GDPR

Privacy Policy and Personal Data Protection System under the GDPR

The purpose of this policy is to demonstrate that the processing of personal data by the controller is carried out in accordance with the currently valid legislation, in particular Act No. 18/2018 Coll. on the Protection of Personal Data (hereinafter referred to as the "New ZOOÚ Act") and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data,  (hereinafter referred to as the "GDPR"). The new legislation obliges the controller, taking into account the nature, scope and purpose of the processing of personal data and the risks of varying likelihood and severity to the rights of a natural person, to take appropriate technical and organisational measures to ensure and demonstrate that the processing of personal data is carried out in accordance with the new legislation. The operator shall update those adopted measures as necessary.

This document is the result of the assessment of the processing of personal data by the controller for the purposes of legal norms governing the protection of personal data. By introducing standardized personal data protection based on the principles outlined herein, the risk of a personal data breach is minimized.

OPERATOR:                                   

Business name:    JustCreate 3D s.r.o.

Sídlo:  Bajkalská 9, 831 04 Bratislava – Nové Mesto district

Legal form: limited                 liability company    

IČO :                            54 557 780

Registration:              registered in the Commercial Register of the District Court Bratislava I,

                                  insert number: 160398/B

Contact details of the controller:            

Name and surname:    Timothée Volpi

Tel:                              0915 509 416

Mail:                           timothee.volpi@justcreate3d.com

delivery address:  Bajkalská 9, 831 04 Bratislava – Nové Mesto district

GENERAL INFORMATION ON THE PROCESSING OF PERSONAL DATA:

The site controller responsible for the processing of personal data pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, (hereinafter referred to as the GDPR)

LAWFUL REASON FOR THE PROCESSING OF PERSONAL DATA:

The legal basis for the processing of personal data by the controller about data subjects of all categories is the following provisions of the GDPR or the new ZOOÚ Act:

a)   the processing of personal data is necessary for the performance of a contract to which the data subject is a party or for the execution of a pre-contractual measure at the request of the data subject, - pursuant to § 13 par. 1 letter b) of the ZOOÚ or Art. 6 letter b) GDPR.

(orders, works contracts, employment contracts, CVs....)

b)   the processing of personal data is necessary according to a special regulation or an international agreement by which the Slovak Republic is bound, - according to § 13 par. 1 letter c) of the ZOOÚ, respectively Art. 6 letter c) GDPR (Cadastral Act, Commercial Code, Labor Code, Health Insurance Act, Social Insurance Act, Income Tax Act....)

c)   further processing of personal data for archiving purposes, scientific purposes,  historical research purposes or statistical purposes, provided that it complies with a specific regulation and that adequate safeguards are in place to protect the rights of the data subject.

d)   According to § 78 par. 3 of the ZOOÚ, the operator, who is the employer of the data subject, is entitled to provide him with personal data or to disclose his personal data to the extent of title, name, surname, job title, service classification, functional classification, personal number of the employee or employee number of the employee, professional department, place of work,

telephone number, fax number, e-mail address to the workplace and employer identification data, if necessary in connection with the performance of the professional duties, duties or functional duties of the person concerned. The provision of personal data or the disclosure of personal data shall not impair the seriousness, dignity and security of the data subject.

e)   the processing of personal data is necessary for the purpose of the legitimate interests of the controller or of  a third party, except where those interests are overridden by the interests or rights of the data subject requiring the protection of personal data, in particular if the data subject is a child, - pursuant to § 13 (1) (f) of the ZOOÚ or Art. 6 (f) GDPR.

STATEMENT:

We declare that, as the controller of your personal data, we comply with all legal obligations required by applicable legislation, in particular the Personal Data Protection Act and the GDPR, and therefore that:

·       We will process your personal data only on the basis of the valid legal reason described above.

·       We hereby fulfil our information obligation to data subjects pursuant to Article 13 GDPR

·       we will enable and support you in exercising and exercising your rights under the new ZOOÚ Act and the GDPR.

PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF PLACING AN ORDER:

Subjects:

·       buyers, pre-contractual and contractual business partners and customers of the operator

Purposes of personal data processing:

·       identification of the contracting party /customer, pre-contractual and contractual partner/

·       conclusion of a distance purchase contract through the operator's e-commerce and fulfillment of obligations arising from or in connection with this purchase contract, as well as in pre-contractual relations with data subjects

·       acceptance of payment for the goods

·       supply/delivery of goods

·       records of orders

·       customer records

·       processing of accounting agenda, issuance of a tax document

·       handling of requests, receivables, complaints, complaints

·       trade intermediation

Category of personal data:

·       title, name, surname, permanent address, address of temporary residence, delivery address, telephone number, e-mail address, IP address, payment details.

·       IČO, TIN, VAT ID, company name, type of legal form, registry number, name, surname, title, type of person, permanent address, delivery address, telephone number, e-mail address, IP address, signature, bank account number and also title, name, surname, tel. number, of the person acting for the company.

Legal basis for the processing of personal data:

 a) The processing of personal data (name, surname, title, street and number, postal code, city) is necessary according to a special regulation or an international agreement by which the Slovak Republic is bound. In particular, according to Act No. 222/2004 Coll. on Value Added Tax.

 b) The processing of personal data (email, telephone contact) is necessary for the performance of the contract.

Personal data storage period: The Controller processes personal data for the time necessary to fulfill the purpose, up to a maximum of 10 years from their collection. The period for which your personal data will be stored by the controller is 10 years, but not longer than until the withdrawal of your consent to the processing of personal data (for this purpose of processing).

PROCESSING OF PERSONAL DATA FOR COMMUNICATION AND CUSTOMER SUPPORT PURPOSES:

Subjects:

·       buyers, pre-contractual and contractual business partners and customers of the operator

Purpose of personal data processing:

·       Communication and customer support

·       help with order completion

·       submission of information about the current status of the request, payment, order, claim or complaint

·       get more information you need

Category of personal data:

·       title, name, surname, e-mail address, IP address, telephone number

Legal basis for the processing of personal data:

Art. 6 par. 1 letter f) GDPR - legitimate interest

Personal data storage period: The Controller processes personal data for the time necessary to fulfill the purpose, up to a maximum of 2 years from their collection.

PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF SENDING MARKETING INFORMATION:

Subjects:

·       buyers, pre-contractual and contractual business partners and customers of the operator

By submitting the registration form for  creating a user account on the e-shop website and subscribing to the e-newsletter, the data subject gives his/her consent to the processing of  his/her personal data and at the  same time confirms that he/she has been informed about the rights and obligations of the data subject, as well as about the conditions for processing personal data according to the General Terms and Conditions of the controller and according to this Policy. The person concerned hereby also declares on oath that he has reached the age of 16. If he is under the age of 16, he is obliged to send the controller the consent of his legal representative to the processing of his or her personal data to the extent and for the purpose of this Article before providing his or her personal data. The data subject is entitled to withdraw his or her consent to the processing of his or her personal data for the purpose under this Article at any time by sending a notice of withdrawal of consent either in writing to the address of the controller's registered office: JustCreate 3D s.r.o., Bajkalská 9, 831 04 Bratislava – Nové Mesto district  or by e-mail to the e-mail address timothee.volpi@justcreate.sk .  The sender may also cancel the sending of the newsletter at any time by clicking on the appropriate unsubscribe link located directly in each newsletter.

Purpose of personal data processing:

·       registration of the data subject on the e-shop website, creation of a user account

·       marketing communication and sales promotion by sending e-mail messages about events, news, product information / "Newsletter" /

Category of personal data:

·       Required data: username and email address

·       voluntary data: title, name, surname, e-mail address, IP address, billing address, delivery address, telephone number

For the processing of personal data for the purpose of registering and sending marketing information, the general information on the processing of personal data listed above applies, as well as:

Legal basis for the processing of personal data: Article 6(1)(a) GDPR - the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Personal data storage period: The period for which your personal data  will be stored by the controller is 10 years from the date of granting your consent, but not longer than until the withdrawal of your consent to the processing of personal data (for this purpose of processing).

PROCESSING OF PERSONAL DATA OF EMPLOYEES

Data subjects: Employees of the company/ controller

Purpose of processing:

·       The controller processes the personal data of its employees exclusively for the purposes of employment relations and other legal relationships arising from labor and social security law.

·       The controller processes personal data necessary for the payment of wages and the management of human resources on the basis of an employment relationship or processing on the basis of agreements on work performed outside the employment relationship

·       Another purpose is to fulfil the employer's obligations related to the employment relationship, civil service relationship or similar relationship (e.g. on the basis of agreements on work performed outside the employment relationship), including pre-contractual relationships

·       Also to ensure the identification of your employee in employment contracts

Personal data storage period: The controller guarantees that the personal data of employees for the purposes specified in this policy will be processed for the maximum duration of the employment relationship, or, if required by any of the above regulations, for the period specified in this legal regulation.

PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF PROCESSING COOKIES:

By clicking on the relevant "I agree/understand" on the e-shop website, the data subject grants the controller his consent to the processing of personal data  cookies, in order to ensure the functionalities of the e-shop  , provide offers or advertisements based on interests identified from cookies and track traffic to the e-shop website. 

More information about the terms of use of cookies and the possibilities of refusing them can be found HERE.

HOW LONG WE WILL COLLECT YOUR PERSONAL DATA:

The controller guarantees that the personal data provided by the data subject in the contract in question or in any other way will be processed in information systems in accordance with the principle of minimizing storage and in the event that the purpose of the processing ceases to exist, the controller guarantees to delete the personal data. In the event that those personal data are processed for a purpose other than that set out above in this Article, the data subject shall be informed of this purpose as well as of the legal basis of such processing prior to such processing.

SECURITY AND PRIVACY:

We protect personal data as much as possible. We protect them as if they were our own. We have put in place all possible technical and organizational measures to prevent the misuse, damage or destruction of your personal data.

TRANSFER OF PERSONAL DATA TO THIRD PARTIES, PROCESSORS, RECIPIENTS:

We handle most of the processing operations ourselves and we do not need 3rd parties for them. To ensure some specific processing operations that we cannot provide on our own, we use the services of processors who specialize in the processing in question and are bound by a processing contract in accordance with the GDPR.

They are providers of the following platforms and services:

Recipients (the recipient can be an accounting company, or even a post office, courier, ...) in this case:

·       Warehouse and courier company

FREE Company s.r.o., Motorway road 6, 903 01 Senec, IČO: 47 976 292  

·       Bank

Fio banka, a.s., foreign bank branch, Dunajská 1, 811 01 Bratislava – Old Town district, IČO: 36 869 376

·       Accounting company

Olga Beňačková, Dostoevsky rad 13, 811 09 Bratislava – Old Town district, IČO: 32 069 910

·       Web hosting

Websupport s.r.o., Karadzičova 12, 821 08 Bratislava, IČO: 36 421 928

·       Additional

Facebook, Instagram, OUTLOOK, LinkedIN

·       Cloud storage

Dropbox

DigitalOcean, Inc.

Vercel

·       Legal representatives, courts for the purpose of asserting and enforcing claims arising out of or relating to the purchase contract

TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION:

We process data exclusively in the European Union or in countries that ensure a degree of protection based on a decision of the European Commission.

YOUR RIGHTS IN RELATION TO THE PROTECTION OF PERSONAL DATA:

The rights of the data subject are regulated by Chapter 3 of the GDPR. These include, for example, the right to lodge a complaint with a supervisory authority, the right to object to processing, the right to request from the controller access to personal data concerning the data subject, the right to rectification or erasure or restriction of the processing of personal data, as well as the right to data portability.

You have several rights in relation to the protection of personal data. If you wish to exercise any of these rights, please contact us via the above email address.

·       You have the right to information, which is already fulfilled by this personal data processing policy. – information obligation

·       Thanks to the right of access , you can call us at any time and we will provide you with proof within 30 days what personal data we process and why.

·       If something changes with you or you see any of your personal data outdated or incomplete, you have the right to have your personal data supplemented and changed.

·       You can exercise the right to restriction of processing if you believe that we are processing your inaccurate data, you believe that we are carrying out the processing unlawfully, but you do not want to delete all the data or if you object to the processing.

·        You can limit the scope of personal data or the purposes of the processing.

·       Right to erasure (to be forgotten): Your other right is the right to erasure if there is no legal basis that entitles us or a legal obligation that obliges us to process your personal data. In this case, we will delete all your personal data from our system, as well as from the system of all sub-processors and backups within the statutory period.

Complaint to the Office for Personal Data Protection: If you feel that we are not treating your data in accordance with the law, you have the right to contact the Office for Personal Data Protection at any time with your complaint. We would be very happy if you would first inform us of this suspicion so that we can do something about it and correct any mistakes.

SECRECY

We would like to assure you that as the controller and also our co-workers and processors who will process your personal data, they are obliged to maintain the confidentiality of personal data, the provision of which would jeopardize the security of your personal data. This confidentiality lasts even after the end of relations with us. Without your consent, your personal data will not be disclosed to a third party.

This Privacy Policy applies from 25.5.2018 and replaces the previous Privacy Policy.