Processing of personal data

1. Basic law for the protection of the rights of individuals against unauthorized processing of their personal data and the rule of law, duties, and responsibilities in the processing of personal data of physical data of persons is contained in law no. _ 18/2018 Coll. on the protection of personal data and amending certain laws, as amended (hereinafter referred to as the “ PDPA ” ) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46 / EC (General Data Protection Regulation) (hereinafter "GDPR").

2. According to the GDPR, personal data is data related to an identified person who can be identified directly or indirectly. In particular, on the basis of a generally used identifier, other identifiers, such as name, surname, identification number, location data, or online identifier. 

3. The seller is the business company DR sro, with its registered office at Uherecká cesta 76, 958 03 Malé Uherce, Slovakia, IČO: 50 244 035, registered in the Commercial Register kept by the District Court of Trenčín, section: Sro, file number: 32891 / R (hereinafter also "DR" or "Seller ").

4. Buyer means any natural person, natural person - entrepreneur or legal entity interested in concluding a purchase contract with the Seller, or who has concluded a purchase contract with the Seller (hereinafter also "Buyer" or "Customer").

5. Under the PDPA, a data controller is anyone who, alone or jointly with others, defines the purpose and means of processing personal data and processes personal data on his or her behalf. For the purposes of the website https://dajanarodriguez.com/, the data subject is the Seller.

6. According to the PDPA, the affected person means any natural person whose personal data is processed. For the purposes of the website https://dajanarodriguez.sk/, the affected person is the Buyer.

7. The Controller provides the data subject with information within the meaning of Section 19(1) and (2) of the IAA as follows:

1. Identification data of the controller: DR s. r. o., with registered office at Uherecká cesta 76, 958 03 Malé Uherce, Slovakia, ID No.: 50 244 035, registered in the Commercial Register kept by the District Court of Trenčín, Section: Sro, Insert No.: 32891/R, tel.: 0650 960 525, e-mail: info@dajanarodriguez.com. 

2. Responsible person: not designated

3. purpose of processing personal data: Implementation of existing contractual relations, the purpose of valid conclusion and ensuring the fulfilment of contractual relations (order processing, dispatch of ordered goods, handling of complaints); bookkeeping, processing of accounting and tax documents, invoicing and cash register, fulfilment of the tax obligations of the operator; identification of the Customer when logging into their account; analysis and measurement of the use of the website; ensuring network security and information security; current ongoing competitions, newsletter (direct marketing, letter to Santa/letter of wishes), business communication.

4. Legal basis for processing personal data: Act No. 431/2002 Coll. on Accounting, as amended; Act No. 222/2004 Coll. on Value Added Tax, as amended; Act No. 40/1964 Coll. Civil Code, as amended; other legal norms; under contractual and pre-contractual relations (Article 6(1)(b) GDPR), legitimate interests (Article 6(1)(f) GDPR) or by legitimate interests (Article 6(1)(f) GDPR); the data subject's consent to the processing of personal data 

5. Recipients of the personal data collected: processors; state and public authorities for the exercise of control and supervision, courts and law enforcement authorities in the event of compliance with a legal obligation of the controller retention period of the personal data: until the settlement of the rights and obligations under the contract, but at least 10 years from the end of the contractual relationship. In the case of competitions, personal data will always be retained by the competition statute 

6. reason for providing - requesting personal data: the controller is obliged to request personal data to fulfil its obligations under the contract.
   
   

7. In the event of failure to provide the requested personal data, it will not be possible to process the order and send the goods to the Customer. In the case of competing, the provision of personal data is necessary for the data subject to participate in the competition.

8. Processors authorized by the controller: EKONÓM KREDIT s. r. o., Rudolfa Jašíka 158/8, Partizánske 958 01, SR (external company processing IS Accounting and accounting documents); Google Ireland, 3rd floor, Gordon House, Barrow Street, Dublin (provider of Google Analytics - measurement of website usage), courier, transport companies and postal carriers.

8. If you have any questions about the processing of the data subject's personal data, you should contact the controller by email at support@dajanarodriguez.com or by writing to the controller's registered office.

9. Rights of the data subject:

1. Right of access to personal data according to Article 15 GDPR: The data subject has the right to obtain confirmation as to whether the controller processes personal data concerning him or her. The data subject has the right to obtain access to his or her personal data (he or she has the right to be provided with a copy of the personal data held by the controller about the data subject) and information about how the controller processes it, to the extent provided for in Article 15 of the GDPR.

2. The right to rectification of personal data under Article 16 GDPR: The data subject has the right to rectification of personal data concerning him or her if they are incorrect or to their completion, if they are incomplete. The controller must comply with the request for rectification or completion of the personal data without undue delay.

3. Right to erasure (Right to be forgotten) under Article 17 GDPR: The data subject has the right to obtain from the controller, without undue delay, the erasure of personal data concerning him or her where one of the grounds referred to in Article 17(1) GDPR is met (e.g. where the personal data concerning him or her obtained by the controller are no longer necessary for the purposes for which they were collected or otherwise processed). This right of the data subject shall be assessed by the controller in the light of all relevant circumstances by Article 17 GDPR (e.g., the controller shall not grant the request if the processing is necessary – for compliance with a legal obligation of the controller or the establishment, exercise or defence of legal claims).

4. The right to restriction of processing of personal data under Article 18 GDPR: The data subject has the right to have the controller restrict the processing of his or her personal data if one of the events listed in Article 18(1) GDPR occurs. Where processing has been restricted by Article 18(1) of the GDPR, such personal data shall, except for storage, be processed: (a) only with the data subject's consent; or (b) for the establishment, exercise or defence of legal claims; or (c) for the protection of the rights of another natural or legal person; or (d) for reasons of substantial public interest of the Union or of a Member State.

5. The right to data portability under Article 20 of the GDPR: Where the processing is based on consent or a contract and is carried out by automated means, the data subject shall have the right to obtain his or her personal data which he or she has provided to the controller in a structured, commonly used and machine-readable format and shall have the right to transmit those data to another controller. As far as technically feasible, he or she shall have the right to have the data transmitted directly from one controller to another.

6. Right to object under Article 21 GDPR: Where the processing is based on legitimate interests (Article 6(1)(f) GDPR), the data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her, including to profiling based on the provisions of Article 6(1)(f) GDPR. In such a case, the controller may no longer process the personal data unless it demonstrates compelling legitimate grounds which override the interests, rights, and freedoms of the data subject or the establishment, exercise or defence of legal claims. Where the data subject objects to the processing of his or her personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing, the personal data may no longer be processed for such purposes.

7. Right to complain with the Office for Personal Data Protection: the data subject is entitled at any time to lodge a complaint or lodge a complaint regarding the processing of personal data with the supervisory authority, i.e. the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, SR, tel.: +421 2 3231 3214, www.dataprotection.gov.sk.

10. The Seller uses cookies. Cookies covering the user's behaviour are archived for 30 days, with the older data being available in an anonymized form in Google Analytics. To refuse the processing of cookies (except technical cookies), the Seller must be contacted via the contact form. Information from the categories of cookies concerned is also used by the Seller for advertising purposes, whereby the Buyer may also be shown advertising based on this data on external websites which the Seller considers relevant about the Buyer.