Personal data processing policy

Personal Data Processing Policy

The business company NORDBEANS s.r.o., with its registered office at 1. máje 868/11, Liberec III-Jeřáb, 460 07 Liberec, Company ID: 04327250, registered in the commercial register maintained by the Regional Court in Ústí nad Labem, C 36134 (hereinafter referred to as the "controller") hereby informs its customers, in accordance with the provisions of Article 12 and subsequent articles of Regulation (EU) 2016/679 of the European Parliament and of the Council, effective from May 25, 2018, about the processing of their personal data in case they use its services.

Personal Data

The controller will process the following personal data:

• First and Last Name,
• Address,
• Phone Number,
• Email,
• For business entities: Company ID, VAT ID (hereinafter referred to as "personal data").

Purpose of Processing

The purpose of processing personal data is to fulfill the legal obligations of the controller arising from the content of the contract concluded between you as the buyer and the controller as the seller, and to fulfill the legal obligations of the controller arising from generally binding legal regulations.

Recipients of Personal Data

Personal data processed for fulfilling obligations arising from specific legal regulations may be provided to law enforcement authorities in justified cases. The personal data you provide may also be shared with the following entities:

• Data Transfer Related to Information System Management:
• wpj s.r.o., CZ28860608

• Data Transfer Related to Order Fulfillment Depending on the Chosen Payment and Delivery Method:
• Balikobot, s.r.o., CZ06283799
• Česká pošta, s.p., CZ47114983
• DPD, s.r.o, CZ63077051

• Data Transfer Related to Marketing Services:
• Facebook Ireland Limited, IE9692928F
• Google Ireland Limited, IE6388047V
• Heureka Shopping s.r.o., CZ02387727

The legal basis here is the fulfillment of obligations arising from the contract with the data subject and also legitimate interests of the controller or a third party. Personal data belonging to special categories of personal data are not transferred.

Obligation to Provide Personal Data

It is necessary to provide personal data to the controller for the purpose of fulfilling the rights and obligations arising from the content of the concluded contract.

Duration of Processing

Personal data may be processed by the controller for the duration necessary to fulfill the rights and obligations arising from the concluded contract, or for as long as necessary to resolve disputes originating from the concluded contract.

Information for Data Subjects

NORDBEANS s.r.o. informs its customers that they have the right to:

1. Obtain confirmation from the controller as to whether personal data concerning them is being processed, and if so, they have the right to access that personal data and the following information: the purposes of processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organizations, the planned duration for which the personal data will be stored, or if not possible to determine, the criteria used to determine that period, the existence of the right to request from the controller the rectification or erasure of personal data concerning them or the restriction of processing, and to object to such processing, as well as the right to lodge a complaint with a supervisory authority.
2. Have the controller rectify without undue delay any inaccurate personal data concerning them. Taking into account the purposes of processing, they have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
3. Have the controller erase personal data concerning them without undue delay, and the controller is obliged to erase personal data without undue delay if one of the following reasons applies: the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, the customer withdraws consent and there is no other legal basis for processing, the personal data have been unlawfully processed, the personal data must be erased for compliance with a legal obligation under Union or Member State law applicable to the controller.
4. Have the controller restrict the processing of their personal data if they contest the accuracy for a period enabling the controller to verify its accuracy, the processing is unlawful, and they oppose the erasure of personal data and request the restriction of their use, the data are no longer needed for the purpose of processing, but are required for the establishment, exercise, or defense of legal claims.
5. Request the controller to transfer their personal data to another controller designated by them.
6. Object to the processing of their personal data by the controller.
7. In case of doubts regarding whether their personal data is being processed by the controller in accordance with the above legal regulations, to contact both the controller and the Office for Personal Data Protection.

In Liberec on May 1, 2024.