Privacy policy

Controller’s information notice

This notice is provided in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), referred to below as the “GDPR”, and Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts, referred to below as the “Act”.

Protecting the personal data of our clients, contractual partners and other individuals is very important to us. We therefore continually review all our personal data processing activities and ensure their compliance with the GDPR and the Act. This notice explains how and under what conditions we process your personal data, and the rights you have in connection with that processing.

What are our contact details?

To enable you to exercise all your rights relating to the protection of personal data, we provide the following contact details:

Name and address of the controller:

• Controller: Weesion s.r.o.
• Registered office: Kríkova 8696/10, 821 07 Bratislava – mestská časť Vrakuňa
• Company registration number (IČO): 56 875 339
• Registration: The company is registered in the Commercial Register of Bratislava III Municipal Court, Section Sro, File No. 186582/B.

If you have a question that is not answered in this information notice, would like more information about any of its points, or wish to exercise any of your data protection rights, please contact us.

Our contact details:

• Postal address: Weesion s.r.o., Kríkova 8696/10, 821 07 Bratislava – mestská časť Vrakuňa
• Email: jcsomor@weesion.eu, ftoth@weesion.eu
• Telephone: 0904/890409, 0918/382873

Why do we process personal data?

We need to process personal data primarily so that we can:

• offer and provide our goods and services to our clients and carry out our business activities;
• fulfil various statutory and contractual obligations; and
• protect our legitimate interests and those of our clients and other persons.

What is the scope, purpose and legal basis of personal data processing?

As the controller, we inform you that we process only the following categories of your personal data, for the following purposes and on the following legal bases:

By processing your personal data, we pursue the following legitimate interests:

• exercising our legal rights and defending our legitimate interests in civil court proceedings, administrative proceedings and criminal proceedings.

Who receives your personal data?

We protect the personal data of our clients, contractual partners and other individuals. We do not disclose or provide it to third parties or entities, except those who maintain accounting records or provide transport services to deliver goods ordered through our online shop and who are therefore considered processors under the GDPR.

Specifically, your personal data may be provided to the following processors/recipients:

• For operating the online shop, within the scope of the Webshop information systems for unregistered and registered customers: Google Analytics.
• For delivering ordered goods, within the scope of the Webshop information systems for unregistered and registered customers and the Contracts information system: DHL Express, operated by DHL Express (Slovakia), spol. s r.o., with its registered office at Letisko M.R. Štefánika, 820 01 Bratislava, company registration number 31 342 876; and the Zásielkovňa delivery service, operated by Packeta Slovakia s.r.o., with its registered office at Sliačska 1E, 831 02 Bratislava – mestská časť Nové Mesto, company registration number 48 136 999.
• For recording business transactions, within the scope of the Accounting information system: the accounting company EKO Profin SK s.r.o., with its registered office at Panónska cesta 34, 851 04 Bratislava – mestská časť Petržalka, company registration number 55 800 556.

When choosing our partners, we consider, among other things, the assurances they provide of reliability and professional care in processing our clients’ personal data. These entities are bound by confidentiality obligations and must adopt appropriate technical and organisational measures to ensure that personal data processing meets the requirements of the GDPR and the Act. Where required by law or a decision of a public authority, your personal data is also provided to public authorities or other entities, such as health insurance companies, tax authorities, the Social Insurance Agency, state administration and public authorities, courts, law enforcement authorities and other bodies to which personal data must be provided by law (for example supervisory authorities). It may also be provided to enforcement officers, courts, our lawyers, notaries providing services to us, or cooperating controllers.

We are required to prevent the commission of criminal offences and to report information in connection with the prevention of money laundering and terrorist financing.

Do we transfer your personal data outside the European Union?

The controller informs you that your data is not transferred outside the European Union to third countries or international organisations.

How long do we retain your personal data?

We retain your personal data only for as long as necessary for the purposes for which it is processed. For example:

• Accounting documents are generally retained for 10 years after the end of the accounting year and tax period.
• Documents relating to individual business transactions are retained for 5 years after the transaction is closed.
• Documents relating to legal disputes are retained for 10 years after the legal case is closed.

Personal data cannot be destroyed, for example, where:

• original documents cannot be destroyed;
• documents must be handed over to the state archives;
• proceedings are pending before a court, state administration authority or law enforcement authority and relate to the content of documents that would otherwise be due for destruction.

Where processing requires the data subject’s consent, we process personal data for three (3) years after your consent ceases to apply; in other cases, we process it for the period specified in our records retention schedule. Once the retention period has expired, we ensure that the personal data is erased or anonymised in full compliance with the GDPR.

What rights do you have in relation to our processing of your personal data?

As a data subject, you have several rights under the GDPR, which we set out below:

7.1 Right of access to personal data

You have the right to obtain confirmation from us as to whether we process personal data concerning you. If we do, you have the right to access that personal data and to obtain basic information about how it is processed. You may contact us at any time using the details in the section “What are our contact details?”.

7.2 Right to rectification and/or completion of personal data

You have the right to require us to correct inaccurate personal data concerning you without undue delay and to complete incomplete personal data. You may contact us at any time using the details in the section “What are our contact details?”.

7.3 Right to erasure of personal data

You have the right to require the erasure of your personal data without undue delay only where:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• you withdraw the consent on which processing is based and there is no other legal basis for processing;
• you object to processing and there are no overriding legitimate grounds for processing;
• the personal data has been processed unlawfully;
• the personal data must be erased to comply with a legal obligation under European Union law or the law of a Member State to which we are subject;
• the personal data was collected in connection with the offer of information society services referred to in Article 8(1) of the GDPR.

You may contact us at any time using the details in the section “What are our contact details?”. We will then assess whether an exception applies in your case that prevents us from erasing your data even if one of the conditions above is met (for example, where the data is necessary for the exercise of legal claims).

7.4 Right to restriction of processing

You have the right to require us to restrict the processing of your data (that is, to store it without otherwise processing it) where:

• you have contested the accuracy of the personal data;
• processing is unlawful and you oppose erasure of the personal data and request restriction of its use instead;
• we no longer need your personal data for processing purposes, but you need it to establish, exercise or defend legal claims;
• you object to processing.

You may contact us at any time using the details in the section “What are our contact details?”. We will then assess whether any exceptions apply that allow us to process your personal data in ways other than storage.

7.5 Right to object to processing

You have the right to object to the processing of your personal data where its legal basis is: (a) the necessary performance of a task carried out in the public interest or in the exercise of official authority; or (b) processing necessary for the purposes of the legitimate interests pursued by our company or a third party, except where those interests are overridden by your interests or fundamental rights and freedoms requiring protection of personal data, particularly where the data subject is a child. You may contact us at any time using the details in the section “What are our contact details?”. We may continue processing your personal data only if we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims.

7.6 Right to data portability

If your personal data is processed by automated means on the basis of your consent or for the performance of a contract, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another person (controller). You may contact us at any time using the details in the section “What are our contact details?”.

7.7 Right to withdraw consent at any time

You also have the right to withdraw your consent to the processing of personal data concerning you at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You may contact us at any time using the details in the section “What are our contact details?”.

7.8 Right to lodge a complaint with a supervisory authority

If you believe that the rights of individuals in connection with personal data processing or the GDPR have been infringed, you may submit a request to initiate personal data protection proceedings to the Office for Personal Data Protection of the Slovak Republic. A template is published on the Office’s website. Contact details: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; telephone: +421 /2/ 3231 3214; email: statny.dozor@pdp.gov.sk; https://dataprotection.gov.sk.

Are you required to provide your personal data?

Providing personal data for the performance of a contract concluded through the online shop is not a statutory obligation of the data subject. However, without that personal data, the controller will not be able to fulfil its contractual obligations properly or complete your order. The same conclusion applies to the provision of personal data in other cases.

Do we obtain your personal data from sources other than you?

If you are our client, we most commonly obtain your personal data directly from you.

Do we carry out automated decision-making, including profiling?

We do not carry out automated individual decision-making without human intervention.

We carry out profiling to a limited extent only for registered customers of our online shop at www.weesion.sk or www.weesion.eu. Registration is voluntary, and an alternative without registration or profiling is offered at the same time. The legal basis for processing personal data when registering with our webshop is your consent, expressed by selecting the appropriate checkbox during registration. The conditions for withdrawing consent are included in the information provided during registration.

Changes to this privacy policy

Protecting personal data is an ongoing responsibility for us. The information we are required to provide about our processing of personal data may change or become outdated. We therefore reserve the right to amend this policy at any time and to any extent. If we make substantial changes, we will bring them to your attention, for example through a general announcement on our website or a separate email notification.