Privacy Policy

Personal Data Processing Policy

/ Personal Data Protection Policy and Instructions/

provided by the controller to the data subject when obtaining personal data from the data subject Online store homba.store

Controller

1. The controller hereby, in accordance with Article 13(1) and (2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 May 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "Regulation") provides the Data Subject from whom the Controller obtains personal data concerning him or her with the following information:

Identity and contact details of the Controller:

Business name: Madlife s.r.o.

Registered office: Jaurisova 515/4, 140 00 Prague 4, Czech Republic

Registered in the Register of the Municipal Court in Prague, File No. C 276476

ID No.: 061 20 407

Bank account: CZ78 2010 0000 0029 0123 2019

The Seller is not a VAT payer /Value Added Tax/

(hereinafter also referred to as "Seller")

2. References

These principles and instructions on personal data protection form part of the General Terms and Conditions published in the Seller's online store.

3. Personal data processed

3.1. The Operator processes the following personal data: name, surname, address, email address, telephone number, data obtained from cookies, IP addresses.

4. Identity and contact details of the Controller's representative: 4.1. The Controller has not appointed a representative. The Controller is also the Seller within the meaning of the term defined in the General Terms and Conditions of the online store.

5. Contact details of the responsible person:

5.1. No responsible person has been appointed.

6. Purposes of processing the personal data of the Data Subject:

6.1. The purposes of processing the personal data of the Data Subject are:

6.1.1. processing of accounting documents

6.1.2.recording of contracts and clients for the purposes of concluding and performing contracts

6.1.3.archiving of documents in accordance with legal regulations

6.1.4.marketing activities of the controller

7. Legal basis for the processing of the personal data of the data subject

7.1.The legal basis for the processing of the personal data of the Data Subject will be, depending on the specific personal data and the purpose of their processing, the consent of the Data Subject to the processing of personal data, the fulfillment of the legal obligation of the controller, the fulfillment of a contract to which the Data Subject is a party.

8. Recipients or categories of recipients of personal data

The recipients of the Data Subject's personal data will be or may at least be:

8.1.statutory bodies or members of statutory bodies of the Controller

8.2.employees of the Controller

8.3.sales representatives of the Controller and other persons cooperating with the Controller in the performance of the Controller's tasks. For the purposes of this document, all natural persons performing dependent work for the Controller on the basis of an employment contract or agreements on work performed outside of an employment relationship shall be considered employees of the Controller.

8.4.The recipients of the Data Subject's personal data will also be the Operator's associates, business partners, suppliers, and contractual partners, in particular: an accounting company, a company providing services related to software development and maintenance, a company providing legal services to the Operator, a company providing consulting services to the Operator, companies providing transportation and delivery of products to buyers and third parties.

8.5.The recipients of personal data will also include courts, law enforcement authorities, tax authorities, and other state authorities in cases specified by law.

9. Information on the intended transfer of personal data to a third country:

Not applicable – The operator does not intend to transfer personal data to a third country.

10. Period of retention of personal data:

Personal data will be retained in accordance with legal regulations for the necessary period of time for the purposes of performing the contract and their subsequent archiving.

11. Information on the existence of relevant rights of the Data Subject:

The data subject has, among other things, the following rights:

11.1. The data subject's right of access to data pursuant to Article 15 of the Regulation, which includes:

11.1.1. The right to obtain confirmation from the Controller as to whether personal data concerning the data subject are being processed;

• if the personal data of the Data Subject is being processed, the right to access the personal data being processed and the right to obtain the following information:
• information about the purposes of the processing;
• information about the categories of personal data concerned;
• information about the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
• where possible, information about the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• information about the existence of the right to request from the Controller the rectification or erasure of personal data concerning the Data Subject or the restriction of processing, and the existence of the right to object to such processing;
• information about the right to lodge a complaint with a supervisory authority;
• if the personal data has not been obtained from the Data Subject, any available information as to its source;
• information about the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, in those cases, at least meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject;

11.1.2. the right to be informed of the appropriate safeguards pursuant to Article 46 of the Regulation concerning the transfer of personal data, if personal data are transferred to a third country or international organization;

11.1.3. the right to obtain a copy of the personal data being processed, provided that the right to obtain a copy of the personal data being processed does not adversely affect the rights and freedoms of others;

11.2. the right of the Data Subject to rectification pursuant to Article 16 of the Regulation, which includes:

11.2.1. the right to have the Controller rectify, without undue delay, inaccurate personal data concerning the Data Subject;

11.2.2. the right to have incomplete personal data concerning the Data Subject completed, including by means of providing a supplementary statement by the Data Subject;

11.3. the Data Subject's right to erasure of personal data (the so-called "right to be forgotten") pursuant to Article 17

of the Regulation, which includes:

11.3.1.the right to obtain from the Controller without undue delay the erasure of personal data concerning the Data Subject, if any of the following grounds apply:

the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

• the data subject withdraws the consent on which the processing is based, provided that there is no other legal basis for the processing of personal data;

• The data subject objects to the processing of personal data pursuant to Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing
• of personal data, or the data subject objects to the processing of personal data pursuant to Article 21(2) of the Regulation;
• the personal data has been processed unlawfully;
• the personal data must be erased in order to comply with a legal obligation under European Union law or the law of a Member State to which the Controller is subject;
• the personal data has been collected in relation to the offer of information society services pursuant to Article 8(1) of the Regulation;

11.4. the right to have the Controller who has made the personal data of the Data Subject public taking into account the available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the personal data that the Data Subject has requested the erasure of any links to, or copies or replications of, those personal data;

provided that the right to erasure of personal data with the content of rights under Article 17(1) and (2) of the Regulation [i.e., with the content of rights under (i) and (ii) of this letter c) of point J. of this document] shall not arise if the processing of personal data is necessary:

11.4.1.to exercise the right to freedom of expression and information;

11.4.2. to fulfill a legal obligation that requires processing under European Union law or the law of a Member State to which the Controller is subject, or to fulfill a task carried out in the public interest or in the exercise of official authority vested in the Controller;

11.4.3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) of the Regulation, as well as Article 9(3) of the Regulation;

11.4.4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the Regulation, in so far as the right referred to in Article 17(1) of the Regulation is likely to render impossible or seriously impair the achievement of the objectives of such processing of personal data; or Regulation is likely to render impossible or seriously impair the achievement of the objectives of such processing of personal data; or

11.4.5.for the establishment, exercise or defense of legal claims;

11.5.the right of the Data Subject to restrict the processing of personal data pursuant to Article 18 of the Regulation,

which includes:

11.5.1.the right to have the Controller restrict the processing of personal data in any of the following cases:

• The Data Subject challenges the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
• the processing of personal data is unlawful and the Data Subject objects to the erasure of the personal data and requests the restriction of their use instead;
• the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise, or defense of legal claims;
• The Data Subject has objected to the processing pursuant to Article 21(1) of the Regulation, pending verification whether the legitimate grounds of the Controller override those of the Data Subject;

11.5.2. the right that, where the processing of personal data has been restricted pursuant to point (i) of this letter d) of point J. of this document, such restricted personal data, with the exception of storage, be processed only with the consent of the Data Subject or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State;

11.5.3the right to be informed in advance of the lifting of the restriction on the processing of personal data;

11.6.the right of the Data Subject to comply with the notification obligation towards recipients pursuant to Article 19 of the Regulation, the content of which is:

11.6.1.the right to have the Controller notify each recipient to whom the personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out pursuant to Article 16, Article 17(1) and Article 18 of the Regulation, unless this proves impossible or involves disproportionate effort;

11.6.2. the right to have the Controller inform the Data Subject about these recipients, if the Data Subject so requests;

11.7. the right of the Data Subject to data portability pursuant to Article 20 of the Regulation, which includes:

11.7.1.the right to obtain personal data concerning the Data Subject and provided to the Controller in a structured, commonly used and machine-readable format and the right to transfer this data to another controller without the Controller preventing this, if:

• the processing is based on the consent of the Data Subject pursuant to Article 6(1)(a) of the Regulation or Article 9(2)(a) of the Regulation, or on a contract pursuant to Article 6(1)(b) of the Regulation, and at the same time
• the processing is carried out by automated means, and at the same time
• the right to obtain personal data in a structured, commonly used and machine-readable format and the right to transfer this data to another controller without the Controller preventing this, will not adversely affect the rights and freedoms of others;

11.7.2.the right to transfer personal data directly from one controller to another controller, where technically feasible;

11.8.the right of the Data Subject to object under Article 21 of the Regulation, the content of which is:

11.8.1.the right to object at any time, on grounds relating to the specific situation of the Data Subject, to the processing of personal data concerning him or her, which is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including the right to object to profiling based on these provisions of the Regulation;

11.8.2. [in the case of exercising the right to object at any time, on grounds relating to the specific situation of the Data Subject, to the processing of personal data concerning him or her which is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including the right to object to profiling based on these provisions of the Regulation] the right to have the Controller cease processing the personal data of the Data Subject unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, the rights and freedoms of the Data Subject, or the grounds for the establishment, exercise, or defense of legal claims

11.8.3.the right to object at any time to the processing of personal data concerning the Data Subject for direct marketing purposes, including profiling to the extent that it is related to direct marketing; provided that if the Data Subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes;

11.8.4. (in relation to the use of information society services) the right to exercise the right to object to the processing of personal data by automated means using technical specifications;

11.8.5.the right to object, on grounds relating to the specific situation of the data subject, to the processing of personal data concerning the data subject, where the personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the Regulation, except where the processing is necessary for the performance of a task carried out for reasons of public interest; Regulation, except where the processing is necessary for the performance of a task carried out for reasons of public interest;

11.9.the right of the Data Subject in relation to automated individual decision-making pursuant to Article 22 of the Regulation, the content of which is:

11.9.1. the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, except in cases referred to in Article 22(2) of the Regulation. Regulation [i.e. except in cases where the decision is: (a) necessary for the conclusion or performance of a contract between the Data Subject and the Controller, 11.9.2.authorized by European Union law or the law of the Member State to which the Controller is subject, which also provides for appropriate measures to safeguard the rights and freedoms and legitimate interests of the Data Subject, or (c) based on the explicit consent of the Data Subject].

12. Information on the Data Subject's right to withdraw consent to the processing of personal data

12.1. The Data Subject is entitled to withdraw their consent to the processing of personal data at any time, without this affecting the lawfulness of the processing of personal data based on the consent given prior to its withdrawal.

The data subject is entitled to withdraw their consent to the processing of personal data at any time, either in whole or in part. Partial withdrawal of consent to the processing of personal data may relate to a specific type of processing operation(s), while the lawfulness of the processing of personal data in the scope of the remaining processing operations remains unaffected. Partial withdrawal of consent to the processing of personal data may relate to a specific purpose of personal data processing / specific purposes of personal data processing, while the lawfulness of personal data processing for other purposes remains unaffected.

The Data Subject may exercise the right to withdraw consent to the processing of personal data in writing to the address of the Controller registered as its registered office in the Commercial Register at the time of withdrawal of consent to the processing of personal data or in electronic form by electronic means (by sending an email to the Operator's email address specified in the identification of the Operator in this document or by filling in the electronic form published on the Operator's website).

13. Information on the right of the Data Subject to lodge a complaint with a supervisory authority

13.1. The Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work, or place of the alleged infringement, if they believe that the processing of personal data concerning them is in breach of the Regulation, without prejudice to any other administrative or judicial remedy.

The data subject has the right to be informed by the supervisory authority to which the complaint has been lodged of the progress and outcome of the complaint, including the possibility of seeking a judicial remedy under Article 78 of the Regulation.

14. Information on the existence/non-existence of an obligation on the part of the data subject to provide personal data

14.1. The Controller informs the Data Subject that the provision of the Data Subject's personal data is necessary for the conclusion and performance of the purchase contract. The Controller informs the Data Subject that the Data Subject is not obliged to provide personal data or to give consent to its processing. The consequence of not providing personal data and/or not granting consent to the processing of personal data will be that the Controller will not be able to conclude and perform the purchase contract.

15. Information related to automated decision-making, including profiling:

15.1. Not applicable. - Since the Controller does not process the personal data of the Data Subject in the form of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, the Controller is not obliged to provide the information referred to in Article 13(2)(f) of the Regulation, i.e. information on automated decision-making. of the Regulation, the Controller is not required to provide the information referred to in Article 13(2)(f) of the Regulation, i.e., information on automated decision-making, including profiling, and the procedure used, as well as the significance and expected consequences of such processing of personal data for the Data Subject.

16. Personal data protection and use of cookies - What is a cookie?

In connection with the EU Directive on privacy in electronic communications, we offer a brief explanation of the function of cookies. Cookies are text files that contain a small amount of information that is downloaded to your computer, mobile phone, or other device when you visit a website. Cookies are useful because they allow the website to recognize the user's device and, at the same time, allow the user to access the features of the site.

We basically divide cookies into two types.

Persistent cookies – these cookies remain on the user's device for the period specified in the cookie file. They are activated whenever the user visits the website that created the cookie.

Session cookies – these cookies allow the website operator to link the user's activities when the user opens a browser window and end when the browser window is closed. Session cookies are created temporarily. After closing the browser, all session cookies are deleted.

16.1. What are COOKIES?

A cookie is a small text file that a website stores on your computer or mobile device when you visit it. This file allows the website to store information about your actions and preferences (such as your login name, language, font size, and other display settings) for a certain period of time, so that you do not have to re-enter them when you visit the site again or browse its individual pages.

16.2. How do we use COOKIES?

Our online store uses cookies to store:

• your display preferences, such as color contrast or font size settings;
• the fact that you have already responded to a survey displayed in a separate window (pop-up), through which you can express your opinion on the content of the page (it will not be displayed again);
• the fact that you have agreed (or disagreed) to our use of cookies on this website.
• Remarketing

Similarly, some subpages that are part of our website use cookies to anonymously collect statistical data about how you got there and which video clips you watched.

Allowing the use of cookies is not strictly necessary for the website to function properly, but it will provide you with a better user experience when working with it. You can delete or block cookies. However, in this case, certain features of the website may not work as they should.

The information stored in cookies is not used to identify you personally, and the structure of the data is fully under our control. Cookies are not used for purposes other than those specified in this text.

16.3. Do we use other COOKIES?

Some of our pages or sub-sites may use additional or different cookies than those mentioned in the previous text. In such cases, detailed information about their use will be provided in a separate cookie notice on the page in question.

16.4. How to control COOKIES?

You can control and/or delete cookies at your discretion – see aboutcookies.org for details. You can delete all cookies stored on your computer, and most browsers can be set to prevent them from being stored. However, in this case, you will probably have to manually adjust some settings each time you visit the website, and some services and features will not work.

17. Final provisions

This Privacy Policy and Instructions form an integral part of the General Terms and Conditions and the Complaints Procedure. Documents – The General Terms and Conditions and Complaints Procedure of this online store are published on the Seller's online store domain.

These personal data protection principles become valid and effective upon their publication in the Seller's online store on February 20, 2021.