Principles of personal data processing

Personal Data Processing Policy

Basic Provisions

1. The data controller is OSEQ s.r.o., ID: 09950435, with its registered office at Prokopa Holého 586, 281 51 Velký Osek, registered in the Commercial Register at the Municipal Court in Prague, Section C, Insert 345068/MSPH (hereinafter referred to as “the Controller”). The Controller can be contacted in writing at the above address or via email at info@oseq.eu.
2. Personal data means all information about a natural person provided to the Controller based on a purchase agreement, registration in the Controller’s e-shop, or consent to processing personal data for newsletter subscriptions sent by the Controller.
3. The Controller has not appointed a Data Protection Officer.
4. These policies are issued in accordance with Regulation (EU) 2016/679 (GDPR) on the protection of natural persons regarding the processing of personal data.

Scope of Personal Data Processing
In connection with the provision of services and the sale of goods, the Controller processes the following categories of personal data:

• Academic title
• First and last name
• Business name
• Company ID (IČO), VAT ID (DIČ)
• Email address
• Telephone number
• Fax number
• Permanent residence address
• Business address
• Billing address
• Personal data obtained from Cookies

Purpose, Legal Basis, and Duration of Personal Data Processing
The data processed depends on the purpose: some are processed based on a contract, the legitimate interest of the Controller, or by law (without consent); others only with consent.

Processing for Contract Fulfillment, Legal Obligations, and Legitimate Interests
Providing personal data necessary for contract fulfillment, legal obligations, or protection of the Controller’s legitimate interests is mandatory. Without providing such data, services or goods cannot be provided. Consent is not required for this processing. Refusal to provide data for these purposes makes contract performance impossible.

Purposes include:

• Sale of goods or services (contract fulfillment)
• Provision of electronic communication services, payment transactions, and other services (contract fulfillment)
• Billing for services (contract fulfillment)
• Compliance with legal tax obligations (legal obligation)

Personal data processed for contract fulfillment is kept for the duration of the contractual relationship and subsequently for 10 years, considering possible claims, limitation periods for damages, or other liabilities.

Processing Personal Data for Marketing and Commercial Purposes with Consent
With the customer’s consent, the Controller processes personal data for marketing and commercial purposes, primarily to send email newsletters about products or services.

Consent is voluntary and can be withdrawn at any time free of charge via the newsletter or by emailing the Controller. This consent is valid for 10 years or until withdrawal. After expiration, it can be renewed for another 10 years.

Processing Data of Registered E-Shop Customers
With the customer’s consent, personal data of registered e-shop users is processed to manage accounts, order history, and provide personalized services.

Processing of Cookies from Websites Operated by the Company

If the data subject has cookies enabled in their web browser, we process records of their behavior from cookies placed on websites operated by the Controller, primarily for the purposes of ensuring better website performance, traffic statistics, and for the Controller’s online advertising purposes – see more below.

After the retention period of personal data expires, the Controller will delete or anonymize the personal data.

Categories of Recipients of Personal Data

The Controller, in fulfilling its contractual obligations and duties, uses specialized services of other entities. If these suppliers process personal data provided by the Controller, they act as data processors and process personal data only according to the Controller’s instructions and may not use it otherwise. Each such entity has a data processing agreement in place, imposing strict obligations to protect and secure personal data. This primarily concerns IT system management, online advertising, logistics services, payment system and gateway providers, accounting services, tax consultancy, and, with your consent, also your email and purchase information with Heuréka.

The Controller does not transfer personal data to third countries (outside the EU) or international organizations.

Your Rights

Please note that you have the right to:

• Withdraw consent at any time – in writing or via mail to the Controller’s contact details above.
• Correct or supplement personal data – the data subject has the right to have the Controller correct or supplement inaccurate personal data without undue delay, according to Article 16 of the GDPR.
• Request restriction of processing – according to Article 18 of the GDPR, especially if the data subject disputes the accuracy of the processed personal data.
• Object or complain about processing in certain cases – according to Article 21 of the GDPR, the data subject has the right to object to the processing of personal data if it is carried out on the basis of legitimate interest, including processing for direct marketing purposes.
• Data portability – the data subject has the right to receive personal data concerning them, which they provided to the Controller, in a structured, commonly used, and machine-readable format and to transfer it to another Controller.
• Access personal data – the data subject has the right to know whether their personal data are being processed and, if so, to access this information under Article 15 of the GDPR.
• Lodge a complaint with a supervisory authority.
• Request deletion of personal data in certain cases.
• Other rights established under the Personal Data Protection Act, the Data Processing Act, and the General Data Protection Regulation (GDPR) 2016/679.

Providing Consent to Personal Data Processing

Providing personal data and consent to its processing is completely voluntary. The data subject is under no obligation to provide it, and no penalties will be imposed for refusal.

However, if the data subject does not provide their personal data to the Controller, it will not be possible to conclude a contract between the data subject and the Controller or properly fulfill it.

Consent to personal data processing can be withdrawn at any time in writing at the Controller’s registered office address.

Security of Personal Data

• The Controller declares that it has adopted all appropriate technical and organizational measures to secure personal data.
• The Controller has implemented all appropriate technical measures to secure data storage and physical storage of personal data.
• The Controller declares that personal data is only accessible to authorized personnel.

Cookies

The Controller uses cookies to ensure the functionality of the e-shop solution, which are stored on the devices of data subjects. These cookies are primarily used to ensure the e-shop functionality, remarketing (Sklik retargeting, Adwords), and tracking data subjects’ movement on the website (visitor analysis via Google Analytics). Cookies can be declined, managed, or deleted by the data subject using their web browser settings or the e-shop’s cookies (Consent) banner.

Information obtained from Google Analytics cookies is anonymized.

Websites are protected against form spam by the reCAPTCHA system, subject to Google’s Privacy Policy and Terms of Service.

Advertising and Statistical Network Cookies

Final Provisions

By placing an order or registering in our e-shop solution, the data subject (client) agrees to the above conditions and the processing of personal data.

In the course of our activities, we process personal data without your consent based on the performance of a (purchase) contract, our legitimate interest, or due to compliance with a legal obligation.

These terms take effect as of 25 May 2018.