Cart
0
0.00 €
GDPR
e-shop: https://www.artforchristian.com/
pursuant to Article 13, REGULATION
(EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on
the protection of individuals with regard to the processing of personal data
and on the free movement of such data and Act no. 18/2018 Coll. on the
protection of personal data and on the amendment of certain laws.
Operator FORK, s.r.o., Pribinova 274/4. 036 01 Martin, Slovakia, IČO: 44311061 (hereinafter referred to as the "Operator")
B. Purpose of the processing of personal data by joint controllers:
Data processing for IS E-Shop purposes; legitimate interest in the processing of the transaction; Accounting documents; Client database; Complaint procedure; Processing of applications of the persons concerned
C. List of personal data:
name, surname, maiden name and title, home telephone number, mobile phone number e-mail address, permanent residence, temporary residence, billing address, shipping address
Operator FORK, s.r.o., Pribinova 274/4. 036 01 Martin, Slovakia, IČO: 44311061 (hereinafter referred to as the "Operator")
B. Purpose of the processing of personal data by joint controllers:
Data processing for IS E-Shop purposes; legitimate interest in the processing of the transaction; Accounting documents; Client database; Complaint procedure; Processing of applications of the persons concerned
C. List of personal data:
name, surname, maiden name and title, home telephone number, mobile phone number e-mail address, permanent residence, temporary residence, billing address, shipping address
D. Additional information:
1. Personal data in the range of name, surname, maiden name and title, telephone number, e-mail address, permanent residence, temporary residence, will be processed for the purpose of Order Processing, E-Shop, Accounting Documents, Client Database, Processing of Requests of Affected Persons, based on the legitimate interest of the operator.
2. Personal data will be provided to third parties in accordance with the law and to intermediaries, transport companies, accounting companies, IT software companies (hereinafter referred to as "Intermediaries") on the basis of contracts.
3. Operators declare that when selecting intermediaries they paid attention to their professional, technical, organizational and personnel competence and their ability to guarantee the security of processed personal data by measures pursuant to Act no. 18/2018 Coll. on the protection of personal data and Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
4. The operator declares that he has taken all measures in accordance with Act no. 18/2018 Coll. on the protection of personal data and Regulation (EU) 2016/679 (GDPR) of the European Parliament and of the Council and hereby undertakes to protect such data against accidental as well as illegal damage and destruction, accidental loss, alteration, unauthorized access and disclosure as well as any other inadmissible forms of processing in accordance with the measures taken in the security project.
5. The intermediary undertakes to process personal data only to the extent and under the conditions agreed in the authorization of the intermediary by the processing of personal data. 6. Operators declare that they will not provide personal data to Intermediaries other than those listed in this notice. 7. Operators declare that they will collect personal data to the extent necessary for the fulfillment of the specified purpose and process them only in accordance with the purpose for which they were collected. 8. Data controllers shall be bound by the obligation of professional secrecy with regard to the personal data they process. The duty of confidentiality continues even after the processing of personal data has ended.
4. The right to obtain the copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
Right of correction
The data subject has the right to have the controller correct incorrect personal data concerning him without undue delay. With regard to the purposes of processing, the data subject has the right to supplement incomplete personal data, including by providing a supplementary declaration.
Right of erasure ("forgetting")
1. The data subject shall also have the right to obtain from the controller without undue delay the deletion of personal data concerning him or her, and the controller shall be obliged to delete personal data without undue delay if any of the following reasons is met:
(a) personal data are no longer required for the purposes for which they were obtained or otherwise processed;
(b) the data subject withdraws the consent on the basis of which the processing is carried out, in accordance with Article 6 (2). 1 letter (a) Regulation or Article 9 (1) 2 letter (a) Regulations and, unless there is another legal basis for processing;
(c) the data subject objects to the processing pursuant to Article 21 (2). 1 and no legitimate grounds for processing prevail or the data subject objects to the processing under Article 21 (1). 2 Regulations;
(d) personal data have been processed illegally;
(e) personal data must be deleted in order to comply with a legal obligation under Union law or the law of the Member State to which the controller is subject;
(f) personal data have been collected in connection with the offer of information society services pursuant to Article 8 (1). 1 Regulations.
2. Where a controller has disclosed personal data and is required to delete personal data pursuant to paragraph 1, it shall take appropriate measures, including technical measures, in the light of available technology and the cost of implementing the measures, to inform controllers that personal data are requested by the data subject; to delete all references, copies or replicas of such personal data.
3. Paragraphs 1 and 2 shall not apply where processing is necessary:
(a) the exercise of the right to freedom of expression and information;
(b) to fulfill a legal obligation which requires processing under Union law or the law of the Member State to which the controller is subject, or to fulfill a task carried out in the public interest or in the exercise of official authority conferred on the controller;
(c) for reasons of public interest in the field of public health in accordance with Article 9 (2). 2 letter (h) and (i) of the Regulation, as well as Article 9 (1) 3 Regulations;
(d) for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (2). 1 of the Regulation, in so far as the law referred to in paragraph 1 is likely to make it impossible or seriously difficult to achieve the objectives of such processing, or to establish, assert or defend legal claims.
Right to restrict processing
9. A responsible person is appointed in the company. Contact details: veselicky@fork.sk
E. Retention period of personal data:
1. Accounting documents: 10 years
2. Client database: 10 years
F. Information on the rights of the data subject:
Right of access
1. The data subject shall have the right to obtain confirmation from the controller as to whether personal data concerning him are being processed and, if so, shall have the right to obtain access to that personal data and the following information:
(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data have been or will be provided, in particular recipients in third countries or international organizations;
(d) if possible, the estimated retention period for personal data or, if that is not possible, the criteria for determining it;
(e) the existence of the right to require the controller to correct or delete or restrict the processing of personal data concerning the data subject, or the right to object to such processing;
(f) the right to lodge a complaint to the supervisory authority;
(g) if personal data have not been obtained from the data subject, any available information as to its source;
(h) the existence of automated decision-making, including the profiling referred to in Article 22 (2); 1 and 4 of the Regulation and in these cases at least meaningful information on the procedure used, as well as the meaning and expected consequences of such processing for the person concerned.
2. Where personal data are transferred to a third country or an international organization, the data subject shall have the right to be informed of the adequate safeguards provided for in Article 46 of the Regulation concerning the transfer.
3. The controller shall provide a copy of the personal data being processed. For any further copies requested by the person concerned, the operator may charge a reasonable fee corresponding to the administrative costs. If the person concerned has submitted the request by electronic means, the information shall be provided in a commonly used electronic form, unless the person concerned has requested another method.
The data subject shall have the right to have the controller restrict processing in one of the following cases:
(a) the data subject contests the accuracy of the personal data during a period allowing the controller to verify the accuracy of the personal data;
(b) the processing is unlawful and the data subject objects to the deletion of the personal data and calls instead for restrictions on their use;
(c) the controller no longer needs personal data for processing purposes, but the data subject needs them to prove, assert or defend legal claims;
(d) the data subject has objected to the processing under Article 21 (1). 1 of the Regulation, until it is verified that the legitimate reasons on the part of the operator outweigh the legitimate reasons of the person concerned.
2. Where processing has been restricted pursuant to paragraph 1, such personal data, with the exception of retention, shall be processed only with the consent of the data subject or for proving, asserting or defending legal claims, or for the protection of other natural or legal persons. or a Member State.
3. The controller shall inform the data subject who has reached the processing restriction pursuant to paragraph 1 before the processing restriction is lifted.
Right of portability
1. The data subject shall have the right to obtain personal data concerning him or her which he or she has provided to the controller, in a structured, commonly used and machine-readable format, and shall have the right to transfer such data to another controller without his or her controller to whom the personal data have been provided. defended if:
(a) processing shall be based on consent in accordance with Article 6 (2); 1 letter (a) Regulation or Article 9 (1) 2 letter a) of the Regulation, or on a contract pursuant to Article 6 para. 1 letter (b) Regulations, and
(b) if the processing is carried out by automated means.
2. In exercising his right to data transfer pursuant to paragraph 1, the data subject shall have the right to transfer personal data directly from one controller to another, as far as is technically possible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17 of the Regulation. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority conferred on the controller.
4. The right referred to in paragraph 1 may not adversely affect the rights and freedoms of others.
The right to object
1. The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out pursuant to Article 6 (1). 1 letter (e) or (f) Regulations, including objections to profiling based on those provisions. The controller may not further process personal data unless it demonstrates the necessary legitimate reasons for the processing which outweigh the interests, rights and freedoms of the data subject, or the reasons for proving, asserting or defending legal claims.
2. Where personal data are processed for the purposes of direct marketing, the data subject shall have the right at any time to object to the processing of personal data concerning him or her for the purposes of such marketing, including profiling to the extent that they relate to such direct marketing.
3. If the data subject objects to processing for direct marketing purposes, personal data may no longer be processed for such purposes.
4. The person concerned shall be expressly informed of the right referred to in paragraph 1. 1 and 2 at the latest in the first communication with her, this right being presented clearly and separately from any other information.
5. With regard to the use of information society services, and notwithstanding Directive 2002/58 / EC, the person concerned may exercise his right of objection by automated means using technical specifications.
6. If personal data are processed for the purposes of scientific or historical research or for statistical purposes pursuant to Art. 89 par. 1 of the Regulation, the data subject has the right to object, on grounds relating to his specific situation, to the processing of personal data concerning him, except where the processing is necessary for the performance of a task for reasons of public interest.
Notice to third parties
The controller shall notify each recipient to whom personal data have been provided of any rectification or erasure of personal data or restrictions on processing carried out pursuant to Article 16, Article 17 (2). 1 and Article 18 of the Regulation, unless this proves impossible or requires a disproportionate effort. The operator shall inform the data subject of these recipients if the data subject so requests.
Initiation of proceedings at the request of the person concerned
Pursuant to §100 of Act 18/2018 Coll., The affected person has to file a motion to initiate proceedings if it is directly affected by its rights stipulated by this Act. The Office shall assess the complaint within 30 days from the date of delivery of the complaint. The Office shall inform the applicant about the method of handling the complaint within 30 days from the date of delivery of the complaint.
1. Personal data in the range of name, surname, maiden name and title, telephone number, e-mail address, permanent residence, temporary residence, will be processed for the purpose of Order Processing, E-Shop, Accounting Documents, Client Database, Processing of Requests of Affected Persons, based on the legitimate interest of the operator.
2. Personal data will be provided to third parties in accordance with the law and to intermediaries, transport companies, accounting companies, IT software companies (hereinafter referred to as "Intermediaries") on the basis of contracts.
3. Operators declare that when selecting intermediaries they paid attention to their professional, technical, organizational and personnel competence and their ability to guarantee the security of processed personal data by measures pursuant to Act no. 18/2018 Coll. on the protection of personal data and Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
4. The operator declares that he has taken all measures in accordance with Act no. 18/2018 Coll. on the protection of personal data and Regulation (EU) 2016/679 (GDPR) of the European Parliament and of the Council and hereby undertakes to protect such data against accidental as well as illegal damage and destruction, accidental loss, alteration, unauthorized access and disclosure as well as any other inadmissible forms of processing in accordance with the measures taken in the security project.
5. The intermediary undertakes to process personal data only to the extent and under the conditions agreed in the authorization of the intermediary by the processing of personal data. 6. Operators declare that they will not provide personal data to Intermediaries other than those listed in this notice. 7. Operators declare that they will collect personal data to the extent necessary for the fulfillment of the specified purpose and process them only in accordance with the purpose for which they were collected. 8. Data controllers shall be bound by the obligation of professional secrecy with regard to the personal data they process. The duty of confidentiality continues even after the processing of personal data has ended.
4. The right to obtain the copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
Right of correction
The data subject has the right to have the controller correct incorrect personal data concerning him without undue delay. With regard to the purposes of processing, the data subject has the right to supplement incomplete personal data, including by providing a supplementary declaration.
Right of erasure ("forgetting")
1. The data subject shall also have the right to obtain from the controller without undue delay the deletion of personal data concerning him or her, and the controller shall be obliged to delete personal data without undue delay if any of the following reasons is met:
(a) personal data are no longer required for the purposes for which they were obtained or otherwise processed;
(b) the data subject withdraws the consent on the basis of which the processing is carried out, in accordance with Article 6 (2). 1 letter (a) Regulation or Article 9 (1) 2 letter (a) Regulations and, unless there is another legal basis for processing;
(c) the data subject objects to the processing pursuant to Article 21 (2). 1 and no legitimate grounds for processing prevail or the data subject objects to the processing under Article 21 (1). 2 Regulations;
(d) personal data have been processed illegally;
(e) personal data must be deleted in order to comply with a legal obligation under Union law or the law of the Member State to which the controller is subject;
(f) personal data have been collected in connection with the offer of information society services pursuant to Article 8 (1). 1 Regulations.
2. Where a controller has disclosed personal data and is required to delete personal data pursuant to paragraph 1, it shall take appropriate measures, including technical measures, in the light of available technology and the cost of implementing the measures, to inform controllers that personal data are requested by the data subject; to delete all references, copies or replicas of such personal data.
3. Paragraphs 1 and 2 shall not apply where processing is necessary:
(a) the exercise of the right to freedom of expression and information;
(b) to fulfill a legal obligation which requires processing under Union law or the law of the Member State to which the controller is subject, or to fulfill a task carried out in the public interest or in the exercise of official authority conferred on the controller;
(c) for reasons of public interest in the field of public health in accordance with Article 9 (2). 2 letter (h) and (i) of the Regulation, as well as Article 9 (1) 3 Regulations;
(d) for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (2). 1 of the Regulation, in so far as the law referred to in paragraph 1 is likely to make it impossible or seriously difficult to achieve the objectives of such processing, or to establish, assert or defend legal claims.
Right to restrict processing
9. A responsible person is appointed in the company. Contact details: veselicky@fork.sk
E. Retention period of personal data:
1. Accounting documents: 10 years
2. Client database: 10 years
F. Information on the rights of the data subject:
Right of access
1. The data subject shall have the right to obtain confirmation from the controller as to whether personal data concerning him are being processed and, if so, shall have the right to obtain access to that personal data and the following information:
(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data have been or will be provided, in particular recipients in third countries or international organizations;
(d) if possible, the estimated retention period for personal data or, if that is not possible, the criteria for determining it;
(e) the existence of the right to require the controller to correct or delete or restrict the processing of personal data concerning the data subject, or the right to object to such processing;
(f) the right to lodge a complaint to the supervisory authority;
(g) if personal data have not been obtained from the data subject, any available information as to its source;
(h) the existence of automated decision-making, including the profiling referred to in Article 22 (2); 1 and 4 of the Regulation and in these cases at least meaningful information on the procedure used, as well as the meaning and expected consequences of such processing for the person concerned.
2. Where personal data are transferred to a third country or an international organization, the data subject shall have the right to be informed of the adequate safeguards provided for in Article 46 of the Regulation concerning the transfer.
3. The controller shall provide a copy of the personal data being processed. For any further copies requested by the person concerned, the operator may charge a reasonable fee corresponding to the administrative costs. If the person concerned has submitted the request by electronic means, the information shall be provided in a commonly used electronic form, unless the person concerned has requested another method.
The data subject shall have the right to have the controller restrict processing in one of the following cases:
(a) the data subject contests the accuracy of the personal data during a period allowing the controller to verify the accuracy of the personal data;
(b) the processing is unlawful and the data subject objects to the deletion of the personal data and calls instead for restrictions on their use;
(c) the controller no longer needs personal data for processing purposes, but the data subject needs them to prove, assert or defend legal claims;
(d) the data subject has objected to the processing under Article 21 (1). 1 of the Regulation, until it is verified that the legitimate reasons on the part of the operator outweigh the legitimate reasons of the person concerned.
2. Where processing has been restricted pursuant to paragraph 1, such personal data, with the exception of retention, shall be processed only with the consent of the data subject or for proving, asserting or defending legal claims, or for the protection of other natural or legal persons. or a Member State.
3. The controller shall inform the data subject who has reached the processing restriction pursuant to paragraph 1 before the processing restriction is lifted.
Right of portability
1. The data subject shall have the right to obtain personal data concerning him or her which he or she has provided to the controller, in a structured, commonly used and machine-readable format, and shall have the right to transfer such data to another controller without his or her controller to whom the personal data have been provided. defended if:
(a) processing shall be based on consent in accordance with Article 6 (2); 1 letter (a) Regulation or Article 9 (1) 2 letter a) of the Regulation, or on a contract pursuant to Article 6 para. 1 letter (b) Regulations, and
(b) if the processing is carried out by automated means.
2. In exercising his right to data transfer pursuant to paragraph 1, the data subject shall have the right to transfer personal data directly from one controller to another, as far as is technically possible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17 of the Regulation. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority conferred on the controller.
4. The right referred to in paragraph 1 may not adversely affect the rights and freedoms of others.
The right to object
1. The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out pursuant to Article 6 (1). 1 letter (e) or (f) Regulations, including objections to profiling based on those provisions. The controller may not further process personal data unless it demonstrates the necessary legitimate reasons for the processing which outweigh the interests, rights and freedoms of the data subject, or the reasons for proving, asserting or defending legal claims.
2. Where personal data are processed for the purposes of direct marketing, the data subject shall have the right at any time to object to the processing of personal data concerning him or her for the purposes of such marketing, including profiling to the extent that they relate to such direct marketing.
3. If the data subject objects to processing for direct marketing purposes, personal data may no longer be processed for such purposes.
4. The person concerned shall be expressly informed of the right referred to in paragraph 1. 1 and 2 at the latest in the first communication with her, this right being presented clearly and separately from any other information.
5. With regard to the use of information society services, and notwithstanding Directive 2002/58 / EC, the person concerned may exercise his right of objection by automated means using technical specifications.
6. If personal data are processed for the purposes of scientific or historical research or for statistical purposes pursuant to Art. 89 par. 1 of the Regulation, the data subject has the right to object, on grounds relating to his specific situation, to the processing of personal data concerning him, except where the processing is necessary for the performance of a task for reasons of public interest.
Notice to third parties
The controller shall notify each recipient to whom personal data have been provided of any rectification or erasure of personal data or restrictions on processing carried out pursuant to Article 16, Article 17 (2). 1 and Article 18 of the Regulation, unless this proves impossible or requires a disproportionate effort. The operator shall inform the data subject of these recipients if the data subject so requests.
Initiation of proceedings at the request of the person concerned
Pursuant to §100 of Act 18/2018 Coll., The affected person has to file a motion to initiate proceedings if it is directly affected by its rights stipulated by this Act. The Office shall assess the complaint within 30 days from the date of delivery of the complaint. The Office shall inform the applicant about the method of handling the complaint within 30 days from the date of delivery of the complaint.