Through this website, personal data is processed in accordance with Act No. 122/2013 Coll. on the protection of personal data, as amended by Act No. 84/2014 Coll. (The complete text of the Act dated 30.05.2014 is available in the Collection of Laws under No. 136/2014 Coll.). Therefore, we would like to inform the individuals whose personal data is being processed about the following facts:

1. 1. The processing of personal data of a specific e-shop’s customer is, according to the law, the processing of their personal data. This leads to the creation of an information system of personal data, referred to as “IS e-shop” or “e-shop information system” in the law. The purpose of processing the personal data of the customer, a physical person, is most commonly for the conclusion of a purchase agreement and subsequent payment, delivery of goods or services, and the provision of other related services (such as handling complaints and other obligations imposed on the e-shop operator, especially in relation to consumer protection regulations). The legal basis for processing the customer’s personal data in the e-shop information system is § 10 paragraph 3 letter b) of the law.
   2. IS Marketing: When sending newsletters to customers’ email addresses, there is also the processing of their personal data, but to a lesser extent and for a different purpose than in the case of purchasing goods or services. In such a scenario, the e-shop operator creates a new information system of personal data, called “IS marketing” or “e-shop marketing information system.” The legal basis for processing the customer’s personal data in this context is their consent.
   3. According to § 34 (1) of the law, the obligation to notify applies to all information systems in which personal data is processed, either fully or partially, using automated processing means. The operator of the e-shop is not obliged to notify the “IS E-shop” to the authority, as the legal basis for processing personal data in it is § 10 (3) letter b) of the law, and the operator maintains a record of the “IS E-shop” in the extent prescribed by law. In the case of the “IS Marketing” of the same e-shop, the legal basis for processing is the consent of the data subjects. If the operator of the e-shop does not have a designated responsible person, they are obliged to notify the “IS Marketing” of the relevant e-shop to the authority using the appropriate form. The operator has fulfilled this obligation.
   4. Identification of the operator of information systems (hereinafter referred to as “IS”):
      
      AUTO-FLEX EU, S.R.O., Commercial Register of the District Court of Trenčín, File No. 28066/R, Company ID: 46 867 627, Tax ID: 2023634316, VAT ID: SK2023634316, registered office: Štúrovo námestie 6478/11, 911 01 Trenčín, Slovakia. Mgr. Miroslav Čonka (director).

   5. The names of the information systems operated by the controller, in which the personal data of the data subjects are processed, are as follows:

      • IS E-shop

      • IS Marketing

   6. Statement of the IS Operator:
      

      The operator has notified the IS Marketing to the Office for Personal Data Protection of the Slovak Republic.

      The operator maintains records of both IS E-shop and IS Marketing.

   7. Purpose of Processing Personal Data through Internet Shop in IS E-shop and IS Marketing:
      The IS operator processes personal data of the data subjects for the purpose of processing orders, sending newsletters, and delivering ordered goods to the data subjects. Personal data is provided to the transport companies listed in the order form.
   8. Scope of Processed Personal Data of a Natural Person (Data Subject):
      • First name
      • Last name
      • Address (for delivery purposes)
      • Phone contact
      • Email contact
   9. The operator of the IS obtains the aforementioned personal data of the data subject(s) electronically and through the website of the e-shop (online store).
   10. Notice of Voluntariness:
       The data subject provides the above-mentioned personal data to the operator of the information system voluntarily, without any pressure or coercion from the operator.
   11. Disclosure of personal data to third parties:
       

       In the case of e-shops, third parties include courier and delivery companies, both those providing their services based on specific laws (e.g., Act No. 324/2011 Coll. on postal services and on the amendment of certain laws, as amended) and those not governed by this or any other specific law.

       In both cases, however, these are entities that, on their own behalf and at their own responsibility, deliver the goods ordered in the e-shop to the customer. The legal basis for processing personal data during delivery and, if necessary, verifying the identity of the person receiving the goods is the contract by which the customer ordered the goods (§ 10 para. 3 let. b) of the law). The customer’s consent is not required for the processing of their personal data by the e-shop for the purpose of delivering the goods through the selected courier. It should be noted that the law on postal services is the legal basis for processing the customer’s personal data for the purposes of providing postal services (delivery, collection, or distribution of the shipment) for entities governed by this law.

       The operator of the IS hereby informs that, for the purpose of delivering the ordered goods, personal data of the data subjects in the specified scope (name, surname, delivery address, telephone contact) are provided to third parties – courier companies specified in the order form during the execution of the order.

   12. Full wording of consent of the data subject for the processing of personal data:
       The data subject (consumer), by registering on the website of the online store, expressing consent, and submitting their order through the respective online store, grants, in accordance with Act No. 122/2013 Coll. on the protection of personal data, as amended by Act No. 84/2014 Coll., the full text of the law as given in Collection of Laws No. 136/2014 (hereinafter referred to as the “Act”), consent to the processing of their personal data provided for the purposes of order processing, including delivery of the ordered goods (via courier companies) and electronic sending of information about promotions and newsletters, to the operator of the information system (IS), which is: AUTO-FLEX EU, S.R.O., Commercial Register of the District Court of Trenčín, File No. 28066/R, IČO: 46 867 627, Tax ID: 2023634316, VAT ID: SK2023634316, address: Štúrovo námestie 6478/11, 911 01 Trenčín, Slovakia. Mgr. Miroslav Čonka (executive director). The consent is voluntarily granted by the customer (consumer) for an indefinite period. The consent may be withdrawn in writing by the customer (consumer) at any time, by sending the withdrawal of the consent granted for the processing of personal data to the address of the operator’s registered office, or electronically to the operator’s email address provided on the website.
   13. Rights of the Data Subject:
       According to Section 28 of Act No. 122/2013 Coll. on Personal Data Protection, as amended by Act No. 84/2014 Coll. (hereinafter referred to as “the Act”):
       1. The data subject has the right, upon a written request to the operator, to:
          a) Obtain confirmation whether personal data concerning them is being processed or not.
          b) Receive information in an intelligible form about the processing of personal data in the information system, in the extent specified in Section 15(1)(a) to (e), points 2 to 6; upon issuance of a decision according to paragraph 5, the data subject is entitled to be informed about the procedure of processing and evaluating operations.
          c) Receive precise information in an intelligible form about the source from which their personal data originated for processing.
          d) Receive a list of their personal data subject to processing.
          e) Have their inaccurate, incomplete, or outdated personal data subject to processing corrected or erased.
          f) Have their personal data subject to processing erased if the purpose of processing has ended; in the case of official documents containing personal data, the data subject may request their return.
          g) Have their personal data subject to processing erased if there has been a violation of the law.
          h) Have their personal data blocked if they withdraw their consent before its expiration, provided that the operator processes personal data based on the data subject’s consent.
       2. The right of the data subject under paragraph 1, points e) and f) may be limited only if such limitation arises from a special law or if its application would breach the protection of the data subject or infringe the rights and freedoms of others.
       3. The data subject has the right, upon a written request, to object to:
          a) The processing of their personal data for the purposes of direct marketing without their consent, and to request their erasure.
          b) The use of personal data stated in Section 10(d) for the purposes of direct marketing by mail.
          c) The provision of personal data stated in Section 10(3)(d) for the purposes of direct marketing.
       4. The data subject has the right, upon a written request or in person if the matter does not tolerate delay, to object to the processing of personal data in cases specified in Section 10(3)(a), (e), (f), or (g) by expressing legitimate reasons or providing evidence of unauthorized interference with their rights and legally protected interests that may be harmed by such processing; if there are no legal reasons preventing it and it is shown that the objection of the data subject is legitimate, the operator is obliged to block and erase personal data objected to by the data subject without undue delay as soon as circumstances permit.
       5. The data subject has the right, upon a written request or in person if the matter does not tolerate delay, to object to and not be subject to a decision of the operator which would have legal effects or significantly affect them, if such a decision is based solely on automated processing of their personal data. The data subject has the right to request the operator to review the decision by a method other than automated processing, whereby the operator is obliged to comply with the data subject’s request. In such a review, the authorized person shall have a decisive role. The operator shall inform the data subject about the manner of the review and the result of the findings within the time limit specified in Section 29(3). The data subject does not have this right only if a special law provides otherwise, regulating measures to secure the legitimate interests of the data subject, or if the operator issued a decision in response to the data subject’s request during pre-contractual relationships or the existence of contractual relationships, or if the operator has taken other adequate measures to secure the data subject’s legitimate interests based on a contract.
       6. If the data subject exercises their rights:
          a) In writing, and the content of their request indicates that they are exercising their rights, the request shall be considered as made under this Act; if the data subject submits the request by electronic mail or fax, they shall deliver it in writing within three days from the date of sending.
          b) Orally in person, where a record must be made, indicating who is exercising their rights, what they are requesting, when, and who prepared the record, including the signatures of the person exercising the rights and the data subject; a copy of the record shall be handed over to the data subject.
          c) Through a mediator according to points a) or b), the mediator is obliged to hand over the request or the record to the operator without undue delay.
       7. If the data subject suspects that their personal data is being processed unlawfully, they may file a proposal with the Office for Personal Data Protection to initiate proceedings for the protection of personal data.
       8. If the data subject lacks full legal capacity, their rights may be exercised by their legal representative.
       9. If the data subject is deceased, their rights under this Act may be exercised by a close person according to Section 116 of the Civil Code.