I. General Provisions
1. The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “GDPR”) is DERMAESTET, s.r.o., with its registered office at Křižíkova 68a, 617 00 Brno, ID No.: 29205395, registered with the Regional Court in Brno, file number C 65402 (hereinafter referred to as the “controller”)
Contact information for the data controller:
- Address: Křižíkova 68a, 617 00 Brno
- Email: info@dermaestet.cz
- Phone: +420 605 162 650
2. Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier (such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person).
II. Sources and Categories of Personal Data Processed
The controller processes the personal data you have provided or the personal data the controller has obtained in connection with the fulfillment of your order:
- first and last name
- home address
- email address
- phone number
The controller processes your identification and contact information necessary for the performance of the contract.
III. Legal Basis and Purpose of Personal Data Processing
The legal basis for the processing of personal data is:
- performance of the contract between you and the controller pursuant to Article 6(1)(b) of the GDPR,
- compliance with the controller’s legal obligation pursuant to Article 6(1)(c) of the GDPR,
- the controller’s legitimate interest in providing direct marketing (in particular for sending scheduled commercial communications and newsletters) pursuant to Article 6(1)(f) of the GDPR,
- your consent to processing for direct marketing purposes (in particular for sending scheduled commercial communications and newsletters) pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 7(2) of Act No. 480/2004 Coll., on Certain Information Society Services, in the event that no order for goods or services has been placed.
The purpose of processing personal data is:
Processing of orders and the exercise of rights and obligations arising from the contractual relationship between you and the controller; when placing an order, personal data is required that is necessary for the successful processing of the order (name, residential address, contact information). Providing personal data is a necessary requirement for entering into and fulfilling the contract; without providing personal data, the contract cannot be entered into or fulfilled by the controller. This also includes fulfilling legal obligations toward the state, sending planned commercial communications, and conducting other marketing activities.
IV. Retention Period for Personal Data
Your personal data is processed only for as long as is necessary, which varies depending on the specific purpose of the processing. Once this period has expired, the personal data is destroyed or retained for the period specified in the applicable Records Management and Retention Policy, issued in accordance with Act No. 499/2004 Coll., on Archiving and Records Management.
V. Personal Data Processors
Personal data is processed by the controller; however, the following processors may also process personal data on its behalf:
the Ecomail service provider (for sending scheduled newsletters)
or other providers of processing software, services, and applications, which the controller does not currently use.
VI. Your Rights
Under the terms of the GDPR, you have the following rights:
- the right to access your personal data under Article 15 of the GDPR,
- the right to rectification of personal data pursuant to Article 16 of the GDPR, or restriction of processing pursuant to Article 18 of the GDPR,
- the right to erasure of personal data pursuant to Article 17 of the GDPR,
- the right to object to processing under Article 21 of the GDPR,
- the right to data portability under Article 20 of the GDPR.
You also have the right to file a complaint with the Office for Personal Data Protection if you believe your right to personal data protection has been violated, or to take the matter to court.
VII. Conditions for the Security of Personal Data
The Controller declares that it has taken all appropriate technical and organizational measures to secure personal data.
The Controller has implemented technical measures to secure data storage systems and physical storage of personal data.
The Controller declares that access to personal data is restricted to authorized personnel.
VIII. Final Provisions
By submitting the contact form on this website, you confirm that you have read and fully accept the Privacy Policy. The Data Controller reserves the right to modify this Privacy Policy. The Data Controller will publish the updated Privacy Policy on its website and will also send the updated version to the email address you provided.
These terms and conditions take effect on March 1, 2022.