Zásady ochrany osobních údajů

Privacy Policy

General information

This Privacy Policy has been prepared pursuant to the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”), in particular Articles 13 and 14 of the GDPR specifying the Controller’s information obligation, as well as the legislation in force and effect in the territory of the Czech Republic. Personal data means any information relating to an identified or identifiable natural person. Under the legal framework, such a person is a data subject. An identifiable person is a natural person who can be identified, directly or indirectly, from their data, such as name, surname, identification number, residential or registered address, as well as other data enabling identification. Personal data may also include other factors specific to an individual’s identity, e.g. physical, physiological, genetic, mental, economic, cultural or social. Personal data also includes an e-mail address, telephone number, biometric information (e.g. fingerprint), location data, IP address, healthcare information, religious beliefs, social security number or marital status. This Privacy Policy explains how your personal data as a data subject is used and what rights you have in connection with the processing of your personal data by the Controller. We strongly recommend that you read the following provisions carefully.

Who is the controller of your personal data?

The controller of your personal data is: Mr Cezary Siwik, trading as: “LANO MEBLE” SIWIK Cezary, NIP: 6190013551, REGON: 100363308 (the “Controller”). The Controller can be contacted at “Lano Meble” Siwik Cezary, Tyble 43C, 98-420 Sokolniki, Poland, or by e-mail at office@lanonabytek.cz.

Categories of personal data processed by the Controller

The Controller processes personal data relating to the identification of your person for the purpose of verifying your identity. These data include in particular your first name and surname, residential address, delivery address (or registered office or place of business), e-mail address, telephone number, company name and identification number.

Does the Controller process data automatically?

The Controller may also process personal data by automated means, including profiling, consisting in creating personalised offers of Goods available at LanoNabytek.cz, presenting them on the website, as well as sending marketing communications to customers (where they have given voluntary consent) by the Controller, which may significantly affect the Customer by enabling them to purchase Goods at the prices stated in the offer.

Purpose, scope, duration and legal basis for processing personal data

The purpose, scope, duration and legal basis for processing personal data by the Controller depend on the activities carried out by the data subject in the online Shop. The Controller processes personal data of data subjects for the following purposes, scope, duration and on the following legal bases:

concluding and performing a contract for the provision of electronic services or taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). Data are stored for the period necessary to perform or otherwise terminate the contract. The scope of processed personal data is as follows:

first name and surname,
e-mail address,
telephone number,
delivery address (street, house number, flat number, postcode, town/city, country), residential/place of business/registered office address (if different from the delivery address).

For Customers who are not Consumers, the company name and identification number may also be considered personal data processed by the Controller. The above scope of personal data may change, in particular in the case of personal collection of a parcel;

compliance with the Controller’s legal obligation arising in connection with handling or fulfilling the relevant order. These legal obligations also include obligations arising for the Controller during the complaints process, as well as accounting and tax obligations (Article 6(1)(c) GDPR). The Controller processes the data provided by the subject in connection with placing an order only for the period necessary to process it, including performance of the concluded contract and obligations arising therefrom, and including accounting and tax obligations. The scope of processed personal data is as follows:

first name and surname,
e-mail address,
telephone number,
residential/place of business/registered office address,
tax identification number;

establishing, pursuing or defending claims in judicial or administrative proceedings or in other legal proceedings that may be initiated by the Controller or brought against the Controller (Article 6(1)(f) GDPR). Personal data are stored for the statutory limitation period for the purpose of pursuing or defending against potential claims. Scope of processed data:

first name and surname,
e-mail address,
telephone number,
delivery address (street, house number, flat number, postcode, town/city, country, and possibly residential/place of business/registered office address if different from the delivery address).

For Customers who are not Consumers, the company name and identification number may also be considered personal data processed by the Controller;

communication in connection with an enquiry submitted to the Controller by the data subject by e-mail or telephone (Article 6(1)(b) and (f) GDPR). Personal data provided in connection with the enquiry are processed for as long as the Controller has a legitimate legal interest related to dealing with the data subject’s enquiry, including providing a response. Scope of processed data:

e-mail address,
telephone number,
data given in the form;

contacting the Customer in connection with placing a telephone order by the data subject (Article 6(1)(b) and (f) GDPR). Personal data are processed until the end of the telephone conversation with the Customer. Scope of processed data:

telephone number,
data provided during the conversation;

marketing activities, direct marketing, including sending commercial information electronically – where consent has been given (Article 6(1)(f) GDPR). Personal data are stored for as long as the Controller’s legitimate interest persists, but no longer than until the data subject objects to the continuation of the above marketing activities. Scope of processed data:

first name and surname,
e-mail address.

Personalised marketing and ad targeting (Google Customer Match) – if you have given your consent (Article 6(1)(f) GDPR). Personal data in the form of your e-mail address may be used for personalised marketing campaigns within the Google advertising ecosystem (e.g. Google Search, YouTube, Gmail). This process consists of sending an encrypted version of your e-mail address to Google, which compares the received data with its user database to determine whether you have a Google account. If a match is successful, you will be added to a custom audience list, allowing us to target personalised advertising messages to you. Personal data are processed until you withdraw your consent.

Where do we obtain your personal data?

We obtain all personal data only from the relevant data subjects.

With whom may we share your personal data?

A recipient is a natural or legal person, public authority, agency or other body to whom personal data of data subjects are made available, whether or not it is a third party. A third party means a natural or legal person, public authority, the data subject, controller, processor and other entities that may process data subjects’ personal data on the basis of a mandate from the Controller or the processor. Public authorities are not regarded as recipients, even where they may receive personal data of subjects under a special procedure in accordance with European Union law or the legal order of the Czech Republic; processing of personal data by these public authorities must be in accordance with the data protection rules applicable to the purposes of the processing. Granting access constitutes the transfer of personal data to a recipient who independently determines the purposes and means of processing.

The recipients of the personal data provided will be:

Poczta Polska Spółka Akcyjna, registered office: ul. Rodziny Hiszpańskich 8, 00-940 Warsaw, NIP: 525-000-73-13, KRS: 0000334972
suppliers fulfilling orders placed via the online Shop.

To whom may we entrust your personal data?

A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller to whom the data subjects’ personal data have been entrusted. In the case of entrustment, the processor receives personal data of data subjects on the basis of a data processing agreement concluded with the Controller.

For the above purposes, the Controller may use external service providers (processors), in particular, for example:

debt collection agents;
persons providing accounting services to the Controller;
persons providing legal services in connection with the Controller’s activities;
persons providing IT services in connection with the Controller’s activities, including hosting services;
providers of tools used to analyse website traffic;
persons providing services aimed at supporting the Controller’s marketing activities;
persons processing personal data on behalf of the Controller.

The above entities process personal data of subjects only on the basis of an agreement concluded with the Controller and solely in accordance with the Controller’s instructions.

Are personal data transferred to a third country or an international organisation?

The Controller does not transfer data subjects’ personal data to any third country or international organisation.

What rights do you have in relation to the processing of your personal data?

The data subject has the following rights:

access to data, including confirmation of processing, receipt of a copy of their data and information about the processing of their data;
to request rectification of inaccurate data or completion of incomplete data;
to request the immediate erasure of data where:

the data are no longer necessary for the purpose for which they were provided, collected or otherwise processed;
the data subject has withdrawn consent to the processing of personal data and there is no other legal basis permitting the processing of that subject’s data;
the data subject has objected to the processing of personal data;
personal data have been processed unlawfully;
personal data must be erased to comply with a legal obligation;

to request restriction of processing where:

the data are inaccurate, for the period necessary for the relevant personal data to be duly verified;
the processing of personal data is unlawful and the applicant objects to their erasure;
the Controller no longer needs the data, whereas the applicant needs them to establish, exercise or defend legal claims;
the data subject has objected to processing, pending verification of whether the Controller’s legitimate grounds override those set out in the objection;

data portability, including receiving the data in a structured, machine-readable format or requesting that they be sent to another Controller, provided all of the following conditions are met:

the processing is based on a contract concluded with the data subject or on the consent given by that person;
the processing is carried out by automated means;

to lodge a complaint with a supervisory authority if the data subject believes that the processing of their personal data infringes the GDPR. The supervisory authority is:

Úřad pro ochranu osobních údajů (Office for Personal Data Protection)
Pplk. Sochora 27, 170 00 Prague 7
tel.: +420 234 665 800
DS: qkbaa2n
posta@uoou.gov.cz

to withdraw consent to the processing of personal data at any time, where processing is based on the data subject’s consent. Withdrawal of consent does not affect processing already carried out on the basis of consent prior to its withdrawal and in accordance with applicable law;
to object to processing for purposes arising from the Controller’s legitimate interests, in particular direct marketing carried out by the Controller.

The Controller will provide you with information about measures taken in response to your request within one month of receiving it. In particularly complex cases, this period may be extended by a further two months from receipt of the request. To fulfil your request, we are entitled to verify your identity to prevent your data being disclosed to an unauthorised person.

If your request proves to be manifestly unfounded or excessive, in particular due to its repetitive character, the Controller may charge a reasonable fee for dealing with the request or refuse to act on the request.

Marketing information

You have the right to consent to receiving commercial and marketing information electronically. You may unsubscribe from marketing information at any time by sending a request to office@lanonabytek.cz or by sending a registered letter to the Controller’s address.

Do we use cookies?

The Controller uses SALESmanago for marketing purposes and to send newsletters. The Controller also uses cookies to personalise transmitted content and for statistical purposes. As part of marketing campaigns, the Controller also uses the following tools: Third-party Google Tag cookies, Google Ads Enhanced Conversions tag, Facebook Pixel and Pinterest Pixel.