Declaration on the processing of personal data on social networks

Declaration on the processing of personal data on social networks

In accordance with the Regulation and the Personal Data Protection Act, the operator:

Company name:                              Barbara Minčíková - VINOPOLITAN

Address:                                             Mraziarenská 16464/6, 821 08 Bratislava – mestská časť Ružinov

Address of the operation:            Námestie SNP 6, 811 06 Bratislava – Old Town

Registration:                                     District court Bratislava,

                                                            Trade Register Number: 110-231907

Company registration number:         47 657 235

(further referred to as "company" or "operator")

processes your personal data to the extent and under the conditions provided for in separate regulations.

This Personal Data Processing Statement (hereinafter referred to as the "Statement") provides basic information about your rights regarding the processing of personal data by the company and information on access to personal data.

Purpose of processing, legal basis and retention period of personal data

Social networks:

The company processes personal data on social media sites for the purpose of informing customers about offers, products, services, promotions, contests, or other topics and news, as well as for communicating with social media visitors about these topics, as well as for responding to relevant inquiries regarding praise, criticism, questions or other suggestions. The legal basis for processing your personal data provided is generally Article 6 (1) (f) of the Regulation. The company operates the following pages on social networks:

-       Facebook:  https://www.facebook.com/VinopolitanBratislava

-       Instagram:  https://www.instagram.com/vinopolitan_wineshop/

Next to us, the operator of the relevant social network platform is also an independent operator. In some cases, it acts as a processor for us in accordance with Article 28 of the Regulation to ensure the management and operation of our account on the relevant social network. The operator of the social network is also an independent operator processing personal data, over which we have only limited influence, but you have accepted their terms and conditions when registering for the respective social network. In cases where we can influence and determine the conditions of personal data processing, we strive to, within the possibilities provided to us by the social network operator, ensure that the processing of personal data is carried out in accordance with the relevant legal regulations.

As mentioned, in cases where the provider of the social media platform allows us to do so, we ensure that our pages on social networks comply with data protection regulations. Therefore, in particular, we do not target advertising to specific groups based on demographic or interest parameters or based on location information, even if such data were made available to us by the operator of the social network. The statistics provided to us by the operator of the social media platform can only be influenced by us to a limited extent, but we cannot turn them off. However, we make sure that no additional optional statistics are provided to us.

Privacy Policy

Recipients / Categories:

The data that you have added to our pages on social networks, such as comments, videos, images, likes, public messages, user profile, etc. are published through the social network platform and we never process or use them for any other purpose. We reserve the right to delete any content that violates legal regulations, such as posts that violate the law, hateful comments, vulgar comments (e.g. containing sexual content), or attachments (e.g. images or videos) that violate copyright, intellectual property rights, criminal laws or ethical principles of the Company.

We may share your content on our page if it is a feature of the social media platform and we communicate with you through the social media platform. The legal basis for this is Art. 6 para. 1 letter b) of the Regulation, as we are jointly participating in the social media platform agreement and have accepted the terms of this service. In some cases, we may also rely on legitimate interest pursuant to Art. 6 (1) (f) of the Regulation, which is justified by the Company's interest in developing our relationships with the public and communicating with you. As for the data that you send to us confidentially (for example, through the private message feature, by letter, or by email), we strictly exclude the transfer of these personal data to a third party outside the VINOPOLITAN group. Exceptionally, data processing may occur through intermediaries authorized by us. These are carefully selected, regularly monitored, and contractually bound in accordance with Article 28 of the Regulation in each individual case. In addition, there may be a situation where it will be necessary to forward your request to our contractual partner (for example, our supplier in case of requests related to specific products) for the purpose of its processing. In these cases, your complaint will be anonymized before it is forwarded in such a way that the third party cannot connect this complaint with your person. If it were necessary in a specific case to forward your personal data to a third party, we will inform you in advance of this need and ask for your consent.

Retention period / Criteria for determining the retention period:

All personal data that you have provided us in connection with your feedback (praise, criticism, question or other feedback) sent via direct message on our social media page will be deleted or permanently anonymized (by deleting all your identification data) by us no later than 90 days after the final response is sent to you. The storage of data for 90 days after sending the final response reflects the fact that it may rarely happen that you will contact us again in the same matter after receiving the response, and on our part, it will be necessary to be able to follow up on the previous communication.

We do not manage and store all the functionalities of the social network, therefore, for example, all posts published on our social media page will remain on the timeline for an unlimited period of time if we do not remove them due to the update of basic topics, or due to their conflict with legal regulations or our policies, or if you do not remove the post yourself.

We cannot influence the deletion of your data by the operator of the social network itself. Therefore, the principles of personal data protection of the relevant operator of the social network also apply retrospectively.

The purpose of processing data by the operator of the social network platform

The operator of the social network platform uses web tracking. Web tracking can be performed regardless of whether you are logged in or registered on the social network platform. Unfortunately, as we have already mentioned, we cannot influence the methods of web tracking used by social network platforms and therefore cannot disable them. It cannot be excluded that the operator of the social media platform uses your profile and data on your behavior, personal relationships, interests, etc. for example, to evaluate your habits, personal relationships, interests, etc., and that the Company has no influence on the processing or handling of your data by the operator of the social media platform.

Further information regarding the processing of personal data through providers of social network platforms and other options to express disagreement can be found in the privacy policies of the relevant platform operator:

Facebook:https://www.facebook.com/privacy/explanation

Instagram: https://help.instagram.com/1896641480634370

Information pursuant to Art. 26(2) of the Regulation: There is a relationship with the operator of social media services under Art. 26(1) of the EU Regulation (joint responsibility). In this context, the operator of social media services operates the entire IT infrastructure of these services, has its own data protection policies, maintains a separate user relationship with you (if you are a registered user of social media services), and is jointly responsible with the Company for deleting content and posts that are inappropriate or in violation of legal requirements. In addition, the social network operator is solely responsible for all issues related to your user profile data, to which the Company does not have access. The social network operator cannot interfere with the processing of your data carried out by the Company in customer communication or contests. To ensure the safe processing of personal data and compliance with the Regulation and the Personal Data Protection Act, the Operator, who you can contact in case of exercising your rights, supervises the processing.

Establishment contact info:

Telephone number:               +421 949 213 441 , +421 905 384 151

Address of the operation:   Námestie SNP 6, 811 06 Bratislava – Old Town

E-mail:                                     info@vinopolitan.sk

 

Your rights under the Regulation and Act on the protection of personal data.

The Regulation or the Act on Personal Data Protection contains detailed information about your rights as a data subject regarding the protection of personal data, available means of redress, as well as their limitations (in particular, Art. 15-22, Art. 77, Art. 79, Art. 82 of the Regulation, § 21-28, § 38 of the Act on Personal Data Protection). You can request information at any time about the processing of your personal data, demand correction or deletion of your personal data, or restrict its processing. You can also object to the processing of your personal data based on legitimate interests and to the sending of direct marketing messages. You have the right to data portability. Below in the text, the most important provisions are summarized.

Right to information

If the operator processes your personal data, they must provide you with information about the data concerning you, including the main characteristics of the processing of personal data, such as the purpose, legal basis, and retention period of the processing, the identity and contact details of the operator and, where appropriate, their representative, the recipients of personal data (in the case of transfer of personal data to third countries, also the mention of appropriate and suitable safeguards), the legitimate interests of the operator and/or third parties in case of processing personal data based on legitimate interest, as well as your rights to data protection and your options for remedies (including the right to file a complaint with the supervisory authority), even without your specific request for their provision. In case of automated decision-making, including profiling, the data subject must be informed in a comprehensible manner about the procedure used, as well as about the significance and expected consequences of such processing for the data subject. The controller will provide you with the above information by making the Privacy Policy accessible. The above does not apply to the extent that you already have the information as a data subject.

The right to access data

You have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:

You have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from the data subject, any available information as to their source.

Based on your request, the controller shall provide a copy of your personal data being processed. The controller may charge a reasonable fee corresponding to administrative costs for any further copies requested. The right to obtain a copy shall not adversely affect the rights and freedoms of others. The controller shall provide you with information on the possibility, procedure, any costs involved, and further details on the provision of a copy after receiving your request.

If you have submitted the request by electronic means, the information will be provided to you in a commonly used electronic form, unless you request otherwise.

In the case of automated decision-making, including profiling, the data subject has access to the following information: the procedure used, as well as the significance and envisaged consequences of such processing for the data subject.

Right to rectification

You have the right to have the controller rectify without undue delay any inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure (‘right to be forgotten’)

You also have the right to obtain from the controller the erasure of personal data concerning you without undue delay, and the controller shall have the obligation to erase personal data without undue delay where certain conditions are met. Reasons for which the controller is obliged to erase your personal data based on your request include, for example: personal data are no longer necessary for the purposes for which they were collected or otherwise processed; you withdraw your consent on which the processing is based and there is no other legal ground for the processing; personal data have been processed unlawfully; or you object to the processing and there are no overriding legitimate grounds for the processing, personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject, or personal data have been collected in relation to the offer of information society services. The operator may not be able to comply with your request in some cases, for example if the processing of personal data is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation that requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest, for reasons of public interest in the area of public health, for archival purposes in the public interest, for the establishment, exercise, or defense of legal claims.

Right to restriction of processing

You have the right to request that the controller limits the processing in any of the following cases:

a) you challenge the accuracy of personal data, for a period enabling the controller to verify the accuracy of the personal data;

b) the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;

c) the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims;

d) you have objected to processing pending the verification whether the legitimate grounds of the controller override your grounds.

If processing has been restricted for the aforementioned reasons, such personal data, except for their storage, shall only be processed with your consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

The operator will inform you before the processing limitation is lifted.

The right to data portability

You have the right to obtain the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

a) the processing is based on your consent or on a contract (to which you are a party), and

b) the processing is carried out by automated means.

When exercising your right to data portability, you have the right to transfer the personal data directly from one controller to another, where technically feasible.

The exercise of the right to data portability shall not prejudice the right to erasure. The right to data portability must not adversely affect the rights and freedoms of others.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on the legitimate interests of the controller, including profiling based on those provisions. The operator may not process personal data further unless it demonstrates necessary legitimate grounds for processing that override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims. If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing. If you have objected to the processing for direct marketing purposes, personal data may no longer be processed for such purposes. The right to withdraw consent at any time. In cases where the controller processes your personal data based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The withdrawal of consent must be as easy as giving it.

You can withdraw your consent by sending it by post to the controller's registered office address, or to the email address of the Data Protection Officer, or in the manner specified in the given consent.

Right to lodge a complaint with the supervisory authority

If you believe that the processing of your personal data is in violation of the Regulation or the Act on Personal Data Protection, you have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; phone number: +421 /2/ 3231 3214; e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk.

Right to an effective judicial remedy

You have the right to a judicial remedy if you believe that processing of your personal data has resulted in a breach of your rights under the Regulation/Law on Personal Data Protection. You can file a motion to initiate proceedings (lawsuit) in the court of a Member State where the controller has an establishment or in the court of your habitual residence (domicile).

Right to compensation for damages and liability

Every person who suffered property or non-property damage as a result of a violation of the Regulation or the Act on Personal Data Protection has the right to compensation for the damage suffered from the controller. The controller is responsible for damage caused by processing in which it participated and which was in breach of the Regulation or the Act on Personal Data Protection (damage caused by unlawful processing). The controller is relieved of liability for damage caused by unlawful processing if it proves that it is not responsible for the event that caused the damage (the damage was not caused by its fault).

In case of any questions regarding the processing of your personal data, you can contact us through our Data Protection Officer. Changes related to the terms of processing and protection of personal data are published on our website through updates to this Statement. This way, we ensure that you always have access to up-to-date information about the conditions under which we process your personal data.