Personal data processing policies

This personal data processing policy applies to all data subjects whose personal data is processed in connection with the operation of the online store www.lusja.sk and in connection with the conclusion of a purchase contract between the trader, which is the company LUSJA s.r.o., with registered office at Textilná 23, Ružomberok 034 05, Slovak Republic, ID No.: 36766372, VAT No.: 2022380525, VAT No.: SK2022380525, registered in the Commercial Register of the District Court of Žilina, in section 1 of the Commercial Register of the District Court of Žilina, in section 2 of the Commercial Register of the Commercial Register of the District Court of Žilina. 18865/L (hereinafter referred to as the "trader") and the buyer, the subject of which is the purchase and sale of goods on the website www.lusja.sk as an electronic shop of the trader.
In this Personal Data Processing Policy, the trader provides detailed and comprehensible information on the processing of personal data within the meaning of Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), (hereinafter referred to as the "Regulation") and Sections 19 and 20 of Act No. 18/2018 Coll. on the protection of personal data (hereinafter referred to as "Act No. 18/2018 Coll.").
The personal data controller is the company LUSJA s.r.o., with its registered office at Textilná 23, Ružomberok 034 05, Slovak Republic, ID No.: 36766372, VAT ID No.: 2022380525, VAT ID No.: SK2022380525, registered in the Commercial Register of the District Court of Žilina, in sec. 18865/L.
Contact details of the operator:
- responsible person/representative of the operator: Iveta Todeková
- e-mail: marketing2@lusja.sk
- tel.: +421 915 830 905
The trader hereby informs the buyer that, pursuant to Article 6(1)(b) of the Regulation, the trader, as an information system operator, will process the buyer's personal data without the consent of the buyer as a data subject in the process of concluding the purchase contract, as the processing of the buyer's personal data will be carried out by the trader in the context of pre-contractual relations with the buyer and the processing of the buyer's personal data is necessary for the performance of the purchase contract, in which the buyer acts as one of the contracting parties.
Pursuant to Article 6(1)(f) of the Regulation, the trader may, after delivery of the ordered goods or services to the buyer on the basis of legitimate interest, also process the buyer's personal data for direct marketing purposes and send information about new products, discounts and promotions on the offered goods or services to the buyer's e-mail address.
The Merchant undertakes to handle and dispose of personal data in accordance with the applicable legislation of the Slovak Republic.
The trader declares that for purposes other than those specified in this personal data processing policy, it will always obtain personal data separately on an adequate legal basis and at the same time it will ensure that such personal data will be processed and used exclusively in a manner that corresponds to the purpose for which it was collected and will not combine it with personal data that was obtained for another purpose or for the purpose of fulfilling the purchase contract.
Before placing an order, the Buyer will be asked to confirm that the Merchant has notified the Buyer in a sufficient, comprehensible and unmistakable manner by ticking the box before placing the order:

its identification data,
the contact details of the trader or the trader's responsible person,
the purpose of the processing of the personal data, which is the conclusion of the purchase contract between the trader and the buyer and the legal basis for the processing of the personal data,
that the Buyer is obliged to provide the requested personal data for the purpose of concluding the purchase contract and the proper processing and delivery of the order,
if the processing is based on Article 6(1)(f) of the Regulation, that the legitimate interest pursued by the trader is direct marketing,
the identification data of the third party, which is the company that will deliver the goods ordered to the buyer, or the identification data of other recipients or categories of recipients of personal data, if any,
the period of retention of the personal data or the criteria for determining it.

The trader declares that it will process personal data in accordance with good manners and will act in a manner that does not contravene or circumvent the Regulation or other generally applicable legislation.
In accordance with the Regulation, the trader provides the following information to the buyer whose data it processes:

the identity and contact details of the trader and, where applicable, of the trader's representative,
the contact details of the responsible person, if any,
the purposes for which the personal data are processed and the legal basis for the processing,
where the processing is based on Article 6(1)(f), the legitimate interests pursued by the trader or the third party,
the recipients or categories of recipients of the personal data, if any,
where applicable, information that the trader intends to transfer the personal data to a third country or an international organisation,
the period of retention of the personal data or the criteria for determining it,
information on the existence of the right to request from the trader access to his personal data and the right to rectification or erasure or restriction of processing or the right to object to processing, as well as the right to data portability,
the right to bring a data protection action before a supervisory authority,
information on whether the provision of personal data is a legal or contractual requirement or a requirement necessary for the conclusion of a contract, whether the purchaser is obliged to provide personal data, as well as the possible consequences of not providing such data,
the existence of automated decision-making, including profiling.

Purposes of the processing of personal data:

Purpose: To perform a contract to which the data subject is a party or to take pre-contractual measures at the request of the data subject

Legal basis: Article 6(1)(b) of the Regulation - performance of a contract or pre-contractual measures
List of personal data:

title
name and surname
signature
address
e-mail
phone number
delivery address

Personal data will not be used for automated individual decision-making, including profiling.
Categories of data subjects: customer
Category of recipients: transport companies:

Geis SK, s.r.o., Trňanská 6, 960 01 Zvolen, ID: 31324428
DHL Express (Slovakia) s.r.o., M.R. Štefánika Airport, 820 01 Bratislava, ID No.: 31342876
123Kurier, s. r. o.. Tomanoczyho 378, 027 43 Nižná, ID No.: 46598863
Slovak Parcel Service s.r.o., Senecká cesta 1 900 28 Ivanka pri Dunaji, ID No.: 31329217
Packeta Slovakia s. r. o., Kopčianska 3338/82A 851 01 Bratislava - Petržalka district, ID No: 48136999
Slovenská pošta, a.s., with registered office at Partizánska cesta 9, 975 99 Banská Bystrica, ID No.: 36631124, registered in the Commercial Register of the District Court of Banská Bystrica, Section Sa, Insert No. 803/S

Intermediaries.
Retention period: for the period of registration in the e-shop
Cross-border transfer: personal data is not transferred to a third country

Purpose: e-shop

Legal basis: Article 6(1)(f) of the Regulation - legitimate interest of the controller. The legitimate interests pursued by the controller include offering the controller's product portfolio in order to provide products or services.
List of personal data:

user account
name and surname
e-mail
telephone number
date of birth
address of permanent residence
delivery address

Personal data will not be used for automated individual decision-making, including profiling.
Description.
Categories of data subjects: customer
Category of recipients: shipping companies:

Geis SK, s.r.o., Trňanská 6, 960 01 Zvolen, ID: 31324428
DHL Express (Slovakia) s.r.o., M.R. Štefánika Airport, 820 01 Bratislava, ID No.: 31342876
123Kurier, s. r. o.. Tomanoczyho 378, 027 43 Nižná, ID No.: 46598863
Slovak Parcel Service s.r.o., Senecká cesta 1 900 28 Ivanka pri Dunaji, ID No.: 31329217
Packeta Slovakia s. r. o., Kopčianska 3338/82A 851 01 Bratislava - Petržalka district, ID No: 48136999
Slovenská pošta, a.s., with registered office at Partizánska cesta 9, 975 99 Banská Bystrica, ID No.: 36631124, registered in the Commercial Register of the District Court of Banská Bystrica, Section Sa, Insert No. 803/S

Intermediaries.
Retention period: for the period of registration in the e-shop
Cross-border transfer: personal data is not transferred to a third country

Purpose: Recording of requests

Legal basis: Article 6(1)(f) of the Regulation - legitimate interest of the controller. The legitimate interests pursued by the controller include establishing communication and offering the controller's product portfolio in order to provide products or services.
List of personal data:

name and surname
address
phone
e-mail

Personal data will not be used for automated individual decision-making, including profiling.
Description.
Categories of data subjects: customer and potential customer
Intermediaries.
Retention period: for 1 year
Cross-border transfer: personal data is not transferred to a third country

Purpose: processing of accounting documents

Legal basis: Article 6(1)(c) of the Regulation - fulfilment of a legal obligation of the controller. Fulfilling the obligations of the controller under Act No 431/2002 Coll. on Accounting, as amended, Act No 222/2004 Coll. on Value Added Tax, as amended, Act No 40/1964 Coll. on the Civil Code, as amended.
List of personal data:

title
name and surname
address
telephone
account number
e-mail
signature

Personal data will not be used for automated individual decision-making, including profiling.
Categories of data subjects: natural persons who have incurred a payment obligation
Intermediaries.
Retention period: in accordance with Act No 395/2002 Coll. on archives and registers
Cross-border transfer: no transfer of personal data to a third country

Purpose: application of liability for defects

Legal basis: Article 6(1)(c) of the Regulation - fulfilment of a legal obligation of the controller. Pursuant to Act No. 40/1964 Coll., the Civil Code, as amended, or Act No. 513/1991 Coll., the Commercial Code, Act No. 108/2024 Coll. on Consumer Protection and on Amendments and Additions to Certain Acts.
List of personal data:

name and surname
address
e-mail
phone
signature

Personal data will not be used for automated individual decision-making, including profiling.
Categories of data subjects: customer/consumer
Intermediaries.
Retention period: 10 years
Cross-border transfer: no transfer of personal data to a third country

Purpose: debt recovery

Legal basis: Article 6(1)(c) of the Regulation - fulfilment of a legal obligation of the controller. Act No. 162/2015 Coll., the Administrative Procedure Code, Act No. 160/2015 Coll., the Civil Procedure Code, Act No. 301/2005 Coll., the Criminal Procedure Code, Act No. 233/1995 Coll., the Enforcement Code, Act No. 7/2005 Coll., the Act on Bankruptcy and Restructuring.
List of personal data:

name and surname
birth number
address

Personal data will not be used for automated individual decision-making, including profiling.
Categories of data subjects: data subjects, natural persons, legal persons acting as parties to proceedings
Intermediaries.
Retention period: 5 years
Cross-border transfer: no transfer of personal data to a third country

Purpose: Execution

Legal basis: Article 6(1)(c) of the Regulation - compliance with a legal obligation of the controller. Pursuant to Act No. 59/2018 Coll. on bailiffs and enforcement activity (the Enforcement Code).
List of personal data:

routine personal data, other personal data discovered or provided in the course of the proceedings

Personal data will not be used for automated individual decision-making, including profiling.
Categories of data subjects: natural person - party to enforcement proceedings, statutory body or other person authorised to act on behalf of a party to the proceedings
Intermediaries.
Retention period: 7 years
Cross-border transfer: no transfer of personal data to a third country

Purpose: Newsletter

Legal basis: Article 6(1)(a) of the Regulation - consent of the data subject to the processing of personal data
List of personal data:

Name and surname
e-mail

The personal data will not be used for automated individual decision-making, including profiling.
Description: If you wish, you can subscribe to our newsletter, which is located on our website www.lusja.sk. Personal data will only be processed for the purpose of sending newsletter messages to the e-mail address you have provided. By subscribing to the newsletter you agree to the processing of your personal data. Personal data is processed within the meaning of Article 6 (1) (a) of the Regulation. Your e-mail address will be processed until you unsubscribe. You can unsubscribe by clicking on the "unsubscribe" link provided in each newsletter message you receive from us. After unsubscribing, you will no longer receive any newsletter messages from us. Scope of personal data processed: e-mail address, first and last name.
Categories of data subjects: customers and potential customers
Categories of recipients: your marketing-related personal data may be provided to our partners who carry out partial processing activities for the controller, in particular in the field of marketing and satisfaction surveys.
Intermediaries.
Retention period: personal data is retained for 1 year from the date of consent
Cross-border transfer: personal data are not transferred to a third country

Purpose: registration of suppliers' and customers' representatives

Legal basis: Article 6(1)(f) of the Regulation - legitimate interest of the controller. The legitimate interest of the controller is the need to keep track of the representatives of the suppliers and customers (customers) of the controller, or their contact persons in contractual relations for the proper performance of contractual obligations and possible proof of legal claims and to ensure continuous and effective communication with the representatives of suppliers and customers.
List of personal data:

title, first name, surname
job title
job title
Functional classification
personal staff number
department
place of employment
telephone and fax number
e-mail address of the workplace
employer's identification data

Personal data will not be used for automated individual decision-making, including profiling.
Categories of data subjects: representatives or employees of suppliers and customers
Intermediaries.
Retention period: 10 years after the end of the contract or business relationship
Cross-border transfer: no transfer of personal data to a third country

Purpose: Direct marketing

Legal basis: Article 6(1)(f) of the Regulation - legitimate interest of the controller. The legitimate interest of the controller in this case is to work with existing customers and to promote products or services to existing customers.
List of personal data:

name and surname
address
phone
e-mail

Personal data will not be used for automated individual decision-making, including profiling.
Categories of data subjects: customer
Categories of recipients: your marketing-related personal data may be provided to our partners who carry out partial processing activities for the controller, in particular in the field of marketing and satisfaction surveys.
Intermediaries.
Retention period: for the duration of the contractual or business relationship
Cross-border transfer: no transfer of personal data to a third country

In relation to the processing of personal data, the data subject has the following rights:

Right of access to personal data: in connection with the processing of personal data, the data subject shall have the right, upon request, to obtain confirmation from the controller as to whether personal data relating to him or her are being processed, and shall also have the right to be provided with information and to be provided with a copy of his or her personal data processed. In the event of a repeated request, the controller may charge the data subject a reasonable fee for the production of a copy of the personal data processed. The controller shall inform the data subject in advance of such procedure.
Right to rectification: In connection with the processing of personal data, the data subject shall have the right to have inaccurate personal data concerning him or her rectified by the controller without undue delay. Having regard to the purpose of the processing of personal data, the data subject shall have the right to have incomplete personal data completed. The rectification shall be carried out by the controller without delay and always taking into account the technical possibilities.
Right to erasure: In connection with the processing of personal data, the data subject shall have the right to have the personal data concerning him or her erased by the controller without undue delay. If the data subject requests the erasure of personal data concerning him or her, the controller shall erase the data subject's personal data without undue delay if:

the personal data are no longer necessary for the purpose for which they were collected or otherwise processed,
the data subject withdraws the consent on the basis of which the personal data are processed and there is no other legal basis for the processing of the personal data,
where the data subject objects to processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or which is necessary for the purposes of the legitimate interest of the controller or of third parties, including profiling based thereon, and no legitimate grounds for the processing of the personal data prevail, and also where the data subject objects to the processing of personal data concerning him or her for the purpose of direct marketing, including profiling to the extent that it is related to direct marketing,
where the personal data are unlawfully processed,
if the reason for deletion is the fulfilment of an obligation under Act No. 18/2018 Coll., the Regulation, a special regulation or an international treaty to which the Slovak Republic is bound,
if the personal data were obtained in connection with the offer of information society services.
However, in some cases the right of the data subject is limited, in particular in cases where the processing of personal data is necessary:

to exercise the right to freedom of expression or the right to information,
to fulfil an obligation under Act No 18/2018 Coll., the Regulation, a special regulation or an international treaty by which the Slovak Republic is bound, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller,
for reasons of public interest in the field of public health,
for archiving purposes, scientific purposes, historical research purposes or statistical purposes, where the exercise of the right to erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing,
for the exercise of a legal claim.

Right to restriction of processing: during the restriction period, the personal data of the data subject will only be stored and not processed by the controller without the data subject's consent. The restriction of processing lasts for as long as any of the above situations persist. The controller will inform the data subject of the termination of the restriction, if any. The data subject shall have the right to restrict the processing provided that:

the data subject objects to the accuracy of the personal data processed by the controller for a period allowing the controller to verify the accuracy of the personal data,
the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead the restriction of their use,
the personal data are no longer necessary but the data subject needs them for the exercise of a legal claim,
the data subject has objected to the processing of the personal data, pending verification that the legitimate grounds on the part of the controller override those of the data subject.

Right to object: In relation to the processing of personal data, the data subject shall have the right to object to processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or which is necessary for the purpose of the legitimate interests of the controller or of third parties. The controller shall not further process the personal data unless it demonstrates compelling legitimate interests for the processing of the personal data which override the rights or interests of the data subject or grounds for exercising a legal claim. The data subject shall also have the right to object to the processing of personal data concerning him or her for direct marketing purposes, including profiling to the extent that it is related to direct marketing. If the data subject objects to the processing of personal data for the purpose of direct marketing, the controller may no longer process the personal data for the purpose of direct marketing. The data subject may exercise the right to object by automated means using technical specifications. The data subject shall have the right to object to the processing of personal data on grounds relating to his or her particular situation, except where the processing of personal data is necessary for the performance of a task carried out for reasons of public interest, where the personal data are processed for scientific purposes, for historical research purposes or for statistical purposes.
Right to data portability: In connection with the processing of personal data, the data subject shall have the right to obtain personal data concerning him or her which he or she has provided to the controller in a structured, commonly used and machine-readable format; andhas the right to transfer those personal data to another controller, where this is technically feasible and where the processing of his or her personal data is based on his or her consent or where the processing of the personal data is necessary for the performance of a contract or for the performance of a pre-contractual measure and the processing is carried out by automated means. If the exercise of this right would affect the rights and freedoms of third parties, the controller will not be able to comply with the data subject's request.
Right not to be subject to automated decision-making, including profiling: the controller does not use automated decision-making, including profiling, in the course of its activities.
Right to withdraw consent to the processing of personal data: Where the data subject has given the controller consent to the processing of personal data, he or she shall have the right to withdraw that consent at any time in the same way in which he or she gave the consent. When withdrawing consent to the processing of personal data, the controller is entitled, on the basis of reasonable doubt, to first verify the identity of the data subject by requesting additional information necessary to confirm the identity. In the case of newsletters (commercial communications), it is possible to unsubscribe by clicking on the unsubscribe link provided in each e-mail. Withdrawal of consent does not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal.
Right to bring an action for the protection of personal data: if the data subject feels that his/her personal data are not being handled in accordance with the law, he/she has the right to bring an action before the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovak Republic, telephone number: +421 /2/ 3231 3214; e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk. If the application is submitted electronically, it must comply with the requirements of Section 19(1) of Act No 71/1967 Coll. on Administrative Proceedings (Administrative Procedure Code).

If the data subject suspects that his or her personal data are being unlawfully processed, he or she may submit a notification by e-mail to the following e-mail address: marketing2@lusja.sk. If the data subject lacks full legal capacity, his or her rights may be exercised by his or her legal representative.