PRIVACY POLICY AND COOKIE NOTICE

Principles and instructions on the protection of personal data provided by the operator to the data subject when obtaining personal data from the data subject and information about cookies for the online store www.stitchartphoto.com

1. Operator

1.1. The identity and contact details of the Operator are:

Business Name: Anna Banášová

Registered Office: Hoste č.d. 177, 92545, Slovakia

Company ID: 54198569
Tax ID: 8037952474
Bank Account: SK1211000000002948115274
The Seller is not a VAT payer.

1.2. The email contact for the Operator is: anna@stitchartphoto.com

1.3. Address of the Operator for sending correspondence:
Anna Banášová, Hoste č.d. 177, 92545, Slovakia

1.4. The Operator hereby provides the Data Subject, from whom the Operator obtains personal data related to them, with the following information, instructions, and explanations in accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of May 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (hereinafter referred to as “Regulation”).

2. References

2.1. These principles and instructions on the protection of personal data form part of the General Terms and Conditions published in the Seller’s online store.

2.2. In accordance with Section 3(1)(n) of Act No. 102/2014 Coll., the Seller informs the consumer that there are no special relevant codes of conduct to which the seller has committed to adhere. A code of conduct refers to an agreement or a set of rules that defines the seller’s behavior, which is obliged to comply with this code in relation to one or more specific business practices or industries, if they are not established by law or other legal regulation or measure of a public authority, which the seller has committed to follow, and how the consumer can become acquainted with them or obtain their wording.

3. Protection of Personal Data and Use of Cookies. Explanation and clarification of cookies

3.1. The Operator provides this brief clarification of the function of cookies:

3.1.1. Cookies are text files that contain a small amount of information that is downloaded to your computer, mobile device, or other electronic device when you visit a website.

Cookies enable the Operator’s website to recognize the user’s device while allowing the user to access functions on the site.

Cookies can be divided into two basic types:

Permanent cookies – these cookies remain on the user’s device for the duration specified in the cookie file. They are activated each time the user visits the website that created the cookie.

Session cookies – these cookies allow the Operator of the website to link the user’s activities when the user opens a browser window and end upon closing the browser window. Session cookies are created temporarily. Once the browser is closed, all session cookies are deleted.

3.2. Explanation of Cookies

3.2.1. A cookie is a small text file that a website stores on your computer or mobile device while you are browsing it. This file allows the website to retain information about your actions and preferences (such as login name, language, font size, and other display settings) for a certain period, so you don’t have to re-enter them when you revisit the website or browse its individual pages.

3.3. Instruction on the Use of Cookies

3.3.1. The Operator’s website uses cookies to retain:

3.3.1.1. the fact that you have already responded to a survey displayed in a separate window (pop-up), through which you can express your opinion about the content of the site (it will not be displayed again);

3.3.1.2. the fact of whether you have agreed (or not agreed) to our use of cookies on this website.

3.3.1.3. Marketing and remarketing

Some subpages that are part of the Operator’s website also use cookies for the anonymous collection of statistical data about who is referring traffic to our domain and how you reached our website.

Permission to use cookies is not strictly necessary for the proper functioning of the website, but it will provide you with a better user experience while working with it. You can delete or block cookies.

The information stored in cookies will not be used for your personal identification, and the structure of the data is fully under our control. Cookies are not used for any other purposes than those mentioned in this text. Some of our pages or subdomains may use additional or different cookies than those mentioned in the previous text. In this case, detailed information about their use will be provided on the specific page in a special cookie notice.

3.4. How to Control Cookies

3.4.1. You can control and/or delete cookies as you wish – details can be found at aboutcookies.org. You can delete all cookies stored on your computer, and most browsers can be set to prevent them from being stored.

4. Processed Personal Data

4.1. The Operator processes the following personal data on its site: first name, last name, residence, email address, telephone number, data obtained from cookies, IP addresses.

5. Contact Details of the Person Responsible for the Collection and Processing of Personal Data, Representative of the Operator

5.1. The Operator has not appointed a person responsible for the collection and processing of personal data.

5.2. The Operator has not appointed its representative for the collection and processing of personal data.

5.3. The Operator is also the Seller as defined in the terms established in the General Terms and Conditions of this website.

6. Purposes of Processing Personal Data of the Data Subject

6.1. The purposes of processing personal data of the Data Subject are primarily:

6.1.2. registration, creation, and processing of contracts and client data for the purpose of concluding contracts with third parties

6.1.3. processing of accounting documents and documents related to the Operator’s business activities

6.1.4. compliance with legal regulations regarding the archiving of documents and records, e.g., according to Act No. 431/2002 Coll., the Accounting Act as amended and other relevant provisions

6.1.4. marketing and similar advertising activities of the Operator

6.1.5. activities related to the Operator’s presence on social networks, such as Facebook, Instagram, Twitter, and others.

6.1.6. activities of the Operator related to online activities such as targeted advertising through Facebook Ads, Google Ads, and others.

6.1.7. activities of the Operator in connection with fulfilling requests, orders, contracts, and similar institutions of the Data Subject.

7. Legal Basis for Processing Personal Data of the Data Subject

7.1. The legal basis for processing the personal data of the Data Subjects is, depending on the specific processed personal data and the purpose of their processing, the consent of the Data Subjects to the processing of personal data.

8. Recipients or Categories of Recipients of Personal Data

8.1. Recipients of the personal data of the Data Subject will be or may be:

8.1.1. statutory bodies or their members of the Operator

8.1.2. persons performing work in employment or similar relationships for the Operator

8.1.3. sales representatives of the Operator and other persons cooperating with the Operator in fulfilling the Operator’s tasks. For the purposes of this document, all physical persons performing dependent work for the Operator based on an employment contract or agreements on work performed outside of an employment relationship will be considered employees of the Operator.

8.1.4. Recipients of the personal data of the Data Subject will also be the Operator’s collaborators, business partners, suppliers, and contractual partners, particularly: accounting companies, companies providing services related to the creation and maintenance of software, companies providing legal services to the Operator, companies providing consulting to the Operator, companies providing transport and delivery of products to buyers and third parties, marketing companies, and companies operating social networks.

8.1.5. Recipients of the personal data will also include courts, authorities conducting criminal proceedings, tax offices, and other state authorities, if so prescribed by law. Personal data will be provided by the Operator to the given authorities and state institutions based on and in accordance with the legal regulations of the Slovak Republic.

9. Information on the Provision of Personal Data to Third Countries and Retention Period

9.1. The Operator does not transfer personal data of individuals to third countries.

9.2. Personal data will be retained in accordance with legal regulations for the necessary time needed to fulfill the contract and for subsequent archiving.

10. Information on the Existence of Relevant Rights of the Data Subject

10.1. The Data Subject has the following rights, among others, noting that:

10.1.1. The rights listed in 10.1 do not affect other rights of the Data Subjects.

10.1.2. The right of the Data Subject to access data according to Article 15 of the Regulation, which includes:

The right to obtain confirmation from the Operator as to whether personal data concerning the Data Subject is being processed, and if so, to what extent. Furthermore, if such data is being processed, the Data Subject has the right to know its content and to request information from the Operator regarding the reasons for processing, particularly information about: the purpose of processing, categories of personal data concerned, recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly in the case of recipients in third countries or international organizations, the expected retention period of the personal data or, if not possible, information on the criteria for its determination, the existence of the right to request the Operator to rectify personal data concerning the Data Subject or to erase it or restrict processing, and the existence of the right to object to such processing, the right to lodge a complaint with a supervisory authority if the personal data was not obtained from the Data Subject, any available information regarding its source, and the existence of automated decision-making including profiling as referred to in Article 22(1) and (4) of the Regulation, in which cases at least meaningful information regarding the procedure used, as well as the significance and anticipated consequences of such processing of personal data for the Data Subject, and the appropriate safeguards under Article 46 of the Regulation concerning the transfer of personal data if personal data is transferred to a third country or international organization.

10.1.3. The right to obtain a copy of the personal data being processed, provided that the right to obtain a copy of the processed personal data does not adversely affect the rights and freedoms of others.

10.1.4. The right of the Data Subject to rectification according to Article 16 of the Regulation, which includes the right for the Operator to rectify inaccurate personal data concerning the Data Subject without undue delay. The right to supplement incomplete personal data concerning the Data Subject, including by providing a supplementary declaration by the Data Subject.

10.1.5. The right to obtain the erasure of personal data concerning the Data Subject from the Operator without undue delay if one of the following grounds applies: personal data are no longer necessary for the purposes for which they were collected or otherwise processed; the Data Subject withdraws consent on which the processing is based, and there is no other legal ground for the processing; the Data Subject objects to the processing of personal data under Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing; or the Data Subject objects to the processing of personal data under Article 21(2) of the Regulation; the personal data have been unlawfully processed; personal data must be erased for compliance with a legal obligation under Union law or the law of a Member State to which the Operator is subject; personal data have been collected in relation to the offer of information society services under Article 8(1) of the Regulation.

10.1.6. The right of the Operator who has made personal data concerning the Data Subject public to take reasonable steps, including technical measures, to inform other operators processing personal data that the Data Subject requests the erasure of all links to those personal data, their copy, or replicas, provided that the right to erasure of personal data in the context of rights under Articles 17(1) and (2) of the Regulation does not arise if the processing of personal data is necessary:

10.1.7. for the exercise of the right to freedom of expression and information.

10.1.8. to comply with a legal obligation requiring processing under Union law or the law of a Member State to which the Operator is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the Operator.

10.1.9. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) of the Regulation, as well as Article 9(3) of the Regulation.

10.1.10. for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes under Article 89(1) of the Regulation, provided that the right referred to in Article 17(1) of the Regulation is likely to render impossible or seriously impair the achievement of the objectives of such processing of personal data; or for the establishment, exercise, or defense of legal claims.

10.1.11. The right of the Data Subject to restrict the processing of personal data under Article 18 of the Regulation, which includes:

10.1.12. The right for the Operator to restrict the processing of personal data if one of the following applies: the Data Subject contests the accuracy of the personal data, for a period enabling the Operator to verify the accuracy of the personal data; the processing of personal data is unlawful and the Data Subject opposes the erasure of the personal data and requests instead the restriction of their use; the Operator no longer needs the personal data for the purposes of processing, but the Data Subject needs them for the establishment, exercise, or defense of legal claims; the Data Subject has objected to processing under Article 21(1) of the Regulation, pending verification of whether the legitimate grounds of the Operator override those of the Data Subject.

10.1.13. The right that if the processing of personal data is restricted, such restricted personal data may only be processed with the Data Subject’s consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

10.1.14. The right to be informed in advance about the lifting of the restriction on processing personal data.

10.1.15. The right of the Data Subject to fulfill the notification obligation to recipients under Article 19 of the Regulation, which includes: the right for the Operator to inform each recipient to whom personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out under Article 16, Article 17(1), and Article 18 of the Regulation, unless this proves impossible or requires disproportionate effort; the right for the Operator to inform the Data Subject about these recipients if the Data Subject requests it.

10.1.16. The right of the Data Subject to data portability under Article 20 of the Regulation, which includes: the right to receive personal data concerning the Data Subject, which the Data Subject has provided to the Operator, in a structured, commonly used, and machine-readable format and the right to transmit those data to another operator without hindrance from the Operator, if:

a/ the processing is based on the consent of the Data Subject under Article 6(1)(a) of the Regulation or Article 9(2)(a) of the Regulation, or on a contract under Article 6(1)(b) of the Regulation, and simultaneously
b/ the processing is carried out by automated means, and simultaneously:

10.1.17. The right to obtain personal data in a structured, commonly used, and machine-readable format and the right to transmit those data to another operator without hindrance from the Operator will not adversely affect the rights and freedoms of others;

10.1.18. The right for the Data Subject to request the direct transfer of personal data from one operator to another, where technically feasible;

10.1.19. The right of the Data Subject to object under Article 21 of the Regulation, which includes:

10.1.20. The right to object at any time on grounds relating to the Data Subject’s particular situation to the processing of personal data concerning him or her, which is based on Article 6(1)(e) or (f) of the Regulation, including the right to object to profiling based on these provisions of the Regulation;

10.1.21. In the event of exercising the right to object on grounds relating to the Data Subject’s particular situation against the processing of personal data concerning him or her, which is based on Article 6(1)(e) or (f) of the Regulation, including the right to object to profiling based on these provisions of the Regulation, the right for the Operator to cease further processing of the Data Subject’s personal data unless the Operator demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject.

11. Information on the Right of the Data Subject to Withdraw Consent to the Processing of Personal Data:

11.1. The data subject has the right to withdraw their consent to the processing of personal data at any time, without affecting the legality of the processing based on the consent given prior to its withdrawal.

The data subject is entitled to withdraw their consent to the processing of personal data in full or in part. A partial withdrawal of consent may concern a specific type of processing operation or operations, while the legality of processing personal data related to the remaining processing operations will remain unaffected. A partial withdrawal of consent may also relate to a specific purpose or purposes of processing personal data, while the legality of processing for other purposes will remain unaffected.

The right to withdraw consent to the processing of personal data may be exercised by the data subject in writing to the Controller at the address registered as their registered office in the commercial register at the time of withdrawal of consent to the processing of personal data, or electronically through electronic means (by sending an email to the Controller’s email address specified in this document or by filling out an electronic form published on the Controller’s website).

12. Information on the Right of the Data Subject to File a Complaint with the Supervisory Authority:

12.1. The data subject has the right to file a complaint with the supervisory authority, particularly in the member state of their habitual residence, place of work, or the place of the alleged infringement if they believe that the processing of personal data concerning them is in violation of the Regulation, without prejudice to any other administrative or judicial remedies.

The data subject has the right to be informed by the supervisory authority to which the complaint has been submitted about the progress and outcome of the complaint, including the possibility of seeking judicial remedy under Article 78 of the Regulation.

12.2. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic.

13. Information on the Existence/Non-existence of the Obligation of the Data Subject to Provide Personal Data and Information Related to Automated Decision-Making, Including Profiling:

13.1. The Controller informs the data subject that providing personal data is necessary for concluding a purchase contract and fulfilling it. The Controller informs the data subject that they are not obliged to provide personal data nor are they obliged to give consent to its processing. The consequence of not providing personal data and/or not giving consent to the processing of personal data will be that the Controller will not be able to conclude and fulfill the purchase contract.

13.2. Since the Controller does not engage in the processing of personal data of the data subject in the form of automated decision-making, including profiling referred to in Article 22(1) and (4) of the Regulation, the Controller is not obliged to provide the information under Article 13(2)(f) of the Regulation, i.e., information about automated decision-making, including profiling, the procedure used, as well as the significance and expected consequences of such processing of personal data for the data subject. This does not apply.

14. Final Provisions

14.1. These Policies and information on the protection of personal data and cookie information form an inseparable part of the General Terms and Conditions and the Complaints Procedure. The documents—General Terms and Conditions and the Complaints Procedure of this online store are published on the domain of the Seller’s Online Store.

14.2. These personal data protection policies shall come into effect upon their publication in the Seller’s Online Store on September 26, 2024.