Data Protection Policy (GDPR)

Privacy Policy (GDPR)

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27. April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter also referred to as "the Regulation" or "GDPR") provides for the obligation of the controller to provide the data subject with all the information referred to in Articles 13 and 14 and all the notifications pursuant to Articles 15 to 22 and Article 34 relating to the processing in a concise, transparent, intelligible and easily accessible form, worded clearly and simply, in particular in the case of information specifically addressed to a child. If the data subject so requests, the information may also be provided orally, provided that the data subject has provided proof of his or her identity.

GoGo.wine, s. r. o. is aware that in connection with the operation of the websites www.zavinom.sk and gogo.wine, personal data is processed. In accordance with the relevant legislation of the Slovak Republic and the legislation of the European Union, the company fulfils its information obligation and informs the data subject about the conditions of processing of personal data by means of this policy.

1. Basic concepts

Operator

The company GoGo.wine, s.r.o. , registered office Šajdíkove Humence 757, 906 07 Šajdíkove Humence, ID No.: 50 794 744, registered in the Commercial Register of the District Court in Trnava, Section: Sro, Insert No. 49645/T as the operator of the websites www.zavinom.sk and gogo.wine as well as the reservation system located on these websites (hereinafter referred to as "website" or "reservation system").

The website operator proceeds with the processing of personal data in accordance with the Regulation and the Act.

Due to the scope and subject matter of its activities, the operator is not obliged to designate a responsible person pursuant to Section 44 of the Act. If you, as a data subject, have any questions regarding the processing of your personal data, please write to the controller at the following e-mail address: info@zavinom.sk, call 033 / 640 9026, or visit the controller in person at the address of its registered office.

Person concerned

A data subject is any identified or identifiable natural person whose personal data are processed by the controller. An identifiable natural person is a person who can be identified directly or indirectly, in particular by reference to an identifier:

name, surname, date of birth,
identification number - birth number, ID card number, location data (address),
genetic data relating to inherited or acquired genetic characteristics of a natural person,
data relating to the health of the data subject which provide information about the past, present or future physical or mental health of the data subject,
data specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person,
Online identifier - individuals may be assigned online identifiers provided by their devices, applications, tools and protocols (IP address, cookies, or other identifiers).

For the purposes of these Rules, a data subject is a natural person - a visitor to the operator's website, an ordering party through the booking system, or another natural person who has provided the operator with his or her personal data.

Personal data

Personal data is any information relating to an identified or identifiable natural person.

Processing of personal data

Processing of personal data means an operation or set of operations which involves personal data or sets of personal data, such as obtaining, recording, organizing, structuring, storing, processing or altering, retrieving, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, whether or not by automated or non-automated means.

Legal basis

The controller is only entitled to process personal data if permitted to do so by one of the legal bases established by the GDPR. When processing personal data, the controller relies on one or more of the following legal bases:

the data subject has consented to the processing of his or her personal data for one or more specific purposes,
the processing is necessary for the performance of a contract to which the data subject is a party,
the processing is necessary for compliance with a legal obligation of the controller,
processing is necessary to protect the vital interests of the data subject or another natural person,
the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party.

Retention period of personal data

In general, the controller shall only store the personal data of data subjects:

for the period necessary for the purpose in question,
to the extent reasonably necessary to comply with any applicable law or as is reasonable in relation to the relevant limitation period provisions.

2. Personal data and the purpose of their processing

Processing of personal data for the purposes of booking a place at the tasting and the complaints procedure

Purposes of personal data processing:
- mediation of the sale of services, issuance of a tax document, contacting the customer regarding the order, performance of the contract, application of liability for defects in the products sold (resulting from the performance of the contract).

Scope of personal data processed:email address, first and last name, delivery address / billing address, telephone number, order information, account number, payment detail (if the Tasting has been cancelled and the Refund has been refunded by the Intermediary), pseudonymous online identifiers (cookies, Facebook and Google Ads remarketing systems)

Legal basis for the processing of personal data: a
) Article 6(1)(b) GDPR - the processing of personal data to the extent specified is necessary for the performance of the Tasting Contract implemented through the booking system, to which the data subject is a party as the ordering party, or for the performance of a pre-contractual measure at the request of the data subject,
b) Article 6(1)(c) GDPR - the processing of personal data to the extent specified is necessary pursuant to special regulations or an international treaty to which the Slovak Republic is bound. 102/2014 Coll. on consumer protection in the sale of goods or provision of services under a distance contract or a contract concluded outside the seller's business premises and on amendment and supplementation of certain acts,
- Act No. 250/2007 Coll. on consumer protection and on amendment of Act No. 372/1990 Coll. of the Slovak National Council on offences, as amended,
- Act No. 40/1964 Coll., the Civil Code, as amended,
- Act No. 431/2002 Coll. on Accounting- Act No. 222/2004 Coll. on Value Added Tax.
c) Article 6(1)(f) GDPR - the processing of personal data to the extent specified is necessary for the purpose of the legitimate interests of the controller, namely for the exercise of the legal claims of the controller through the courts, e.g. the right to compensation for damages.

Retention period of personal data:
- accounting documents shall be kept by the operator for 10 years,
- data necessary for the conclusion of the Tasting Contract shall be kept by the operator for the necessary period of time, up to a maximum of one year after the expiry of the Tasting Contract.
- registration data on the reservation system shall be kept by the operator until the cancellation of the registration by the customer or two years after the last login of the customer to the reservation system.

Recipients of personal data:
The operator provides personal data for the purpose of delivery of ordered goods to the company - suppliers of tastings identified in the reservation system,
- the operator provides personal data for the purpose of operating the website to the web hosting provider Websupport, s.r.o. with its registered office at Staré Grunty 12, 841 04 Bratislava,
- the operator provides personal data to a public authority that processes personal data on the basis of a special regulation or an international treaty to which the Slovak Republic is bound. The provision of personal data is a contractual obligation. The consequences of not providing the data will prevent the tasting from taking place and the claim from being made.
Processing of personal data for the purpose of registration of the customer
Purposes of the processing of personal data:
- to speed up and facilitate the possible, but especially repeated, booking of a place at the tasting, so that the person concerned as the customer does not have to fill in the registration data repeatedly each time he or she books a place at the tasting.
Scope of the personal data processed:
- e-mail address, log in, password, first name, surname, home address, telephone number, IP address.
Legal basis for processing personal data:
- Article 6(1)(a) GDPR - the data subject has consented to the processing of his or her personal data for one or more specific purposes.
The data subject has the right to withdraw the consent given at any time by writing to the controller's registered office or by e-mail to info@zavinom.sk. The withdrawal of consent shall not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal. Failure to provide the e-mail address will prevent the data subject from creating a user account.

Retention period of personal data:
- lasts for the duration of the data subject's interest in registration. If the data subject cancels his/her registration, his/her personal data in the database will be deleted. If the data subject has booked a place at the Tasting via the Booking System and has registered in the Booking System for this purpose, his/her data shall remain in the database of the Booking System for the necessary period of time, up to a maximum of one year after the Tasting Contract has been entered into.

Recipients of personal data:
- the controller provides personal data for the purpose of operating the website to the web hosting provider Websupport, s.r.o. , with registered office at Staré Grunty 12, 841 04 Bratislava.

3. Cookies

The operator's website uses cookies to ensure the necessary functionality, as well as to make the operator's website more attractive, to remember user settings and to collect statistical information about users.

Google Analytics

In connection with cookies, the operator also uses Google Analytics to analyse user behaviour in order to optimise the functionality of the website. The operator uses Google Analytics with the "IP anonymisation" function activated.

For more information on all the cookies used by the Operator, please refer to the Cookies cookiessection, which forms an integral part of these Rules.

4. Rights of the data subject

You have the right, on written request, to request from the controller:
a) confirmation as to whether or not personal data concerning you are being processed,
(b) in a generally comprehensible form, information about the processing of personal data in the information system, including the identification data of the controller and the processor (if established); the purpose of the processing of personal data; the list or scope of the personal data processed; an indication of the voluntariness or the obligation to provide the personal data requested, the period of validity of the consent or a notification of which legal provision imposes the obligation to provide the personal data; the third parties to whom the personal data are to be disclosed; the range of recipients to whom the personal data are to be disclosed; and the form of disclosure of the personal data, if disclosure is to be made; third countries, if the transfer of personal data to those countries is to take place,
c) in a generally comprehensible form, precise information on the source from which the controller obtained the personal data for processing,
d) in a generally comprehensible form, a list of the personal data which are the subject of the processing,
e) the rectification or destruction of its incorrect, incomplete or outdated personal data which are the subject of the processing,
f) the destruction of the personal data the purpose of the processing of which has ceased to exist; where official documents containing personal data are the subject of the processing, it may request their return,
g) the destruction of personal data which are the subject of the processing where there has been a breach of the law,
h) the blocking of personal data due to the withdrawal of consent before the expiry of the time of its validity, where the controller processes personal data on the basis of consent.

The data subject may address the aforementioned request or information on the leakage of personal data or other serious facts concerning the processing of personal data by the controller to the controller at the above address or at the following telephone number: 033/640 9026, or at the following electronic address: info@zavinom.sk.

Right of access to personal data
The data subject shall have the right to have the controller confirm whether he or she processes personal data concerning him or her. Where the controller processes personal data, the data subject shall have the right to obtain access to them and further information on the purpose of the processing, the category of personal data processed, to whom they have been or are to be disclosed, in particular the recipient in a third country or an international organisation, if applicable; where personal data are transferred to a third country or an international organisation, the data subject shall have the right to be informed of the appropriate safeguards required by law, the period of retention of the personal data; if this is not possible, information on the criteria for its determination, the right to request rectification, erasure or restriction of the processing of personal data or the right to object to the processing of personal data, the right to bring a data protection action, the source of the personal data if the personal data was not obtained from you, the existence of automated individual decision-making, including profiling. Profiling is any form of automated processing of personal data which consists of the use of that personal data to evaluate certain personal aspects relating to an individual, in particular relating to job performance, financial situation, health, personal preferences, interests, reliability, behaviour, location or movements. In these cases, the controller shall provide the data subject with information, in particular on the procedure used, as well as on the significance and foreseeable consequences of such processing of personal data for the data subject. The controller shall be obliged to disclose the personal data which it processes. The controller may charge a reasonable fee corresponding to the administrative costs for the repeated provision of the personal data. The controller is obliged to provide you with the personal data in the manner requested by you. The right to obtain personal data must not adversely affect the rights of other natural persons.

Right to rectification of personal data
The data subject shall have the right to have inaccurate personal data concerning him or her rectified by the controller without undue delay. Depending on the purpose of the processing of the personal data, he or she has the right to have incomplete personal data completed.

Right to object to the processing of personal data
The data subject shall have the right to object to processing of his or her personal data on grounds relating to a particular situation if the controller carries out profiling or processing of personal data on the following legal grounds:
a) the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
b) the processing of personal data is necessary for the purpose of the legitimate interests of the controller or of a third party.

The controller may no longer process the personal data of the data subject unless he or she demonstrates compelling legitimate interests for the processing of the personal data which override his or her rights or interests or grounds for exercising a legal claim. The data subject shall have the right to object to the processing of personal data concerning him or her for direct marketing purposes, including profiling to the extent that it is related to direct marketing. If the data subject objects to the processing of personal data for the purpose of direct marketing, the controller may no longer process the personal data for the purpose of direct marketing. The data subject shall have the right to object to processing of personal data concerning him or her on grounds relating to his or her particular situation if the personal data concerning him or her are processed for scientific, historical research or statistical purposes, except where the processing of the personal data is necessary for the performance of a task carried out for reasons of public interest.

Right to erasure of personal data (right to be forgotten)
The data subject has the right to have personal data concerning him or her erased by the controller without undue delay. If you ask the controller to erase your personal data, the controller is obliged to erase it in the following cases:
(a) the personal data are no longer necessary for the purpose for which they were collected or otherwise processed,
(b) the data subject withdraws the consent on the basis of which the controller processes his or her personal data and there is no other legal basis for the processing of the personal data,
c) the data subject objects to the processing of personal data and no legitimate grounds for processing the personal data prevail or objects to the processing of personal data for the purpose of direct marketing, including profiling to the extent that it is related to direct marketing,
d) the personal data are processed unlawfully,
e) the ground for erasure is the fulfilment of an obligation imposed by law,
f) the personal data were collected in connection with the offer of information society services pursuant to Section 15 par. 1. Act.

Where a controller has disclosed personal data of a data subject and is obliged to erase them on the basis of the above conditions, the controller is also obliged, in view of the technology and costs available, to inform other controllers who process personal data that those controllers erase the references to the personal data and the copies or copies thereof.

The controller has no obligation to delete personal data if they are necessary:
(a) for the exercise of the right to freedom of expression or the right to information,
(b) for compliance with an obligation under law or an international treaty or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
(c) for reasons of public interest in the field of public health,
(d) for archiving purposes, scientific purposes, historical research purposes or statistical purposes, where erasure is likely to make it impossible or seriously impede the achievement of the purposes of such processing, or (e
) for the establishment of a legal claim.

Right to restriction of processing of personal data
The data subject shall have the right to have the controller restrict the processing of his or her personal data if
(a) he or she objects to the accuracy of his or her personal data; the controller shall restrict the processing of his or her personal data for the period of time necessary to verify their accuracy, (
b) the processing of his or her personal data is unlawful and, instead of erasure, the data subject requests the restriction of their use, (
c) the controller no longer needs the personal data for the purpose of the processing of the personal data, but the data subject needs them for the exercise of a legal claim, or (d
) you object to the processing of the personal data;
(e) the controller restricts the processing of the personal data pending verification that the legitimate grounds on the part of the controller outweigh the legitimate grounds of the data subject.

Where the processing of personal data has been restricted, the controller may, in addition to storage, only process the personal data with the consent of the data subject or for the purpose of exercising a legal claim, for the protection of individuals or for reasons of public interest. The controller shall inform the data subject before the restriction on the processing of personal data is lifted.

Notification obligation in relation to rectification, erasure or restriction of the processing of personal data
The controller is obliged to notify the recipient (anyone to whom the personal data of the data subject have been disclosed) of the rectification of the personal data, the erasure of the personal data or the restriction of the processing of the personal data, unless this proves impossible or does not require disproportionate effort. If the data subject so requests, the controller shall inform the data subject of those recipients.

Right to portability of personal data
The personal data relating to the data subject which he or she has provided to the controller shall have the right to obtain them in a structured, commonly used and machine-readable format. He or she also has the right to transfer that personal data to another controller where technically feasible and where the processing of your personal data is carried out by automated means (i.e. electronically), where the personal data are processed eithera
) on the basis of consent,
b) where the processing is carried out by automated means,
c) or is necessary for the performance of a contract to which the data subject is a party or for the performance of a pre-contractual measure upon request.

This right must not adversely affect the rights of other persons. The exercise of the right of portability shall be without prejudice to the right to erasure of personal data. The right of portability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The right to file a petition for initiation of a personal data protection proceedingIf the data subject is directly affected by his or her rights under the Personal Data Protection Act pursuant to Section 100 of the Act, he or she has the right to file a petition for initiation of a personal data protection proceeding with the Office for Personal Data Protection of the Slovak Republic. The purpose of the proceeding is to determine whether there has been a violation of the rights of natural persons in the processing of his or her personal data or whether there has been a violation of the Act, and in the event of a finding of deficiencies, to impose, if it is reasonable and appropriate, remedial measures or a fine for a violation of the Act. The Office publishes a model of the proposal on its website. The application for initiation of proceedings must contain evidence in support of the allegations set out in the application and a copy of the document or other evidence demonstrating the exercise of a right by the controller (right of access to personal data, right to request rectification of personal data, right to erasure or restriction of processing of personal data, right to object to the processing of personal data, right to portability of personal data), if such right has been exercised by the data subject, or an indication of the reasons of special consideration for not exercising the right in question.

The above-mentioned rights (except the right to bring a personal data protection procedure) may be exercised by e-mail or in writing by post with the controller who supervises the processing of personal data. The controller may also be notified of personal data leaks or other serious facts concerning the processing of personal data by the controller.

If the data subject suspects that his or her personal data are being unlawfully processed, he or she may lodge a request for the initiation of a personal data protection procedure with:

Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27 or contact the Office via its website http://www.dataprotection.gov.sk.

If the data subject lacks full legal capacity, his or her rights may be exercised by a legal representative. If the data subject is deceased, his or her rights which he or she had under this Act may be exercised by a person close to him or her.

The data subject's request under the Personal Data Protection Act shall be processed by the controller free of charge, except for a payment in an amount which may not exceed the amount of the reasonably incurred material costs associated with the making of copies, the procurement of technical media and the sending of the information to the data subject, unless a special law provides otherwise. The controller shall be obliged to deal with the data subject's request in writing no later than 30 days from the date of receipt of the request. The controller shall notify the data subject and the Office for Personal Data Protection of the Slovak Republic in writing without undue delay of the restriction of the data subject's rights under the Personal Data Protection Act.

5. Transfer of personal data to a third country or international organisation

The controller does not transfer any personal data to third countries or international organisations.

6. Automated individual decision-making, including profiling

As a data subject, you have the right not to be subject to a decision which is based solely on automated processing, including profiling, and which has legal effects concerning you or similarly significantly affecting you.

The controller does not use automated individual decision-making or profiling when processing personal data for any of the above purposes.

7. Storage and protection of personal data

The website operator takes the protection of personal data responsibly and seriously. It treats personal data as confidential in accordance with the relevant data protection legislation and these Rules.

The controller processes personal data either manually or using electronic systems. The controller has taken all necessary and indispensable organisational, technical and administrative measures to ensure that the personal data are accurate and up-to-date, that the personal data are protected against unauthorised or unlawful processing and against accidental loss, destruction or damage, and that the level of protection of the personal data is as high as possible.

Privacy policies may change over time. It will publish any changes to the Policy on the Website and inform data subjects whose personal data it processes before making any changes. Where required by law, the Operator will seek the data subject's consent before making any changes to the Rules.