Privacy Policy Conditions

I. Basic Provisions

1. The data controller is Grandoly.com (hereinafter: "controller"),
2. Contact details of the controller are

Address: Kaprova 42/14, 11000 Prague, Czech Republic

Email: [email protected]

3. Personal data means any information about an identified or identifiable natural person; an identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, network identifier or one or more elements specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that person.

II. Sources and categories of processed personal data

1. The controller processes personal data provided by you or personal data obtained by the controller based on fulfilling your order.
2. The controller processes your identification and contact details and data necessary for contract performance.

III. Reasons and purposes of processing personal data

1. The reason for processing personal data is

• fulfillment of the contract between you and the controller,
• the legitimate interest of the controller in providing direct marketing (in particular for sending commercial messages and newsletters),
• your consent to the processing for the purpose of providing direct marketing (in particular for sending commercial messages and newsletters) in case no goods or services were ordered.

2. The purpose of personal data processing is

• to process your order and exercise rights and obligations arising from the contractual relationship between you and the controller; personal data is required for successful order processing (name and address, contact), providing personal data is a necessary requirement for concluding and fulfilling the contract, without providing personal data, it is not possible to conclude or fulfill the contract on the part of the controller,
• sending commercial messages and conducting other marketing activities.

3. The controller may make decisions about you or your data based solely on automated processing. By such processing, you give your explicit consent.

IV. Data retention period

1. The controller retains personal data

• for the duration necessary to exercise rights and obligations arising from the contractual relationship between you and the controller and to enforce claims from these contractual relationships (for a period of 15 years after termination of the contractual relationship).

2. After the expiry of the personal data retention period, the controller will delete the personal data.

V. Recipients of personal data (subcontractors of the controller)

1. Recipients of personal data are

• persons involved in the delivery of goods / services / payment processing based on the contract,
• providing services for the operation of a shopping gallery and other related services,
• providing marketing services.

2. Some operated services, providing marketing and support activities

• Google Analytics - records cookies and website usage
• Google Ads - records cookies and website usage
• Facebook and associated platforms - records cookies and website usage

VI. Your rights

1. In connection with the processing of your personal data, you have the following rights:

• the right to access your personal data,
• the right to rectify personal data, or restrict its processing,
• the right to erase personal data,
• the right to object to processing,
• the right to data portability,
• the right to withdraw consent to data processing in writing or electronically to the address or email of the controller provided in these terms.

2. Furthermore, you have the right to file a complaint with the relevant data protection authority in your jurisdiction if you believe your right to data protection has been violated and applicable law grants you this right. 

VII. Data security conditions

1. The controller declares that it has adopted all appropriate technical and organisational measures to secure personal data.
2. The controller has adopted technical measures to secure data storage and personal data in paper form, in particular secure / encrypted access to the website, encryption of customer passwords in the database, regular system updates, regular backups of the system.
3. The controller declares that only authorized persons have access to personal data.

VIII. Final provisions

1. By submitting an order via the online order form, you confirm that you have read the privacy policy conditions and accept them in full.
2. The controller has the right to change these conditions. The new version of the privacy policy conditions will be published on its website and simultaneously sent to you by email at the address you provided to the controller.

 

These conditions come into effect on 24 July 2023