Personal Data Protection
PERSONAL DATA PROTECTION AND COOKIES NOTICE
Principles and Instructions on Personal Data Protection
provided by the Operator to the Data Subject when collecting personal data from the Data Subject and the Cookies Notice of the online store www.magaela.com /
I. Operator
1.1. Identity and contact details of the Operator:
Business name: Magaela s.r.o.
Place of business: Vyšehradská 3732/12, 851 06 Bratislava, Slovak Republic
Registration: Bratislava City Court III, Section: Sro, Insert no. 174393/B
Company ID (ICO): 55 896 731
Tax ID (DIC): 2122126897
VAT ID (IC DPH): SK2122126897
Bank account: Tatra banka, a.s. IBAN: SK39 1100 0000 0029 4918 3631
The Seller is a VAT payer.
1.2. Email and telephone contact for the Operator:
Email: magaela@magaela.sk
Tel.: +421 917 088 983
1.3. Address of the Operator for sending correspondence:
Roman Ďuriš, Holičšká 11, P.O. Box 32, 85006 Bratislava 56, Slovakia
1.4. The Operator hereby, in accordance with Article 13(1) and (2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 May 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, “GDPR”), repealing Directive 95/46/EC, provides the Data Subject (Buyer), from whom the Operator (Seller) obtains personal data concerning them, with the following information, instructions and explanations:
II. References
2.1. These principles and instructions on personal data protection form part of the General Terms and Conditions published on the Seller's Website.
2.2. Pursuant to Section 3, paragraph 1, letter n) of Act No. 102/2014 Coll., the Seller informs the consumer that there are no special relevant codes of conduct to which the Seller has committed to adhere. A code of conduct refers to an agreement or a set of rules that define the behavior of the seller, who has committed to following this code of conduct in relation to one or more specific commercial practices or business sectors, unless such conduct is established by law, another legal regulation, or a measure of a public authority. The seller also informs the consumer of the way they may access or obtain the text of the code of conduct.
III. Personal Data Protection and Use of Cookies
Instructions and Explanation on Cookies, Scripts, and Pixels
3.1. The website operator provides this brief explanation of the function of cookies, scripts, and pixels:
3.1.1. Cookies are text files that contain a small amount of information, which are downloaded to your device when you visit a website. Thanks to these files, the website can retain information about your actions and preferences (such as login name, language, font size, and other display settings) for a certain period, so you don't have to re-enter them every time you visit the website or browse its individual pages.
A script is a portion of programming code used to ensure the proper and interactive functionality of web pages. This code runs on the operator’s server or your device.
Pixels are small, invisible text or image elements on a webpage used to monitor site traffic. To enable this, pixels store various data.
3.1.2. Cookies are categorized as follows:
Technical or functional cookies – ensure the proper functioning and usability of the Operator’s website. These cookies are used without consent.
Statistical cookies – allow the Operator to collect statistics on the use of their website. These cookies are used only with user consent.
Marketing / Advertising cookies – are used to create advertising profiles and similar marketing activities. These cookies are used only with user consent.
3.2. How to control cookies:
3.2.1. You can control and/or delete cookies as you wish – see details at aboutcookies.org. You can delete all cookies stored on your computer or other device and set most browsers to prevent them from being saved.
3.3. The Operator’s website uses the following cookies:
All cookies used by the Operator can be found at https://www.cookieserve.com/ by entering the Operator’s website address: www.magaela.com
3.3.1. Cookies shared with third parties:
Google Analytics, Google Ads
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
More information on privacy:
https://support.google.com/analytics/topic/2919631?hl=en&ref_topic=1008008
Facebook Pixels
Provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
More information on privacy:
https://www.facebook.com/about/privacy
IV. Processed Personal Data
4.1. The Operator processes the following personal data on its website:
Name, surname, residence, email address, home phone number, mobile phone number, billing address, delivery address, data obtained from cookies, IP addresses.
V. Contact Details of the Data Protection Officer
5.1. The Operator has appointed a Data Protection Officer in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
Contact: magaela@magaela.sk
5.2. The Operator is also the Seller as defined in the General Terms and Conditions of this website.
VI. Purposes of Personal Data Processing and Data Retention Period
6.1. The purposes of processing personal data of the Data Subject include in particular:
6.1.1. Recording, creating, and processing contracts and client data for the purpose of concluding contracts with third parties.
6.1.2. Processing of accounting documents and records related to the Operator's business activities.
6.1.3. Compliance with legal regulations related to document and record archiving, e.g., under Act No. 431/2002 Coll., the Accounting Act, as amended, and other relevant legislation.
6.1.4. Activities carried out by the Operator in connection with fulfilling requests, orders, contracts, or similar actions initiated by the Data Subject.
6.1.5. Newsletter, marketing, and similar promotional activities carried out by the Operator, provided that the Data Subject has given consent for such marketing and promotional purposes.
6.2. The Operator retains the personal data of the Data Subject only for the period necessary to fulfill the contract and for subsequent archiving in accordance with legal retention periods imposed by legislation.
If the Data Subject has given consent to receive marketing emails and similar offers, their personal data will be processed for these purposes until the consent is withdrawn. However, this period shall not exceed 10 years.
VII. Legal Basis for the Processing of the Data Subject's Personal Data
7.1. The legal basis for processing personal data of the Data Subjects, depending on the specific data processed and the purpose of processing, is the consent of the Data Subjects to the processing of their personal data.
7.2. In cases where the Operator processes personal data based on the Data Subject's consent, such processing will commence only after the consent has been granted by the Data Subject.
7.3. If the Operator processes personal data of the Data Subject for the purposes of pre-contractual negotiations, concluding, and fulfilling the purchase contract, including the delivery of goods, products, or services, the Data Subject is obliged to provide personal data necessary for proper contract performance. Otherwise, such fulfillment is not possible. In this case, personal data is processed without the consent of the Data Subject.
VIII. Recipients or Categories of Recipients of Personal Data
8.1. The recipients or potential recipients of the Data Subject’s personal data include:
8.1.1. Statutory bodies or their members of the Operator.
8.1.2. Individuals performing work for the Operator in an employment or similar relationship.
8.1.3. The Operator’s sales representatives and other collaborators involved in fulfilling the Operator’s tasks. For the purposes of this document, “employees” of the Operator also include all natural persons performing dependent work under employment contracts or agreements outside of employment.
8.1.4. The recipients will also include collaborators, business partners, suppliers, and contractual partners of the Operator, specifically:
Accounting firm
Companies responsible for software development and maintenance
Legal service providers
Consulting service providers
Companies responsible for transporting and delivering products to buyers or third parties
Marketing companies
Social media companies
Payment gateway operators and other payment service providers
8.1.5. Personal data may also be provided to courts, law enforcement authorities, tax authorities, and other government institutions if required by law. The Operator will provide such data to the mentioned institutions based on and in accordance with the laws of the Slovak Republic.
8.1.6. A list of third-party processors and recipients processing personal data of the Data Subject:
Packeta Slovakia s. r. o., Kopčianska 3338/82A, 851 01 Bratislava, IČO: 48136999 – third party providing shipping services
STRIPE PAYMENTS EUROPE, LIMITED, C/O A & L Goodbody, IFSC, North Wall Quay, Dublin, D01 H104, Ireland – third party providing payment gateway services
Lisboa Tax, s.r.o., Kováčska 4, 831 04 Bratislava – third party providing accounting services
IX. Information on the Transfer of Personal Data to Third Countries and Data Retention Period
9.1. Not applicable. The Operator does not transfer personal data to third countries.
X. Information on the Existence of Relevant Rights of the Data Subject
10.1. The Data Subject has, among others, the following rights, whereas:
10.1.1. The rights listed under point 10.1 do not affect other rights of Data Subjects.
10.1.2. The right of access to data under Article 15 of the Regulation, which includes:
The right to obtain confirmation from the Operator as to whether or not personal data concerning the Data Subject are being processed, and if so, to what extent. If such data are being processed, the Data Subject has the right to:
Access the content of the data
Request information from the Operator on:
The purpose of the data processing
The categories of personal data concerned
The recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly in the case of recipients in third countries or international organizations
The envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period
The existence of the right to request from the Operator rectification or erasure of personal data concerning the Data Subject or restriction of processing, and the right to object to such processing
The right to lodge a complaint with a supervisory authority if the personal data were not collected directly from the Data Subject, any available information as to their source
The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation, and, in such cases, at least meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject
Appropriate safeguards pursuant to Article 46 of the Regulation relating to the transfer of personal data, if the personal data are transferred to a third country or to an international organization
10.1.3. The right to obtain a copy of the personal data undergoing processing, provided that this right does not adversely affect the rights and freedoms of others.
10.1.4. The right of the Data Subject to rectification under Article 16 of the Regulation, which includes:
The right to have the Operator correct inaccurate personal data concerning the Data Subject without undue delay.
The right to have incomplete personal data completed, including by means of providing a supplementary statement by the Data Subject.
The Data Subject’s right to the erasure of personal data (the so-called “right to be forgotten”) pursuant to Article 17 of the Regulation, which includes:
10.1.5. the right to request that the Operator erase personal data concerning the Data Subject without undue delay if one of the following conditions is met:
The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
The Data Subject withdraws consent on which the processing is based, and there is no other legal ground for the processing;
The Data Subject objects to the processing pursuant to Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing, or the Data Subject objects to the processing pursuant to Article 21(2);
The personal data have been unlawfully processed;
The personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the Operator is subject;
The personal data were collected in relation to the offer of information society services referred to in Article 8(1) of the Regulation.
10.1.6. The right to have the Operator, who has made the personal data public, take reasonable steps — including technical measures — considering available technology and the cost of implementation, to inform other operators processing the personal data that the Data Subject has requested the erasure of any links to, or copies or replications of, those personal data.
This right to erasure under Article 17(1) and (2) of the Regulation shall not apply to the extent that processing is necessary:
10.1.7. For exercising the right of freedom of expression and information.
10.1.8. For compliance with a legal obligation which requires processing under European Union law or the law of a Member State to which the Operator is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Operator.
10.1.9. For reasons of public interest in the area of public health, in accordance with Article 9(2)(h) and (i) and Article 9(3) of the Regulation.
10.1.10. For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) of the Regulation, insofar as the right referred to in Article 17(1) is likely to render impossible or seriously impair the achievement of the objectives of such processing; or for the establishment, exercise, or defence of legal claims.
10.1.11. The right of the Data Subject to restriction of processing under Article 18 of the Regulation, which includes:
10.1.12. The right to have the Operator restrict the processing of personal data in any of the following cases:
The Data Subject contests the accuracy of the personal data, for a period enabling the Operator to verify the accuracy of the data;
The processing is unlawful, and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
The Operator no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise, or defence of legal claims;
The Data Subject has objected to processing pursuant to Article 21(1) of the Regulation, pending the verification whether the legitimate grounds of the Operator override those of the Data Subject.
10.1.13. The right to ensure that, where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the Data Subject’s consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.
10.1.14. The right to be informed in advance before the restriction of processing is lifted.
10.1.15. The right of the Data Subject to fulfillment of the notification obligation towards recipients under Article 19 of the Regulation, which includes:
The right to have the Operator inform each recipient to whom the personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out pursuant to Article 16, Article 17(1), and Article 18 of the Regulation, unless this proves impossible or involves disproportionate effort. The Data Subject also has the right to request information from the Operator about such recipients.
10.1.16. The right of the Data Subject to data portability under Article 20 of the Regulation, which includes:
The right to receive personal data concerning the Data Subject, which they have provided to the Operator in a structured, commonly used, and machine-readable format, and the right to transmit those data to another operator without hindrance from the Operator, where:
a) The processing is based on the Data Subject’s consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the Regulation, or on a contract pursuant to Article 6(1)(b) of the Regulation, and
b) The processing is carried out by automated means, and
10.1.17. The exercise of the right to obtain personal data in a structured, commonly used, and machine-readable format and the right to transfer those data to another operator without hindrance from the Operator shall not adversely affect the rights and freedoms of others.
10.1.18. The right to have personal data transmitted directly from one controller to another, where technically feasible.
10.1.19. The right of the Data Subject to object pursuant to Article 21 of the Regulation, which includes:
10.1.20. The right to object at any time, on grounds relating to the particular situation of the Data Subject, to the processing of personal data concerning them which is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including profiling based on those provisions.
10.1.21. In the event the right to object at any time, on grounds relating to the Data Subject’s particular situation, to the processing of personal data concerning them based on Article 6(1)(e) or (f) of the Regulation (including profiling based on those provisions) is exercised, the Operator shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or for the establishment, exercise, or defense of legal claims.
10.1.22. The right to object at any time to the processing of personal data concerning the Data Subject for the purposes of direct marketing, including profiling to the extent that it is related to such direct marketing; in this case, where the Data Subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
10.1.23. In connection with the use of information society services, the right to exercise the right to object to processing by automated means using technical specifications.
10.1.24. The right to object, on grounds relating to the Data Subject’s particular situation, to the processing of personal data concerning them for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the Regulation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
10.1.25. The right of the Data Subject related to automated individual decision-making according to Article 22 of the Regulation, which includes:
10.1.26. The right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning them or similarly significantly affects them, except in cases pursuant to Article 22(2) of the Regulation, i.e., except where the decision:
(a) is necessary for entering into or performance of a contract between the Data Subject and the Operator
(b) is authorized by Union or Member State law to which the Operator is subject and which also lays down suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests, or
(c) is based on the Data Subject’s explicit consent.
XI. Information on the Data Subject’s Right to Withdraw Consent to the Processing of Personal Data:
11.1. The Data Subject has the right to withdraw their consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
The Data Subject may withdraw their consent in whole or in part. Partial withdrawal of consent may concern a specific type of processing operation(s), while the lawfulness of processing of personal data for the remaining processing operations shall remain unaffected. Partial withdrawal of consent may also concern specific purposes of processing personal data, while the lawfulness of processing for other purposes shall remain unaffected.
The right to withdraw consent may be exercised by the Data Subject in writing sent to the Operator’s address as registered in the trade register at the time of withdrawal, or electronically via electronic means (by sending an email to the Operator’s email address provided in this document).
XII. Information on the Data Subject’s Right to Lodge a Complaint with a Supervisory Authority:
12.1. The Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if the Data Subject considers that the processing of personal data concerning them infringes the Regulation, without prejudice to any other administrative or judicial remedies.
The Data Subject has the right to be informed by the supervisory authority with which the complaint was lodged about the progress and outcome of the complaint, including the possibility of lodging a judicial remedy pursuant to Article 78 of the Regulation.
12.2. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic.
XIII. Information Related to Automated Decision-Making Including Profiling:
13.1. Since the Operator does not carry out processing of personal data of the Data Subject in the form of automated decision-making including profiling as referred to in Article 22(1) and (4) of the Regulation, the Operator is not obliged to provide information pursuant to Article 13(2)(f) of the Regulation, i.e., information about automated decision-making including profiling and the applied procedure, as well as the significance and the expected consequences of such processing of personal data for the Data Subject. Not applicable.
XIV. Final Provisions
14.1. These Privacy Policies and instructions on personal data protection and cookies form an integral part of the General Terms and Conditions and the Complaint Procedure. The documents – General Terms and Conditions and Complaint Procedure of this Website are published on the domain of the Seller’s Website.
14.2. These Privacy Policies come into force and effect upon their publication on the Seller’s Website on 13.02.2022.
This e-shop is certified at http://www.pravoeshopov.sk
