may object to the processing of your personal data we process for direct marketing purposes or for legitimate interest. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for that purpose.
- the right to portability, where you have the right to receive all your personal data that you have provided to us and that we process with your consent and on the basis of the contract in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller, if technically feasible.
- the right to lodge a complaint about personal data processing with the supervisory authority, which is the Office for Personal Data Protection (www.uoou.cz).
If necessary, direct your questions or requirements to firstname.lastname@example.org.