I.PRIVACY OF PERSONAL DATA
1.1 By sending an order from an online order form for the delivery of goods, the buyer confirms that he / she understands the terms of personal data protection, agrees with their wording and accepts them in full.
1.2 The vendor is the personal data controller of Article 4 (7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC the Data Protection Regulation) (hereinafter referred to as the "GDPR"). Seller agrees to process personal data in accordance with legal regulations, especially GDPR.
1.3 Personal information is any information about an identified or identifiable natural person. An identifiable natural person is a natural person that can be identified directly or indirectly, in particular by reference to a particular identifier such as name, identification number, location data, network identifier or one or more specific physical, physiological, genetic, psychological, economic, the social identity of this individual.
1.4 When ordering, the personal data required to conclude the sales contract and successfully complete the order (name and address, contact details) are required. The purpose of processing personal data is to execute the buyer's order and to exercise the rights and obligations arising from the contractual relationship between the seller and the buyer. The purpose of processing personal information is to send business information and do other marketing activities. The legal reason for the processing of personal data is the fulfillment of the contract pursuant to Article 6 (1) b) GDPR, fulfillment of the statutory obligation of the administrator pursuant to Article 6 (1) (c) GDPR and the seller's legitimate interest pursuant to Article 6 (1) f) GDPR. The Provider's legitimate interest is the processing of personal data for direct marketing purposes.
1.5 Personal data required to handle demand is Inquiry (name, contact details). The purpose of processing personal data is to handle buyer's inquiry. The seller stores the buyer's personal data for 90 days.
1.6 The seller uses the services of subcontractors, especially the provider of the web hosting service. Subcontractors are screened for the safe processing of personal data. The Web site vendor and subcontractor has entered into a personal data processing agreement under which the subcontractor is responsible for ensuring the proper physical, hardware, and software perimeter and hence bears direct responsibility for the buyer for any leakage or intrusion of personal data.
1.7 The Seller shall store personal data of the Buyer for the period necessary to exercise the rights and obligations arising from the contractual relationship between the Seller and the Buyer and the claims arising from these contractual relationships (for 10 years from the termination of the contractual relationship). After it expires, data will be erased.
1.8 The buyer has the right to require from the seller access to his / her personal data pursuant to Article 15 of the GDPR, the correction of personal data pursuant to Article 16 of the GDPR, or the restriction of the processing under Article 18 GDPR. The buyer has the right to delete personal data in accordance with Article 17 (1) (a) and (c) to (f) of the GDPR. In addition, the buyer has the right to object to the processing under Article 21 of the GDPR and the right to data portability pursuant to Article 20 GDPR.
1.9 The buyer has the right to send a complaint to the Office for Personal Data Protection in case he/ her considers that his/ her right to the protection of personal data has been violated.
1.10 Buyer is under no obligation to provide personal information. However, providing of personal data is a necessary requirement for the conclusion and performance of a contract, and without providing personal data, it is not possible to conclude the contract or to execute it by the seller.
1.11 The Seller does not make decisions based solely on automated processing within the meaning of GDPR No. 22.
1.12 Interested parties about the seller's goods by filling in the contact form:
1. agrees to use his or her personal data for the purpose of sending commercial messages, promotional materials, direct sales, market surveys and direct product offers by the seller, but not more than once a week, and at the same time
2. Declares that the sending of information according to article 1.11.1 does not consider an unsolicited advertisement within the meaning of Act. No. 40/1995 Coll. in the wording of the amendments, since the purchaser, by sending the information according to point 1.11.1 in conjunction with § 7 of Act no. No. 480/2004 Coll. explicitly agree.
3. Consent may be withdrawn at email@example.com at any time in writing.
1.12 Seller uses the so-called "cookies" to improve the quality of its services, personalize the offer, collect anonymous data, and for analytical purposes in its presentation. By using the site, the buyer agrees to use the technology.
2. RIGHTS AND OBLIGATIONS BETWEEN SELLERS AND BUYERS (PROCUREMENT AGREEMENT)
2.1 The Seller is the processor in relation to the personal data of the buyer's clients under Article 28 GDPR. Buyer is the administrator of this data.
2.2 These Terms govern the mutual rights and obligations in the processing of personal data to which the Seller has gained access in the context of the fulfillment of the Purchase Contract concluded in the form of the General Business Terms and Conditions at www.lasoul.cz (the "Purchase Agreement") concluded with the Purchaser on the date of sending the order .
2.3 The Seller undertakes for the Buyer to process personal data to the extent and for the purposes set out in Articles 2.4 - 2.7 of these Terms. Processing resources will not be automated. Seller will collect, store, store, block, and disassemble personal data in the processing. Seller is not authorized to process personal data in violation or beyond the limits set by these terms.
2.4 The Seller undertakes for the Buyer to process personal data in the following extent:
common personal data,
specific categories of data under Article 9 of the GDPR that it obtained in connection with its own business.
2.5 Seller agrees for the buyer to process personal data to fulfill the purchase contract.
2.6 Personal data may only be processed at the workplace of the vendor or its subcontractors under Article 2.8 of these Conditions, within the territory of the European Union.
2.7 Seller is obliged to process his or her personal data for the time necessary to perform the rights and obligations arising from the contractual relationship between the seller and the buyer, and from claiming these contractual relationships (for 10 years from the termination of the contractual relationship).
2.8 The Purchaser grants a license with the involvement of a subcontractor, as a further processor, pursuant to Article 28 (2) of the GDPR, which is the hosting provider www.lasoul.cz. In addition, the buyer grants the seller a general authorization to engage in the processing of another personal data processor, but the seller must inform the user in writing of any intended changes to accept or replace the other processors and give the buyer the opportunity to object to these changes. The vendor must impose on its subcontractors as personal data processors the same personal data protection obligations as set out in these terms.
2.9 Seller agrees that the processing of personal data will be ensured in particular as follows:
Personal data is processed in accordance with legal regulations and on the instructions of the buyer, ie to perform all the activities necessary to fulfill the purchase contract.
The Seller undertakes to provide technically and organizationally the protection of the processed personal data in such a way that unauthorized or accidental access to the data, its modification, destruction or loss, unauthorized transmissions, any other unauthorized processing, as well as other misuse may occur personally and organizationally throughout the data processing process, all the obligations of the data processor resulting from the legislation are safeguarded.
The technical and organizational measures adopted correspond to the degree of risk. The vendor assures the continued confidentiality, integrity, accessibility, and resilience of processing systems and services, and timely restores the availability of and access to personal data in the event of physical or technical incidents.
The Seller hereby declares that the personal data protection is subject to the Seller's internal security regulations.
Only authorized persons of the vendor and subcontractors will have access to personal data under Article 2.8 of these Conditions, which will set the terms and extent of data processing for the seller and any such person will access personal data under his unique identifier.
Authorized persons of the vendor who process personal data under these conditions are required to maintain confidentiality about personal data and security measures whose disclosure would compromise their security. The seller shall ensure their demonstrable commitment to this obligation. The seller will ensure that this obligation for both the seller and authorized persons will last even after termination of a labor or other relationship with the seller.
Seller will assist the purchaser by means of appropriate technical and organizational measures, if possible, to meet the buyer's obligation to respond to the data subject's requests for data subject to the GDPR; as well as ensuring compliance with the GDPR Articles 32 to 36, taking into account the nature of the processing and the information available to the seller.
Upon termination of the provision of the performance associated with processing under Article 2.7 of these Conditions, the Seller is obliged to delete all personal data or return it to the Purchaser if it is not obliged to store personal data under a Special Act.
The Seller shall provide the Purchaser with all information necessary to prove that the obligations under this Agreement and the GDPR have been met.
2.10 The Buyer undertakes to promptly report any facts known to him that could affect the proper and timely fulfillment of the obligations arising out of these conditions and to provide the Seller with the necessary cooperation to meet these conditions.
3. FINAL STATEMENT
3.1 These Terms shall expire on the expiry of the time specified in Article 1.6 and Article 2.7 of these Conditions.
3.2 The Buyer acknowledges that he is obliged to state his / her personal data when making an order from the web interface of the shop correctly and truthfully and that he is obliged to inform the seller of any change in his / her personal data without undue delay.
3.3 Buyer agrees to these terms by ticking the consent via the online form. By signing the consent, the user expresses that he has read these terms, agrees with them and accepts them in their entirety.
3.4 The Seller is entitled to change these terms. Seller is obliged to publish a new version of the terms on its website without any unnecessary delay. will send the new version to the buyer at his email address.
3.5 Seller's contact details regarding the following terms and conditions: firstname.lastname@example.org.
3.6 Relationships expressly not governed by these terms and conditions are governed by the GDPR and the Czech legal order, in particular Act No. 89/2012 Coll., The Civil Code, as amended.
3.7 The Czech language is the main language of the GDPR Policy.
Prague, May 13, 2018.