GDPR: Privacy Policy
Through this Privacy Policy (hereinafter referred to as the "Policy"), we inform data subjects whose personal data we process about all processing activities and the principles of data subject privacy protection.
1. Responsible Persons
Data Controller:
Organic Wines s.r.o., ID No.: 05891299, with its registered office at Bratislavská 1527/15, Praha - Hostivař 102 00
Contacts for exercising your rights: Phone: +420 608 818 059, Email: lenka@organic-wines.cz
(hereinafter also referred to as "we", "us", "our")
2. Basic Definitions
GDPR:
Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, effective as of May 25, 2018.
Personal Data:
Within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "GDPR"), personal data means any information relating to an identified or identifiable natural person (i.e., the data subject = you).
Special Categories of Personal Data (Sensitive Data):
Special categories of personal data mean data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning health or data concerning a natural person's sex life or sexual orientation.
Data Subject = You:
A data subject means an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Controller:
Within the meaning of Article 4(7) of the GDPR, a controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In relation to your personal data, we act as the controller.
Processor:
Within the meaning of Article 4(8) of the GDPR, a processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
Supervisory Authority:
The supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů – hereinafter referred to as "ÚOOÚ").
High-Risk Processing:
High-risk processing means processing that is likely to result in a risk to the rights and freedoms of data subjects, processing that is not occasional, or involves the processing of special categories of data or personal data relating to criminal convictions and offences referred to in Article 10 of the GDPR.
Automated Individual Decision-Making, including Profiling:
Automated individual decision-making, including profiling, generally means any form of decision based on the automated processing of personal data, i.e., without human intervention, consisting, among other things, of evaluating certain personal aspects relating to a data subject, in particular to analyze or predict aspects concerning their performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
3. Categories of Data Subjects, Processed Personal Data, Purpose, Legal Basis, and Processing Period
| Data Subject Category | Purpose of Processing | Legal Basis and Processed Personal Data | Processing Period |
|---|---|---|---|
| Our Customers | Performance and execution of contracts concluded with customers | Legal basis: Performance of a contract. Data: Identification data (first name, surname), contact details (delivery address or permanent residence address, email, phone number), accounting data (credit card number, bank account number), order history, IP address, cookies, account registration details used for logging in, and data from the complaint form (product identification, product defects). | Personal data may be processed for this purpose for the duration of the contractual relationship and the warranty period. |
| Exercising claims arising from contractual relationships after contract termination | Legal basis: Our legitimate interest, which consists of the right to enforce receivables, compensation for damages, and other claims that may have arisen during our contractual relationship. Data: Identification data (first name, surname), contact details (delivery address or permanent residence address, email, phone number), accounting data (bank account number), order history, IP address, cookies, account registration details used for logging in, and data from the complaint form (product identification, product defects). These are necessary after contract termination for handling complaints, debt collection, and enforcing other contractual obligations from contracts concluded between us and data subjects. | Personal data may be processed for this purpose for a period of four years from the termination of the contractual relationship; in the case of court proceedings, for the entire duration of the proceedings. | |
| Compliance with our bookkeeping and tax obligations | Legal basis: Compliance with a legal obligation imposed on us by legal regulations, such as the Accounting Act or the Value Added Tax Act. Data: Identification data (first name, surname), contact details (delivery address or permanent residence address, email, phone number), accounting data (bank account number and other information on tax documents). | Personal data may be processed for this purpose for up to 10 years from the end of the taxable period in which the performance provided to the customer took place. | |
| Dissemination of commercial communications in the form of professional information and updates, marketing materials, and offers of our goods or services | Legal basis: Our legitimate interest in providing and offering you similar services or goods that correspond to your needs, based on our mutual business relationship. Data: Processing of customers' identification and contact personal data occurs for the purpose of disseminating commercial communications. | Personal data may be processed for this purpose for the duration of the contractual relationship. | |
| Website Visitors | Statistics before data anonymization, displaying advertisements for our services or goods | Legal basis: Our legitimate interest in terms of: a) improving our services and focusing on what truly interests you; b) offering you similar services or goods that correspond to your needs based on your visit to our website. Data: Identification data (first name, surname), contact details (address, email, phone number), IP address, and cookies. | Personal data may be processed for this purpose for a period of 6 months. |
| Sending a response to a website visitor's inquiry | Legal basis: Performance of a contract or your consent. Data: Identification data (first name, surname), contact details (address, email, phone number), IP address, cookies, and the inquiry submitted via the form. | Personal data may be processed for this purpose until the inquiry from the contact form is resolved, but for no longer than 30 days or the duration for which your consent to processing lasts. | |
| Newsletter Subscribers | Regular sending of commercial communications via email | Legal basis: Consent granted by you when registering for the newsletter subscription. Data: Identification data (first name and surname), contact detail (email). | Personal data may be processed for this purpose until the consent is withdrawn. |
4. Retention Period of Personal Data
We retain personal data only for the period necessary to fulfill the purpose of their processing – see the table above. After this period, personal data may only be retained for the purposes of the state statistical service, scientific purposes, and archiving purposes.
5. Recipients of Personal Data and Transfer of Personal Data Outside the European Union
In justified cases, we may transfer your personal data to other entities (hereinafter referred to as "recipients").
Personal data may be transferred to the following recipients:
- Processors who process your personal data according to our instructions, particularly in the areas of public relations, electronic data management, or accounting;
- Public authorities and other entities if required by applicable legal regulation;
- Other entities in the event of an unexpected occurrence where the disclosure of data is necessary to protect life, health, property, or another public interest, or if it is necessary to protect our rights, property, or safety.
6. Cookies
Upon your first visit to our website, our server sends a small amount of data to your computer and stores it there. During each subsequent visit to the website, the browser sends this data back to the server. This small file is called a "cookie" and it is a short text file containing a specific string of characters with unique information about your browser. We use cookies to improve the quality of our services and to better understand how people use our website. Therefore, we store user preferences in cookies and use them to track user trends, how people behave on our website, and how they view it.
Most browsers are set up to accept cookies. However, you have the option to set your browser to block cookies or to notify you when cookies are sent. Without cookies, however, some services or features may not function properly.
Our website uses "first-party" cookies, meaning cookies used only by our website (hereinafter referred to as first-party cookies), and "third-party" cookies (meaning cookies originating from third-party websites). We use first-party cookies to store user preferences and data needed during your visit to the website (e.g., the contents of your shopping cart). We use third-party cookies to track user trends and behavior patterns, and for ad targeting with the help of third parties – web statistics providers. Third-party cookies used for tracking trends and behavior patterns are only used by our website and the web statistics provider; they are not shared with any other third party.
Cookie Settings
7. Principles of Personal Data Processing
Lawfulness
We process your personal data in accordance with applicable legal regulations, in particular the GDPR.
Consent of the Data Subject
We process personal data only in the manner and to the extent to which you have granted us consent, provided that consent is the legal basis for processing.
Data Minimization and Storage Limitation
We process personal data only to the extent necessary to achieve the purpose of their processing, and for no longer than necessary to achieve the purpose of their processing.
Accuracy of Processed Personal Data
We process personal data with an emphasis on its accuracy, using available measures. We also process updated personal data using appropriate means.
Transparency
Through this Policy and the contact person, you have the opportunity to familiarize yourself with the manner in which we process your personal data, as well as with their scope and content.
Purpose Limitation
We process personal data only to the extent necessary to fulfill the specified purpose and in accordance with this purpose.
Security
We process personal data in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.
8. Automated Individual Decision-Making and Profiling
During the processing of personal data, no automated individual decision-making occurs, including profiling.
9. Your Rights as a Data Subject
Right of Access to Personal Data
You have the right to request access to personal data relating to you from us. In particular, you have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed by us, and to be provided with further information about the data processed and the manner of processing within the meaning of the relevant provisions of the GDPR (purpose of processing, categories of personal data, recipients, planned storage period, the existence of your right to request rectification, erasure, restriction of processing, or the right to object, the source of personal data, and the right to lodge a complaint). If you request it, we will provide you with a copy of the personal data we process about you free of charge. In the case of repeated requests, we may charge a reasonable fee corresponding to the administrative costs of processing for providing a copy.
To gain access to your personal data, please use your user account or the contacts listed in this policy.
Right to Withdraw Consent to the Processing of Personal Data, if Processing is Based on Consent
You have the right to withdraw your consent to the processing of personal data that is processed by us on the basis of this consent at any time.
You can withdraw your consent through your user account or the contacts listed in this policy.
Right to Rectification, Restriction, or Erasure
If you find that the personal data we hold about you is inaccurate, you can request that we rectify this data without undue delay. If appropriate with regard to the specific circumstances of the case, you may also request the completion of the data we hold about you.
You can request rectification, restriction of processing, or erasure of data through your user account or the contacts listed in this policy.
Right to Erasure of Personal Data
You have the right to request that we erase personal data concerning you without undue delay in the following cases:
- If you withdraw consent to the processing of personal data and there is no other legitimate ground for processing on our part that would override your right to erasure;
- if you object to the processing of personal data (see below);
- your personal data are no longer necessary for the purposes for which we collected or otherwise processed them;
- the personal data have been unlawfully processed by us;
- the personal data were collected by us in connection with the offer of information society services to a person under 18 years of age;
- the personal data must be erased for compliance with a legal obligation laid down in European Union law or the Czech legal system that applies to us.
You can request erasure in these cases through your user account or the contacts listed in this policy.
The right to request the erasure of personal data does not apply in a situation where the processing is necessary:
- For exercising the right of freedom of expression and information;
- for compliance with our legal obligations;
- for reasons of public interest in the area of public health;
- for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, if it is likely that the erasure of data would render impossible or seriously impair the achievement of the objectives of that processing;
- for the establishment, exercise, or defense of legal claims.
You can find out whether grounds for the impossibility of using the right to erasure exist through your user account or the contacts listed in this policy.
Right to Restriction of Processing of Personal Data
You have the right to restrict the processing of your personal data in cases where:
- You contest the accuracy of the personal data. In this case, the restriction applies for a period enabling us to verify the accuracy of the personal data.
- The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead.
- We no longer need your personal data for the purposes for which we processed them, but you require them for the establishment, exercise, or defense of legal claims;
- You object to the processing (see below). In this case, the restriction applies for a period until it is verified whether the legitimate grounds on our part override your legitimate grounds.
During the period of restriction of personal data processing, we may process your personal data (with the exception of its storage) only with your consent, or for the establishment, exercise, or defense of our legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. As stated above, you can request restriction of processing through your user account or the contacts listed in this policy.
Right to Object to Processing
You have the right to object to the processing of your personal data in the following cases:
- In the event that personal data are processed for the reason that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of public authority vested in us, or for the purposes of our legitimate interests, and you object to the processing, we can no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
- If personal data are processed for direct marketing purposes and you object to the processing, we will no longer process the personal data for these purposes.
- If your personal data are processed for scientific or historical research purposes or statistical purposes, we will no longer process them unless the processing is necessary for the performance of a task carried out for reasons of public interest.
You can submit an objection through your user account or the contacts listed in this policy.
