Personal Data Processing Notice

 

This Personal Data Processing Notice (hereinafter "Notice") has been prepared by Merch s.r.o., with registered office at Slávičia 10, 903 01 Senec, Company ID: 47 608 803, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No.: 95409/B (hereinafter "Company") for the purpose of providing clear, transparent, understandable, and easily accessible information regarding the processing of your personal data.

 

1. Definitions of Terms Used

 

In accordance with the principle of transparency and clarity, the Company uses the following terms for the purposes of this Notice:

 

  • Data Subject refers to you if the Company processes your personal data as described in this Notice;

 

  • GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation);

 

  • Portal refers to the website https://atteustore.com, including all subdomains, subpages, and components;

 

  • Act refers to Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts, as amended.

 

 

2. General Introduction

 

This Notice is prepared in accordance with Articles 13 and 14 of the GDPR, Sections 19 and 20 of the Act, and other generally binding legal regulations.

 

As the controller processing your personal data, the Company provides all necessary information regarding such processing.

 

The Company also uses cookies on the Portal. Some cookies may, in addition to other functions, collect your personal data. In such cases, the Company acts as the controller under Article 4(7) GDPR and Section 5(o) of the Act. More information on cookies is available on the Portal.

 

The Company has implemented standard and specific data protection measures, including appropriate technical and organizational safeguards, to ensure a high level of security for your personal data.

 

For any questions regarding this Notice or the processing of your personal data, or to exercise your rights under GDPR and the Act, you may contact the Company at any time:

  1. by post: Merch s.r.o., Slávičia 10, 903 01 Senec;
  2. by email: shop@atteustore.com;

 

3. Information on Personal Data Processing

 

The Company provides below an overview of the individual processing activities, the personal data processed, the purpose of processing, the legal basis, retention period, and other information.

 

Processed Personal Data

Purpose of Processing

Legal Basis

Retention Period

Legal/Contractual Requirement & Consequences of Non-provision

Data necessary for communication – name, surname, email, phone number, and content of communication.

Communication may take place online (email, contact form, etc.), by phone, or via postal mail.

Ensuring communication (sending, receiving, and recording of physical and electronic correspondence) between the Company and the Data Subject.

Legitimate interest of the Company – effective and smooth communication with the Data Subject.

3 years from the last communication or 10 years for postal correspondence.

Voluntary provision. You may object to processing under Art. 21 GDPR.

Data necessary for registration and user account – name, surname, address, email, phone.

Registration on the Portal and user account management.

Pre-contractual and contractual necessity. Registration creates a contractual relationship for account management.

For the duration of the account and thereafter for the statutory limitation period.

Mandatory provision. Without it, the Company cannot create a user account.

Data contained in documentation in company registry – name, surname, signature, address, email, phone, and other data as per law.

Registry management.

Legal obligation under Act No. 395/2002 Coll. and Decree No. 410/2015 Coll.

10 years from document registration date.

Mandatory provision. Non-provision breaches legal requirements.

Data necessary for exercising Company’s rights – name, surname, address, date of birth, other data relevant to legal proceedings.

Claim enforcement via courts, arbitration, enforcement officers, legal offices, notaries, or out-of-court settlements.

Legal obligation under civil, commercial, procedural laws.
Legitimate interest when no legal duty applies – to enforce and defend Company rights.

Until limitation or preclusion period expires, or 10 years after final resolution.

Mandatory or legitimate interest. Non-provision limits Company's ability to enforce rights.

Data for concluding and performing contracts (business counterparties) – name, surname, email, phone, job title, signature.

Contract execution, communication, fulfilling obligations.

Legitimate interest to ensure proper contract performance and communication.

For the statutory limitation period related to contractual claims.

Voluntary provision, with right to object under Art. 21 GDPR. Employer may lawfully share data (§78(3) Act).

Data for consumer contracts – name, surname, delivery address, email, phone, order details.

Conclusion and performance of consumer contract.

Pre-contractual and contractual necessity.

For statutory limitation period on claims.

Mandatory provision. Non-provision prevents purchase and contract conclusion.

Data necessary to exercise your rights – name, surname, email, phone, related data, right invoked, other info.

Processing requests to exercise data subject rights.

Legal obligation under GDPR and Act.

5 years after the year the request was handled.

Mandatory provision. Without data, requests cannot be processed.

Data for accounting and tax purposes – name, surname, email, phone, data on invoices.

Accounting and tax record-keeping.

Legal obligation under tax and accounting laws.

10 years after the year of first processing.

Mandatory provision under law.

Data for call recordings and service improvement – name, surname, phone, email, call recording, communication details.

Improving calls and customer service via call center.

Legitimate interest to enhance assistance and services.

1 month from recording date.

Voluntary provision, right to object under Art. 21 GDPR.

Data for participation in contests – name, surname, social profile, delivery address, info on drawing, content of comment (photo, text, video).

Organizing the contest and awarding prizes.

Pre-contractual and contractual necessity to enable contest participation.

For statutory limitation period on related claims.

Mandatory provision. Without data, participation is not possible.

Data for processing complaints – name, surname, address, product/service claimed, other complaint details.

Handling complaints as required by law.

Legal obligation under civil and consumer protection laws.

For statutory limitation period on claims.

Mandatory provision under law.

 

4. Rights of Data Subjects

 

You have the following rights under GDPR and the Act: access, rectification, erasure, restriction, portability, objection, rights regarding automated decision-making, right to lodge a complaint, and right to withdraw consent. Details on how to exercise these rights and applicable exceptions are available upon request or on the Company’s website.

 

5. Sources of Personal Data

Primarily provided by you directly. In some cases, from public sources or third parties authorized to share your data (§78(6) Act).

6. Recipients of Personal Data

Data may be shared with business partners, service providers (legal, IT, tax), postal and courier companies, authorities, and other entities as required by law or for contract performance. Data processing agreements are in place under GDPR Art. 26/28.

7. Data Retention

Data are retained for periods specified in section 3 or longer if required for legitimate interests or new legal obligations.

8. Transfers to Third Countries

Data may be transferred outside the EU only with adequate safeguards. Currently, no transfers to third countries are performed.

9. Automated Decision-Making

No automated decision-making, including profiling, is used in processing your personal data.