Privacy policy

Personal data and its protection

General information on the processing of personal data

1. Data subject – buyer/visitor of the website,

Operator – e-shop operator: saffronbeds.com/sk, Nat Design s.r.o., Česká 1, 04001 Košice, Slovakia, IČO: 50161482, VAT ID: SK 2120201512. Tel. +421 905 505 775, e-mail: kosice@saffronbeds.com. Registered in the Commercial Register of the District Court Košice I, Section Sro, Insert No. 36030/V.

1. Due to the scope and subject of its activity, the operator is not obliged under § 44 of Act no. 18/2018 Coll. on the protection of personal data to appoint a data protection officer. However, if you have any questions regarding your personal data, please write to us by e-mail: kosice@saffronbeds.com, call the number: +421 905 505 775, or visit us personally at the above address of the controller. The site operator responsible for the processing of personal data pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, (hereinafter referred to as GDPR). The data subject has the right, upon written request from the operator, to request information about his or her personal data that are subject to processing or destruction or correction of his or her personal data by the controller.
2. The data subject is obliged to provide true and up-to-date personal data. The rights of the data subject are governed by Chapter 3 of the GDPR. The data subject has the right to: lodge a complaint with the supervisory authority, object to processing, request from the controller access to personal data concerning the data subject, rectification or erasure or restriction of processing of personal data, as well as the right to data portability.

Information on the rights of the data subject

The data subject has the right, upon written request, to require from the operator:

and, confirmation of whether or not personal data about it are processed,

b, in a generally comprehensible form, information on the processing of personal data in the information system to the extent of identification data of the controller and processor (if appointed); the purpose of the processing of personal data; a list or scope of processed personal data; instruction on the voluntariness or obligation to provide the requested personal data, the period of validity of the consent or notification which law imposes the obligation to provide personal data; third parties, if personal data are to be disclosed to them; the group of recipients, if personal data are to be made available to them; the form of publication of personal data, if personal data are to be disclosed; third countries, if the transfer of personal data to these countries is to take place,

c, in a generally comprehensible form, precise information about the source from which the controller obtained its personal data for processing,

d, in a generally comprehensible form, a list of its personal data that are the subject of processing,

e, rectification or liquidation of its incorrect, incomplete or outdated personal data that are the subject of processing,

f) liquidation of his or her personal data whose purpose of processing has ended; if official documents containing personal data are the subject of processing, you can request their return,

g, liquidation of its personal data that are the subject of processing, if there has been a violation of the law,

h, blocking her personal data due to withdrawal of consent before its expiry date, if the controller processes personal data on the basis of its consent. The said request or information about personal data leakage or other serious facts regarding the processing of personal data by the operator may be addressed to the controller, at the above address or tel. number: +421 905 505 775, or at the electronic address: kosice@saffronbeds.com

Right of access to personal data

As the data subject, you have the right to have the controller confirm to you whether it processes personal data concerning you. If the controller processes your personal data, you have the right to access them and further information on the purpose of processing your personal data, the category of personal data processed, to whom your personal data have been or are to be provided, in particular the recipient in a third country or an international organization, if possible; if personal data is transferred to a third country or an international organization, you have the right to be informed about the appropriate safeguards required by law, the retention period of the personal data; if this is not possible, information on the criteria for its determination, the right to request the correction of your personal data, their erasure or restriction of their processing, or the right to object to the processing of personal data, the right to initiate proceedings on the protection of personal data, the source of personal data if personal data have not been obtained from you, the existence of automated individual decision-making, including profiling. Profiling is any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a person, in particular related to performance at work, property situation, health, personal preferences, interests, reliability, behaviour, location or movement) In such cases, the controller shall provide the data subject with information in particular on the procedure used, as well as on the significance and envisaged consequences such processing of personal data for the data subject. The operator is obliged to provide you with your personal data that it processes. For the repeated provision of personal data, the controller may charge a reasonable fee corresponding to the administrative costs. The operator is obliged to provide you with personal data in the manner requested by you. The right to receive personal data must not adversely affect the rights of other natural persons.

Right to rectification of personal data

As the data subject, you have the right to have the controller correct incorrect personal data concerning you without undue delay. Depending on the purpose of personal data processing, you have the right to supplement your incomplete personal data.

Right to object to the processing of personal data

You have the right to object to the processing of your personal data on grounds relating to your particular situation if the controller carries out profiling or processes your personal data on the following legal bases:

• the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
• The processing of personal data is necessary for the purpose of the legitimate interests of the controller or a third party. The controller may not further process your personal data unless it demonstrates the necessary legitimate interests for the processing of personal data that outweigh your rights or interests or the reasons for asserting a legal claim. You have the right to object to the processing of personal data concerning you for the purpose of direct marketing, including profiling to the extent that it relates to direct marketing. If you object to the processing of personal data for the purpose of direct marketing, the controller may no longer process personal data for the purpose of direct marketing. You have the right to object to the processing of personal data concerning you on grounds relating to your particular situation, if your personal data are processed for scientific purposes, historical research purposes or statistical purposes, except where the processing of personal data is necessary for the performance of a task for reasons of public interest.

Right to erasure of personal data

As the data subject, you have the right to have the controller erase personal data concerning you without undue delay. If you request the controller to delete your personal data, the controller is obliged to delete them in the following cases:

and, the personal data are no longer necessary for the purpose for which they were collected or otherwise processed,

b, you withdraw the consent on the basis of which the controller processes your personal data and there is no other legal basis for the processing of personal data,

c, you will object to the processing of personal data and there are no overriding legitimate reasons for the processing of personal data, or you will object to the processing of personal data for the purpose of direct marketing, including profiling to the extent that it relates to direct marketing,

d, personal data are processed unlawfully,

e, the reason for deletion is the fulfilment of an obligation laid down by law,

f, personal data were obtained in connection with the offer of information society services pursuant to § 15 par. 1. of the Act If the controller has published your personal data and is obliged to delete them under the above conditions, it is also obliged, taking into account the available technology and costs, to inform other controllers processing your personal data so that these operators delete links to your personal data and copies or copies thereof.

The operator is not obliged to delete your personal data if they are necessary

and, to exercise the right to freedom of expression or information;

b, for the fulfilment of an obligation under a law or an international treaty or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,

c, for reasons of public interest in the area of public health,

d, for archiving, scientific, historical research or statistical purposes, where erasure is likely to render impossible or seriously impair the achievement of the objectives of such processing; or

e, to assert a legal claim.

Right to restriction of processing of personal data

You have the right to have the controller restrict the processing of your personal data if

a, you object to the accuracy of your personal data; the operator limits the processing of your personal data to the period of verification of their accuracy,

b, the processing of your personal data is unlawful and you request the restriction of their use instead of deletion,

c, the controller no longer needs the personal data for the purpose of processing the personal data, but you need them to assert a legal claim, or

d, you object to the processing of personal data;

e, the controller will restrict the processing of your personal data until it is verified whether the legitimate reasons on the part of the controller outweigh your legitimate reasons. If the processing of personal data has been restricted, in addition to storage, the controller may process personal data only with the consent of the data subject or for the purpose of asserting a legal claim, for the protection of persons or for reasons of public interest. The operator is obliged to inform you before the restriction on the processing of personal data is lifted.

Notification obligation regarding rectification, erasure or restriction of processing of personal data

The operator is obliged to notify the recipient (everyone to whom your personal data have been provided) of the rectification of your personal data, the deletion of personal data or the restriction of the processing of personal data, unless this proves impossible or requires disproportionate effort. If you request it, the operator will inform you about these recipients.

Right to portability of personal data

You have the right to obtain the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. At the same time, you have the right to transfer these personal data to another controller, if technically possible and if the processing of your personal data is carried out by automated means (i.e. electronically), while personal data are processed either

and, subject to your consent,

b, or are necessary for the performance of a contract to which you are a party or for the implementation of a pre-contractual measure at your request. This right must not adversely affect the rights of others. The exercise of the right to portability is without prejudice to the right to erasure of personal data. The right to portability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to initiate proceedings on the protection of personal data

In the event that you are directly affected by your rights stipulated by the Personal Data Protection Act, you have the right under § 100 of this Act to file a motion to initiate proceedings on personal data protection with the Office for Personal Data Protection of the Slovak Republic. The purpose of the proceedings is to determine whether the rights of natural persons have been violated in the processing of their personal data or the law has been violated and, if deficiencies are found, if justified and expedient, to impose remedial measures or a fine for violation of the law. A model proposal shall be published by the Office on its website. The proposal to initiate proceedings must contain evidence in support of the claims made in the application and a copy of the document or other evidence proving the exercise of the right with the controller (right of access to personal data, right to request rectification of personal data, right to erasure or restriction of processing of personal data, right to object to the processing of personal data, right to portability of personal data), if such a right has been exercised by the data subject,  or a statement of reasons worthy of special consideration for not exercising the right in question.

The above rights (except for the right to initiate proceedings on personal data protection) may be exercised by e-mail or in writing by post with the controller who supervises the processing of personal data. The controller may also be notified of personal data leakage or other serious facts relating to the processing of personal data by the controller.

If the data subject suspects that his or her personal data are being processed unlawfully, he or she may file a motion to initiate personal data protection proceedings with the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27, Slovak Republic or contact the Office through its website http://www.dataprotection.gov.sk.

If the person concerned does not have full legal capacity, his or her rights may be exercised by a legal representative. If the person concerned does not live, his or her rights under this Act may be exercised by a close person.

The request of the data subject under the Personal Data Protection Act shall be handled by the operator free of charge, except for payment in an amount that may not exceed the amount of purposefully incurred material costs associated with making copies, acquiring technical carriers and sending information to the data subject, unless a special law provides otherwise. The operator is obliged to handle the request of the data subject in writing no later than 30 days from the date of receipt of the request. The operator shall notify the data subject and the Office for Personal Data Protection of the Slovak Republic in writing without undue delay of the restriction of the rights of the data subject under the Personal Data Protection Act.

The operator hereby informed you, as the data subject, about the protection of your personal data and instructed you about your rights in relation to the protection of personal data within the scope of this written information obligation.

Processing of personal data for the purpose of order execution and complaint procedure

1. Purposes of personal data processing: issuing a tax document, contacting the customer regarding the order, fulfilling the contract, handling the enforcement of liability for defects in the products sold – resulting from the execution of the contract.
2. Legal basis for the processing of personal data: a) The processing of personal data (name, surname, title, street and number, postcode, city) is necessary according to a special regulation or an international treaty by which the Slovak Republic is bound. In particular, according to Act No. 222/2004 Coll. on value added tax.  b) The processing of personal data (email, telephone contact) is necessary for the performance of the contract.
3. Personal data retention period – 5 years
4. The provision of personal data is a contractual obligation.

Processing of personal data for the purpose of sending marketing information

1. For the processing of personal data for the purpose of sending marketing information, the general information on the processing of personal data listed above applies, as well as:

1. Purposes of personal data processing: sending marketing information
2. Legal basis for the processing of personal data: Article 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes
3. Retention period of personal data – 3 years
4. The provision of personal data for a legitimate interest is mandatory to achieve this legitimate interest. When processing on the basis of consent, the provision of personal data is voluntary.

Automated individual decision-making, including profiling

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him.

Processing of personal data for the purpose of processing cookies

For the processing of personal data for the purpose of processing cookies, the general information on the processing of personal data above applies, as well as:

1. Purposes of personal data processing: provision of services, personalization of ads, traffic analysis, adwords, google analytics, order delivery, order processing, accounting storage in accordance with Slovak legislation.
2. Cookies are a small amount of data that servers send to your browser. It stores them on the user’s computer. Each time you visit the site, the browser then sends this data back to the server.
3. Legal basis for the processing of personal data: Article 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes
4. Personal data retention period – Cookies used on our site can be divided into two basic types in terms of their durability. Short-term so-called “session cookies”, which are only temporary and remain stored in your browser only until you close your browser, and long-term so-called “persistent cookies”, which remain stored on your device for a longer period of time or until you manually delete them, while the duration of keeping cookies on your device depends on the settings of the cookie itself and your browser settings.
5. The provision of personal data is necessary to achieve the purpose.

Conditions and method of processing personal data of data subjects

The controller processes in its information systems the personal data of data subjects by automated and non-automated means of processing. The operator does not disclose the processed personal data, except if required by a special legal regulation or a decision of a court or other state authority. The operator will not process your personal data without your explicit consent or other legal basis for any other purpose, nor to a greater extent than stated in this information and the registration sheets of individual information systems of the controller.

Automated individual decision-making, including profiling cookies

The operator uses an analytical tool to monitor its website, which prepares a data chain and tracks how visitors use pages on the Internet. When someone browses the site, the system generates cookies to record information related to the visit (pages visited, time spent on our site, browsing data, leaving the site, etc.), but this data must not be linked to the person of the visitor. This tool is a tool to improve the ergonomic design of a website, to create a user-friendly website and to enhance the online experience of visitors. Most Internet browsers accept cookies, but visitors have the option to delete or automatically reject them. Because every browser is different, visitors can set their cookie preferences individually using the browser toolbar. If you choose not to accept cookies, you will not be able to use some features on our website.

The operator uses the advertising program Google AdWords, through which it has the opportunity to create online advertisements and reach people just when they are interested in products and services provided by the operator. The Remarketing or Similar audiences features in AdWords allow us to reach people who have visited your website in the past. Allows ads to appear on search, YouTube, and email. Dynamic remarketing allows users to show ads for products or services that they’ve viewed in the past. Cookies securing remarketing codes can be disabled by visitors to the website by setting the browser accordingly.

The operator can also be contacted via Facebook. The purpose of data management is to share the content of the operator’s website and presentation of the operator. Through the Facebook page, guests can learn about news, current special offers at the operator and also view photos from selected orders of the operator. By clicking on “like” on the operator’s Facebook page, the operators agree to post their news and offers on their Facebook wall. The operator also publishes photos/videos from various events on its Facebook page.

The operator publishes these data of natural persons only if their written consent has been obtained beforehand. Further information on data management from the Facebook Page can be found in the www.facebook.com’s privacy guide and policy. For the purpose of presentation, the operator also has his profile on the social network Instagram, where he presents photos from selected orders together with a description. By clicking on “follow”, you agree to view photos posted by the operator.