The operator of the online store www.tastivo.eu (hereinafter referred to as the seller) is Mibax Trade, s.r.o, with its registered office at M.R.Štefánika 1050/74, 03601 Martin, Company ID: 47 36 4874, Tax ID: 2023828455, registered in the Commercial Register of the District Court in Žilina, Section: Sro, File No.: 59754/L.
In order to provide services to customers (hereinafter referred to as buyers), information of a personal nature is required in accordance with Act No. 122/2013 Coll. on the protection of personal data. This is data that is entered when registering on our website and which is necessary for the conclusion of a purchase contract between the seller and the buyer. Therefore, in order to purchase goods in the online store www.tastivo.eu, it is necessary to register and provide the following data:
• first and last name, exact address including country (or the address to be stated on the invoice)
• e-mail address (used for identification in the system and for communication with the buyer)
• optional additional addresses (if you wish to have the shipment delivered to an address other than the billing address)
• optional telephone number
• if you are purchasing as a company/sole trader, additionally: business name, company ID number and VAT ID number (for invoicing and correct accounting)
Personal data is stored in a secure database on the hosting provider's server. An encrypted connection is used during data entry to ensure the secure storage of personal data for the purpose of fulfilling the rights and obligations of the contracting parties. The personal data provided is also processed for the purpose of issuing a tax document in the MRP accounting system at the seller's accounting processor.
Personal data and other settings can be changed or updated at any time by email or by logging into the buyer's account directly on the store's website in the My Account section. If the buyer revokes their consent to the processing of personal data and requests cancellation of registration and deletion of their account, they can do so themselves in the My Account/GDPR Personal Data Protection section. In the GDPR Personal Data Protection section, it is possible not only to delete your account, but also to export personal data in xml format.
When paying by bank card through the reputable GP WebPay service, the store operator does not come into contact with sensitive information about the customer's bank account. From September 30, 2021, the obligation to verify the customer's identity multiple times during payment transactions will come into force, in accordance with the European PSD2 directive. When sending a card payment request from an e-shop, the ADDINFO parameter is sent, which contains the following customer data:
First and last name (Name)
Email address (Email address)
Home phone number (Home phone number)
Mobile phone number
Billing address
Shipping address
When visiting the online store www.caj-kava-cokolada.sk, temporary information (cookies) is stored that is necessary for the proper functioning of the store (e.g., what you have placed in your shopping cart, when you arrived at the site, where you came from).
After logging in to www.caj-kava-cokolada.sk, buyers can check their personal data at any time and change it if necessary in the My Account/GDPR Personal Data Protection section.
The buyer's personal data is not provided to third parties, with the exception of companies that are necessary for the processing of the order and the fulfillment of the seller's obligations arising from the purchase contract concluded between the seller and the buyer. These activities include, in particular:
• issuing a tax document – the company's accounting processor
• delivery of the order via a delivery service
• provision of bank identification details for payment
In connection with the processing of personal data, it is assumed, pursuant to Section 15(1)(e)(3) and (4) of Act No. 122/2013 Coll. on the protection of personal data, that the data will be provided and made available to the following third parties or group of recipients:
a) Direct Parcel Distribution SK s.r.o., Technická 7, 821 04 Bratislava, Company ID: 35 834 498, Tax ID: 2021648739, VAT ID: SK2021648739, The company is registered in the Commercial Register of the District Court BA1, Section SRO, Entry No. 26367/B
b) Slovenská pošta, a.s., Partizánska cesta 9, 975 99 Banská Bystrica, ID No.: 36 631 124, registered in the Commercial Register of the District Court of Banská Bystrica, Section Sa, Entry No. 803/S
c) Packeta Slovakia s.r.o., with its registered office in Bratislava, Kopčianska 3338/82A, Postal Code 851 01, Company ID No.: 48136999
d) DHL Express (Slovakia), spol. s r.o., Letisko M. R. Štefánika, 820 01 BRATISLAVA
By registering on the website of the online store www.caj-kava-cokolada.sk, the buyer confirms that they have been informed in accordance with applicable legislation that the seller will process the buyer's personal data without the buyer's consent in the process of concluding and fulfilling the purchase contract, as the processing of personal data will be carried out in pre-contractual relations and the processing of the buyer's personal data is necessary for the establishment of a contractual relationship, the processing of the order, the delivery of goods, and the performance of other purchase contracts in which the buyer acts as one of the contracting parties.
By checking the box "Sign up for our newsletter!", during registration, the buyer freely expresses their specific, informed, and unambiguous consent to the processing of their personal data provided during registration for the purposes of direct marketing, sending information about new products, discounts, and promotions on offered goods, and other marketing activities and improving the range of services.
The buyer has the right, upon written request, to object to the processing of personal data that he/she believes is or will be used for direct marketing purposes without his/her consent and may request the deletion of personal data. The buyer also has the right to object to the use and provision of their personal data for direct marketing purposes (including postal communications).
The buyer may revoke their consent to the processing of personal data at any time by sending a written request to the email address provided on the website www.caj-kava-cokolada.sk. Immediately after receiving the withdrawal of consent to the processing of personal data, Mibay Trade, s.r.o. will ensure the blocking and destruction of the buyer's personal data that was processed for marketing purposes.
In the event that the buyer grants consent to the processing of personal data for marketing purposes, the buyer simultaneously confirms that this consent was granted to the seller voluntarily and the buyer acknowledges that this consent is valid until its revocation or until the end of the period of processing of the buyer's personal data.
The seller may process the buyer's personal data even after the original purpose of processing has ended, but only to the extent necessary for statistical, accounting and research purposes, and may provide third parties or the public with summary statistical information about customers, visitor numbers, turnover and other data, but in an anonymised form so that it is not possible to identify buyers in any way.
The period for collecting and processing the buyer's personal data corresponds to the duration of their registration on the website of the online store www.caj-kava-cokolada.sk. For the purposes of invoicing payments, recording and enforcing and transferring claims for services provided, for the purposes of processing participant submissions, for the exercise of rights or for the fulfilment of other obligations imposed by generally binding legal regulations, Mibax Trade, s.r.o. is entitled to keep records of personal data even after the termination of the service contract to which you were a party.
The buyer may exercise all rights under the provisions of § 28 and § 29 of Act No. 122/2013 Coll. on the protection of personal data in writing with the seller. If the buyer suspects that their personal data is being processed unlawfully, they have the right to file a motion to initiate proceedings on the protection of personal data with the Office for Personal Data Protection of the Slovak Republic, located at Hraničná 12, 820 07 Bratislava.
Processing of personal data and instruction of the data subject within the meaning of the GDPR
I. Basic provisions
The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "GDPR") is Mibax Trade, s.r.o. (hereinafter referred to as the "controller").
The contact details of the controller are address: Mibax Trade, s.r.o. , M.R.Štefánika 1050 / 74, 03601 Martin, Slovak Republic
email: admin@tastivo.eu
phone: +421 911 366 664
Personal data is any information relating to an identified or identifiable natural person; An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
The controller has not appointed a data protection officer.
II. Sources and categories of personal data processed
The controller processes personal data that you have provided to it or personal data that the controller has obtained on the basis of fulfilling your order.
The controller processes your identification and contact details and the data necessary for the performance of the contract.
III. Legal basis and purpose of personal data processing
The legal basis for the processing of personal data is:
- performance of a contract between you and the controller pursuant to Article 6(1)(b) of the GDPR,
- the controller's legitimate interest in providing direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6(1)(f) of the GDPR,
- your consent to processing for the purposes of direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6(1)(a) GDPR in conjunction with Section 7(2) of Act No. 480/2004 Coll. on certain information society services in the event that no goods or services have been ordered.
European Directive PSD2
The purpose of personal data processing is:
- to process your order and exercise the rights and obligations arising from the contractual relationship between you and the controller; when placing an order, personal data necessary for the successful processing of the order (name and address, contact details) is required; the provision of personal data is a necessary requirement for the conclusion and performance of the contract; without the provision of personal data, it is not possible to conclude the contract or for the controller to perform it;
- sending commercial communications.
The controller carries out automated individual decision-making within the meaning of Article 22 of the GDPR. You have given your explicit consent to such processing.
IV. Data retention period
The controller retains personal data:
- for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and the controller and to enforce claims arising from these contractual relationships (for a period of 10 years from the termination of the contractual relationship).
- for the period until the consent to the processing of personal data for marketing purposes is revoked, for a maximum of 3 years, if the personal data is processed on the basis of consent.
After the expiry of the personal data retention period, the controller will delete the personal data.
V. Recipients of personal data (subcontractors of the controller)
The recipients of personal data are persons:
- involved in the delivery of goods/services/payment processing on the basis of a contract,
- providing e-shop operation services (Shoptet) and other services related to the operation of the e-shop,
- providing marketing services.
The controller does not intend to transfer personal data to a third country (outside the EU) or to an international organization. The recipients of personal data in third countries are mailing service providers.
VI. Your rights
Under the conditions set out in the GDPR, you have:
- the right to access your personal data pursuant to Article 15 of the GDPR,
- the right to rectify personal data pursuant to Article 16 of the GDPR, or to restrict processing pursuant to Article 18 of the GDPR.
- the right to erasure of personal data pursuant to Article 17 of the GDPR.
- the right to object to processing pursuant to Article 21 of the GDPR, and
- the right to data portability pursuant to Article 20 of the GDPR.
- the right to withdraw consent to processing in writing or electronically to the address or email of the controller specified in Article III of these terms and conditions.
You also have the right to lodge a complaint with the Office for Personal Data Protection if you believe that your right to personal data protection has been violated.
VII. Conditions for securing personal data
The controller declares that it has taken all appropriate technical and organizational measures to secure personal data.
The controller has taken technical measures to secure data storage and personal data storage in paper form.
The controller declares that only persons authorized by it have access to personal data.
VIII. Information on online dispute resolution
The European Commission provides a platform for online dispute resolution.
The purpose of this so-called "ROS platform" is to help companies and consumers resolve disputes out of court concerning contractual obligations arising from purchase or service contracts concluded via the Internet.
The ROS platform is available at the following link: ONLINE DISPUTE RESOLUTION PLATFORM
IX. Final provisions
By submitting an order from the online order form, you confirm that you are familiar with the terms and conditions of personal data protection and that you accept them in full.
You agree to these terms and conditions by ticking the consent box on the online form. By ticking the consent box, you confirm that you are familiar with the terms and conditions of personal data protection and that you accept them in full.
The administrator is entitled to change these terms and conditions. The new version of the personal data protection terms and conditions will be published on its website and sent to you at the email address you provided to the administrator.
These terms and conditions come into effect on May 18, 2018.