Categories
 
 
Introduction Protection Policy Personal Data Processing and Protection Policy
 
 
 
Age Verification
 
 

Personal Data Processing and Protection Policy

Protection Policy

I. Basic Provisions

  1. The controller of personal data pursuant to Article 4 point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: "GDPR") is DRINKSHOP s. r. o., ID (IČO) 36333034, with its registered office in Trenčín (hereinafter: "Controller").

  2. The contact details of the Controller are:

    • address: Bratislavská 971, Trenčín 911 05

    • email: info@drinkshop.sk

    • phone: +421 907 752 378

  3. Personal data means any information relating to an identified or identifiable natural person (hereinafter: "Data Subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

  4. In accordance with Article 37 of the GDPR, the Controller has not appointed a Data Protection Officer.

II. Sources and categories of processed personal data

  1. Sources of personal data:

    • The Controller processes personal data provided directly by you as the data subject, particularly when filling out the order form, registering a user account, or communicating with the controller (e.g., via email or telephone).

    • The Controller also processes data obtained automatically during your use of the e-shop through technical means, such as cookies and server logs.

  2. Categories of processed personal data (the controller processes the following categories of personal data for the purposes listed below):

a) For the purposes of order fulfillment (standard purchase):

- Identification data: First name and last name.
- Contact details: Delivery address, billing address, email address (for order confirmation and communication), telephone number (for informational purposes and courier delivery).
- Order data: Information on purchased goods, price and related transaction data.

b) For the purposes of maintaining a user account (upon registration):

- Data listed in point a), which you provide during registration or your first order.
- Login details: Your email address (serves as a username) and a securely hashed password.
- Order history: Provides you with an overview of your purchases and simplifies future orders.

c) When visiting and using the e-shop (automatically collected data):

- IP address and derived location: To ensure the security of information systems, prevent fraud, and diagnose technical problems.
- Cookies and other online identifiers: To ensure the proper functioning of the website (necessary cookies), for statistical traffic analysis (analytical cookies), and for ad personalization (marketing cookies).

III. Legal basis and purpose of personal data processing

  1. The legal basis for the processing of personal data is:

    • fulfillment of the contract between you and the controller pursuant to Article 6(1)(b) of the GDPR,

    • legitimate interest of the controller in providing direct marketing (sending commercial communications and newsletters) pursuant to Article 6(1)(f) of the GDPR,

    • your consent to the processing of personal data for the purposes of providing direct marketing (sending commercial communications and newsletters) pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 116 of Act No. 452/2021 Coll. on Electronic Communications, if no order for goods or services has been placed.

  2. The purpose of the processing of personal data is:

    • processing your order and exercising the rights and obligations arising from the contractual relationship between you and the controller; when placing an order, personal data are required which are necessary for the successful processing of the order (name and address, contact). Providing personal data is a necessary requirement for the conclusion and performance of the contract; without providing them, it is not possible to conclude the contract or for the controller to perform it.

  3. There is no automated individual decision-making by the controller within the meaning of Article 22 of the GDPR.

IV. Retention period of data

  1. The controller stores personal data:

    • for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and the controller and the assertion of claims from these contractual relationships (for a period of 10 years from the termination of the contractual relationship in accordance with Act No. 431/2002 Coll. on Accounting).

    • for the period until consent to the processing of personal data for marketing purposes is withdrawn, but no longer than 3 years if the personal data are processed on the basis of consent.

  2. After the retention period has expired, the controller will delete the personal data.

V. Recipients of personal data (subcontractors of the controller)

  1. Recipients of personal data include, in particular, the following categories of entities:

    • Shipping and courier companies – ensuring the delivery of goods to customers (DPD, GLS, Neoship).

    • Payment service providers and banks – processing payments for goods (Finby, ČSOB).

    • E-shop solution and web hosting provider – e-shop operation, technical support, and maintenance (Creativesites, WebSupport).

    • Accounting and tax office – accounting processing and fulfillment of legal obligations.

    • Marketing and analytical services – sending newsletters, evaluation and analysis of website traffic, personalized advertising (Google Analytics, Google Ads, Meta/Facebook, Ecomail).

    • Public authorities and institutions – to the extent required by the legal order of the Slovak Republic (Financial Administration, Slovak Trade Inspection).

  2. The controller may also provide personal data to other processors who provide services necessary for the proper functioning of the e-shop, always in accordance with the GDPR and only to the extent necessary to fulfill the purpose of processing.

  3. If the controller uses the services of entities based in third countries outside the EU (e.g., Google, Meta), the transfer of personal data is ensured on the basis of the European Commission's adequacy decision (EU–U.S. Data Privacy Framework) or on the basis of standard contractual clauses approved by the European Commission.

VI. Your Rights

  1. Under the conditions set out in the GDPR, you have:

    • the right of access to your personal data pursuant to Article 15 of the GDPR,

    • the right to rectification of personal data pursuant to Article 16 of the GDPR, or restriction of processing pursuant to Article 18 of the GDPR,

    • the right to erasure of personal data pursuant to Article 17 of the GDPR,

    • the right to object to processing pursuant to Article 21 of the GDPR, and

    • the right to data portability pursuant to Article 20 of the GDPR,

    • the right to withdraw consent to processing in writing or electronically to the address or email of the controller specified in Article I of these terms.

  2. Furthermore, you have the right to lodge a complaint with the Office for Personal Data Protection if you believe that your right to personal data protection has been violated.

VII. Personal data security conditions

  1. The Controller has adopted technical measures to secure data storage, in particular the use of encryption (e.g., SSL certificate on the website), secured access to systems using passwords, and regular software updates.

  2. The Controller has adopted organizational measures, such as internal guidelines for working with personal data and employee training, to ensure that personal data is accessed only by authorized and mandated persons who are bound by confidentiality.

VIII. Final Provisions

  1. By submitting an order from the online order form, the customer confirms that they have familiarized themselves with these personal data protection terms and that they acknowledge them in their entirety.

  2. If the customer provides consent to the processing of personal data for marketing purposes (e.g., newsletter subscription), they grant it voluntarily through a separate checkbox. This consent may be withdrawn at any time, either in writing or electronically, using the contact details of the controller specified in Article I of these terms.

  3. The Controller is entitled to change these terms at any time. A new version of the personal data protection terms will be published on the website www.drinkshop.sk and, if necessary, sent to the email address provided by the customer to the controller.

 

These terms are effective as of May 25, 2018, and were last updated on July 1, 2025.