Privacy policy

I. Introductory provisions 1. For the purposes of this Policy, the following shall be understood: a. Enizon, s.r.o., with registered office at Rosina 140, 013 22 Rosina, ID No.: 45 566 500, registered in the Commercial Register of the District Court of Žilina, Section Sro, File No.: 52998/L (hereinafter referred to as the "Operator"), b. Personal data name and surname, e-mail address, telephone number, billing address, delivery address, IP address, cookies. 2. The Operator of the online shop www.enizon.com, as the controller of the Personal Data, hereby informs about the manner and scope of processing of the Personal Data, including the scope of the Subscriber's rights (as defined below) related to the processing of his Personal Data. 3. In processing Personal Data, the Controller shall comply with the following legal regulations in particular: a. Act No. 18/2018 Coll. on the Protection of Personal Data, as amended, b. Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as the "Regulation"). 4. The Subscriber is a natural person who purchases goods from the Operator or uses its website. 5. The Operator is a legal entity that operates this online shop for the purpose of selling goods and services to the Subscriber. In connection with the above, the processing of Personal Data occurs: a. To the extent that they have been provided in connection with an order for the Operator's products and/or services, or in the context of the negotiation of a contract with the Operator, as well as in connection with the concluded contract, b. for the purpose(s) set out below in Article II.on the legal bases set out therein. II. Purposes and periods of processing of Personal Data 6. The Controller processes Personal Data for the following purposes: a. The performance of a contract or other obligation and the provision of services: i. Personal Data will be processed during the period of negotiations for the conclusion of a contract between the Operator and the Subscriber, both for the purpose of concluding the contract and for the duration of the contractual relationship; ii. sending satisfaction questionnaires: sending satisfaction questionnaires for the purpose of improving the quality of the services provided to customers following the creation of an order, booking or direct sale. In this case, the period of processing of personal data is 3 years; iii. marketing actions: for the purpose of fulfilling the marketing action, evaluation, termination, delivery of any winnings, etc. Processing period: for the duration of the marketing event. b. compliance with a legal obligation (in particular accounting, tax and archiving obligations, provision of assistance to administrative authorities, police, courts, etc.): i. the tax document will be kept for 10 years from the end of the contract: In order to comply with the legal obligation to archive accounting documents pursuant to Act No. 563/1991 Coll., on Accounting, as amended, the Personal Data will be further processed and kept for a period of 10 years from the year following the year in which the contract between the Operator and the Participant was concluded; ii. the performance of obligations in connection with the exercise of rights arising from defective performance, the provision of assistance to administrative authorities, the police, the court: The Operator is entitled to process the basic personal, identification and contact data of the Subscriber, data on the goods and data from customer communications for a period of 4 years from the date of expiry of the warranty period for the goods. c. The legitimate interests of the Controller, protection of the rights and legally protected interests of the Controller: i. Effective protection of the Controller's rights in the event of a dispute. The processing period is set here for 4 years from the expiry of the warranty period for the goods and is extended by the period for which the dispute is conducted; ii. the legitimate interest of the Controller is further to send commercial communications (blanket offers and individual offers) in accordance with Section 7(3) of Act No. 480/2004 Coll. on certain information society services and in accordance with point 47 of the Regulation, if the Controller has obtained electronic contact details in connection with the sale of goods and services to the Subscriber. d. marketing and commercial offers of the Operator's services: i. Broad mailing of commercial offers of products and services: sending general advertising communications without targeting a specific group of recipients. In this case, the period of processing of personal data is 3 years; ii. individual offer: sending of advertising communications after evaluation of certain personal aspects relating to the natural person. The controller does not carry out profiling in accordance with Article 22 of the Regulation, as this is not automated processing, but the manual creation of individual offers. The period of processing of personal data in this case is 3 years; iii. cookies: short text files generated by a web server and stored on the computer via the browser. Two types are distinguished. Firstly, they are cookies necessary to ensure the functioning and analysis of the website (to carry out the transmission of electronic communications via an electronic communication network, the use of these cookies cannot be opposed) (hereinafter referred to as "technical cookies"). They are also cookies that evaluate certain personal aspects relating to a specific natural person (hereinafter referred to as "advertising and marketing cookies"). The use of the second type of cookies requires the Participant's consent. The processing period in this case is 3 years. Further information and conditions are set out in Article V of this Policy. 7. For the purpose of re-marketing, cookies are only passed on to other operators if consent for this purpose has been granted by them, with an expiry period of a maximum of 540 days. If consent for advertising cookies is withdrawn, it is technically not possible to immediately delete the cookies once they have been transferred to the processor. The deletion of cookies by the processor will occur automatically after the expiry period. The immediate solution to prevent re-marketing activities by the processor is to delete the cookies from the browser. 8. Legal basis for processing personal data: a. Performance of a contract - in the case of ordering goods and setting up a user account or in the case of participation in a consumer competition. b. Consent - especially in connection with sending commercial communications about news and current offers, or other forms of marketing, in the case of sending communications about jobs or the inclusion of candidates in the candidate database. Any consent given is voluntary and can be withdrawn at any time, but this does not affect the lawfulness of the processing prior to its withdrawal. c. Compliance with legal obligations - when storing data in accounting records or when disclosing data to state and other authorities supervising the activities of the controller or dealing with disputes or enforcing decisions. d. Legitimate interest - in improving and personalising our services, certain marketing activities, or in relation to security and rights protection. In these cases, the controller will always assess whether the processing will constitute a disproportionate interference with the rights of the subscriber. III. Data protection and processing information 9. If the Participant does not provide his Personal Data, it is not possible to conclude a contract with the Controller and/or to provide him with the services resulting therefrom. In this context, the Personal Data is necessary for the provision of a specific service or product of the Operator. 10. After the expiry of the time limits set out in Article II. The Controller shall delete or anonymise the Personal Data. 11. the Subscriber is obliged to provide only true and accurate Personal Data to the Operator. The Participant is responsible for the correctness, accuracy and truthfulness of the Personal Data provided. The Operator shall not be liable for the accuracy of the data provided. 12. The Operator shall use its best endeavours to prevent unauthorised processing of Personal Data. 13. The Operator is entitled to transfer the Participant's Personal Data to third parties for the following purposes: completion of the order process, delivery of goods, sending of commercial notifications, customer satisfaction assessment, customer support services, handling of complaints, registration of a new customer. 14. Personal data is and will be processed electronically in a non-automated manner. 15. The controller does not intend to transfer any personal data to a third country or international organisation. 16. The controller does not use automated individual decision-making, including profiling pursuant to § 28 (1) and (4) of the Act, in the processing of personal data. IV. Rights of the Participant related to processing (information for the Participant) 17. Rights of the Participant in relation to the protection of personal data: a. Request access to his Personal Data from the Controller; b. to rectify the Personal Data provided; c. to erasure of the Personal Data provided (right to be forgotten); d. to restrict the processing of Personal Data; e. lodge a complaint with the Data Protection Authority; f. the right to transfer Personal Data to another controller; g. the right to object to the processing of Personal Data; h. the right to withdraw consent to the processing of Personal Data. 18. The participant may exercise his/her rights under paragraph 1 of this Article by means of a request to info@enizon.com. 19. Should the Participant consider that the Controller carries out processing of his or her Personal Data which is contrary to the protection of his or her private and personal life or contrary to the relevant legislation, in particular if the Personal Data are inaccurate with regard to the purpose of their processing, he or she may: a. request an explanation from the Data Controller, by email to info@enizon.com, b. object to the processing and request, by email to info@enizon.com, that the Controller ensure that the situation thus arising is rectified (e.g. by blocking, correcting, supplementing or destroying the Personal Data). The Controller shall promptly decide on the objection and inform the Participant. If the Operator does not comply with the objection, the Participant has the right to contact the Data Protection Authority directly. This provision is without prejudice to the right of the Subscriber to address his/her complaint directly to the Data Protection Authority. 20. If the Subscriber exercises any right under this Article, the Operator shall respond within 30 days of receipt of the request by the Subscriber to the Operator. 21. The receipt of a request to exercise a right under Article IV(1)(a) and (f) shall only be possible by means of a message with a guaranteed electronic signature of the Participant or a letter with a certified signature to the address of the Operator's registered office. The request must be accompanied by an e-mail address to which a verification e-mail will subsequently be sent to confirm the identity of the applicant. 22. If the Subscriber exercises any of the rights set out in Article IV, paragraph 1, the Operator shall have the right to require proof of the Subscriber's identity. Thus, the request for access to personal data must be sent from the e-mail address of the applicant. If the request is made in a different form or from a different e-mail address, the Controller shall have the right to request additional verification in the form of a reply to the verification e-mail. If the applicant does not prove his/her identity within 14 days of the sending of the verification e-mail, his/her request to exercise the rights under Article IV.1 will not be accepted and therefore not processed. 23.The Operator shall be entitled to charge a reasonable fee for the administrative costs involved in the event of a repeated and unjustified request for the provision of a physical copy of the Personal Data being processed. V. Categories of recipients, third parties and cookies 24. The Controller does not provide, disclose or share Personal Data, but may share it with third party service providers. Data is only shared to the extent necessary for the sale and provision of the service in accordance with the Terms and Conditions. Data is shared when: a. Making purchases, whereby data may be shared to the extent necessary: i. Mailchimp - The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA b. Shipping, whereby data may be provided to the extent necessary: i. General Logistics Systems Slovakia s.r.o., Budča 1039, 962 33 Budča ii. PaletExpress, s.r.o., Moyzesova 7883/39, 960 01 Zvolen iii. Slovenská pošta, a.s., Partizánska cesta 9, 975 99 Banská Bystrica 1 c. Operation, improvement and maintenance of websites: personal data is also available to the extent necessary to contractors who provide the operator with services related to the creation and maintenance of websites, where the data may be provided: i. - d. Providing advertisements and analysing data from them, whereby the data may be provided to the extent necessary: i. Google Analytics - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ii. Google AdWords - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland iii. Facebook Pixel - Facebook Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland 25. Cookies a. Technical cookies are used by the operator for the proper functioning of the website and consent to their use is not required from the subscriber. b. Advertising and marketing cookies are used by the operator for the purpose of displaying content according to the subscriber's previous preferences and for the purpose of displaying advertising according to the subscriber's interests, and advertising and marketing cookies are only stored by the operator with the subscriber's consent. c. The Participant is entitled to refuse or delete cookies, whereby the Operator warns that such action may cause partial or complete non-functionality of the www.enizon.com website. d. Information about browsers and how to set preferences for cookies is available on the following websites: i. Chrome ii. Firefox iii. Internet Explorer iv. Safari VI. Final Provisions 26. All legal relations arising from the processing of Personal Data shall be governed by the laws of the Slovak Republic, regardless of where the access to the Personal Data was made. The Slovak courts shall be competent to resolve any disputes arising in connection with the protection of privacy between the Participant and the Operator. 27. The participant has the right to contact the Data Protection Authority. 28. This Policy shall enter into force on 1.2.2020.