Privacy Policy

This privacy policy sets out the personal data protection principles of the online store www.forlled.sk (hereinafter referred to as the "Online Store").

Article I.

General provisions

The owner and controller of personal data is the company NAKATA, s. r. o., with its registered office at Langsfeldova 5402/1, 036 01 Martin, Slovak Republic, Company ID (IČO): 52 321 100, Tax ID (DIČ): 2120988199, VAT ID (IČ DPH): SK2120988199, contact e-mail: forlled@forlled.sk, telephone: 0918 873 336 (hereinafter referred to as the "Controller").

Article II.

Information on the processing of personal data provided pursuant to Article 13 of the Regulation.

With effect from 25 May 2018, all personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - hereinafter referred to as the "Regulation").

The supervisory authority to which the data subject may address a complaint concerning the processing of personal data is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic, e-mail: statny.dozor@pdp.gov.sk, web: dataprotection.gov.sk.

Article III.

Right of access by the data subject

The data subject shall have the right to obtain from the Controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

1. the purposes of the processing
2. the categories of personal data concerned
3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
5. the existence of the right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where the personal data are not collected from the data subject, any available information as to their source;
8. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The Controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by the data subject. The right to obtain a copy shall not adversely affect the rights and freedoms of others.

Article IV.

Right to rectification pursuant to Article 16 of the Regulation:

The data subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Article V.

Right to erasure ("right to be forgotten") pursuant to Article 17 of the Regulation:

The data subject shall also have the right to obtain from the Controller the erasure of personal data concerning him or her without undue delay, and the Controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2) of the Regulation, and where there is no other legal ground for the processing;
3. the data subject objects to the processing pursuant to Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the Regulation;
4. the personal data have been unlawfully processed;
5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject;
6. the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the Regulation.

Where the Controller has made the personal data public and is obliged pursuant to the above to erase the personal data, the Controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested the erasure of any links to, or copies or replications of, those personal data.

Article VI.

The right to erasure does not apply to the extent that processing is necessary:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
3. for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) of the Regulation;
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the Regulation, in so far as the right referred to above is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
5. for the establishment, exercise or defence of legal claims.

Article VII.

Right to restriction of processing pursuant to Article 18 of the Regulation:

The data subject shall have the right to obtain from the Controller restriction of processing where one of the following applies:

1. the accuracy of the personal data is contested by the data subject, for a period enabling the Controller to verify the accuracy of the personal data;
2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. the Controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
4. the data subject has objected to processing pursuant to Article 21(1) of the Regulation pending the verification whether the legitimate grounds of the Controller override those of the data subject.

Where processing has been restricted as described above, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. A data subject who has obtained restriction of processing shall be informed by the Controller before the restriction of processing is lifted.

Article VIII.

Right to data portability pursuant to Article 20 of the Regulation:

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Controller, in a structured, commonly used and machine-readable format and shall have the right to transmit those data to another controller without hindrance from the Controller to which the personal data have been provided, where:

1. the processing is based on consent pursuant to point (a) of Article 6(1)
2. or point (a) of Article 9(2)
3. of the Regulation, or on a contract pursuant to point (b) of Article 6(1)
4. of the Regulation, and
5. the processing is carried out by automated means.

In exercising his or her right to data portability, the data subject shall have the right to have personal data transmitted directly from one controller to another, where technically feasible. The exercise of this right shall be without prejudice to Article 17 of the Regulation. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller. The right to data portability shall not adversely affect the rights and freedoms of others.

Article IX.

Right to object, including to profiling (where applicable), pursuant to Article 21 of the Regulation:

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller) or point (f) (processing necessary for the purposes of the legitimate interests pursued by the Controller or by a third party) of Article 6(1) of the Regulation, including profiling based on those provisions. The Controller shall no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the Regulation, the data subject shall have the right to object, on grounds relating to his or her particular situation, to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Article X.

Personal data of customers are collected in the following cases:

1. registering an account in the online store in order to create and manage an individual account. Legal basis: necessity for the performance of the contract on the provision of the Account service.
2. placing an order in the online store for the purpose of fulfilling a purchase contract. Legal basis: necessity to fulfil the purchase contract.
3. subscribing to the newsletter for the purpose of performing a contract, the subject of which is the provision of a service available in electronic form. Legal basis - the data subject's consent to the performance of the contract on the provision of services.

Article XI.

When registering an account in the online store, the customer provides:

1. e-mail address;
2. address details;
3. postal code and city;
4. country;
5. street with house/apartment number;
6. first and last name;
7. telephone number.

Article XII.

When registering an account in the online store, the customer sets an individual password to access it.

The customer may change the password.

Article XIII.

When placing an order in the online store, the buyer provides the following information:

1. e-mail address;
2. address details;
3. postal code and city;
4. country;
5. street with house/apartment number;
6. first and last name;
7. telephone number.

1. If a postal service is used, the customer provides a one-off e-mail address.
2. When using the store's website, additional information may be collected, in particular: the IP address assigned to the customer's computer or the external IP address of the internet service provider, domain name, browser type, access time, operating system type.
3. Some data provided by the customer may be processed as part of the functionality of the Online Store, such as: first name, last name, service usage data.
4. The transfer of personal data to NAKATA, s. r. o. is voluntary in connection with concluded purchase contracts or the provision of services through the website of the online store, provided that failure to provide the data specified in the registration forms will prevent registration and creation of a customer account, and in the case of placing an order without registering a customer account, will prevent the placing and execution of the customer's order.

Article XIV.

Right to restriction of processing

1. The data subject shall have the right to obtain from the Controller restriction of processing where one of the following applies:
   1. the accuracy of the personal data is contested by the data subject, for a period enabling the Controller to verify the accuracy of the personal data;
   2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
   3. the Controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
   4. the data subject has objected to processing pursuant to Article 21(1), pending the verification whether the legitimate grounds of the Controller override those of the data subject.
2. Where processing has been restricted under point 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
3. A data subject who has obtained restriction of processing under point 1 shall be informed by the Controller before the restriction of processing is lifted.

Article XV.

Cookies, IP address

1. The Online Store uses so-called Cookies. These are small text files, stored by the Forlle'd online store on the end device of a person visiting the online store, if the web browser allows it. A cookie typically contains the name of the domain it comes from, its validity period, and a unique random number that identifies the file. Information collected using files of this type is used to best adapt the Forlle'd online store to the customer's requirements. In this way, customers can obtain information about individual product preferences, and the use of cookies can meet their needs. Cookies also make it possible to develop overall statistics on visits to the online store.
2. The Forlle'd online store uses two types of cookies
   1. Session cookies - the information in them is deleted immediately after the visit to the site ends. This type of cookie mechanism does not allow the collection of personal data or confidential information from the customer's computer.
   2. Persistent cookies - are stored on the customer's device and remain there until they expire or are deleted.
3. The Forlle'd online store uses "cookie" files for:
   1. Authenticating the customer in the online store and providing the customer's session (after login), as a result of which the customer does not need to re-enter their username and password on every subpage of the online store.
   2. Analysis and creation of anonymous statistics that help understand how the buyer uses the store's website, which helps improve its structure and content.
4. The Forlle'd online store uses external cookie files for:
   1. Measuring advertising performance and collecting general, anonymized statistical data on traffic using the Meta (Facebook) Pixel tool (external cookie administrator: Meta Platforms, Inc., based in the United States of America).
5. The cookie mechanism is completely safe for online shoppers. However, in their browsers, customers may restrict or disable access to cookies for their computers. If you use this option, you can use the online store in addition to the functions that require cookies.
6. Below we show how you can change the settings of popular web browsers regarding the use of cookies:
   1. Internet Explorer browser;
   2. Microsoft Edge browser;
   3. Mozilla Firefox browser;
   4. Chrome browser;
   5. Safari browser;
   6. Opera browser
7. The Forlle'd online store may collect customers' IP addresses.
8. The online store contains links to other websites. The Controller is not responsible for the personal data protection practices applied on them.

Article XVI.

Changes to the privacy policy

1. The privacy policy may be changed, of which the Controller will inform customers within 7 days.
2. Questions concerning personal data protection should be directed to: forlled@forlled.sk