Privacy policy - GDPR

General information on the processing of personal data

1. Concerned subject - buyer / website visitor,
    Operator - e-shop operator: Viktor Bednarik, Magnezitárska 35, Košice 04013, Slovakia, ID: 53 593 235, District Office Košice, Trade register number: 820-93466
2. Personal data recipients - Ľudmila Mackovjaková, Viedenská 19, 040 13 Košice, ID 1139473
3. The operator, regarding the scope and subject of the activity, is not obliged to appoint a responsible person in accordance with Section 44 of Act No. 18/2018 Coll. on the protection of personal data. However, may you have any questions regarding your personal data, write to us an e-mail at: wonderland@therooms.eu, or visit us in person at the above address of the operator.
   
   Site operator is responsible for the processing of personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council of Ministers, 27 April 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, (hereinafter GDPR) The concerned subject has the right, upon written request from the operator, to request information about his/her personal data, which are the subject of processing or liquidation or correction of his/her personal data by the operator.
4. The concerned subject is obliged to provide true and current personal data. The rights of the concerned subject are governed by Chapter 3 of the GDPR. The concerned subject shall have the right: to lodge a complaint with the supervisory authority, to object to the data processing, to request access to personal data concerning the subject from the controller, to correct, erase, or restrict the processing of personal data, and to transfer data.

 

Instruction on the rights of the concerned subject

The person concerned shall have the right, upon written request, to require the operator to:

1. provide a confirmation of whether or not personal data about him/her are processed,
2. in a generally comprehensible form, provide information on the processing of personal data in the information system to the extent of the operator identification data and the intermediary (if established); the purpose of the processing of personal data; a list or a scope of the personal data processed; an indication of voluntariness or the obligation to provide the requested personal data, the time period of validity of the consent or the notification, which legal obligation imposes on the provision of personal data; third parties if personal data are to be provided to them; the range of recipients, if personal data are to be made available to them; the form of disclosure of personal data, if personal data are to be disclosed; third countries, if personal data are to be transferred to those countries,
3. in a generally comprehensible form, provide precise information on the source, from which the operator obtained his personal data for processing,
4. in a generally comprehensible form, provide a list of his/her personal data, which are the subject of processing,
5. to provide correction or disposal of its incorrect, incomplete, or out-of-date personal data which are the subject of processing,
6. to provide liquidation of his/her personal data, whose purpose of the processing ended; if official documents containing personal data are subject of processing, you can request their return,
7. to provide liquidation of his/her personal data, which are the subject of processing, if a violation of the law occurred,
8. to provide blocking of his/her personal data due to the revocation of the consent before the expiry of its validity, if the operator processes personal data on the basis of his/her consent. The listed request or information on the leakage of personal data or other serious issues concerning the processing of personal data by the operator may be addressed to the operator at the electronic address: wonderland@therooms.eu
   
   

Right of access to personal data

As the concerned person, you have the right to get the confirmation of the operator whether he is processing any personal data concerning you. If the operator processes your personal data, you have the right to access them and also further information on the purpose of processing your personal data, the category of personal data processed, to whom your personal data has been or is to be provided, particularly the recipient in a third country or international organization, if possible; if personal data is transferred to a third country or international organization, you have the right to be informed of the appropriate guarantees required by law, the retention period of personal data; if this is not possible, information on the criteria for its determination, the right to request the correction of your personal data, their deletion or restriction of their processing, or the right to object to the processing of personal data, the right to initiate proceeding on personal data protection, personal data source, if personal data has not been obtained from you, the existence of automated individual decision-making, including profiling. Profiling is any form of automated processing of personal data which consists of the use of such personal data to evaluate certain personal aspects relating to a person, in particular; job performance, property, health, personal preferences, interests, reliability, behavior, location or movement. In such cases, the operator shall provide the concerned subject with information, in particular on the procedure used, as well as on the meaning and expected consequences of such processing of personal data. The operator is obliged to provide you with your personal data, which are processed. The operator may charge a reasonable fee for the repeated provision of personal data, corresponding to the administrative costs. The operator is obliged to provide you with personal data in the manner required by you. The right to obtain personal data must not adversely affect the rights of other individuals.

The right to correct personal data

As the concerned subject, you have the right to have the operator correct incorrect personal data concerning you without undue delay. Depending on the purpose of processing personal data, you have the right to supplement your incomplete personal data.

The right to object to the processing of personal data

You have the right to object to the processing of your personal data for reasons relating to your specific situation, if the operator carries out profiling or processes your personal data on the following legal grounds:

- the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of the official authority conferred on the operator,

- the processing of personal data is necessary for the legitimate interests of the operator or of a third party. The operator may not further process your personal data unless he demonstrates the necessary legitimate interests for the processing of personal data, which prevail over your rights, interests, or the reasons for enforcing a legal claim. You have the right to object to the processing of personal data concerning you for the direct marketing purpose, including profiling to the extent that it relates to direct marketing. If you object to the processing of personal data for the purpose of direct marketing, the operator may not further process personal data for the purpose of direct marketing. You have the right to object to the processing of personal data concerning you for reasons relating to your specific situation, if your personal data are processed for a scientific, historical, or statistical purpose, except for the cases where the processing of personal data is necessary for the performance of tasks for reasons of public interest.

The right to delete personal data

As the concerned subject, you have the right to have the operator delete personal data concerning you without undue delay. If you ask the operator to delete your personal data, the operator is obliged to delete them in the following cases:

1. the personal data are no longer needed for the purpose for which they were obtained or otherwise processed,
2. you revoke the consent on the basis of which the operator processes your personal data and there is no other legal basis for the processing of personal data,
3. you object to the processing of personal data and there are no legitimate reasons for the processing of personal data or you object to the processing of personal data for the purpose of direct marketing, including profiling to the extent related to direct marketing,
4. personal data are processed illegally,
5. the reason for the deletion is the fulfillment of an obligation stipulated by legal order,
6. personal data were obtained in connection with the offer of information company services according to § 15 par. Act no. 1, If the operator published your personal data, then is obliged to delete them on the basis of the above conditions, the operator is also obliged to inform other operators who process your personal data due to available technology and costs, so that these operators delete links to your personal data and their copies or depreciation. The operator is not obliged to delete your personal data if necessary
7. to exercise the right to freedom of expression or the right to information,
8. to fulfill an obligation under law or an international agreement or to fulfill a task carried out in the public interest or in the exercise of public authority entrusted to the operator,
9. for reasons of public interest in the field of public health,
10. for archiving purposes, for scientific purposes, for historical research purposes, or for statistical purposes, where deletion is likely to make it impossible or seriously difficult to achieve the objectives of such processing, or
11. to enforce a legal claim.

The right to restrict the processing of personal data

You have the right to have the operator restrict the processing of your personal data if

1.  you object to the accuracy of your personal data; the operator will limit the processing of your personal data to the period of verifying their accuracy,
2. the processing of your personal data is illegal and instead of deleting them you will request a restriction on their use,
3. the operator no longer needs personal data for the purpose of processing personal data, but you need them to enforce a legal claim, or
4. you object to the processing of personal data;
5. the operator limits the processing of your personal data until it is verified, whether the legitimate reasons on the side of the operator outweigh your legitimate reasons. If the processing of personal data has been restricted, except for addition to storage, the operator may process personal data only with the consent of the concerned subject, or for the purpose of enforcing a legal claim, for the protection of subjects, or for reasons of public interest. The operator is obliged to inform you before the restriction on the processing of personal data is lifted.
   
   

Notification obligation in connection with correction, deletion or restriction of the processing of personal data

The operator is obliged to notify the recipient (anyone to whom your personal data has been provided) of the correction, or deletion of personal data, or restrictions on the processing of personal data, unless this proves impossible or requires a disproportionate effort. If required, the operator will inform you of these recipients.

Right to portability of personal data

You have the right to obtain personal data concerning you and which you have provided to the operator in a structured, commonly used and machine-readable format. Simultaneously, you have the right to transfer this personal data to another operator, if it is technically possible and if the processing of your personal data is performed by automated means (e.g. electronically), while the personal data are processed either

1. with your consent,
2. or are necessary for the performance of the contract to which you are a party, or for the performance of a pre-contractual measure at your request. This right must not adversely affect the rights of other subjects. The enforcement of the right of portability does not affect the right to delete personal data. The right of portability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority conferred on the operator.
   
   

The right to initiate proceeding for the protection of personal data

Providing that you are directly affected under the Personal Data Protection Act, you have the right to submit a proposal to initiate proceeding on personal data protection according to Section 100 of this Act. The purpose of the proceeding is to determine whether the rights of individuals have been violated in the processing of their personal data or the law has been violated and, if deficiencies are found, if justified and expedient, to impose remedial measures or a fine for violating the law. The office shall publish a model of the proposal on its website. The proposal must contain evidence in support of the allegations made in the proposal, and a copy of the document, or other evidence proving the exercise of the right by the operator (right of access to personal data, right to request correction of personal data, right to erase or restrict processing of personal data, right to object to processing of personal data, the right to the transfer of personal data), if such a right has been exercised by the concerned subject, or an indication of reasons worthy of special consideration for not exercising the right in question.

The above rights (in addition to the right to initiate proceedings on personal data protection) may be exercised by e-mail or in writing by post to the operator supervising the processing of personal data. The operator may also be notified of the leakage of personal data or other serious issues concerning the processing of personal data by the operator.

If the concerned subject suspects that his/her personal data are being processed unjustifiably, he/she may file a motion to initiate proceedings on personal data protection with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovak Republic or contact the office via its website. headquarters http://www.dataprotection.gov.sk.

If the concerned subject does not have full legal capacity, his/her rights may be exercised by a legal representative. If the concerned subject is not alive, his/her rights may be exercised by a close person under this Act.

The request of the concerned subject pursuant to the Personal Data Protection Act shall be processed free of charge, except for payment in amount which may not exceed the amount of expediently incurred material costs associated with making copies, supplying technical media and sending information to the concerned subject, unless a special law provides otherwise. The operator is obliged to process the request of the concerned subject in writing no later than 30 days from the date of delivery of the request. The operator shall notify the data subject and the Office for Personal Data Protection of the Slovak Republic in writing of the restriction of the data subject's rights pursuant to the Personal Data Protection Act without undue delay.

The Operator hereby informed you, as the concerned subject, about the protection of your personal data and instructed you about your rights in relation to the protection of personal data within the scope of this written information obligation.

 

Processing of personal data for the purposes of ordering and complaint procedures

1. The purposes of processing personal data: issuing a tax document, contacting the customer regarding the order, contract fulfillment, handling the application of liability for defects in the sold products - resulting from the the contract.
2. Legal basis for the processing of personal data: a) The processing of personal data (name, surname, title, street and number, postal code, city) is necessary according to a special regulation or an international agreement by which the Slovak Republic is bound. Especially according to Act no. 222/2004 Coll. on value added tax. b) Processing of personal data (email, telephone contact) is necessary for the performance of the contract.
3.  Retention period of personal data - ten years.
4. The provision of personal data is a contractual obligation.

Processing of personal data for the purpose of sending marketing information

The processing of personal data for the purpose of sending marketing information, the general information for the processing of personal data mentioned above applies, as well as:

1. The purposes of personal data processing: sending marketing information
2. Legal basis for the processing of personal data: article 6 par. 1 letter a) GDPR - the concerned subject has consented to the processing of his/her personal data for one or more specific purposes
3. Retention period of personal data - ten years.
4. The provision of personal data in the case of a legitimate interest is obligatory in order to achieve this legitimate interest. When processing on the basis of consent, the provision of personal data is voluntary.
   
   

Individual automated individual decision-making, including profiling

The concerned subject shall have the right not to be subject to a decision, which is based exclusively on automated processing, including profiling, and which has legal effects affecting or similarly significantly affecting him/her.

 

Processing of personal data for the purpose of cookie processing

For the processing of personal data for the purpose of processing cookies, the general information for the processing of personal data mentioned above applies, as well as:

1. The purposes of processing personal data: providing services, personalizing ads, traffic analysis, adwords, google analytics, heureka.
   Cookies are small amounts of data that servers send to your browser. The browser saves them on the user's computer. Each time you visit the site, the browser then sends this data back to the server.
2. Legal basis for the processing of personal data: article 6 par. 1 letter a) GDPR - the concerned subject has consented to the processing of his/her personal data for one or more specific purposes
3. Retention period of personal data - Cookies used on our website can be divided into two basic types in terms of their durability. Short-term cookies, so-called "Session cookies," which are only temporary and remain stored in your browser only until you close the browser, and long-term cookies, so-called "Persistent cookies" that remain stored on your device for a long time or until you delete them manually, the time it takes to keep cookies on your device depends on the settings of the cookie itself and your browser settings.
4. The provision of personal data is necessary to achieve the purpose.
   
   

Conditions and method of processing the personal data of the concerned subjects

The operator processes the personal data of the concerned subjects in its information systems by automated and non-automated means of processing. The operator does not disclose the processed personal data, unless required by a special legal regulation or a decision of a court or other state body. The operator will not process your personal data without your express consent or other legal basis for any other purpose, or to a greater extent than stated in this information and the records of the individual information systems of the operator.

Individual automated decisions, including cookie profiling

The operator uses an analytical tool to monitor his website, which prepares the data chain and monitors how visitors use the site on the internet. When someone browses the site, the system generates cookies to record information related to the visit (visited pages, time spent on our site, browsing data, leaving the site, etc.), but this data must not be linked to the visitor subject. This tool is a tool to improve the ergonomic design of a website, to create a user-friendly website and to enhance the online experience for visitors. Most internet browsers accept cookies, but visitors have the option to delete them or automatically reject them. Since each browser is different, visitors can set their cookie preferences individually using the browser toolbar. If you choose not to accept cookies, you will not be able to use some functions on our website.

 

Type of cookies	Use	Validity of cookies
Absolutely necessary / basic	- for the most important functions necessary / basic website, enabling proper functioning of the website - remembers username that will give you a quick login the next time you visit the site - these cookies do not collect any information about you that could be used for marketing purposes	1 year
Functional	- used to improve the service for the user, customize the user interface - preference information is recorded according to the choice of content - cookies can remember items that you have added to the e-shop shopping cart or errors you have encountered	After leaving the page
Performance cookies and targeting cookies - analytical cookies	- third-party analytics tools (google analytics) are used to improve quality - analytical content cookies for website visitors - statistics are collected such as the number of website visits and links to our website and the number of visits - help to understand how the website visitors behave - Cookies improve website performance - these cookies do not collect - information to find out your identity - is anonymous	Deleted automatically 2 years after the last visit to the website
Sharing for - use of social networks	- Use of third-party social media, which allows you to share content on social media from our website, using the buttons "like" and "share" - cookies are required for easier use of their services - Record information about your activity on the Internet and on the websites you use	Deleted automatically 2 years after the last visit to the website
Quality display	built-in cookies that improve performance for faster loading of content and help with the compatibility	Deleted after closing the browser
The website owner	according to the given website settings - can only be "read" by a given website (the number of visitors to the website, from which they came and which parts of the site they visited)	1 year

 

An operator uses the Google AdWords advertising program, which enables to create online ads and reach people when they are interested in the products and services provided by the operator. AdWords Remarketing or Similaraudiences allow us to reach people who have visited your websites in the past. Allows your ad to appear on search, YouTube, and email. Dynamic remarketing allows users to show ads on products or services they have viewed in the past. Cookies that provide remarketing codes can be disabled by website visitors through appropriate browser settings.

The operator can be also contacted via Facebook. The purpose of data processing is to share the content of the operator's website and the operator's presentation. Guests can find out about news, current special offers from the operator via Facebook, and also view photos from selected orders of the operator. By clicking on "like" on the operator's Facebook page, subject agree that the operator will post the news and offers on their Facebook message board. The operator also publishes photos / videos from various events on the Facebook page.

The operator publishes this data of individuals only if their written consent has been previously obtained. For more information on managing data from the Facebook page, see the guide and privacy policy at www.facebook.com. The operator also has his profile on the social network Instagram, where he presents together with a description of photos from selected orders, for the purpose of presentation,. By clicking on "follow" you agree to the display of photos published by the operator.