PRINCIPLES OF THE PERSONAL DATA PROCESSING

SOLLAU s.r.o., with its firm domicile at No. 212, 763 07 Hřivínův Újezd, Czech Republic, IDNo.: 292 61 759, entered in the Commercial Register kept by the Regional Court in Brno, Czech Republic, Section C, Insert 68934 (hereinafter referred to as the “Administrator” or the “SOLLAU” or the “Company”)

Administrator’s contact details:

Hřivínův Újezd 212, 763 07 Hřivínův Újezd, Czech Republic, e-mail: eshop@sollau.com
Phone: +420 577 013 873

The Administrator did not nominate a data protection representative.

LEGAL BASIS OF THE PERSONAL DATA PROCESSING

The company processes personal data in accordance with the EU law, in particular in accordance with the Regulation of the European Parliament and that of the Council No. 2016/679 dated 27 April 2016 on the protection of individuals concerning the personal data processing and on the free movement of these data and repealing the Directive 95/46 / EC (hereinafter "GDPR"), as well as in conformity with international agreements by which the Czech Republic is bound. In particular with the Convention on the protection of persons with regard to the automated personal data processing No. 108, promulgated under No. 115/2001 Coll. m. s., and further with national legal regulations, which are in particular Act No. 101/2000 Coll., on the personal data protection and in the wording of subsequent rules.

The legal reason for your personal data processing is the fact that this processing is necessary for the fulfillment of the contract between You and the Company or for the implementation of measures by the Administrator before concluding such a contract in the sense of the GDPR, Art. b).

In the event of a contractual relationship, the Company sends its customers business announcements related to its products due to the realization of the Company's entitled interests in the form of limited direct marketing. The company does not require consent for sending these commercial announcements but allows you to unsubscribe from the newsletter at any time, or to raise an objection to such processing.

In the case of direct marketing from the side of the Administrator without the establishment of a contractual relationship, the Administrator is entitled to process your personal data only based on your consent.

To better targeting the Company's advertising and promotion, the Company processes data on visits to websites, viewed products, and other website activity using cookies. Processing is only possible based on your consent to the use of the relevant cookies. More information about cookies can be found here.

The extent of personal data processed by the Company.

There will be processed the personal data, provided by the customers when registering or creating an order. These are name, surname, address, phone number, and e-mail.

If you have enabled the storage of cookies and you agree to their use, the Company will obtain data on visits to the website, viewed products, and other website activity.

Special categories of personal data (sensitive data) will be not processed by the Company.

Purpose of personal data processing

The Company, as the Administrator of personal data together with the provision of its services through the websites, will process and store personal data of Data Subjects under the conditions and within the limits set by applicable law, in particular following the provisions of the GDPR, Art. 6 (1) L. a) and L. b) for the following purposes:

• contacting and providing the information requested by the Data Subject (an e-mail address is used);
• fulfillment of the contractual obligation (name, surname, address, e-mail address, and phone number for the carrier are used);
• direct marketing based on the consent of the Data Subject (an e-mail address is used);
• maintenance of a database for direct marketing (name, surname, address, telephone number, and e-mail address are used).

Time of personal data processing

Personal data will be processed for the necessary time to ensure mutual rights and obligations arising from the contractual relationship, i.e. for the entire period of processing the order, including its payment and delivery of goods. By law, the Company will subsequently retain certain data contained in accounting documents.

Commercial announcements are sent for the whole time of the consent for their sending. In the case of customers, the commercial announcements are sent until their subscription is signed off, or until an objection is raised against the personal data processing for this purpose. However, commercial messages will be sent for a maximum of 7 years. The Company will then apply for a new consent again.

Data obtained for marketing purposes through cookies will be processed for the entire duration of consent for using cookies. I.e. as long as storing cookies is allowed in your browser, or until an objection is raised against the processing of your data for this purpose.

Further personal data processing beyond the above will be processed only if it is necessary for the fulfillment of obligations arising from legal regulations relating to the Company.

As soon as the purpose of the processing will cease, or the Administrator has no legal reason for the personal data processing anymore, the personal data will be deleted by the Administrator.

ADDITIONAL INFORMATION ON THE PERSONAL DATA PROCESSING

Personal data of the Data Subject will be processed manually by the Company's employees.

The personal data of the Data Subject will be further processed by the following personal data processors:

• processors providing server, web, cloud, or IT services to the Administrator;
• PPL & DHL-transport service.

INSTRUCTIONS ON THE RIGHTS OF DATA SUBJECTS

The Administrator hereby informs the Data Subjects about the basic rules and principles in conformity with the provisions of Art. 13 et seq. of the GDPR, based on which the Company, as the personal data Administrator, disposes of the personal data of the Data Subject.

The Data Subject has the right to obtain a confirmation from the Administrator whether or not the personal data are processed. If yes, the Data Subject has the right to obtain access to the personal data.

The Data Subject has the right to have the Administrator correct inaccurate personal data without undue delay. The Data Subject has also the right to replenish incomplete personal data, including by providing an additional statement, with regard to the processing purposes.

The Data Subject has the right to have the Administrator delete personal data if these are no longer needed for the processing purpose. The Data Subject has the right to revoke the consent to the personal data processing, to raise an objection to their processing if there are no overriding legitimate reasons for the processing.

The Data Subject has the right to restrict the processing if the Data Subject denies the accuracy of the personal data, for the time necessary to verify their accuracy.
The data Administrator no longer needs the personal data for the processing purpose, but the Data Subject requires them for determination, performance, or defense of legal claims, or the Data Subject has raised an objection to the personal data processing.

The Data Subject has the right to withdraw his consent to the personal data processing at any time without any sanction. The Data Subject may revoke the consent on the individual contact details of the Administrator in any way specified above. Withdrawal of consent by the Data Subject does not affect the lawfulness of the processing based on the consent before its revocation.

The Data Subject has the right to lodge a complaint with a competent supervisory authority if the Data Subject considers that the personal data processing is contrary to law. In the Czech Republic, the competent supervisory authority is the Office for Personal Data Protection.

The Data Subject has the right to raise an objection to the personal data processing concerning him or her if the Administrator processes personal data for the following reasons:

• processing is necessary for the performance of a task carried out in the public interest or for the execution of official authority entrusted to the Administrator,
• processing is necessary for the legitimate interests of the Administrator or a third party,
• for direct marketing purposes,
• for scientific or historical research purposes or statistical purposes.

Safety

The Company hereby declares that the personal data handling is carried out in full compliance with applicable law. The personal data of the Data Subject are safe on the part of the Company through technical and organizational measures.

All personal data in electronic form are stored in databases and systems. Only people who need to handle personal data directly for the purposes mentioned in these rules have access to them, and only to the extent necessary. This personal data access is protected by a password and a firewall.

Efficiency

These rules have been effective since 25.5.2018.