Privacy

PRINCIPLES OF PERSONAL DATA PROTECTION

 

The right to the protection of personal data, which under the Constitution of the Slovak Republic is an inseparable part of fundamental human rights and freedoms, is reflected in our procedures and measures which, in the position of controller, we apply when processing personal data.

 

The Personal Data Protection Principles (hereinafter the “Principles”) will provide you in particular with information on how we handle your personal data and how you can contact us if needed. The Principles are intended for customers who shop via the controller’s websites (for example www.epyclub.com). The Principles, which follow on from the General Terms and Conditions, also focus on the processing of personal data via social networks (Facebook, Instagram, and the like) and the use of cookies.

 

When processing personal data, we proceed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), Act No. 18/2018 Coll. on Personal Data Protection and on amendments and supplements to certain acts (hereinafter the “Personal Data Protection Act”) and other generally binding legal regulations.

 

In connection with the processing of personal data, we have prepared information for users of the websites (hereinafter the “data subject”) whose personal data we process in connection with the provision of our services, regarding the protection of personal data under Articles 13 and 14 of the General Data Protection Regulation.

  • CONTROLLER

 

The controller EPY s.r.o., Volgogradská 4938/23 , 903 01 Martin, Company ID: 53124383 operates websites (in particular www.epyclub.com) where customers can purchase products sold by the controller, or products whose sale the controller intermediates. The conditions and process of sale are governed by the General Terms and Conditions.

 

 

  • PROCESSING OF PERSONAL DATA

 

The processing of personal data is carried out in accordance with several generally binding legal regulations governing the protection of personal data. The key regulations are in particular the General Data Protection Regulation and the Personal Data Protection Act.

 

The processing of personal data by EPY s.r.o. is also carried out on the basis of special regulations that further govern the conditions of processing, in particular on the basis of:

  • Act No. 22/2004 Coll. on electronic commerce and on amendments and supplements to Act No. 128/2002 Coll. on state control of the internal market in matters of consumer protection and on amendments and supplements to certain acts, as amended by Act No. 284/2002 Coll.,
  • Act No. 351/2011 Coll. on electronic communications, as amended,
  • Act No. 513/1991 Coll. Commercial Code, as amended,
  • Act No. 40/1964 Coll. Civil Code, as amended,
  • Act No. 102/2014 Coll. on consumer protection in the sale of goods or provision of services under a contract concluded at a distance or a contract concluded outside the seller’s business premises and on amendments and supplements to certain acts,
  • Act No. 250/2007 Coll. on consumer protection and on amendment of Act of the Slovak National Council No. 372/1990 Coll. on offences, as amended.

 

  • RESPONSIBLE PERSON

 

The person responsible for the protection of personal data processed by EPY s.r.o. will answer any questions you may have regarding the processing of your personal data. You can contact the responsible person via the following contact details:

  • e-mail address: zodpovednaosoba@epyclub.com
  • registered office address: EPY s.r.o., Volgogradská 4938/23 , 903 01 Martin, Company ID: 47 608 803.

 

In the case of a written request sent to the registered office address of EPY s.r.o., please write the text “GDPR – responsible person” on the envelope.

 

  • IDENTIFICATION AND CONTACT DETAILS OF THE CONTROLLER:

 

The personal data of data subjects is processed by the controller:

EPY s.r.o.

Volgogradská 4938/23 , 903 01 Martin

Company ID: 53124383

registered in the Commercial Register of the District Court Žilina I, Section: Sro , Insert No. 75003/L.:

(also hereinafter as “EPY s.r.o.” or “controller” or “we”)

 

Your personal data is obtained and further processed by EPY s.r.o. (controller), which is responsible for the correctness and lawfulness of processing. As a data subject, you may exercise against EPY s.r.o. the rights set out below.

 

EPY s.r.o. is in the position of controller except in cases where it processes personal data on the instructions of other controllers and on their behalf, when it acquires the status of processor.

 

 

  • PERSONAL DATA WE PROCESS ABOUT YOU

 

EPY s.r.o. processes only such personal data on the basis of which we can ensure and provide you with professional services with due professional care, while the scope of such personal data is determined in accordance with the purposes of personal data processing.

 

EPY s.r.o. processes personal data by automated as well as non-automated means of processing. Automated processing of personal data is carried out through dedicated secured devices.

 

EPY s.r.o. declares that only expressly authorized and instructed persons have permitted access to personal data.

 

EPY s.r.o. ensures the protection of personal data against damage, destruction, loss, alteration, unauthorized interference and disclosure, provision or publication, and against any other impermissible forms of processing. In connection with such security, appropriate technical and organizational measures corresponding to the method of processing personal data have been adopted.

 

Information on the nature of the personal data provided

 

If the legal basis for processing personal data is a contract, the provision of personal data is a contractual requirement. The data subject is obliged to provide personal data; if such data is not provided, it is not possible to conclude a contractual relationship.

 

If the legal basis for processing personal data is a law, the provision of personal data is a legal requirement. The data subject is obliged to provide personal data; otherwise, it is not possible to properly fulfil the controller’s obligations arising from the relevant generally binding legal regulations.

 

If the legal basis for processing personal data is the legitimate interest pursued by the controller or a third party, the purpose of processing specifies what legitimate interest it is.

 

The personal data we process are in particular:

  • identification and contact data, meaning title, first name and last name, permanent residence address, delivery address, contact phone number, e-mail address, bank account details; your identification data form part of the contract you enter into with us in accordance with the terms and conditions,
  • transaction data, meaning data on received and sent payments,
  • communication and interaction data, meaning e.g. data from the use of the web application, data from business communication or data from mutual contact via the relevant contact points,
  • purchase data, meaning information about which products you purchased,
  • shopping behaviour data, meaning the history of your purchases and preferences,
  • complaints data, meaning data contained in your complaint,
  • marketing data, meaning data that are displayed about you on our fan pages on social networks, cookies, as well as data about your preferences relating to personalized marketing offers.

 

 

  • PURPOSES AND LEGAL BASES FOR PROCESSING PERSONAL DATA

 

We process your personal data to the necessary extent, while most processing activities are justified by the fact that such personal data are necessary to provide the requested services or are related to the provision of our services.

 

We process your personal data for the following purposes:

 

  1. user registration “rukahore”

We process personal data for the purpose of registering a natural person who is interested in registering on the website www.epyclub.com. By registering, EPY s.r.o. enables the customer (data subject) unlimited access to the content of their account, where it is possible to track orders, their history and complaints, as well as other benefits in accordance with the general terms and conditions. The purchase of goods is not conditional on customer registration on the portal www.epyclub.com. Creating a customer account is voluntary. The legal basis for processing is the preparation for concluding and the performance of a contract under which the controller’s services will be provided to the data subject. In the event of cancellation of registration, personal data that are not necessary to retain will be disposed of within 3 years from the date of customer registration.

 

  1. performance of the contract when purchasing goods sold by the controller

We process personal data for the purpose of selling goods and providing services by EPY s.r.o. to a registered or unregistered customer (data subject) after payment of the fee. We retain documents relating to the purchase of goods for 10 years following the year of conclusion of the contract.

 

  1. performance of the contract when intermediating the sale of goods of the controller’s business partner

We process personal data for the purpose of intermediating the sale of goods sold by our partner. In the case of this form of purchase, you conclude an intermediation contract with us. Our company will issue you an invoice for postage and packing. The invoice for the goods will be issued by the partner. We retain documents relating to this form of purchase of goods for 10 years following the year of conclusion of the contract.

 

  1. handling complaints or claims

You can submit complaints and claims on the EPY s.r.o. website or via customer service in accordance with the General Terms and Conditions. In the event of a complaint, we need your identification and contact details. Complaints will be handled in accordance with the General Terms and Conditions and applicable legal legislation. We process personal data in accordance with legal regulations. We retain documents relating to a complaint or claim for 10 years following the year of completion of the complaint or handling of the claim.

 

  1. organizing and evaluating consumer contests

On exceptional occasions, EPY s.r.o. organizes contests in which a natural person can participate and win tangible prizes. Information about an ongoing contest is available on the EPY s.r.o. website or on social networks (e.g. Facebook). If you participate in the contest and provide us with your personal data, such personal data will be processed exclusively for the purpose of the contest, its evaluation and sending the prize. We process your personal data on the legal basis of your consent. More detailed information is provided in the statutes or rules of individual contests.

 

  1. asserting or defending our legal claims

In some cases, we are forced to turn to the courts in order to assert our rights and legally protected interests, or we are forced to participate in litigation for the purpose of protecting our rights and legally protected interests. Most often, claims are pursued arising from non-performance of contractual obligations. The retention period of personal data for this processing purpose is 10 years from the final decision of the court or other public authority.

 

  1. marketing in the form of sending information about news or other useful information relating to the controller’s services

EPY s.r.o. has a legitimate interest in contacting you (as a customer) and sending you commercial offers and information about its own products or services, via your e-mail address, or providing you with these commercial offers and information by phone. The legitimate interest is informing customers about news and other important facts relating to the services of EPY s.r.o. The data subject can freely set subscription or unsubscription from these e-mail messages in their user account on the controller’s website, or if they do not have an account, they can do so in the newsletter preference settings (separate website). The retention period for this purpose is 3 years from the date of the last login to the user account or from the date of the last purchase of goods.

 

  1. marketing based on the use of cookies

For the purpose of creating personalized (tailor-made) marketing offers, we also use cookies. Personal data are processed on the basis of the data subject’s consent pursuant to Art. 6(1)(a) of the General Data Protection Regulation. The retention period for this purpose is 3 months from the date of the last access to our websites.

 

  1. third-party cookies

Third-party cookies are created by companies whose services EPY s.r.o. uses when operating the websites. Some websites may contain content from other websites (Youtube, Facebook and the like), which may create their own cookies stored by the browser on the data subject’s computer or similar device. In particular, identification data (IP address) and data on the data subject’s activities and preferences during their visit to our websites are obtained. Personal data are processed on the basis of the data subject’s consent pursuant to Art. 6(1)(a) of the General Data Protection Regulation, which the data subject grants to the third party. The retention period for this purpose is determined by the third party.

 

  1. operating fan pages created on social networks

In order to simplify communication between EPY s.r.o. and its customers or supporters, we have set up fan pages on social networks (e.g. Facebook). Personal data are processed for the purpose of preparing or performing a contract pursuant to Art. 6(1)(b) of the General Data Protection Regulation or on the basis of the data subject’s consent pursuant to Art. 6(1)(a). The retention period for this purpose corresponds to the duration of the contract or the granted consent.

 

  1. maintaining accounting records

As a regulated entity, EPY s.r.o. is subject to tax and accounting obligations arising from legal regulations. In order to fulfil these obligations towards regulators, we process your personal data. The retention period is 10 years following the year to which payments associated with the given user relate.

 

  1. handling data subject requests

In order for us to respond to your request, you need to identify yourself. We retain the data subject’s request for 5 years following the year in which the request was handled.

 

  1. verified by customers

This concerns the provision of the Verified by Customers service, which is ensured for the controller by Heureka ShoPPing s.r.o., Karolinská 650/1, Karlin, 186 00 Prague 8. The purpose of the service is to obtain an assessment of the quality of services provided by the controller within the Heureka.sk portal and to provide this assessment to the controller and other users of the Heureka.sk portal. The legitimate interest is obtaining evaluations from customers of the controller’s web portals for the purpose of improving services. We retain evaluations for 5 years following the year in which the evaluation was provided.

 

EPY s.r.o. also processes personal data on the basis of legitimate interest. In this case, EPY s.r.o. takes steps to ensure that the impact on your privacy is minimized and that processing does not upset the balance between the legitimate interests of EPY s.r.o. and your privacy.

 

 

  • AUTOMATED INDIVIDUAL DECISION-MAKING INCLUDING PROFILING 

 

The controller also processes the data subject’s personal data by automated means of processing; however, the result is not decisions that would have legal effects on the data subject or similarly significantly affect them. Personal data will not be used for automated individual decision-making including profiling within the meaning of Art. 22 of the General Data Protection Regulation.

 

 

  • PERSONAL DATA PROTECTION

 

Your personal data are processed by automated as well as non-automated means of processing within information systems that are protected and secured in accordance with relevant security standards and legal regulations dealing with personal data protection.

 

Within the personnel structure of EPY s.r.o., authorization to handle personal data is granted only to persons authorized by the controller, who have been duly acquainted with the controller’s instructions and instructed on the possible consequences of failure to comply with these instructions.

 

EPY s.r.o. declares that it adheres to the principle of data minimization and processes only such personal data as are necessary to achieve the purpose of processing. Personal data are processed for predetermined purposes and are not processed for any other purpose.

 

When processing personal data, EPY s.r.o. proceeds in accordance with its internal policy governing personal data protection and information system security. EPY s.r.o. assesses and continuously evaluates whether a given processing of personal data would pose a high risk for data subjects and interfere with their privacy in an unreasonable manner. Based on this observation, a detailed assessment of risks and impacts on the privacy of data subjects is carried out, the result of which is taken into account when setting and implementing the controller’s procedures.

 

To secure personal data against their unauthorized or accidental disclosure to a third party, we use appropriate and suitable security technical and organizational measures. Technical measures consist in applying technologies that prevent unauthorized access by third parties to personal data. For maximum protection, encryption of personal data and password protection for access to EPY s.r.o.’s internal systems, or access to personal data stored on EPY s.r.o.’s servers, are used. Organizational measures consist of a set of behavioural rules for our employees that are incorporated into the controller’s internal regulations. EPY s.r.o.’s internal regulations are considered confidential.

 

 

  • RECIPIENTS OF PERSONAL DATA

 

In exceptional cases, your personal data may be provided to third parties, in particular when such procedure is permitted by the relevant legal regulation.

 

Suppliers and business partners

Some processing activities are also carried out through our suppliers. When selecting suppliers, we pay particular attention to their professional, technical, organizational and personnel competence so that the security of processed personal data is guaranteed.

 

Our suppliers and business partners include in particular, but not only:

  • server service providers,
  • programming service providers,
  • providers of accounting and legal services,
  • providers of services ensuring handling of complaints and packing of goods,
  • agencies ensuring the management of social networks and advertising campaigns,
  • the company providing the Verified by Customers service.

 

Authorities entrusted with performing supervision

In connection with carrying out inspections or supervision, your personal data may be provided to authorities that by law supervise the performance of our activity, e.g. the Office for Personal Data Protection of the Slovak Republic, the Slovak Trade Inspection, and others.

 

Enforcement of claims and assertion of rights:

In connection with enforcing our rights and legally protected interests, in justified cases we provide your personal data to the competent courts, bailiffs, notaries, law firms, court experts, or other external entities engaged in the enforcement of claims or the assertion of rights.

 

Public administration authorities:

On the basis of special legal regulations, we provide personal data to certain entities to whom we are obliged to provide such data upon their request for cooperation, e.g. state administration authorities, courts, prosecutor’s offices, law enforcement authorities or the Financial Administration of the Slovak Republic.

 

Other authorities, institutions and entities:

Social Insurance Agency, health insurance company, audit company, archive, and others.

 

 

  • RETENTION PERIOD OF PERSONAL DATA

 

We retain and protect your personal data for the period stipulated by applicable legal regulations. If we retain your personal data on the basis of your consent, we retain the personal data for the period for which you granted us your consent. Retention periods differ depending on the specific purpose for which the personal data are processed. The set retention period is based on the principle of storage minimization.

 

 

  • RIGHTS OF DATA SUBJECTS

 

As a data subject you have the following rights:

 

Right of access to data under Art. 15 of the General Data Protection Regulation

You have the right to obtain from us information as to whether we process your personal data. If we process your personal data, you have the right to obtain access to such personal data, to the extent of: the purpose of processing, category of personal data, recipients of personal data, duration of processing of personal data and information about the source from which we obtained your personal data. You also have the right to be provided with a copy of your personal data, however it is necessary that you expressly state this in your request. If you request additional copies, we have the right to charge a reasonable fee for the provision of additional copies. The rights of third parties, including other persons who provided personal data to EPY s.r.o., cannot be restricted thereby and EPY s.r.o. cannot make foreign personal data available to you in this way.

 

Right to rectification or completion under Art. 16 of the General Data Protection Regulation

You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data that we process about you. By exercising this right properly, you will help keep your personal data accurate and up to date.

 

Right to erasure (right “to be forgotten”) under Art. 17 of the General Data Protection Regulation

You have the right to request that your personal data be erased without undue delay if one of the following reasons is met:

  1. the personal data are no longer necessary for the purposes for which they were obtained or otherwise processed,
  2. the data subject withdraws consent pursuant to Article 6(1)(a) or withdraws explicit consent pursuant to Article 9(2)(a) of the General Data Protection Regulation, and there is no other legal basis for processing,
  3. the data subject objects to processing pursuant to Article 21(1) of the General Data Protection Regulation (objection to legitimate interest or public interest), if there are no overriding legitimate grounds for processing, or the data subject objects to processing pursuant to Article 21(2) (objection to direct marketing),
  4. the personal data were processed unlawfully,
  5. the personal data must be erased in order to comply with a legal obligation under Union law or the law of the Member State to which EPY s.r.o. is subject,
  6. the personal data were collected in connection with the offer of information society services under Article 8(1) of the General Data Protection Regulation (child’s consent).

 

EPY s.r.o. is not obliged to erase your personal data if the processing is:

  1. for exercising the right of freedom of expression and information,
  2. for compliance with a legal obligation which requires processing under Union law or the law of the Member State to which EPY s.r.o. is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in EPY s.r.o.,
  3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) as well as Article 9(3) of the General Data Protection Regulation,
  4. for the purposes of archiving in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the General Data Protection Regulation, insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of such processing, or
  5. for the establishment, exercise or defence of legal claims.

 

Right to restriction of processing under Art. 18 of the General Data Protection Regulation

You have the right, based on a request to block your personal data (restriction of processing of your personal data to their storage; other processing operations during the restriction are not permitted) in the following cases:

  1. restriction of processing of your personal data during verification of their accuracy,
  2. if your personal data are processed unlawfully and you request, instead of erasure, only restriction of their processing (storage only),
  3. you need your personal data for the establishment, exercise or defence of legal claims,
  4. you have objected to processing pursuant to Article 21(1) of the General Data Protection Regulation (legitimate interest or public interest), pending the verification whether the legitimate grounds of EPY s.r.o. override your legitimate interests.

 

If processing of personal data were restricted, EPY s.r.o. may further only store the personal data or process them:

  1. for the establishment, exercise or defence of legal claims,
  2. for the protection of the rights of another natural or legal person,
  3. for reasons of important public interest of the Union or a Member State,
  4. with the consent of the data subject.

 

If a situation were to arise that would lead to lifting the restriction of processing, EPY s.r.o. will inform the data subject of this fact in advance.

 

Right to data portability under Art. 20 of the General Data Protection Regulation

You have the right to obtain your personal data that you have provided to us in a structured, commonly used and machine-readable format. You have the right to request that we transmit your personal data from EPY s.r.o. to another controller you specify in your request, provided that it is technically feasible.

 

The right to data portability applies in cases where:

  1. processing is based on the legal basis of consent or a contract,
  2. processing is carried out by automated means.

 

Right to object under Art. 21 of the General Data Protection Regulation

You have the right at any time to object to the processing of your personal data if the legal basis for processing is legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation, by sending a written request to the e-mail address zodpovednaosoba@epyclub.com, by post or by personal delivery of a written request at the registered office of EPY s.r.o.

 

Upon receipt of the objection, we will dispose of your personal data, except for the following cases:

  1. if EPY s.r.o. demonstrates compelling legitimate grounds for processing which override your interests, rights and freedoms, or
  2. if it is demonstrated that EPY s.r.o. needs your personal data for the establishment, exercise or defence of legal claims;

 

Your objections do not affect the processing of your personal data prior to receipt of your objections.

 

Automated individual decision-making including profiling under Art. 22 of the General Data Protection Regulation

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

 

This right does not apply if the decision is:

  1. necessary for the conclusion or performance of a contract between the data subject and EPY s.r.o.,
  2. authorized by Union law or the law of the Member State to which EPY s.r.o. is subject and which also lays down suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject,
  3. based on the data subject’s explicit consent.

 

When providing our services, there is no automated individual decision-making within the meaning of the General Data Protection Regulation.

 

Right to withdraw consent under Art. 7 of the General Data Protection Regulation

If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Consent may be withdrawn under the same conditions under which it was granted. The data subject may also withdraw consent in the following ways:

  1. by e-mail message sent to zodpovednaosoba@epyclub.com
  2. by sending a written request to the registered office address of EPY s.r.o. with the text “GDPR – withdrawal of consent” stated on the envelope.

Withdrawal of consent does not affect the lawfulness of processing based on consent granted before its withdrawal (for example contests).

 

Right to lodge a complaint with a supervisory authority under Art. 77 of the General Data Protection Regulation

If you believe that your rights regarding personal data have been violated or that the processing of your data has been violated, you have the right to lodge a complaint with the supervisory authority, which is:

 

Office for Personal Data Protection of the Slovak Republic

Hraničná 4826/12

820 07 Bratislava 27

 

phone:          +421 2 3231 3214

e-mail:statny.dozor@pdp.gov.sk

 

Exercising your rights under Art. 12 of the General Data Protection Regulation

EPY s.r.o. will provide information regarding the processing of personal data only upon the request of the data subject when exercising their rights, provided that it is demonstrably able to identify the data subject. Without successful verification of your identity, EPY s.r.o. is not obliged to provide any information regarding the processing of personal data. In doing so, EPY s.r.o. prevents unauthorized access to your personal data and violation of your rights by an unauthorized person.

 

You may exercise your personal data rights in the following ways:

  1. in person at the registered office of EPY s.r.o.,
  2. by post,
  3. by email sent to zodpovednaosoba@epyclub.com.

 

You may also submit the completed and signed request in person directly at our registry office at the registered office address of EPY s.r.o. The request must contain all necessary information and attachments required for its handling and for assessing your claims regarding the processing of personal data. If your request is incomplete, we will contact you in order to complete it.

 

 

  • FINAL PROVISIONS

 

EPY s.r.o. reserves the right to any update of this information obligation, in particular in connection with changes in legislative processes. The current version will always be available on the website www.epyclub.com and other websites operated by the controller. If there is a substantial change in personal data protection, in particular the method of processing personal data, EPY s.r.o. will fulfil its information obligation by visibly publishing a notice prior to implementing the changes.

 

With these Principles we want to assure you that we approach personal data with the greatest care and respect, guided by applicable legal regulations and using the available level of technical protection. If you have questions regarding personal data protection that you did not find an answer to in this document, write to zodpovednaosoba@epyclub.com

 

In Senec on 10.2.2022