Get a 5% discount with discount code: BALANCE5

Privacy

PRIVACY POLICY

 

The right to the protection of personal data, which under the Constitution of the Slovak Republic is an inseparable part of fundamental human rights and freedoms, has been reflected in our procedures and measures which, in the position of controller, we apply when processing personal data.

 

The Privacy Policy (hereinafter referred to as the “Policy”) will provide you in particular with information on how we handle your personal data and how you can contact us if necessary. The Policy is intended for customers who shop via the controller’s websites (for example www.shop.balancetv.sk). The Policy, which follows the General Terms and Conditions, also focuses on the processing of personal data via social networks (Facebook, Instagram, etc.) and the use of cookies.

 

When processing personal data, we proceed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (hereinafter referred to as the “Personal Data Protection Act”) and other generally binding legal regulations.

 

In connection with the processing of personal data, we have prepared for users of the websites (hereinafter referred to as the “data subject”) whose personal data we process in connection with the provision of our services, information concerning personal data protection pursuant to Articles 13 and 14 of the General Data Protection Regulation.

 

  • CONTROLLER

 

The controller Merch s.r.o., Slávičia 10 , 903 01 Senec, Company ID: 47 608 803 operates websites (in particular www.shop.balancetv.sk), where customers can purchase products sold by the controller, or products the sale of which is brokered by the controller. The terms and process of sale are governed by the General Terms and Conditions.

 

 

  • PROCESSING OF PERSONAL DATA

 

The processing of personal data is carried out in accordance with several generally binding legal regulations governing the protection of personal data. The key regulations are in particular the General Data Protection Regulation and the Personal Data Protection Act.

 

The processing of personal data by Merch s.r.o. is also carried out on the basis of specific regulations that further govern the conditions of processing, in particular on the basis of:

  • Act No. 22/2004 Coll. on Electronic Commerce and on Amendments to Act No. 128/2002 Coll. on State Control of the Internal Market in Matters of Consumer Protection and on Amendments to Certain Acts as amended by Act No. 284/2002 Coll.,
  • Act No. 351/2011 Coll. on Electronic Communications, as amended,
  • Act No. 513/1991 Coll. the Commercial Code, as amended,
  • Act No. 40/1964 Coll. the Civil Code, as amended,
  • Act No. 102/2014 Coll. on Consumer Protection in the Sale of Goods or Provision of Services under a Distance Contract or a Contract Concluded Outside the Seller’s Premises and on Amendments to Certain Acts,
  • Act No. 250/2007 Coll. on Consumer Protection and on the Amendment of the Act of the Slovak National Council No. 372/1990 Coll. on Offences, as amended.

 

  • DATA PROTECTION OFFICER

 

The person responsible for the protection of personal data processed by Merch s.r.o. will answer any questions regarding the processing of your personal data. You can contact the responsible person via the following contact details:

  • e-mail address: zodpovednaosoba@shop.balancetv.sk
  • company registered office address: Merch s.r.o., Slávičia 10 , 903 01 Senec, Company ID: 47 608 803.

 

In the case of a written request sent to the registered office address of Merch s.r.o., please state on the envelope the text “GDPR – responsible person”.

 

  • IDENTIFICATION AND CONTACT DETAILS OF THE CONTROLLER:

 

The personal data of data subjects is processed by the controller:

Merch s.r.o.

Slávičia 10 , 903 01 Senec

Company ID: 47 608 803

registered in the Commercial Register of the District Court Bratislava 1, Section: Sro , File No. 95409/B.:

(hereinafter also as “Merch s.r.o.” or the “controller” or “we”)

 

Your personal data is obtained and further processed by Merch s.r.o. (controller), which is responsible for the accuracy and lawfulness of processing. As a data subject, you may exercise against Merch s.r.o. the rights set out below.

 

Merch s.r.o. is in the position of controller except in cases where it processes personal data on the instructions of other controllers and on their behalf, in which case it acquires the position of processor.

 

 

  • PERSONAL DATA WE PROCESS ABOUT YOU

 

Merch s.r.o. processes only such personal data on the basis of which we can ensure and provide you with professional services with due professional care, while the scope of such personal data is determined in accordance with the purposes of personal data processing.

 

Merch s.r.o. processes personal data by automated as well as non-automated means. Automated processing of personal data is carried out through designated secured devices.

 

Merch s.r.o. declares that only expressly authorised and instructed persons have permitted access to personal data.

 

Merch s.r.o. ensures the protection of personal data against damage, destruction, loss, alteration, unauthorised interference and making available, provision or disclosure, and against any other impermissible methods of processing. In connection with such safeguarding, appropriate technical and organisational measures corresponding to the method of personal data processing have been adopted.

 

Information on the nature of the personal data provided

 

If the legal basis for processing personal data is a contract, providing personal data is a contractual requirement. The data subject is obliged to provide personal data; if such data is not provided, it is not possible to enter into a contractual relationship.

 

If the legal basis for processing personal data is a law, providing personal data is a legal requirement. The data subject is obliged to provide personal data, otherwise it is not possible to properly fulfil the controller’s obligations arising from the relevant generally binding legal regulations.

 

If the legal basis for processing personal data is the legitimate interest pursued by the controller or a third party, the purpose of processing specifies what legitimate interest it is.

 

The personal data we process includes in particular:

  • identification and contact data, meaning title, first name and last name, permanent address, delivery address, contact telephone number, e-mail address, bank details; your identification data is part of the contract concluded, which you enter into with us in accordance with the terms and conditions,
  • transaction data, meaning data on received and sent payments,
  • communication and interaction data, meaning e.g. data from the use of the web application, data from business communication or data from mutual contact via the relevant contact points,
  • purchase data, meaning information about which products you purchased,
  • shopping behaviour data, meaning the history of your purchases and preferences,
  • complaint data, meaning data contained in your complaint,
  • marketing data, meaning data displayed about you on our fan pages on social networks, cookies, as well as data about your preferences relating to personalised marketing offers.

 

 

  • PURPOSES AND LEGAL BASES FOR PROCESSING PERSONAL DATA

 

We process your personal data to the necessary extent, while most processing activities are justified by the fact that this personal data is needed to provide the requested services or is related to the provision of our services.

 

We process your personal data for the following purposes:

 

  1. user registration 

We process personal data for the purpose of registering an individual who is interested in registering on the website www.shop.balancetv.sk. By registering, Merch s.r.o. enables the customer (data subject) unlimited access to the content of their account, where it is possible to track orders, their history and complaints, as well as other benefits in accordance with the general terms and conditions. Purchasing goods is not conditional on customer registration on the portal www.shop.balancetv.sk. Creating a customer account is voluntary. The legal basis for processing is the preparation for concluding and performance of the contract under which the controller’s services will be provided to the data subject. In the event of cancellation of registration, personal data that is not necessary to retain will be disposed of within 3 years from the date of customer registration.

 

  1. performance of the contract when purchasing goods sold by the controller

We process personal data for the purpose of selling goods and providing services by Merch s.r.o. to a registered or unregistered customer (data subject) after payment of the fee. We retain documents related to the purchase of goods for a period of 10 years following the year of concluding the contract.

 

  1. performance of the contract when brokering the sale of goods of the controller’s business partner

We process personal data for the purpose of brokering the sale of goods sold by our partner. In the case of this form of purchase, you conclude an agency contract with us. Our company will issue you an invoice for shipping and handling. The invoice for the goods will be issued by the partner. We retain documents related to this form of purchasing goods for a period of 10 years following the year of concluding the contract.

 

  1. handling complaints or claims

You can submit complaints and claims on the website of Merch s.r.o. or through customer service in accordance with the General Terms and Conditions. In the case of a complaint, we need your identification and contact details. When handling complaints, we will proceed according to the General Terms and Conditions and in accordance with applicable legal legislation. We process personal data in accordance with legal regulations. We retain documents related to a complaint or claim for a period of 10 years following the year in which the complaint was closed or the claim handled.

 

  1. organising and evaluating consumer contests

On exceptional occasions, Merch s.r.o. organises contests in which an individual can participate and win prizes. Information about an ongoing contest is available on the website of Merch s.r.o. or on social networks (e.g. Facebook). If you participate in the contest and provide us with your personal data, this personal data will be processed solely for the purpose of the contest, its evaluation and sending the prize. We process your personal data on the legal basis of your consent. More detailed information is provided in the statutes or rules of individual contests.

 

  1. asserting or defending our legal claims

In some cases, we are forced to turn to the court in order to assert our rights and legally protected interests, or we are forced to participate in court proceedings for the purpose of protecting our rights and legally protected interests. Most often, claims arising from failure to fulfil contractual obligations are pursued. The retention period of personal data for this purpose is 10 years from the final decision of the court or other public authority.

 

  1. marketing in the form of sending information about news or other useful information related to the controller’s services

Merch s.r.o. has a legitimate interest in contacting you (as a customer) and sending you commercial offers and information about its own products or services via your e-mail address, or providing you with these commercial offers and information by phone. The legitimate interest is informing customers about news and other important facts related to the services of Merch s.r.o. The data subject may freely set subscription or unsubscription from these e-mail messages in their user account on the controller’s website, or if they do not have an account they can do so in the newsletter preference settings (separate website). The retention period for this purpose is 3 years from the date of the last login to the user account or from the date of the last purchase of goods.

 

  1. marketing based on the use of cookies

For the purpose of creating personalised (tailor-made) marketing offers, we also use cookies. Personal data is processed based on the data subject’s consent pursuant to Art. 6(1)(a) of the General Data Protection Regulation. The retention period for this purpose is 3 months from the date of the last access to our websites.

 

  1. third-party cookies

Third-party cookies are created by companies whose services Merch s.r.o. uses when operating the websites. Some websites may contain content from other websites (YouTube, Facebook, etc.) which may create their own cookies stored by the browser on the data subject’s computer or similar device. In particular, identification data (IP address) and data on the activities and preferences of the data subject during their visit to our websites are obtained. Personal data is processed based on the data subject’s consent pursuant to Art. 6(1)(a) of the General Data Protection Regulation, which the data subject grants to the third party. The retention period for this purpose is determined by the third party.

 

  1. operating fan pages created on social networks

In order to simplify communication between Merch s.r.o. and its customers or supporters, we have set up fan pages on social networks (e.g. Facebook). Personal data is processed for the purpose of preparing or performing a contract pursuant to Art. 6(1)(b) of the General Data Protection Regulation or based on the data subject’s consent pursuant to Art. 6(1)(a). The retention period for this purpose corresponds to the term of the contract or the consent granted.

 

  1. maintaining accounting records

Merch s.r.o., as a regulated entity, is subject to tax and accounting obligations arising from legal regulations. In order to fulfil these obligations towards regulators, we process your personal data. The retention period is 10 years following the year to which the payments associated with the given user relate.

 

  1. handling data subject requests

In order for us to respond to your request, it is necessary that you identify yourself. We retain the data subject’s request for a period of 5 years following the year in which the request was handled.

 

  1. verified by customers

This concerns the provision of the Verified by Customers service, which is provided for the controller by Heureka ShoPPing s.r.o., Karolinská 650/1, Karlin, 186 00 Prague 8. The purpose of the service is to obtain an evaluation of the quality of services provided by the controller within the Heureka.sk portal and to provide this evaluation to the controller and other users of the Heureka.sk portal. The legitimate interest is obtaining evaluations from customers of the controller’s web portals for the purpose of improving services. We retain evaluations for a period of 5 years following the year in which the evaluation was provided.

 

Merch s.r.o. also processes personal data on the basis of legitimate interest. In this case, Merch s.r.o. takes steps to minimise the impact on your privacy and to ensure that processing does not disturb the balance between the legitimate interests of Merch s.r.o. and your privacy.

 

 

  • AUTOMATED INDIVIDUAL DECISION-MAKING INCLUDING PROFILING 

 

The controller processes the data subject’s personal data also by automated means of processing; however, the result is not decisions that would have legal effects on the data subject or similarly significantly affect them. Personal data will not be used for automated individual decision-making including profiling within the meaning of Art. 22 of the General Data Protection Regulation.

 

 

  • PROTECTION OF PERSONAL DATA

 

Your personal data is processed by automated as well as non-automated means within information systems that are protected and secured in accordance with the relevant security standards and legal regulations dealing with the protection of personal data.

 

Within the personnel structure of Merch s.r.o., only persons authorised by the controller to handle personal data have permission, and they have been duly familiarised with the controller’s instructions and instructed about the possible consequences of failing to comply with those instructions.

 

Merch s.r.o. declares that it complies with the principle of data minimisation and processes only such personal data as is necessary to achieve the purpose of processing. Personal data is processed for predefined purposes and is not processed for any other purpose.

 

When processing personal data, Merch s.r.o. proceeds in accordance with its internal policy governing personal data protection and information system security. Merch s.r.o. assesses and continuously evaluates whether the given processing of personal data would pose a high risk for data subjects and interfere with their privacy in an undue manner. Based on this observation, a detailed risk and privacy impact assessment is carried out, the result of which is taken into account when setting and implementing the controller’s procedures.

 

To secure personal data against unauthorised or accidental disclosure to a third party, we use adequate and appropriate technical and organisational security measures. Technical measures consist of applying technologies that prevent unauthorised access by third parties to personal data. For maximum protection, encryption of personal data and password protection of access to the internal systems of Merch s.r.o., or access to personal data stored on Merch s.r.o. servers, is used. Organisational measures consist of a set of rules of conduct for our employees, incorporated into the controller’s internal regulations. The internal regulations of Merch s.r.o. are considered confidential.

 

 

  • RECIPIENTS OF PERSONAL DATA

 

In exceptional cases, your personal data may be provided to third parties, in particular where such a procedure is permitted by the relevant legal regulation.

 

 

 

 

Suppliers and business partners

Some processing activities are also performed through our suppliers. When selecting suppliers, we primarily consider their professional, technical, organisational and personnel competence so that the security of processed personal data is guaranteed.

 

Our suppliers and business partners include in particular, but not only:

  • server service providers,
  • programming service providers,
  • providers of accounting and legal services,
  • service providers ensuring complaint handling and goods packaging,
  • agencies ensuring management of social networks and advertising campaigns,
  • the company providing the Verified by Customers service.

 

Authorities entrusted with carrying out supervision

In connection with inspections or supervision, your personal data may be provided to authorities which by law supervise the performance of our activity, e.g. the Office for Personal Data Protection of the Slovak Republic, the Slovak Trade Inspection, and others.

 

Enforcement of claims and assertion of rights:

In connection with the enforcement of our rights and legally protected interests, in justified cases we provide your personal data to the competent courts, bailiffs, notaries, law firms, court experts, or other external entities dealing with enforcement of claims or assertion of rights.

 

Public administration authorities:

On the basis of special legal regulations, we provide personal data to certain entities to whom we are obliged to provide this data upon their request for cooperation, e.g. state administration authorities, courts, prosecutor’s offices, law enforcement authorities or the Financial Administration of the Slovak Republic.

 

Other authorities, institutions and entities:

Social Insurance Agency, health insurance company, auditing company, archive, and others.

 

 

  • RETENTION PERIOD OF PERSONAL DATA

 

We retain and protect your personal data for the period specified by applicable legal regulations. If we retain your personal data based on the consent you have granted, we retain the personal data for the period for which you granted us your consent. Retention periods vary depending on the specific purpose for which personal data is processed. The specified retention period is based on the principle of storage limitation.

 

 

  • RIGHTS OF DATA SUBJECTS

 

As a data subject, you have the following rights:

 

Right of access under Art. 15 of the General Data Protection Regulation

You have the right to obtain from us information as to whether we process your personal data. If we process your personal data, you have the right to access that personal data, to the extent of: the purpose of processing, the category of personal data, recipients of personal data, the period of processing of personal data, and information about the source from which we obtained your personal data. You also have the right to be provided with a copy of your personal data, but you must expressly state this in your request. If you request additional copies, we have the right to charge a reasonable fee for issuing additional copies. However, the rights of third parties, including other persons who have provided personal data to Merch s.r.o., cannot be restricted by this, and Merch s.r.o. cannot make other persons’ personal data available to you in this way.

 

Right to rectification or completion under Art. 16 of the General Data Protection Regulation

You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data that we process about you. By using this right properly, you will help keep your personal data accurate and up to date.

 

Right to erasure (the “right to be forgotten”) under Art. 17 of the General Data Protection Regulation

You have the right to request that your personal data be erased without undue delay if one of the following reasons is met:

  1. the personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
  2. the data subject withdraws consent under Article 6(1)(a) or withdraws explicit consent under Article 9(2)(a) of the General Data Protection Regulation, and there is no other legal basis for processing,
  3. the data subject objects to the processing under Article 21(1) of the General Data Protection Regulation (objection to processing based on legitimate or public interest), and there are no overriding legitimate grounds for processing, or the data subject objects to the processing under Article 21(2) (objection to direct marketing),
  4. the personal data was processed unlawfully,
  5. the personal data must be erased in order to comply with a legal obligation under Union law or the law of the Member State to which Merch s.r.o. is subject,
  6. the personal data was collected in connection with the offer of information society services under Article 8(1) of the General Data Protection Regulation (child’s consent).

 

Merch s.r.o. has no obligation to erase your personal data where processing is necessary:

  1. for exercising the right of freedom of expression and information,
  2. for compliance with a legal obligation which requires processing under Union law or the law of the Member State to which Merch s.r.o. is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in Merch s.r.o.,
  3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i), as well as Article 9(3) of the General Data Protection Regulation,
  4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes under Article 89(1) of the General Data Protection Regulation, insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
  5. for the establishment, exercise or defence of legal claims.

 

Right to restriction of processing under Art. 18 of the General Data Protection Regulation

You have the right, based on a request to block your personal data (restriction of processing of your personal data to its storage; other processing operations during the blocking are not permitted) in the following cases:

  1. restriction of processing of your personal data while verifying its accuracy,
  2. if your personal data is processed unlawfully and at the same time you request only restriction of processing (storage only) instead of erasure of your personal data,
  3. you need your personal data for the establishment, exercise or defence of legal claims,
  4. you have objected to processing under Article 21(1) of the General Data Protection Regulation (legitimate interest or public interest), pending the verification whether the legitimate grounds of Merch s.r.o. override your legitimate interests.

 

If processing of personal data is restricted, Merch s.r.o. may further store or process personal data only:

  1. for the establishment, exercise or defence of legal claims,
  2. for the protection of the rights of another natural or legal person,
  3. for reasons of important public interest of the Union or a Member State,
  4. with the consent of the data subject.

 

If a situation arises that would lead to lifting the restriction of processing of personal data, Merch s.r.o. will inform the data subject in advance of this fact.

 

Right to data portability under Art. 20 of the General Data Protection Regulation

You have the right to obtain your personal data that you have provided to us in a structured, commonly used and machine-readable format. You have the right to request that we transfer your personal data from Merch s.r.o. to another controller you specify in your request, provided that it is technically feasible.

 

The right to data portability applies if:

  1. processing is based on the legal basis of consent or contract,
  2. processing is carried out by automated means.

 

Right to object under Art. 21 of the General Data Protection Regulation

You have the right to object at any time to the processing of your personal data where the legal basis for processing is legitimate interest within the meaning of Article 6(1)(f) of the General Data Protection Regulation, by sending a written request to the e-mail address zodpovednaosoba@shop.balancetv.sk, by post, or by personal delivery of a written request at the registered office of Merch s.r.o.

 

Upon receipt of the objection, we will dispose of your personal data, except for the following cases:

  1. if Merch s.r.o. demonstrates compelling legitimate grounds for processing which override your interests, rights and freedoms, or
  2. if it is demonstrated that Merch s.r.o. needs your personal data for the establishment, exercise or defence of legal claims;

 

Your objections do not affect the processing of your personal data prior to the delivery of your objections.

 

Automated individual decision-making including profiling under Art. 22 of the General Data Protection Regulation

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

 

This right does not apply if the decision is:

  1. necessary for entering into or performance of a contract between the data subject and Merch s.r.o.,
  2. authorised by Union law or Member State law to which Merch s.r.o. is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests,
  3. based on the data subject’s explicit consent.

 

When providing our services, automated individual decision-making within the meaning of the General Data Protection Regulation does not take place.

 

Right to withdraw consent under Art. 7 of the General Data Protection Regulation

If the processing of your personal data is based on your consent as the legal basis, you have the right to withdraw your consent at any time. Consent may be withdrawn under the same conditions under which it was granted. The data subject may also withdraw consent in the following ways:

  1. by e-mail message sent to zodpovednaosoba@shop.balancetv.sk
  2. by sending a written request to the registered office address of Merch s.r.o., stating on the envelope the text “GDPR – withdrawal of consent”.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal (e.g. contests).

 

Right to lodge a complaint with a supervisory authority under Art. 77 of the General Data Protection Regulation

If you believe that your personal data rights have been violated or that your data has been processed in breach of the rules, you have the right to lodge a complaint with the supervisory authority, which is:

 

Office for Personal Data Protection of the Slovak Republic

Hraničná 4826/12

820 07 Bratislava 27

 

tel.:          +421 2 3231 3214

e-mail:statny.dozor@pdp.gov.sk

 

Exercising your rights under Art. 12 of the General Data Protection Regulation

Merch s.r.o. will provide information regarding the processing of personal data only on the basis of a request from the data subject when exercising their rights, provided that it is demonstrably able to identify the data subject.Without successful verification of your identity, Merch s.r.o. is not obliged to provide any information regarding the processing of personal data. In this way, Merch s.r.o. prevents unauthorised access to your personal data and the violation of your rights by an unauthorised person.

 

You can exercise your personal data rights in the following ways:

  1. in person at the registered office of Merch s.r.o.,
  2. by post,
  3. by e-mail sent to zodpovednaosoba@shop.balancetv.sk.

 

You may also submit the completed and signed request in person directly at our registry office at the registered office address of Merch s.r.o. The request must contain all necessary information and attachments required for its processing and assessment of your claims regarding personal data processing. If your request is incomplete, we will contact you in order to complete it.

 

 

  • FINAL PROVISIONS

 

Merch s.r.o. reserves the right to any update of this information obligation, in particular in connection with changes in legislative processes. The current version will always be available on the website www.shop.balancetv.sk and other websites operated by the controller. If there is a material change in personal data protection, in particular the method of processing personal data, Merch s.r.o. will fulfil its information obligation by visibly publishing a notice before implementing the changes.

 

Through this Policy, we would like to assure you that we approach personal data with the utmost care and respect, following applicable legal regulations and using the available level of technical protection. If you have questions regarding personal data protection that you did not find answered in this document, write to the e-mail address zodpovednaosoba@shop.balancetv.sk

 

In Senec on 10.7.2019