Privacy

PROTECTION OF PERSONAL DATA AND COOKIES NOTICE / Principles and notices on the protection of personal data

provided by the controller to the data subject when obtaining personal data from the data subject, and cookies notice of the online shop www.fashionspy.sk /

I. Controller

The identity and contact details of the Controller are:
Business name: CHILLI CONTENT, s.r.o.
Registered office: Tallerova 4, Bratislava - mestská časť Staré mesto 811 02, Slovak Republic
Entered in the register of the District Court Bratislava I, Section Sro, Insert No. 47351/B
Company ID (IČO): 36 816 825
Tax ID (DIČ): 2022427473
VAT ID (IČ DPH): SK2022427473
Bank account: SK45 0900 0000 0006 3168 7152
The Seller is a VAT payer /Value Added Tax/
The email and telephone contact of the Controller are:
Email: info@fashionspy.sk
Tel. no.: +421944126204
The Controller's address for the delivery of written correspondence:
CHILLI CONTENT, s.r.o., Tallerova 4, Bratislava - mestská časť Staré mesto 811 02, Slovak Republic
In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the “Regulation”), the Controller hereby provides the Data Subject, from whom the Controller obtains personal data relating to them, with the following information, notices and explanations:

II. References

These principles and notices on the protection of personal data form part of the General Terms and Conditions published on the Seller's Website.
Pursuant to Section 3(1)(n) of Act No. 102/2014 Coll., the Seller informs the consumer that there are no specific applicable codes of conduct to which the seller has committed to adhere, where a code of conduct means an agreement or a set of rules defining the conduct of a seller who has committed to comply with that code of conduct in relation to one or more particular commercial practices or business sectors, where these are not laid down by law or another legal regulation or measure of a public authority), which the seller has committed to comply with, and the manner in which the consumer can become acquainted with them or obtain their wording.

III. Protection of personal data and use of cookies. Notice and explanation of cookies

The Controller provides this brief explanation of the function of cookies:

1.1. Cookies are text files containing a small amount of information which are downloaded to your computer, mobile phone or other electronic device that you use to browse the web domain when you visit a website.

Cookies allow the Controller's web domain not only to recognise the user's device, but at the same time they give the user access to functions on the site.

We divide cookies into two basic types, namely:

Persistent cookies – these cookies remain on the user's device for the period specified in the cookie. They are activated every time the user visits the web domain that created the given cookie.

Session cookies – these files allow the operator of the web domain to link the user's activities when the user opens a browser window, and they end when the browser window is closed. Session cookies are created temporarily. After the browser is closed, all session cookies are deleted.
Explanation of cookies

2.1.A cookie is a small text file that a website stores on your computer or mobile device when you browse it. Thanks to this file, the website retains for a certain period information about your actions and preferences (such as login name, language, font size and other display settings), so that you do not have to enter them again on your next visit to the website or when browsing its individual pages.
Notice on the use of cookies

3.1. The Controller's website uses cookies in order to retain:

3.1.1. The fact that you have already answered a survey displayed in a separate window (pop-up), through which you can express your opinion on the content of the site (it will not be displayed again);

3.1.2. The fact whether you have agreed (or not agreed) to our use of cookies on this website.

3.1.3. Marketing and remarketing

Likewise, some subpages that are part of the Controller's sites use cookies for the anonymous collection of statistical data about who is the referrer of the source to our web domain and in what way you reached our web domain.

Allowing the use of cookies is not strictly necessary for the website to function properly, but it will give you a better user experience when working with it. You can delete or block cookies.

The information stored in cookies will not be used to personally identify you and the data structure is fully under our control. Cookies are not used for any purposes other than those stated in this text. Some of our pages or sub-sites may use additional or different cookies than those stated in the preceding text. In such a case, detailed information on their use will be provided on the page concerned in a separate cookies notice.
How to control cookies

4.1.You can control and/or delete cookies as you see fit – for details, see aboutcookies.org. You can delete all cookies stored on your computer and you can set most browsers to prevent them from being stored.

IV. Personal data processed

On its website, the Controller processes the following personal data: first name, surname, place of residence, email address, home telephone number, mobile telephone number, billing address, delivery address, data obtained from cookies, IP addresses.

V. Contact details of the person responsible for oversight of personal data protection

The Controller has appointed a person responsible for the protection of personal data in accordance with Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Contact: info@fashionspy.sk
The Controller is at the same time the Seller within the meaning of the term set out in the General Terms and Conditions of this website.

VI. Purposes of processing the Data Subject's personal data and the period of processing of personal data

The purposes of processing the Data Subject's personal data are in particular:

1.2. records, creation and processing of contracts and client data for the purpose of concluding contracts with third parties

1.3. processing of accounting documents and documents related to the Controller's business activity

1.4.compliance with legal regulations in connection with the archiving of documents and records, e.g. under Act No. 431/2002 Coll., the Accounting Act, as amended, and other relevant regulations

1.5.the Controller's activity in connection with the fulfilment of a request, order, contract and similar instruments of the Data Subject.
The Controller retains the Data Subject's personal data only for the period strictly necessary for the purposes of performing the contract and its subsequent archiving in accordance with the statutory periods imposed on the Controller by legal regulations.

VII. Legal basis for processing the Data Subject's personal data

The legal basis for processing the personal data of Data Subjects is, depending on the specific personal data processed and the purpose of their processing, the consent of the Data Subjects to the processing of personal data.
Where the Controller carries out processing of personal data based on the Data Subject's consent, this processing will only commence after the Data Subject has given the relevant consent.
Where the Controller processes the Data Subject's personal data for the purposes of negotiating pre-contractual relations and the conclusion and performance of a purchase contract, and the related delivery of goods, a product or a service, the Data Subject has an obligation to provide personal data for the proper performance of the purchase contract; otherwise, performance cannot be ensured. Personal data for this purpose are processed without the consent of the data subject.

VIII. Recipients or categories of recipients of personal data

The recipients of the Data Subject's personal data will be, or at least may be:

1.1. statutory bodies or their members of the Controller

1.2. persons performing work activity for the Controller in an employment or similar relationship.

1.3. the controller's commercial representatives and other persons cooperating with the Controller in the performance of the Controller's tasks. For the purposes of this document, the Controller's employees will be considered to be all natural persons performing dependent work for the Controller on the basis of an employment contract or agreements on work performed outside an employment relationship.

1.4. The recipients of the Data Subject's personal data will also be the controller's collaborators, its business partners, suppliers and contractual partners, in particular: an accounting company, a company providing services related to the creation and maintenance of software, a company providing legal services to the controller, a company providing advisory services to the controller, companies providing the transport and delivery of products to buyers and third parties, marketing companies, companies operating social networks, companies providing payment gateways and other payment methods.

1.5. The recipients of personal data will also be courts, law enforcement authorities, the tax office and other state authorities, where so provided by law. In that case, the personal data will be provided by the Controller to the given offices and state institutions on the basis of and in accordance with the legal regulations of the Slovak Republic

IX. Information on the provision of personal data to third countries and the period of their retention:

Not applicable. The Controller does not transfer personal data of persons to third countries.

X. Notice of the existence of the relevant rights of the Data Subject:

The Data Subject has, among others, the following rights, whereby:

1.1.Point 10.1 does not affect other rights of Data Subjects.

1.2.The Data Subject's right of access to data under Art. 15 of the Regulation, the content of which is:

the right to obtain from the Controller confirmation as to whether it is processing the Data Subject's personal data and, if so, to what extent. Likewise, if they are being processed, the right to find out their content and to request from the Controller information on the reason for their processing, in particular information on: The reason for their processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations, the envisaged period for which the personal data will be stored or, if that is not possible, information on the criteria used to determine that period, the existence of the right to request from the Controller rectification or erasure of personal data concerning the Data Subject or restriction of processing and the existence of the right to object to such processing, the right to lodge a complaint with a supervisory authority, where the personal data are not collected from the Data Subject, any available information as to their source, the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, in those cases, at least meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing of personal data for the Data Subject, the appropriate safeguards pursuant to Article 46 of the Regulation relating to the transfer of personal data, where personal data are transferred to a third country or an international organisation.

1.3.the right to obtain a copy of the personal data being processed, provided, however, that the right to obtain a copy of the personal data being processed must not adversely affect the rights and freedoms of others.

1.4.the Data Subject's right to rectification under Article 16 of the Regulation, the content of which is the right: to have the Controller rectify without undue delay inaccurate personal data concerning the Data Subject. the right to have incomplete personal data of the Data Subject completed, including by means of providing a supplementary statement by the Data Subject, the Data Subject's right to erasure of personal data (the so-called “right to be forgotten”) under Article 17 of the Regulation, the content of which is:

1.5.the right to obtain from the Controller the erasure of personal data concerning the Data Subject without undue delay where one of the following grounds applies:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, the Data Subject withdraws consent on which the processing is based, provided that there is no other legal ground for the processing of personal data, the Data Subject objects to the processing of personal data pursuant to Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing of personal data or the Data Subject objects to the processing of personal data pursuant to Article 21( 2) of the Regulation, the personal data have been unlawfully processed, the personal data have to be erased for compliance with a legal obligation under European Union law or the law of the Member State to which the Controller is subject, the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the Regulation;

1.6.the right that the Controller who has made the Data Subject's personal data public, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers which are processing the personal data that the Data Subject has requested them to erase any links to, or copy or replication of, those personal data, whereby the right to erasure of personal data with the content of the rights under Article 17(1) and (2) of the Regulation does not arise where the processing of personal data is necessary:

1.7.for exercising the right of freedom of expression and information.

1.8.for compliance with a legal obligation which requires processing under European Union law or the law of the Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.

1.9.for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) of the Regulation, as well as Article 9(3) of the Regulation.

1.10.for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the Regulation, in so far as the right referred to in Article 17(1) of the Regulation is likely to render impossible or seriously impair the achievement of the objectives of that processing of personal data; or for the establishment, exercise or defence of legal claims;

1.11.the Data Subject's right to restriction of processing of personal data under Article 18 of the Regulation, the content of which is:

1.12.the right to have the Controller restrict the processing of personal data in one of the following cases: the Data Subject contests the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data, the processing of personal data is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead, the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims, the Data Subject has objected to processing pursuant to Article 21(1) of the Regulation, pending verification whether the legitimate grounds of the Controller override those of the Data Subject;

1.13.the right that, where the processing of personal data has been restricted, such restricted personal data shall, with the exception of storage, be processed only with the Data Subject's consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State;

1.14.the right to be informed in advance of the lifting of the restriction of processing of personal data;

1.15.the Data Subject's right to the fulfilment of the notification obligation towards recipients under Article 19 of the Regulation, the content of which is: the right that the Controller communicate to each recipient to whom the personal data have been disclosed any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 of the Regulation, unless this proves impossible or involves disproportionate effort, the right that the Controller inform the Data Subject about those recipients if the Data Subject requests it;

1.16.the Data Subject's right to data portability under Article 20 of the Regulation, the content of which is: the right to receive the personal data concerning the Data Subject, which the Data Subject has provided to the Controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller, where:

a/ the processing is based on the Data Subject's consent pursuant to Article 6(1)(a) of the Regulation or Article 9(2)(a) of the Regulation, or on a contract pursuant to Article 6(1)(b) of the Regulation, and at the same time
b/ the processing is carried out by automated means, and at the same time:

1.17.the right to receive personal data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller, shall not adversely affect the rights and freedoms of others;

1.18.the right to have the personal data transmitted directly from one controller to another controller, where technically feasible;

1.19.the Data Subject's right to object under Article 21 of the Regulation, the content of which is:

1.20.the right to object, on grounds relating to the Data Subject's particular situation, at any time to the processing of personal data concerning them which is based on Article 6(1)(e) or (f) of the Regulation, including objection to profiling based on those provisions of the Regulation;

1.21.in the event of exercising the right to object, on grounds relating to the Data Subject's particular situation, at any time to the processing of personal data concerning them which is based on Article 6(1)(e) or (f) of the Regulation, including objection to profiling based on those provisions of the Regulation, the right that the Controller shall no longer process the Data Subject's personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or defence of legal claims

1.22.the right to object at any time to the processing of personal data concerning the Data Subject for direct marketing purposes, including profiling to the extent that it is related to direct marketing; whereby, where the Data Subject objects to processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes;

1.23.in the context of the use of information society services, the right to exercise the right to object to the processing of personal data by automated means using technical specifications;

1.24.the right to object, on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning the Data Subject where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the Regulation, except where the processing is necessary for the performance of a task carried out for reasons of public interest;

1.25.the Data Subject's right relating to automated individual decision-making under Article 22 of the Regulation, the content of which is:

1.26.the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning them or similarly significantly affects them, except in the cases under Article 22(2) of the Regulation [i.e. except where the decision: (a) is necessary for entering into, or performance of, a contract between the Data Subject and the Controller,

1.27.is authorised by European Union law or the law of the Member State to which the Controller is subject and which also lays down suitable measures to safeguard the Data Subject's rights and freedoms and legitimate interests, or (c) is based on the Data Subject's explicit consent.

XI. Notice of the Data Subject's right to withdraw consent to the processing of personal data:

The Data Subject is entitled at any time to withdraw their consent to the processing of personal data, without this affecting the lawfulness of processing of personal data based on consent given before its withdrawal.

The Data Subject is entitled at any time to withdraw their consent to the processing of personal data – in full or only in part. A partial withdrawal of consent to the processing of personal data may relate to a certain type of processing operation / certain processing operations, whereby the lawfulness of processing of personal data within the scope of the remaining processing operations remains unaffected. A partial withdrawal of consent to the processing of personal data may relate to a certain specific purpose of processing of personal data / certain specific purposes of processing of personal data, whereby the lawfulness of processing of personal data for the other purposes remains unaffected.

The Data Subject may exercise the right to withdraw consent to the processing of personal data in written form to the address of the Controller registered as its registered office in the commercial register at the time of withdrawal of consent to the processing of personal data, or in electronic form by electronic means (by sending an email to the Controller's email address stated in the identification of the Controller in this document).

XII. Notice of the Data Subject's right to lodge a complaint with a supervisory authority:

The Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, if they consider that the processing of personal data relating to them infringes the Regulation, all without prejudice to any other administrative or judicial remedy.

The Data Subject has the right to have the supervisory authority with which the complaint has been lodged inform them, as the complainant, of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the Regulation.
The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic.

XIII. Information relating to automated decision-making, including profiling:

Since the Controller does not process the Data Subject's personal data in the form of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation, the Controller is not obliged to provide the information under Article 13(2)(f) of the Regulation, i.e. information about automated decision-making, including profiling, and about the logic involved, as well as the significance and the envisaged consequences of such processing of personal data for the Data Subject. Not applicable.

XIV. Final provisions

These Principles and notices on the protection of personal data and notices on cookies form an integral part of the General Terms and Conditions and the Complaints Procedure. The documents – the General Terms and Conditions and the Complaints Procedure of this Website – are published on the domain of the Website of the Seller.
These Principles of personal data protection become valid and effective upon their publication on the seller's Website on 24.05.2021

This e-shop is certified by http://www.pravoeshopov.sk