Recording of a customer’s personal data by a specific e-shop constitutes personal data processing in accordance with Act No. 18/2018 Coll. on the Protection of Personal Data (hereinafter referred to as the “Personal Data Protection Act”). This creates an information system of personal data. The purpose of processing the customer’s personal data (natural person) is usually the conclusion of a purchase agreement and subsequent payment processing, delivery of goods or services, and potential provision of related services (claims handling and other obligations of the e-shop operator mainly under consumer protection laws).

The personal data we request from you is used exclusively for internal purposes related to fulfilling obligations from your order and is not shared with third parties. We process your personal data strictly within the scope permitted by Act No. 18/2018 Coll. on the Protection of Personal Data.

Your personal data is secured against misuse and unauthorized access by third parties and will not be used for commercial purposes. When registering, you may choose to receive information about news or other marketing messages from the seller. Your data is used solely for processing your order within our company and for delivery through Slovak Post or courier services.

DATA CONTROLLER IDENTIFICATION

The data controller is Cafézia s.r.o., Bočná 6, 04001 Košice, Company ID: 50196219. Contact email: info@cafezia.sk.
Hereinafter referred to as the “Website Operator”.

PROCESSING OF PERSONAL DATA

The Website Operator processes the following personal data for the purpose of registration, purchasing through the online store, and fulfilling rights and obligations between you and the Website Operator:

• First name and last name

• Phone number

• Email address

• Billing address

• Shipping address

• IP address

The legal basis for processing personal data is your consent under the following:

– Article 6(1)(b) GDPR – performance of a contract
– Article 6(1)(c) GDPR – compliance with legal obligations
– Article 6(1)(a) GDPR – consent for direct marketing, if no order has been placed
– Article 6(1)(f) GDPR – the legitimate interest of the controller in direct marketing

Processing of personal data is necessary for the performance of the purchase contract and for fulfilling the legal obligations of the Website Operator.
No automated individual decision-making as per Article 22 GDPR takes place.

DATA RETENTION PERIOD

Personal data is processed for the period necessary to fulfill the rights and obligations arising from the contractual relationship (up to 3 years after its termination) or until the withdrawal of consent to data processing.

DATA RECIPIENTS

Recipients of personal data include the following:

– Courier or transport company responsible for delivering goods to the customer, acting as a processor

DATA SUBJECT RIGHTS

Under the GDPR, you have the right to:

– Access your personal data
– Rectify your personal data
– Restrict processing
– Delete your personal data
– Data portability
– Object to the processing of your personal data

If you believe your personal data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority.

DATA SECURITY

The data controller commits to taking appropriate technical and organizational measures to secure personal data against unauthorized access or loss. The controller declares that personal data will only be accessible to authorized persons bound by confidentiality. Technical measures have been implemented to protect data storage and personal data recorded in physical form.

FINAL PROVISIONS

By submitting an order via our e-shop, you confirm that you have read and fully agree with these data protection terms. The controller reserves the right to amend these terms. The current version is always published on the controller’s website.