Personal data processing policies

within the meaning of Regulation (EC) No. 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "General Regulation") and other legal regulations of the Czech Republic. The full text of the General Regulation is available here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504

The administrator of personal data is Smile, by Rudy sro, with its registered office at Pražákova 1008/69, 639 00 Brno, Company ID 23056631, registered in the Commercial Register kept by the Regional Court in Brno under file number C 144165 (hereinafter referred to as the “administrator” or “company”). Contact e-mail: info@smilebyrudy.sk.

The purpose of these Principles is to inform you, as natural persons and data subjects within the meaning of the General Regulation, about the processing of your personal data in connection with purchasing goods from the company's range via the online store at www.smilebyrudy.sk (hereinafter referred to as the "e-shop").

The company obtains your personal data in particular in the following cases:

a) Ordering goods or services from the company's assortment via the e-shop at www.smilebyrudy.sk.

In such a case, you provide our company with, in particular, your identification data (name, surname/name of legal entity, address/registered office, company ID, e-mail address, telephone number) and other data that are necessary to conclude a contract or accept and deliver an order, register on the company's e-shop, issue prescribed accounting documents, resolve any claims arising from the contract (complaints, return of goods, etc.).

b) Communication with the company

This includes all communication with the company, e.g. for the purpose of non-binding requests for goods or services, communication regarding details of delivery of purchased goods, negotiations on payment terms, complaints and complaint procedures, etc. This communication can take place by telephone, electronically or in writing.

c) Visiting the e-shop

When visiting the company's e-shop, the company's server sends a small amount of data to the data subject's device and stores it there, and with each subsequent visit, the data is sent back to the server - this short text file contains a specific string of characters with unique information about the data subject and is known as a cookie.

The law states that cookies can be stored on a device if they are strictly necessary for the operation of the website in question (mandatory cookies). For all other types of cookies, the consent of the device owner is required. Most browsers allow you to control how cookies are set and used while browsing and allow you to delete cookies and browsing data. However, data subjects have the option of setting their browser to block cookies or to notify them when cookies are sent. However, some services or functions will not function properly without cookies.

The company's e-shop only uses the following cookies:

• Necessary cookies - these cookies are essential for the website to function properly, including features such as logging in and adding items to your cart.

• Personalized cookies – these cookies store details of your actions in order to personalize your next visit to the website.

• Marketing cookies – these cookies are used to optimize marketing communications and display advertisements on other sites.

• Analytical cookies - these cookies help us understand how you interact with the site. We use this data to identify areas for improvement.

Consent to cookies (except for mandatory cookies) is obtained through the cookie bar, and you have the option to revoke your consent at any time (e.g. by clicking on a special section within the website or by displaying the cookie bar again with the option to change settings).

The company processes your personal data exclusively for the following lawful reasons and purposes:

a) Performance of the contract. In such a case, the purpose of the processing is to first identify you so that a contract can be concluded with you and subsequently fulfill all obligations arising from the concluded contract. This category authorizing the processing of personal data also includes the negotiation of the conclusion of the contract itself, i.e. for example, placing goods in the basket on the company's e-shop, sending a request for a certain type of goods, etc. Performance of the contract also means the situation where you have login details for our e-shop, through which you subsequently carry out individual orders and purchases of goods.

b) Fulfillment of legal obligations. The company also collects your personal data if required to do so by legal regulations, e.g. in the field of accounting, tax records, fulfillment of tax obligations, etc.

c) Legitimate interest. Legitimate interest is understood as a situation where the company does not need to know certain personal data, even though it is not required by law or contract, but it is still a completely legitimate requirement for the company to have this data and to further handle it. A typical example is contacting existing customers with an offer of similar goods to those they already purchase, in the form of so-called newsletters.

The company processes personal data in the following scope: name, surname, title, company ID, VAT number, contact email and telephone number, billing and delivery address. Processing means in particular their collection, retention, storage and handling for the purposes stated above.

The company generally does not transfer your personal data to other independent administrators, except in situations where it is required to do so by law (e.g. public authorities).

To ensure the proper operation of its e-shop and the fulfillment of contractual obligations, the company uses the services of selected personal data processors who process personal data on behalf of the company and on the basis of its instructions. The company has concluded proper processing contracts with these processors in accordance with Article 28 of the General Regulation. These include in particular:

• providers of accounting services and tax advice,

• IT service providers (e.g. hosting, e-shop management),

• postal service providers, couriers and private carriers,

• legal service providers (if they act as processors).

In justified cases and to the necessary extent, personal data may also be transferred to other processors on the basis of legal regulations, for the fulfillment of a contract or for reasons of the legitimate interest of the company.

The Company stores your personal data for the necessary period of time. In the case of processing based on a legal obligation or performance of a contract, this period is determined by the legal regulations of the Czech Republic regarding the requirements for archiving accounting documents, tax documents, tax records, etc.

In the case of processing based on legitimate interest, your personal data is stored for the necessary period of time, which in this case means the duration of the legitimate interest and then for a period of 4 years, taking into account the statutory limitation period.

The provision of personal data for the purposes of fulfilling a contract, fulfilling legal obligations or for the legitimate interests of the company is a necessary condition for the provision of the requested goods or services. Without this data, it is not possible to conclude and perform a contract with you. The provision of personal data for purposes that are based on your consent (e.g. certain marketing activities beyond the scope of legitimate interest) is completely voluntary and its refusal does not affect the provision of goods or services.

In connection with the processing of personal data, you, i.e. the data subject, have the following rights under the General Regulation:

• right of access to data: the data subject has the right to information about whether and what personal data about him/her are being processed by the company, and if so, to other information referred to in Article 15 of the General Regulation;

• the right to rectify data: the data subject may request that their incorrect or incomplete data be immediately rectified or supplemented; however, the data subject is responsible for the correctness of the data in the inquiry form, the company considers all the data provided to be correct and complete;

• right to erasure: the data subject may request that data concerning him or her be erased if consent to their processing has been withdrawn and in other cases provided for in Article 17 of the General Regulation; the right to erasure shall not apply if the company is obliged to process personal data by a legal regulation, if their processing is necessary for the exercise of the right to freedom of expression and the right to information or for the determination, exercise and defence of the company's legal claims;

• the right to restriction of processing: the data subject may request that the processing of personal data be restricted, in particular if the personal data are inaccurate, until they are corrected, and in other cases referred to in Article 18 of the General Regulation;

• the right to data portability: if personal data are processed on the basis of consent and at the same time by automated means, the data subject may request their provision in a machine-readable format and is entitled to provide the data to third parties at their discretion;

• the right to object to processing: if the data subject does not agree with the way in which his or her personal data is processed, he or she may, under the conditions set out in Article 21 of the General Regulation, lodge an objection to this with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7;

• right to withdraw consent and to withhold data: the data subject may withdraw consent to processing at any time by sending an e-mail to the company's address above and, in the case of newsletters sent by e-mail, also by unsubscribing by clicking on the link at the end of the e-mail. The data subject is not obliged to provide personal data, but in such a case the requested offer cannot be provided.

In the Czech Republic, the processing of personal data is subject to supervision by the supervisory authority, which is the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7.

In accordance with Article 77 of the General Regulation, you have the right to lodge a complaint with a supervisory authority against the way in which your personal data is processed.

The Company may update this Policy from time to time to reflect operational, legal or regulatory changes. The Company will post the revised Policy on www.smilebyrudy.sk, updating the “Last Updated” date, and take any other steps required by applicable law.