Processing of personal data

STATEMENT OF THE OPERATOR REGARDING THE PROCESSING OF PERSONAL DATA

The operator KREŽ, s.r.o., with its registered office at SNP 89/175 Spišská Stará Ves, 061 01, ID: 36451771 (hereinafter referred to as the "operator"), has taken appropriate technical and organizational measures to ensure the protection of the rights of data subjects, which declare legal processing of personal data. The operator has also introduced a transparent system for recording security incidents and any questions from the data subject, as well as other persons.

Individual information can also be obtained by the data subject by phone at +421 911 612 750, by email at info@monk-nutrition.com, in person at SNP 89/175 Spišská Stará Ves, 061 01 or on the operator's website: https://www.monk-nutrition.com/processing-of-personal-data.

Below we provide information on the processing and protection of personal data in accordance with EU Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (General Data Protection Regulation) and Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (hereinafter referred to as the "Act on the Protection of Personal Data").

1. Operator

KREŽ, s.r.o.

SNP 89/175 Spišská Stará Ves, 061 01

ID: 36451771

We process your data for our own purposes as an operator. This means that we determine the purposes for which we collect your personal data, determine the means of processing, and are responsible for their proper performance.

2. List of our processors and recipients who process your personal data

In certain cases, the data controller may process personal data of data subjects through processors authorized to process personal data in accordance with Article 28 of the GDPR.

Processors process personal data of data subjects on behalf of the data controller. Processing personal data through processors does not have a negative impact on the exercise and application of the rights of the data subject. The data controller only uses processors providing appropriate technical, organizational, and other measures to ensure that the processing meets the requirements of the GDPR and that the rights of the data subject are fully protected.

When processing personal data of data subjects, the data controller uses the following categories of processors:

• Companies providing technical solutions, web hosting services, maintenance, and IT system support used by the data controller.
• Companies providing accounting and tax obligations.

When processing personal data of data subjects, the data controller uses the following categories of recipients:

• Government authorities and public authorities for control and supervision.
• Delivery companies, couriers.
  
  By consenting to Profiling (marketing) cookies, you consent to the use of a new type of data:
• consent to the targeting of personalized advertisements.
• consent to the provision of user data to Google tools.

3. The purpose of processing personal data

The purpose of processing personal data by KREŽ, s.r.o. as the data controller is to provide full services related to the sale of nutritional products and other products. The purposes of processing personal data during different processing steps are:

• When communicating with clients via phone, in-person, electronic/paper mail, or through an online contact form, we process data in accordance with Article 6(1)(f) of the GDPR - legitimate interest - for the purpose of responding to your inquiry or question about our services and products. This includes verifying the relevance of the request and potentially following up with you as the data subject.

• When you express interest in our services, place an order via phone, in-person, electronic/paper mail, or direct purchase through the online store https://www.monk-nutrition.com, we process data in accordance with Article 6(1)(b) of the GDPR - necessary for the performance of a contract - during the pre-contractual relationship. This includes identifying you as the client, defining or modifying the order, determining or changing the delivery address and time, and adding other necessary data to finalize the order.

• After the order is confirmed and a contractual relationship is established between KREŽ, s.r.o. as the data controller and you as the data subject, we process data in accordance with Article 6(1)(b) of the GDPR - necessary for the performance of a contract. This includes necessary cooperative communication with the client, informing you of changes to the order status, personal delivery, and preparing and issuing tax documents (invoices).

• Through the website https://www.monk-nutrition.com, you have the option to voluntarily create and register a user account, which simplifies online shopping and keeps a record of all purchases. We process data in accordance with Article 6(1)(a) of the GDPR - based on your consent to process personal data for the purpose of creating and maintaining a user account.

4.

4. List of processed personal data

• Data required to send a message through an online contact form

• Name

• Email address

• Phone number

 

• Data required to register a user account

• First and last name

• Email address

• Permanent address or other correspondence address for delivery of the shipment

• Phone number

• Personal access password

• Data required to process an order

• First and last name

• Email address

• Permanent address or other correspondence address for delivery of the shipment

• Phone number

• Billing information

• First and last name

• Permanent address or other correspondence address for billing purposes

• Account number / IBAN

 

• Contact information in case of shipment delivery

• First and last name

• Permanent address or other correspondence address for shipment delivery

• Phone number - for the purpose of confirming the date, time and place of delivery, or in case of changes in the order

• Email address - for the purpose of sending an electronic confirmation of the order and changes in the order status, as well as an emergency communication means if the customer is not available at the provided phone number.

5. Processing and Storage Period for Your Personal Data

Your personal data, which we have processed or will process pursuant to Art. 6 (1) (b) of the GDPR - in the course of fulfilling KREŽ, s.r.o.'s obligations to its customers and clients - are further processed for the purpose of fulfilling our legal obligations in the area of taxes and accounting, which result from generally binding legal regulations (e.g. storing individual accounting records of your confirmed orders and invoicing for the purpose of delivering selected goods to your contact address, pursuant to Act No. 431/2002 Coll. on Accounting, as amended, for the purpose of demonstrating compliance with tax obligations pursuant to tax legal regulations, Act No. 595/2003 Coll. on Income Tax, Act No. 563/2009 Coll. on Tax Administration, etc.), and we must keep them for the period specified by the relevant legal regulations. In any case, however, we follow the principle of minimization of personal data storage pursuant to Art. 5 (1) (e) of the GDPR, and therefore your personal data, which are not subject to archiving pursuant to special legal regulations, will be erased or anonymized.

Personal data processed pursuant to Art. 6 (1) (a) of the GDPR - based on your consent to the processing of personal data for the purpose of creating and maintaining a user account - are processed for a period of 3 years or until the consent is revoked. In case the processing period ends, we will initiate contact in writing or by e-mail, during which it is possible to renew and extend the consent to process personal data for the defined purpose for the next processing period. In case of refusal to grant consent during the renewal and extension of the processing purpose, or failure to respond to the contact, we will no longer process your personal data - meaning that we will automatically remove the data from the records, technically delete electronic data from systems, and physically destroy the data.

Personal data processed pursuant to Art. 6 (1) (f) of the GDPR - based on legitimate interest obtained when responding to your inquiry/petition or question regarding the services provided and products supplied, where it was necessary to verify the relevance of the request or to carry out any subsequent contact with the client/affected person, after the request has been processed and has not subsequently been transferred to the pre-contractual or contractual relationship, are immediately deleted.

As the Controller, we will ensure the deletion of personal data without undue delay after: all contractual relationships between you and us as the Controller have ended; and/or all your personal data have become irrelevant to us.

6. Disclosure of data

Our company does not disclose any obtained data under any circumstances.

7. Cross-border transfer of personal data

Cross-border transfer of personal data is not carried out.

8.

Rights and obligations of the data subject

• The customer is obliged to provide only complete and truthful information. • The customer undertakes to update their information in case of any changes, at the latest before placing the first order following the change. • The customer undertakes to provide personal data of a third party (name, surname, phone number) only with their consent, and the data subject is informed of the procedures, rights, and obligations stated on this website. • As our client and data subject, you have the right to decide on the handling of your personal data within the specified scope. You can exercise the rights listed below:

• In person at the contact point of the controller KREŽ, s.r.o., with registered office at SNP 89/175, Spišská Stará Ves, 061 01;
• Through our customer line: +421 911 612 750;
• By e-mail: info@monk-nutrition.com ; We will do our best to respond as soon as possible, but we will always reply within 30 days of receiving your request. Applicable legal regulations and GDPR Regulation or the Act ensure you the following:

Right to access – You have the right to request confirmation from us whether your personal data is being processed, and if so, to obtain a copy of this data and additional information arising from Article 15 of the Regulation or § 21 of the Act. If we collect a large amount of data about you, we may ask you to specify your request for the specific data we process about you.

Right to rectification – In order for us to continually process only current personal data about you, you need to notify us of any changes as soon as possible. If we process incorrect data about you, you have the right to request their correction.

Right to erasure – If the conditions of Article 14 of the Regulation or § 23 of the Act are met, you may request the erasure of your personal data. You may request erasure, for example, if you have withdrawn your consent to the processing of personal data, and there is no other legal basis for processing, or if we process your personal data unlawfully, or if the purpose for which we processed your personal data has expired, and we do not process them for another compatible purpose. However, we will not erase your data if they are necessary for proving, asserting or defending legal claims.

Right to restriction of processing – If the conditions of Article 18 of the Regulation or § 24 of the Act are met, you may request us to restrict the processing of your personal data. You may request restriction, for example, while objecting to the accuracy of the processed data or if the processing is unlawful, and you do not wish us to erase the data, but you need us to restrict their processing.

9.

Contact details of the Office and responsible person

Office for Personal Data Protection of the Slovak Republic

Address:

Hraničná 12

820 07, Bratislava 27

Slovakia

ID number: 36 064 220

 

Registry:

Monday - Thursday: 8:00 - 15:00

Friday: 8:00 - 14:00

 

Phone consultations on personal data protection:

Tuesday and Thursday from 8:00 to 12:00 +421 2 323 132 20

Secretary of the President's Office +421 2 323 132 11

Office Secretary +421 2 323 132 14

Fax: +421 2 323 132 34

Spokesperson:

mobile: 0910 985 794

e-mail: hovorca@pdp.gov.sk

 

E-mail:

a) common contact: statny.dozor@pdp.gov.sk

b) For providing information under the Act No. 211/2000 Coll.: info@pdp.gov.sk

c) web address: webmaster@pdp.gov.sk

d) To submit a request for the provision of information under Act No. 211/2000 Coll. on free access to information, please use the online form.

e) Email address through which the Office will provide advice on the protection of personal data. It is intended for children, youth, students, teachers, and parents who suspect that their personal data has been misused:  ochrana@pdp.gov.sk

 

You can find a sample proposal to initiate personal data protection proceedings on the website of the Office. (https://dataprotection.gov.sk/uoou/sk/content/konanie-o-ochrane-osobnych-udajov).

 

10. Website Security

The website https://www.monk-nutrition.com uses encrypted SSL connection when any user connects or transmits any data, which prevents third parties from accessing the transmitted data during their transmission on the Internet and modifying such data by third parties. The databases of the operator containing personal data are protected by encryption and non-public access credentials in accordance with the latest technical standards.