Your shopping cart is empty!
Welcome to the website of the 1st specialist retailer of nicotine and cbd bags in Slovakia.
Data protection
General information on the processing of personal data
1. Affected person - buyer/visitor of the website,
Operator - the operator of the online shop: Slovak distribution, s. r. o., Doležalova 3424/15C, 821 04
Bratislava, IČO 53 070 992
2. Recipients of personal data
Packeta Slovakia s. r. o., Kopčianska
3338/82A, 851 01 Bratislava, IČO 48 136 999
Heureka Group a.s., Karolinská 650/1,
186 00 Praha 8 – Karlín, IČO 07 822 774
24-pay s.r.o., Kálov 356, 010 01
Žilina, IČO 44 002 602
3. Due to the scope and subject matter of its activities, the controller is not obliged to appoint a responsible person pursuant to Section 44 of Act No. 18/2018 Coll. on the Protection of Personal Data. However, if you have any questions in relation to your personal data, please write to us by e-mail: info@zuvaj.sk
The website operator is responsible for the processing of personal data pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the GDPR).The data subject has the right, upon written request to the controller, to request information about his or her personal data that are subject to processing or the destruction or correction of his or her personal data by the controller.
4. The data subject is obliged to provide true and up-to-date personal data. The rights of the data subject are governed by Chapter 3 of the GDPR. The data subject has the right: to lodge a complaint with a supervisory authority, to object to processing, to request from the controller access to personal data concerning the data subject, to rectification or erasure or restriction of processing of personal data, as well as the right to data portability.
Information on the rights of the data subject
The data subject shall have the right, upon written request from the controller, to request:
a, confirmation as to whether or not personal data concerning him or her are being processed,
b, in a generally comprehensible form, information about the processing of personal data in the information system, including the identification data of the controller and the processor (if established); the purpose of the processing of the personal data; the list or scope of the personal data processed; an indication of the voluntary nature or the obligation to provide the personal data requested, the period of validity of the consent or a statement of which legal provision imposes the obligation to provide the personal data; the third parties to whom the personal data are to be disclosed; the range of recipients to whom the personal data are to be disclosed; the form of disclosure of the personal data, if the personal data are to be disclosed; the third countries, if the transfer of personal data to those countries is to take place,
c, in a generally intelligible form, precise information about the source from which the controller obtained his or her personal data for processing,
d, in a generally comprehensible form, a list of her personal data subject to processing,
e, the rectification or erasure of her inaccurate, incomplete or outdated personal data subject to processing,
f, the destruction of her personal data for which the purpose of the processing has ended; where official documents containing personal data are the subject of the processing, you may request their return,
g, the destruction of her personal data which are the subject of the processing if there has been a breach of the law,
h, the blocking of her personal data due to the withdrawal of her consent before the expiry of its validity period, if the controller processes personal data on the basis of her consent. The aforementioned request or information about the leakage of personal data or other serious facts concerning the processing of personal data by the controller may be addressed to the controller, at the above-mentioned address info@zuvaj.sk
Right of access to personal data
As a data subject, you have the right to have the controller confirm to you whether it is processing personal data relating to you. If the controller processes your personal data, you have the right to obtain access to them and further information about the purpose of the processing of your personal data, the category of personal data processed, to whom your personal data have been or are to be disclosed, in particular the recipient in a third country or an international organisation, if applicable; if the personal data are transferred to a third country or an international organisation, you have the right to be informed about the appropriate safeguards required by law, the period of retention of the personal data; if this is not possible, information on the criteria for its determination, the right to request the rectification of your personal data, their erasure or restriction of their processing or the right to object to the processing of personal data, the right to bring a data protection action, the source of the personal data if the personal data was not obtained from you, the existence of automated individual decision-making, including profiling. Profiling is any form of automated processing of personal data which consists of the use of such personal data to evaluate certain personal aspects relating to a person, in particular relating to job performance, financial situation, health, personal preferences, interests, reliability, behaviour, location or movement) In these cases, the controller shall provide the data subject with information, in particular on the procedure used as well as on the meaning and the envisaged consequences of such processing of personal data for the data subject. The controller is obliged to provide you with the personal data it processes. For repeated provision of personal data, the controller may charge a reasonable fee corresponding to the administrative costs. The controller is obliged to provide you with the personal data in the manner you request. The right to obtain personal data must not adversely affect the rights of other natural persons.
Right to rectification of personal data
As a data subject, you have the right to have incorrect personal data concerning you rectified by the controller without undue delay. Depending on the purpose of the processing of the personal data, you have the right to have your incomplete personal data completed.
Right to object to the processing of personal data
You have the right to object to the processing of your personal data on grounds relating to your particular situation if the controller carries out profiling or processes your personal data on these legal bases:
- the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
- the processing of personal data is necessary for the purpose of the legitimate interests of the controller or of a third party. The controller may not further process your personal data unless it demonstrates compelling legitimate interests for the processing of the personal data which override your rights or interests or grounds for exercising a legal claim. You have the right to object to the processing of personal data concerning you for the purpose of direct marketing, including profiling to the extent that it is related to direct marketing. If you object to the processing of personal data for the purpose of direct marketing, the controller may no longer process the personal data for the purpose of direct marketing. You have the right to object to the processing of personal data concerning you on grounds relating to your particular situation if your personal data are processed for scientific, historical research or statistical purposes, except where the processing of personal data is necessary for the performance of a task carried out for reasons of public interest.
Right to erasure of personal data
As a data subject, you have the right to have the personal data concerning you erased by the controller without undue delay. If you ask the controller to erase your personal data, the controller is obliged to erase them in the following cases:
a, the personal data are no longer necessary for the purpose for which they were collected or otherwise processed,
b, you withdraw the consent on the basis of which the controller processes your personal data and there is no other legal basis for the processing of your personal data,
c, you object to the processing of personal data and there are no overriding legitimate grounds for processing the personal data or you object to the processing of personal data for the purpose of direct marketing, including profiling to the extent that it is related to direct marketing,
d, the personal data are being processed unlawfully,
e, the reason for deletion is the fulfilment of an obligation laid down by law,
f, the personal data were collected in connection with the offer of information society services pursuant to Section 15(1) of the Act If the controller has disclosed your personal data and is obliged to delete them on the basis of the above conditions, it is also obliged, in view of the available technology and costs, to inform other controllers who process your personal data that these controllers delete the references to your personal data and copies or copies thereof or copies thereof. The controller is not obliged to delete your personal data if they are necessary
a, to exercise the right to freedom of expression or the right to information,
b, for compliance with an obligation under law or an international treaty or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
c, for reasons of public interest in the field of public health,
d, for archiving purposes, scientific purposes, historical research purposes or statistical purposes, where erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing; or
e, for the exercise of a legal claim.
Right to restriction of processing of personal data
You have the right to have the controller restrict the processing of your personal data if
a, you object to the accuracy of your personal data; the controller shall restrict the processing of your personal data for the period of verification of their accuracy,
b, the processing of your personal data is unlawful and you request the restriction of its use instead of erasure,
c, the controller no longer needs the personal data for the purpose of processing the personal data, but you need them to assert a legal claim; or
d, you object to the processing of the personal data;
e, the controller restricts the processing of your personal data pending verification that the legitimate grounds on the part of the controller outweigh your legitimate grounds. Where the processing of personal data has been restricted, in addition to storage, the controller may only process the personal data with the consent of the data subject or for the purpose of exercising a legal claim, for the protection of individuals or for reasons of public interest. The controller is obliged to inform you before the restriction on the processing of personal data is lifted.
Notification obligation in relation to rectification, erasure or restriction of the processing of personal data
The controller is obliged to notify the recipient (anyone to whom your personal data has been provided) of the rectification of your personal data, the erasure of your personal data or the restriction of the processing of your personal data, unless this proves impossible or requires disproportionate effort. If you so request, the controller will inform you of these recipients.
Right to portability of personal data
You have the right to obtain the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transfer this personal data to another controller, if technically feasible and if the processing of your personal data is carried out by automated means (i.e. electronically), where the personal data is processed either
a, based on your consent,
b, or are necessary for the performance of a contract to which you are a party or to carry out a pre-contractual measure at your request. This right must not adversely affect the rights of other persons. The exercise of the right of portability is without prejudice to the right to erasure of personal data. The right of portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Right to bring a data protection action
In the event that you are directly affected by your rights under the Personal Data Protection Act, you have the right under Section 100 of this Act to file a petition with the Office for Personal Data Protection of the Slovak Republic to initiate a personal data protection proceeding. The purpose of the proceeding is to determine whether there has been a violation of the rights of natural persons in the processing of their personal data or whether there has been a violation of the Act and, if deficiencies are found, to impose, if reasonable and expedient, remedial measures or a fine for the violation of the Act. The Office publishes a model of the proposal on its website. The application for initiation of proceedings must contain evidence to support the allegations in the application and a copy of the document or other evidence demonstrating the exercise of a right by the controller (right of access to personal data, right to request rectification of personal data, right to erasure or restriction of processing of personal data, right to object to the processing of personal data, right to portability of personal data), if such right has been exercised by the data subject, or an indication of the reasons of special consideration for not exercising the right in question.
The above-mentioned rights (except the right to bring a personal data protection procedure) may be exercised by e-mail or in writing by post with the controller who supervises the processing of personal data. The controller may also be notified of personal data leaks or other serious facts concerning the processing of personal data by the controller.
If the data subject suspects that his or her personal data is being unlawfully processed, he or she may file a petition for initiation of personal data protection proceedings with the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27, Slovenská republika or contact the Authority via its website http://www.dataprotection.gov.sk.
If the data subject lacks full legal capacity, his or her rights may be exercised by a legal representative. If the data subject is deceased, his or her rights which he or she had under this Act may be exercised by a person close to him or her.
The controller shall process the data subject's request pursuant to the Personal Data Protection Act free of charge, except for a payment in an amount which may not exceed the amount of the reasonably incurred material costs associated with the making of copies, the procurement of technical media and the sending of the information to the data subject, unless otherwise provided for by a special law. The controller shall be obliged to deal with the data subject's request in writing no later than 30 days from the date of receipt of the request. The controller shall notify the data subject and the Office for Personal Data Protection of the Slovak Republic in writing without undue delay of the restriction of the data subject's rights under the Personal Data Protection Act.
The controller has hereby informed you, as the data subject, about the protection of your personal data and instructed you about your rights in relation to the protection of personal data within the scope of this written information obligation.
Processing of personal data for the purposes of order processing and the complaints procedure
1. Purposes of personal data processing: issuing a tax invoice, contacting the customer about the order, fulfilling the contract, handling liability for defects in the products sold - resulting from the planning of the contract.
2. Legal basis for the processing of personal data: a) The processing of personal data (name, surname, title, street and number, postcode, city) is necessary pursuant to a special regulation or an international treaty to which the Slovak Republic is bound. b) The processing of personal data (email, telephone contact) is necessary for the performance of the contract.
3. Retention period of personal data - ten years.
4. Providing personal data is a contractual obligation.
Processing of personal data for the purpose of sending marketing information
For the processing of personal data for the purpose of sending marketing information, the general information on the processing of personal data set out above applies, as well as:
1. Purposes of the processing of personal data: sending marketing information
2. Legal basis for the processing of personal data: Article 6(1)(a) GDPR - the data subject has consented to the processing of his or her personal data for one or more specific purposes
3. Retention period of personal data - ten years.
4. Disclosure of personal data for legitimate interest is mandatory to achieve that legitimate interest. When processing on the basis of consent, the provision of personal data is voluntary.
Automated individual decision-making, including profiling
The data subject shall have the right not to be subject to a decision which is based solely on automated processing, including profiling, and which has legal effects concerning him or her or similarly significantly affects him or her.