Privacy Policy
1. General provisions
1.1 The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with the regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the 'GDPR') is the company Fantasy cards s.r.o, with its registered office at Ondříčkova 2166/14, 130 00 Praha 3, Company ID 24257478 (hereinafter: 'Controller’).
1.2. The controller's contact details are:
- address: Ondříčkova 2166/14, 130 00 Praha 3
- email: [email protected]
- phone number: 722 069 709
1.3. Personal information is any information about an identified or identifiable natural person; an identifiable natural person is a natural person that can be identified directly or indirectly, in particular by reference to a particular identifier such as name, identification number, location data, network identifier or one or more specific physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person.
1.4. The controller did not appoint a data protection officer.
2. Sources and categories of personal data processing
2.1. The controller processes personal data that you have provided to them or personal data the controller has obtained based on the performance of your order.
2.2. The controller processes your identification, contact details, and data necessary to perform the contract.
3. Legal grounds for processing personal data
3.1. The legal reason for processing personal data is:
- the performance of the contract between you and the controller pursuant to Article 6(1)(b) GDPR,
- the legitimate interest of the controller in the provision of direct marketing (in particular for sending commercial messages and newsletters) pursuant to Article 6(1)(a) GDPR,
- your consent to data processing for the purpose of providing direct marketing (in particular for sending commercial messages and newsletters) pursuant to Article 6(1)(a) GDPR in connection with § 7 paragraph 2 of Act No. 480/2004 Coll., on certain information society services in the event that no goods or services have been ordered.
3.2. The purpose of personal data processing is:
- the processing of your order and the rights and obligations arising from the contractual relationship between you and the controller; when ordering personal data are required, which are necessary for the execution of the order (name, address, and contact), provision of personal data is a necessary requirement for concluding and performance of the contract, without providing personal data it is not possible to conclude the contract or perform it by the controller,
- sending commercial messages and doing other marketing activities.
3.2 The controller has an automatic individual decision-making within the meaning of Article 22 GDPR. You have given your express consent to such processing.
4. Data retention period
4.1. The controller stores data:
- for the time necessary to exercise the rights and obligations arising from the contractual relationship between you and the controller, and also for the time necessary for the purposes of archiving in accordance with the relevant generally binding legal regulations.
- until the consent of the processing of personal data for marketing purposes is revoked, for a maximum period of 5 years, if the personal data are processed on the basis of the consent.
4.2. After the retention period of personal data, the controller deletes the personal data.
5. Recipients of personal data (subcontractors of the controller)
5.1. Recipients of personal data are persons:
- involved in the supply of goods/services/execution of payments on the basis of the contract,
- providing e-shop operation services and other services in connection with e-shop operation,
- providing marketing services.
5.2 The controller does not intend to transfer personal data to a third country (to a non-EU country) or to an international organization.
6. Your rights
6.1. Under the conditions set out in the GDPR, you have:
- the right to access personal data pursuant to Article 15 GDPR,
- the right to rectify personal data pursuant to article 16 GDPR, or restriction on processing pursuant to Article 18 GDPR,
- the right to erasure personal data pursuant to Article 17 GDPR,
- the right to object to the processing pursuant to Article 21 GDPR, and
- the right to data portability according to Article 20 GDPR,
- the right to withdraw consent to processing in writing or electronically to the seller's email address.
6.2. You also have the right to file a complaint with the Office for Personal Data Protection if you believe that your right to personal data protection has been violated.
7. Personal data security conditions
7.1. The controller declares that they have taken all appropriate technical and organizational measures to secure personal data.
7.2. The controller has taken technical measures to secure data repositories and personal data repositories in paper form.
7.3. The controller declares that only persons authorized by the controller have access to personal data.
8. Final provisions
8.1. By submitting an order form from the online order form, you confirm that you are familiar with the terms of privacy and you accept them in its entirety.
8.2. You agree to these terms by checking the consent in the order form. By checking the consent, you confirm that you are familiar with the terms of privacy and that you accept them in its entirety.
8.3. The controller is entitled to change these terms. The controller will publish a new version of the terms of privacy on their website, and/or send you a new version of these terms to the email address you provided to the controller.
Last updated: in Prague, on 4th July 2021