Processing of Personal Data and Information for the Data Subject
Personal Data Protection Policy
I. Basic Provisions
The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “GDPR”) is Antiques Cinolter s.r.o. (hereinafter referred to as the “controller”).
The controller’s contact details are:
Address: Maiselova 9, 110 00 – Prague 1
Email: kontakt@antiqueprague.cz
Phone: +420 222 319 816
Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
The controller has not appointed a Data Protection Officer.
II. Sources and Categories of Processed Personal Data
The controller processes personal data that you have provided or personal data obtained in the course of fulfilling your order.
The controller processes your identification and contact data and data necessary for fulfilling the contract.
III. Legal Basis and Purpose of Personal Data Processing
The legal basis for processing personal data is:
the performance of a contract between you and the controller pursuant to Article 6(1)(b) of the GDPR,
the legitimate interest of the controller in direct marketing (in particular, for sending commercial messages and newsletters) pursuant to Article 6(1)(f) of the GDPR,
your consent to processing for the purposes of direct marketing (in particular, for sending commercial messages and newsletters) pursuant to Article 6(1)(a) of the GDPR in conjunction with § 7(2) of Act No. 480/2004 Coll., on Certain Information Society Services, in cases where no goods or services have been ordered.
The purpose of processing personal data is:
to process your order and exercise rights and obligations arising from the contractual relationship between you and the controller; when placing an order, personal data necessary for successful completion of the order (name, address, contact details) are required; the provision of personal data is a necessary requirement for concluding and fulfilling the contract, and without providing such data it is not possible to conclude or perform the contract,
to send commercial communications and carry out other marketing activities.
The controller engages in automated individual decision-making within the meaning of Article 22 of the GDPR. You have given your explicit consent to such processing.
IV. Period of Data Retention
The controller retains personal data:
for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and the controller and to assert claims from such contractual relationships (for 10 years from the termination of the contractual relationship),
until consent to the processing of personal data for marketing purposes is withdrawn, for a maximum of 3 years if the data is processed based on consent.
After the retention period expires, the controller will erase the personal data.
V. Recipients of Personal Data (Controller’s Subcontractors)
The recipients of personal data are individuals:
involved in the delivery of goods/services/making payments under the contract,
providing e-shop operation services and other services related to the operation of the e-shop,
providing marketing services,
for the purpose of accounting tax documents in accordance with the contract and legal regulations to the following extent:
– name and surname, title,
– postal address,
– billing address,
– email address,
– phone contact,
– bank account details,
– details regarding the subject of performance by the Controller.
The controller does not intend to transfer personal data to a third country (outside the EU) or to an international organisation.
VI. Your Rights
Under the conditions set out in the GDPR, you have:
the right to access your personal data pursuant to Article 15 of the GDPR,
the right to rectification of personal data pursuant to Article 16 of the GDPR or restriction of processing pursuant to Article 18 of the GDPR,
the right to erasure of personal data pursuant to Article 17 of the GDPR,
the right to object to processing pursuant to Article 21 of the GDPR,
the right to data portability pursuant to Article 20 of the GDPR,
the right to withdraw consent to processing in writing or electronically to the address or email of the controller specified in Article III of these terms.
You also have the right to lodge a complaint with the Office for Personal Data Protection if you believe that your right to data protection has been infringed.
VII. Conditions for Securing Personal Data
The controller declares that all appropriate technical and organisational measures to secure personal data have been taken.
The controller has adopted technical measures to secure data storage (login name, password, antivirus software, and firewall) and storage of personal data in physical form (a locked room).
The controller declares that only authorised persons have access to personal data.
VIII. Final Provisions
By submitting an order via the online order form, you confirm that you are familiar with the personal data protection terms and that you accept them in full.
You agree to these terms by ticking the consent box via the online form. By ticking the box, you confirm that you are familiar with the personal data protection terms and that you accept them in full.
The controller reserves the right to amend these terms. The new version of the personal data protection policy will be published on the website and sent to your email address provided to the controller.
These terms take effect on 25 May 2018.
