Privacy Policy

Privacy Policy

I. General Provisions

1. FHINIX VIBRATIONS, s.r.o., with registered office at Sudince 45, 962 71 Sudince, ID No.: 46 695 303, registered in the Commercial Register of the District Court of Banská Bystrica, Section: Sro, Insert No.: 22258/S, tel. No.: …, email: … as the controller (hereinafter also referred to as the “controller”) processes personal data of buyers and potential customers, who are natural persons (hereinafter together as “data subjects”) in the scope, manner and for the purpose in accordance with the applicable regulations and according to these Principles.

II. Purpose, legal basis and duration of the processing of personal data of data subjects

2.1 The controller processes the personal data of the data subjects for the purpose of concluding a distance purchase contract via the controller’s e-commerce: … (hereinafter referred to as “Eshop”) and the performance of obligations arising from or in connection with this purchase contract, as well as in pre-contractual relations with the data subjects, in the following scope: first name, surname, billing address, delivery address, e-mail address, telephone number, payment data.
2.2 The personal data referred to in point 2.1 of this article are processed on a legal basis – contract, since their processing is necessary for the performance of the purchase contract to which the data subject is a party. If the data subject does not provide his or her personal data pursuant to point 1. of this Article, the purchase contract cannot be concluded. The personal data referred to in point 2.1 of this Article shall be processed by the controller until the expiry of the period during which the claims of the parties arising out of or in connection with the purchase contract may be asserted. The documentation containing the personal data referred to in point 2.1 of this Article shall be archived within the time limits in accordance with the specific legislation.
2.3 The controller processes the personal data of the data subjects for the purpose of registering the data subject on the Eshop website, creating a user account and sending related system notifications (e.g. notifications of order incompletion), within the scope of mandatory data: username and e-mail address and optional data: first name, last name, billing address, delivery address, telephone number.
2.4 The personal data pursuant to point 2.3 of this article are processed on the basis of the consent of the authorised person for a period of 10 years from the date of consent, but at the latest until the consent to the processing of personal data for this purpose is withdrawn. The terms and conditions for the use of the customer account are set out in Article III of this Policy.

2.5 By submitting the registration form for creating a user account on the Eshop website, the data subject grants the operator his/her consent to the processing of personal data to the extent and for the purpose according to point 2.3 of this article and also confirms that he/she has been informed about the rights and obligations of the data subject, as well as about the conditions for processing personal data according to the General Terms and Conditions of the operator and according to these Principles. The data subject hereby also solemnly declares that he or she has reached the age of 16 years. If the data subject is under 16 years of age, he or she shall, before providing his or her personal data, send the controller the consent of his or her legal representative to the processing of his or her personal data to the extent and for the purpose referred to in point 2.3. of this Article. The data subject shall be entitled to withdraw his/her consent to the processing of his/her personal data for the purpose referred to in point 2.3 of this Article at any time by sending a notice of withdrawal of consent either in writing to the address of the controller’s registered office: FHINIX VIBRATIONS s.r.o., with registered office at Sudince 45, 962 71 Sudince, or by e-mail to the following e-mail address: …
2.6 The controller processes the personal data of the data subjects for marketing purposes, in particular sending newsletters, informing about new products, promotions, discounts and similar marketing activities, in the following scope: username, first name, surname and e-mail address.
2.7 The personal data pursuant to point 2.6 of this article is processed on the basis of the consent of the authorised person for a period of 10 years from the date of consent, but at the latest until the consent to the processing of personal data for this purpose is withdrawn.

2.8 By subscribing to the e-newsletter, the data subject grants the operator his/her consent to the processing of his/her personal data to the extent and for the purpose pursuant to point 2.6 of this article and also confirms that he/she has been informed of the rights and obligations of the data subject as well as of the conditions for the processing of personal data pursuant to the General Terms and Conditions of the operator and pursuant to these Principles. The data subject hereby also solemnly declares that he or she has reached the age of 16 years. If the data subject is under 16 years of age, he or she shall, before providing his or her personal data, send the controller the consent of his or her legal representative to the processing of his or her personal data to the extent and for the purpose referred to in point 2.6. of this Article. The data subject shall be entitled to withdraw his/her consent to the processing of his/her personal data for the purpose referred to in point 2.6 of this Article at any time by sending a notice of withdrawal of consent either in writing to the address of the controller’s registered office: FHINIX VIBRATIONS, s.r.o. with registered office at Sudince 45, 962 71 Sudince, or by e-mail to the following e-mail address: … . The data subject may also cancel the receipt of the newsletter at any time by clicking on the unsubscribe link located directly in each newsletter.
2.9 The controller processes the personal data of the data subjects for the purpose of communication and handling of the data subject’s requests sent via Livechatoo live chat (live chat located on the Eshop website), in the form of 1.) offline chat in the scope of mandatory data: username, e-mail address, IP address and optional data: phone number, or in the form of 2.) online chat in the scope of mandatory data: IP address.

2.10 The personal data pursuant to point 2.9 of this Article shall be processed on the basis of the legitimate interest of the controller for the period necessary for the processing of the data subject’s request, but for a maximum period of 2 years from the date of their provision.
2.11 By submitting his or her personal data via … live chat customer support, the data subject confirms that he or she has been informed of the data subject’s rights and obligations, as well as of the terms and conditions of the processing of personal data pursuant to the General Terms and Conditions of the controller and this Policy. The data subject is entitled to object to the processing of the personal data in accordance with point 6.11 of this Policy.

2.12 The controller processes the personal data of the data subjects for the purpose of communication and handling of the data subject’s requests sent via the online contact form located on the website www.indalofarma.sk within the scope of the mandatory data: username, e-mail address, IP address.

2.13 The personal data referred to in point 2.12 of this Article shall be processed on the basis of the legitimate interest of the controller for the period necessary for the processing of the data subject’s request, but for no longer than 2 years from the date of their provision.
2.14 By submitting his or her personal data via the online contact form located on the website of the … confirms that he or she has been informed of the rights and obligations of the data subject, as well as of the conditions for processing personal data pursuant to the General Terms and Conditions of the controller and this Policy. The data subject is entitled to object to the processing of personal data pursuant to point 6.11 of this Policy.

2.15 The controller processes the personal data of the data subjects for the purpose of direct marketing, in the following scope: e-mail address and information about the purchased goods. The satisfaction of the data subject with the purchase is ascertained by the controller through e-mail questionnaires within the framework of the Verified Customers programme, in which the Eshop is involved. These e-mail questionnaires are sent to the data subject every time he or she makes a purchase in the Shop, unless, in accordance with § 62 of the Act, the data subject has made a purchase in the Shop, in which case the e-mail questionnaire is sent to the data subject. 351/2011 Coll. on electronic communications, as amended, the data subject does not refuse the sending of electronic mail for direct marketing purposes. The processing of personal data for the purpose of sending questionnaires under the Verified Customers programme is carried out by the controller on a legal basis – legitimate interest, which consists in ascertaining the satisfaction of the data subject with the purchase in the Eshop. For the purpose of sending questionnaires, evaluating the feedback of the data subjects and analysing the market position, the controller uses a processing agent, which is the operator of the Heureka.sk portal, to which the following information relating to the data subjects is transmitted for these purposes: information about the goods purchased and the e-mail address. The personal data of the data subjects are not passed on to any third party for its own purposes when sending the e-mail questionnaires. The data subject may object at any time to the sending of e-mail questionnaires as part of the Customer Verified Programme by means of a link in the e-mail containing the questionnaire. If the data subject objects, the questionnaire will no longer be sent to him or her.
2.16 By ticking the relevant “I agree” box on the Eshop website, the data subject grants the controller his/her consent to the processing of personal data: cookies, for the purpose of ensuring the functionality of the Eshop, providing offers or advertisements based on the interests identified from the cookies and tracking the traffic on the Eshop website. This personal data will be stored by the controller until the consent is withdrawn or until the cookies are deleted by the data subject in the Internet browser. Further information on the terms and conditions for the use of cookies and the options for refusing them can be found here.

III. Terms of use of the user account

3.1 By registering on the Eshop website, the person concerned can set up a user account, which will allow him to store and edit his contact details and thus complete the payment faster, access information on the status and history of his orders. The person concerned acknowledges that the creation of a user account is not a condition of purchase on the Shop, the purchase of Goods through the Shop the person concerned is entitled to make at any time even without registration.

3.2 Before using a user account, registration is required. For this purpose, the data subject shall fill in the mandatory fields of the registration form – username and e-mail address. Once the form has been completely filled in and successfully submitted by clicking on the “Create new account” button, the person concerned will receive an e-mail with a link to the website, which is used to log in once to the Eshop website, where the person concerned will set his/her password. After setting the password, the data subject is allowed to log in to the user account using the following access data – username and password. The controller does not have the data subject’s password. The data subject is obliged to protect the login data to the user account and may not disclose them to third parties. If the data subject becomes aware of any unauthorised use of his or her login data, he or she shall immediately inform the controller thereof. The person concerned is liable for any unauthorised use or misuse of his or her login data.

3.3 The controller makes the user account available to the data subject free of charge for an indefinite period of time and reserves the right to exclude the data subject from the registration or use process or to discontinue the user account and the related services at any time without giving any reason. The Operator reserves the right, at any time, to modify the functions of the user account or the conditions of its use. The operator will notify the data subjects of the new terms of use by e-mail.

IV. Recipients of personal data

4. The controller does not disclose, make available or provide personal data of the data subjects to any other entities, except for the following recipients:
(a)carriers for the purpose of delivery of goods – …
b)in the case of the choice of personal collection of goods according to point 3.3.1. of the GTC, the personal data of the data subjects to the extent necessary for the delivery of the goods are provided to – to the company …,;
c)to the provider of online services enabling the sending of newsletters – …;
d)to the provider of online services enabling online chat for the purpose of communication with buyers and potential customers via the application …;

e)data centre – ..;
f)web hosting and IT service provider – … ;
g)the operator of the Heureka.sk portal – …;
h)recipients of advertising displayed on the basis of the use of information contained in cookies;

i)payment service providers for the purpose of processing payments and banks on the basis of an order, the execution of a purchase contract;
j)accounting service providers;
k)online marketing agencies;
l) legal representatives, courts for the purpose of asserting and enforcing claims arising out of or in connection with the Purchase Agreement.

V. Transfer of personal data to third countries

5.1 The controller does not actively transfer the personal data of data subjects to third countries outside the EU, but cooperates with entities (currently …) that carry out such transfers, namely to …. Further information on the transfer of personal data to third countries outside the EU can be provided at the contact details of the controller as set out in Article I of this Policy.

VI. Rights of the data subject

6.1 The data subject has the right to access his or her data. At the request of the data subject, the controller shall issue a confirmation as to whether the personal data of the data subject relating to the data subject are being processed. If the controller processes such data, it shall, upon request, issue a copy of those personal data to the data subject.

6.2 The issue of the first copy pursuant to paragraph 6.1 of this Article shall be free of charge. For any further copies requested by the person, the controller shall charge a fee corresponding to the administrative costs incurred in issuing the copy. Where a person requests information by electronic means, it shall be provided to him in a commonly used electronic form, in the form of an e-mail, unless he requests otherwise.

6.3 The data subject shall have the right to rectification of personal data if the controller records incorrect personal data about him or her. At the same time, the data subject shall have the right to have incomplete personal data completed. The controller shall carry out the rectification or completion of the personal data without undue delay after the data subject has requested it.
6.4 The data subject shall have the right to erasure of personal data concerning him or her, provided that:

(a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws the consent on the basis of which the processing is carried out,
(c) the data subject objects to the processing of personal data pursuant to point 6.11 of this Article,
(d) the personal data have been unlawfully processed,
(e) the erasure is based on the fulfilment of an obligation under a law, a special regulation or an international treaty to which the Slovak Republic is bound, or
(f) the personal data were collected in connection with the offer of information society services to a person under the age of 16.

6.5 The data subject will not have the right to erasure of personal data provided that processing is necessary:

(a) to exercise the right to freedom of expression and information;
b) for the performance of an obligation under a law, a special regulation or an international treaty by which the Slovak Republic is bound, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
(c) for reasons of public interest in the field of public health,
(d) for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, where the right to erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing, or
(e) for the establishment, exercise or defence of legal claims.
6.6 The controller shall carry out the erasure of the personal data of the data subjects upon request, without undue delay after it has assessed that the data subject’s request is justified.
6.7 The data subject shall have the right to restrict the processing of personal data if:
(a) challenges the accuracy of the personal data by objection pursuant to point 6.11 of this Article, during a period allowing the controller to verify the accuracy of the personal data;
(b) the processing is unlawful and the data subject requests restriction of the use of the personal data instead of erasure;
(c) the controller no longer needs the personal data for the purposes of the processing but the data subject needs them to establish, exercise or defend legal claims;
(d) the data subject has objected to the processing of the personal data on the basis of a legitimate claim by the controller, pending verification that the legitimate grounds on the part of the controller override those of the data subject.

6.8 If the data subject requests the restriction of the processing of his or her personal data, the controller shall not carry out any processing operations, other than storage, on the personal data without the data subject’s consent.
6.9 The data subject will be informed by the controller if the restriction on the processing of the data is lifted.

6.10 The data subject shall have the right to data portability, which means obtaining the personal data which he or she has provided to the controller, while having the right to transmit these data to another controller in a commonly used and machine-readable format, provided that the personal data have been obtained on the basis of the data subject’s consent or on the basis of a contract and the processing is carried out by automated means.
6.11 The data subject shall have the right to object at any time to processing of his or her personal data on grounds relating to his or her particular situation. The data subject may object to the processing of his or her personal data on the basis of:
(a) the performance of a task carried out in the public interest or in the exercise of official authority, or (b) the legitimate interest of the controller,

(b) the processing of personal data for direct marketing purposes,
(c) processing for scientific or historical research purposes or for statistical purposes.
6.12 If the data subject objects to the controller to the processing of personal data for direct marketing purposes pursuant to point 6.11(b) of this Article, the controller may no longer process his or her personal data.
6.13 The controller shall consider the objection received within a reasonable time. The controller may not further process the personal data unless it demonstrates compelling legitimate interests for the processing of the personal data which override the rights or interests of the data subject or grounds for exercising a legal claim.

6.14 The data subject shall have the right to withdraw his or her consent to the processing of personal data at any time, insofar as the processing of personal data was based on this legal title. The data subject shall withdraw his or her consent by contacting the responsible person with his or her request by any means of his or her choice. However, the lawfulness of the processing of personal data on the basis of the consent given shall not be affected by its withdrawal. The data subject is also entitled to withdraw his or her consent to the processing of personal data for the purpose of sending newsletters at any time by clicking on the unsubscribe link provided in each electronic newsletter. Upon expiry of the period of validity of the consent, or upon receipt of a withdrawal of consent to the processing of personal data or upon receipt of a legitimate objection from the data subject to the processing of personal data, the controller shall immediately ensure the blocking and destruction of the data subject’s personal data.
6.15 If the data subject considers that the processing of personal data has infringed his or her rights in the field of personal data protection, he or she has the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27.

VII. Further information

7.1 The controller hereby informs the data subject that the processing of his or her personal data does not involve automated decision-making or profiling.

7.2 The Data Subject who chooses the option of delivery of the Goods by personal collection pursuant to clause 3.3.1 of the GTC, acknowledges that the collection points of the establishment (…. establishments) are monitored by a camera system for security reasons. The camera systems are installed for the purpose of protecting persons and property against unlawful acts, in particular for the prevention and clarification of robbery, theft, vandalism or various fraudulent acts; the personal data of the data subjects in the scope of the video recording are thus processed on the basis of the legitimate interest of the controller. The joint controllers of the CCTV systems are: the company … The joint controllers shall keep the personal data in the form of video recordings for the period necessary to achieve the purpose, i.e. if the video recording is not used for the purposes of criminal or misdemeanour proceedings, it shall be disposed of within 60 days from the day following the day on which the recording was made, unless a special law provides otherwise.

7.3 IP address of the data subject: the IP address is transmitted whenever the data subject makes a request to the server, so that the server is aware of where the response to this request is to be sent. The IP address is assigned to the buyer and potential customer by the Internet service provider as soon as he or she connects to the Internet. The ISP can track which customer has been assigned the selected IP address at a specific point in time. During the time the IP address is stored, it is theoretically possible to indirectly determine the identity of the owner of the IP address. For this reason, IP addresses are only used for the purpose of determining the location to which a server response to a data subject’s request should be sent, as well as for the purpose of warding off potential cyber-attacks.

VIII. Final provisions

8.1 The data subject confirms that he or she has provided the personal data voluntarily, without coercion, that it is true and that he or she consents to its use for the defined purpose.
8.2 This Privacy Policy shall come into force and effect on the date …
8.3 This Privacy Policy forms an integral part of the General Terms and Conditions of FHINIX VIBRATIONS, Ltd. as an appendix thereto.