PRIVACY POLICY OF EL CAMINO VERDE S.R.O.
1. Introduction
The purpose of this Personal Data Protection document (hereinafter referred to as the "Policy") is a detailed explanation of the terms of personal data processing carried out by the company EL CAMINO VERDE, s.r.o., IČO: 26207516, registered office: K Zahrádkám 98, Kamenice 251 68 (hereinafter referred to as " administrator"), when operating services in the warehouse at K Zahrádkám 98, Kamenice 251 68. The administrator determines the purpose and means of personal data processing in the client program.
As part of the offered services, the personal data of the client is processed, which can only be a fully independent natural person over the age of 16 (hereinafter also referred to as "participant" or "subject"). Personal data is any information relating to a specified or determinable data subject. A subject is considered to be determined or determinable if the subject can be directly or indirectly identified mainly on the basis of a number, code or one or more elements specific to its physical, physiological, psychological, economic, cultural or social identity; personal data is, for example, name, surname, e-mail, mobile phone; personal data can also be data on a purchase preference in connection with other personal data (collectively referred to as "personal data" or "data").
The subject's personal data is processed in accordance with this policy. Personal data processing is any operation or set of operations carried out with personal data automatically or manually, by means of computer technology or by other means, in particular the collection, storage on information carriers, making available, editing or changing, searching, using, forwarding, storing, sorting or combining, blocking and disposal (hereinafter referred to as "processing").
The subject is obliged to read these policies carefully before giving consent to processing. If the entity does not understand any point or condition according to these policies, it can contact the administrator at the contacts listed below.
The administrator takes great care in protecting the provided personal data. Personal data is processed by the administrator transparently and in accordance with the relevant effective legislation.
As a rule, the administrator collects only the personal data that he really needs for the specified purpose. The administrator does everything in order to continuously evaluate the processing both from the point of view of proper security, minimization of personal data, and also from the point of view of transparency, correctness and legality. The administrator adheres to the principles of responsibility, integrity, confidentiality, accuracy and storage limitations.
These policies are valid and effective from 07/01/2020. The administrator is entitled to change the policy if necessary, but this does not affect the conditions of already agreed processing. When using the offered services, the entity is obliged to regularly check the wording of the policies.
2. Contact details of the administrator
The administrator's contact details are as follows: www.mahonydiet.com info@mahonydiet.com
EL CAMINO VERDE, s.r.o., K Zahrádkám 98, Kamenice 251 68, ID: 26207516, VAT number: CZ26207516
3. Purpose of personal data processing
Personal data is processed in such a way that it is possible to ensure proper use of the services offered by the subject.
The purpose of personal data processing is therefore to ensure the provision of all benefits and services resulting from the activity of NZZ, including the provision of discounts, promotional offers and benefits, provision of additional services, services including the sending of commercial messages via electronic contacts (telephone, e-mail address).
To fulfill the purpose, profiling will be carried out (segmentation mainly according to the age and gender of the subject or according to data on purchases made, for the purpose of selecting suitable benefits and offers from the administrator. In the event that the subject uses the client program also in the Internet environment, there will be profiling also using electronic means (especially according to behavior and preferences), to ensure better user comfort and full site functionality.
In particular, the following processing operations (activities) leading to the given purpose will be carried out within the scope of the stated purpose:
registration of clients and their verification,
updating and supplementing client data
segmentation for sending appropriate information,
segmentation for sending suitable offers,
sending information necessary for clients, sending so-called transaction messages,
sending information in the field of health, cosmetics and body care, including invitations to educational events and proposals for additional services.
4. Legal basis of processing
The legal basis of the processing is the subject's informed and voluntary consent, which is granted to the administrator for the specified purpose.
The subject is not obliged to provide personal data and grant consent. However, if the subject does not give consent, the operations from point 4 cannot be performed
In the event that the subject withdraws its consent, all activities will be terminated according to the rules.
After withdrawal of consent, the legal basis is the administrator's legitimate interest for the purpose of demonstrating compliance during inspections by supervisory authorities and for the defense and exercise of rights.
5. Scope of processed personal data
The subject's personal data is processed to the extent necessary to fulfill the given purpose.
Your personal data is processed to the following extent: Data submitted and filled in by the subject: name, surname, email, mobile phone, correspondence address (municipality, street, identification number, zip code, part of municipality, state), gender and date of birth, possibly also title, billing address , delivery address and other data filled in during registration or later added or changed by the entity;
Data detected by the administrator based on operations from point 4 and within the scope of the services offered, i.e. also data on health status (the scope of this data differs for each entity): data relating to products purchased within the scope of the service offered and related transaction data on the price, on amount of discount, type of product, date and place of purchase;
The administrator does not process special categories of personal data, which are data indicating the subject's racial or ethnic origin, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
6. Period of Processing of Personal Data
The subject's personal data will be processed from the date of signing the informed consent according to the rules.
The subject is entitled at any time to request the termination of data processing according to the rules.
After withdrawal of consent, the subject's personal data are kept for the reason of the administrator's legitimate interest consisting in the right to defend and exercise rights, and only to the limited necessary extent for the necessary period.
7. Method of processing, processors and recipients
Personal data will be processed in an automated and manual manner by the controller's own employees or by persons in the position of processors whom the controller has authorized to process personal data and with whom it has concluded relevant contracts on the processing of personal data (such person hereinafter referred to as the "processor"). The processing will also be carried out by means of computer technology.
The entity acknowledges that the administrator uses processors to fulfill the given purpose, who have access to the necessary range of personal data of the entity to fulfill their task. These are processors mainly from the following categories:
persons performing accounting, auditing, legal services;
persons providing IT services;
marketing persons;
persons engaged in the processing of printed materials;
persons involved in the development, sale and service of pharmacy systems;
persons involved in the development and implementation of enterprise systems;
web and mobile application developers;
persons engaged in online communication, including communication on social networks;
persons engaged in determining customer satisfaction.
The subject's personal data may also be provided to other recipients. These recipients are mainly persons in the Czech Republic or those providing the transport of shipments or operating the method of payment for goods chosen by the entity.
An up-to-date list of recipients, including processors, can be requested from the administrator's contacts listed in Article II, paragraph 1 of this policy.
Personal data may also be provided to public authorities authorized to obtain personal data according to relevant legal regulations. The processing of personal data by these public authorities must be in accordance with the applicable data protection rules for the given purpose of processing.
8. Exercise of rights, withdrawal of consent
All questions, comments or requests regarding the processing of personal data, including revocation of consent to the processing of personal data, can be directed to the administrator's contacts listed in Article II, paragraph 1 of these policies.
If the subject's inquiry or request for personal data processing according to the previous paragraph is not satisfactorily resolved, or if the subject has any other question, he may contact the administrator's representative for the protection of personal data at the contacts listed in Article II, paragraph 2 of these policies.
The subject can also request the termination of sending commercial communications by electronic means in the manner specified in each individual commercial communication.
The request, question, revocation of consent, exercise of right, request for access or other request of the subject will be processed without unnecessary delay after acceptance by the administrator, in justified cases no longer than 1 month. If necessary, this deadline can be extended by another 2 months, taking into account the complexity and number of applications. The withdrawal of consent to the sending of commercial communications via electronic contacts (telephone, e-mail address) will be processed without delay, within 7 calendar days at the latest.
If necessary, when processing requests according to this Article VIII. policy, additional information is required by the administrator to assign a person to a specific entity. In justified cases, to protect the rights of subjects, a control/verification of the applicant's identification may be required.
The supervisory body for the processing of personal data is the Office for the Protection of Personal Data, whose contact details are listed at www.uoou.cz. The entity is entitled to file a complaint with the supervisory authority.
9. Detailed instruction on rights
Right of access
The subject has the right to obtain confirmation from the administrator as to whether his personal data is being processed, and if so, he has the right to request information on the purpose, categories, source, recipients, processing time, existence of the right to correction, erasure, restrictions, objections and filing a complaint at the supervisory authority.
The administrator has measures in place to provide each subject with all information and communications about the processing. The administrator will provide the information electronically or in writing.
The administrator will not refuse to comply with the subject's request in the exercise of the subject's rights, unless he can reliably establish the identity of the data subject to whom the data in question relates.
All information, communications and actions are provided free of charge. If the requests submitted by the entity are evaluated as manifestly unfounded or unreasonable, and especially if they are repeated, the administrator can either: (i) impose a reasonable fee taking into account the administrative costs associated with providing the requested information, communication or taking the requested actions, or (ii) reject the requests comply.
If the administrator has reasonable doubts about the identity of the natural person who submits the request, he may request the provision of additional information necessary to confirm the subject.
Right to rectification
The subject has the right to have the administrator correct inaccurate personal data concerning the subject without undue delay.
Taking into account the purposes of processing, the subject also has the right to supplement incomplete personal data, including by providing an additional statement.
Right to erasure ("right to be forgotten")
The subject has the right to have the administrator delete personal data relating to the subject without undue delay, and the administrator has the obligation to delete personal data without undue delay if one of the following reasons is given:
the personal data are no longer needed for the purposes for which they were collected or otherwise processed;
the entity revokes the consent on the basis of which the data was processed and there is no other legal reason for the processing;
the subject objects to the processing (as per the “Right to Object” below) and there are no overriding legitimate grounds for the processing;
personal data were processed unlawfully;
personal data must be deleted to fulfill a legal obligation set out in the law of the European Union or a Member State that applies to the administrator;
personal data were collected in connection with the offer of information society services in the case of a person under the age of 16, for whom the person exercising parental responsibility must give consent to the processing in accordance with effective legislation.
The above does not apply if the processing is necessary:
for the exercise of the right to freedom of expression and information;
for the fulfillment of a legal obligation that requires processing according to legal regulations, or for the fulfillment of a task carried out in the public interest or in the exercise of public authority with which the administrator is entrusted;
for reasons of public interest in the field of public health;
for the purposes of archiving in the public interest, for the purposes of scientific or historical research or for statistical purposes, if it is likely that the aforementioned right would make it impossible or seriously jeopardize the fulfillment of the objectives of the said processing;
for the determination, exercise or defense of legal claims.
Right to restriction of processing
The subject has the right to have the controller restrict the processing in any of the following cases:
if the subject denies the accuracy of the personal data, for the time required for the controller to verify the accuracy of the personal data;
the processing is unlawful and the entity refuses to delete the personal data and requests instead to restrict its use;
the administrator no longer needs the personal data for processing purposes, but the subject requires them for the determination, exercise or defense of legal claims;
if the subject has objected to the processing, until it has been verified whether the legitimate reasons of the controller outweigh the legitimate reasons of the subject.
If processing has been restricted according to the above-mentioned "Rights to restriction of processing", these personal data, with the exception of their storage, may only be processed with the consent of the subject, or for the purpose of determining, exercising or defending legal claims, for the purpose of protecting the rights of other physical or legal entities person or for reasons of important public interest of the European Union or a member state.
Right to data portability
The subject has the right to receive the personal data relating to him, which he has communicated to the controller, in a structured, commonly used and machine-readable format, and the right to transfer this data to another controller without hindrance from the controller to whom the personal data was provided, in if:
the processing is based on consent or on a contract; or
processing is done automatically.
The subject of "Rights to Portability" is not data obtained by the activity of the administrator.
When exercising its right to data portability, the subject has the right to have personal data transferred directly by the administrator to another administrator, if this is technically feasible.
The exercise of the above-mentioned "Right to data portability" does not affect the above-mentioned "Right to erasure".
The above-mentioned "Right to Data Portability" must not adversely affect the rights and freedoms of other persons.
The right to object
For reasons relating to the specific situation of the subject, the subject has the right to object at any time to the processing of personal data concerning him and which are processed on the basis of a legal reason consisting in the legitimate interest of the controller.
If personal data is processed for the purposes of defense against the subject's claims, collection of claims by the administrator, to document compliance during the inspection by the supervisory authority, the entity has the right to raise an objection at any time. Based on this objection, the administrator will review the processing and will not process the personal data further, unless there are serious legitimate reasons for the processing that outweigh the interests or rights and freedoms of the data subject, or for the determination, exercise or defense of legal claims.
Automated individual decision-making, including profiling
The subject has the right not to be the subject of any decision based solely on automated processing, including profiling, which has legal effects for the subject or significantly affects it in a similar way.
The administrator does not base any of his decisions in the operation of the client program exclusively on the automated processing and profiling carried out by the administrator, it does not have legal effects for the subject, nor does it significantly affect him.
10. Cookies
In order to improve the quality of the website, we use so-called cookies, which store small files through the browser, which allow us to better customize the website and improve the quality of the content. Cookies are small text files that are from websites and allow to obtain information such as information about the visit or other settings, in order to make each visit as pleasant as possible (e.g. for display on a mobile phone) or to display advertisements on our products.
By using the website, the visitor agrees to the storage of cookies. The use of cookies can be limited or completely blocked in the web browser settings. Information on the settings of a specific browser can be found at these addresses
Internet Explorer: windows.microsoft.com
Google Chrome: support.google.com
Mozilla Firefox: support.mozilla.org
Opera: help.opera.com
Safari: support.apple.com
More information on cookies can be found here: https://www.google.cz/intl/cs/policies/technologies/cookies.
