Privacy
I. . Basic provisions
1. The following entity shall be regarded as the personal data controller pursuant to Article 4 (7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the personal data processing and on the free movement of such data (hereinafter referred to as the “GDPR”):
Toothy Original s.r.o.
Company VAT Number CZ09728856
Okružní 101, Budyně nad Ohří, 41118
(hereinafter referred to as the “Controller”).
2. Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to a specific identifier, such as name, identification number, position data, network identifier or one or more specific physical, physiological, genetic, mental, economic, cultural or social identity elements of that natural person.
II. Sources and categories of the processed personal data
1. The Controller processes the personal data you have provided to him or the personal data that the Controller has obtained while you fulfilled the order.
2. The Controller processes your identification and contact data and the data necessary for the contract’s performance.
III. Legal reason and purpose of the personal data processing
1. The legal reason for the personal data processing shall be:
- The performance of the contract between you and the Controller pursuant to Article 6 (1) (b) of the GDPR,
- The legitimate interest of the Controller in the provision of direct marketing (especially for sending commercial messages and newsletters) pursuant to Article 6 (1) (f) of the GDPR,
- Your consent to the processing for the purposes of providing direct marketing (in particular for sending commercial messages and newsletters) pursuant to Article 6 (1) (a) of the GDPR, in connection with Article 7 (2) of Act No. 480/2004 Coll., On certain information society services, should no goods or services have been ordered.
2. The purpose of the personal data processing shall be:
- Processing your order and exercising the rights and obligations arising from the contractual relationship between you and the Controller. When ordering, personal data, such as your name and address, contact details, are necessary for the successful execution of the order; personal data provision is perceived to be an essential requirement for concluding and fulfilling the contract. Without providing personal data, the Controller cannot complete the contract or fulfil it,
- Sending business messages and conducting other marketing activities.
3. The Controller shall not make any automatic individual decision within the meaning of Article 22 of the GDPR. You have given your express consent to such processing.
IV. Data retention period
1. The Controller shall retain personal data
- For the time necessary to exercise the rights and obligations arising from the contractual relationship between you and the Controller and to assert claims under these contractual relationships (for 15 years from the moment of termination of the contractual relationship),
- Until the consent to the personal data processing for marketing purposes is revoked, for a maximum period of 2 years, if the personal data are processed based on your consent.
2. Once the retention period of personal data expires, the Controller shall delete them.
V. The personal data recipients (subcontractors of the Controller)
1. The personal data recipients are persons
- Involved in the delivery of goods/services or execution of payments subject to a contract,
- Providing e-shop operation services (Shoptet) and other services in connection with e-shop operation,
- Providing marketing services.
2. The Controller does not intend/intends to transfer personal data to a third country (a non-EU country) or to an international organisation. Recipients of personal data in third countries are mailing/cloud service providers.
VI. Your rights
1. Under the conditions set out in the GDPR, you have the following rights:
- The right of access to their personal data pursuant to Article 15 of the GDPR,
- The right to correct personal data pursuant to Article 16 of the GDPR, or the right to restrict its processing pursuant to Article 18 of the GDPR,
- The right to delete personal data pursuant to Article 17 of the GDPR,
- The right to object to the processing pursuant to Article 21 of the GDPR,
- The right to data portability pursuant to Article 20 of the GDPR,
- The right to withdraw your consent to the processing sent, in writing or electronically, to the address or e-mail of the Controller specified in Article III of these Terms and Conditions.
2. Besides, you have the right to lodge a complaint with the Office for Personal Data Protection if you believe that your rights concerning personal data protection have been violated.
VII. Terms of personal data security
1. The Controller declares that he has taken all appropriate technical and organisational measures to secure the personal data.
2. The Controller has taken technical measures to secure the data repositories and repositories of personal data in paper form, in particular…
3. The Controller declares that the personal data shall be accessed only by persons authorised by him.
VIII. Final Provisions
1. By sending the order generated from the online order form, you confirm that you have got acquainted with personal data protection conditions and accept them in full.
2. By checking the box with your consent on the online form, you agree to the Terms and Conditions. By checking the consent, you confirm that you have gotten acquainted with personal data protection conditions and accept them in full.
3. The Controller is entitled to change these Terms and Conditions. The new version of the Terms concerning personal data protection shall be published on his website. Simultaneously, the latest version of the Terms and Conditions shall be sent to you by the e-mail address you provided to the Controller.
These Terms and Conditions took effect on January 1st, 2021.