the Data Controller’S INFORMATION OBLIGATION - towards clients

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to personal data processing and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the „Regulation“)

We would like to briefly inform you with regard to personal data processing. This information does not apply to the personal data of legal entities, including the name, legal form and contact details of the legal entity.

1. Who is the Data Controller of your personal data?

The Data Controller of your personal data is:

KELLYS BICYCLES s.r.o., a company established and existing under Slovak Republic law, with its registered office at Slnečná cesta 374, 922 01 Veľké Orvište, Business ID No: 17 641 322, entered in the Commercial Register of the District Court in Trnava, Section Sro, Insert 37/T (hereinafter referred to as the „Data Controller“)

Data Controller’s contact details:
Address: Slnečná cesta 374, 922 01 Veľké Orvište
Email: kellys@kellysbike.com,
Telephone: +421 333 213 111

2. In wHICH situations will the DATA CONTROLLER process your data?

We only process your personal data without your consent in cases where applicable law allows us to do so. We cannot provide you with our services if you do not provide us with the personal data that we require on the basis of an agreement, special regulation or on the basis of a legitimate interest.

We only process your personal data without your consent in the following cases and on the basis of the following legal bases:

• Fulfilment of rights and obligations arising from contractual relationships - e.g. sale of goods to e-shop customers - when ordering, personal data is required, which are necessary for order processing (name and address, contact details), the provision of personal data is a necessary requirement for concluding and fulfilling the agreement, without providing personal data it is not possible to conclude the agreement or for the Data Controller to fulfil it;
• Fulfilment of legal obligations - e.g. handling a complaint process or bookkeeping - personal data processing is required by certain special laws, particularly Act No 40/1964 Coll., of the Civil Code, Act No 250/2007 Coll., on consumer protection, Act No 102/2014 Coll., on consumer protection in the sale of goods or the provision of services on the basis of a distance agreement or an agreement concluded outside the seller’s premises, Act No 222/2004 Coll., on value added tax, Act No 431/2002 Coll., on accounting;

We may also process personal data on the basis of your consent, which we may ask you for in any such operation. Provision of consent is voluntary, i.e. it is up to you to decide whether or not you provide us with your personal data. If you give us your consent, you can then revoke it at any time.

3. processed personal data Categories

• Basic identification data - name, surname, address;
• Customer account data - name, password, list of purchased goods;
• Contact details - telephone number, email address;
• Socio-demographic data - statistical data on age, gender, education, employment, number of children;
• Information on the use of products and services - what services you had with us in the past. Based on these data, we can recommend suitable products and services;
• Information from records of telephone calls or other interactions with you, for example by email, chat, text messages;
• Cookies

4. Legitimate interests for which YOUR PERSONAL DATA IS PROCESSED

Sometimes the Data Controller processes your personal data without your consent on the basis of its legitimate interest in processing or on the basis of the legitimate interest of third parties. In these cases, the Data Controller will always assess whether processing constitutes a disproportionate interference with the rights of the participant. The Data Controller processes your personal data on the basis of the following legitimate interests:

• The Data Controller’s legitimate interest in the protection of the server as well as in the protection of its business, the legitimate interest in the website’s proper functioning (cookies). At www.kellysbikes.com, we use cookies within Google Analytics and the Kellys website, which help us to adapt the website to your needs. All such data is anonymous and do not record any personal data about the user, nor data that could lead to their identification. These data are used only for statistical and technical purposes;
• The Data Controller’s legitimate interest is the sending of commercial communications in accordance with § 7 (3) of Act No 480/2004 Coll., on certain information society services, and in accordance with point 47 of the Regulation if the Data Controller obtains details of electronic contact in the context of the sale of goods and services to the participant;
• The legitimate interest of the Data Controller is the safety of our goods and employees, as well as the protection of our rights - in this connection, e.g. making a camera recording in shops, etc. The record is kept by our company for the time necessary to fulfill the purpose, but no longer than 14 days from the date of issue.

5. How long will we process your personal data?

We keep your personal data for as long as necessary for the purposes for which the personal data is processed. When storing personal data, we follow special regulations that set us deadlines for storage and/or the basic principles of the Regulation regarding the storage and disposal of personal data. In general, our company applies a period of 10 years for storing personal data, including communication with the client, starting from the termination of the contractual relationship.

We always store personal data processed on the basis of your consent only for the period for which you have given us your consent.

6. What sources does this information come from?

The personal data we process about you comes from you as the data subject or from other persons who have ordered goods or services for your benefit.

7. Who is the personal data recipient?

We only provide your personal data in justified cases and only to the extent necessary to the following categories of recipients:

• Persons providing e-shop operation services and other services in connection with e-shop operation;
• Persons involved in the supply of goods/services/execution of payments under contracts;
• Slovak Trade Inspection, Alternative Dispute Resolution Body, Police Force, Court, Expert Institutes and Experts, other authorised entity.

8. What are your rights when processing your personal data?

• Right to access - you can ask us for access to the personal data that we process about you. The Data Controller shall also provide a copy of the processed personal data.
• Right of rectification - you can ask us to rectify inaccurate or incomplete personal data that we process about you.
• Right to erasure - you can ask us to erase your personal data if any of the following situations occurs:
  • (i) personal data are no longer needed for the purposes for which they were collected or otherwise processed;
  • (ii) you have revoked the consent on the basis of which your personal data were processed and there is no other legal reason to process them;
  • (iii) you have objected to being a subject of decision-making based on automated personal data processing and there are no overriding legitimate reasons for such processing, or you have objected to personal data processing for direct marketing purposes;
  • (iv) your personal data have been processed illegally;
  • (v) your personal data must be erased in order to comply with a legal obligation laid down in European Union or member state law applicable to the Data Controller;
  • (vi) your personal data has been collected in connection with the offer of information society services.
• Right to restrict processing - you can ask the Data Controller to restrict personal data processing if any of the following situations occurs:
  • (i) you have denied the accuracy of the personal data for the time necessary for the Data Controller to verify the accuracy of the personal data;
  • (ii) processing your personal data is illegal, but you object to the erasure of such data and instead request a restriction of their use;
  • (iii) the Data Controller no longer needs your personal data for processing purposes, but you request them to determine, enforce or defend legal claims;
  • (iv) you have objected to personal data processing pursuant to Article 21 (1) of the Regulation until it is verified that the legitimate reasons of the Data Controller outweigh your legitimate reasons.
• Right to data portability – if we process your personal data on the basis of your consent or because it is necessary for the agreement’s performance to which you are a party, and it is processed by automated means of processing, you have the right to obtain personal data concerning you and which you have provided to the Data Controller, in a structured, commonly used and machine-readable format, provided that this right must not adversely affect the rights and freedoms of others.
• Right to withdraw the consent – if personal data processing is based on consent, you have the right to withdraw your consent to personal data processing for the purpose for which you have given your consent, at any time.
• Right to object – you can object at any time to personal data processing by the Data Controller for the purposes of direct marketing carried out on the basis of the Data Controller’s legitimate interest and whenever we process your personal data on the basis of a legitimate interest or public interest, including profiling.
• Right to lodge a complaint – ou have the right to lodge a complaint with the supervisory authority, which is: The Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.uoou.sk.

9. FINAL STATEMENTS

By submitting an order from the online order form, you confirm that you are familiar with the conditions of personal data protection and that you accept them in full.

The data subject is obliged to provide the Data Controller only with true and accurate personal data. The data subject is responsible for the accuracy, precision and veracity of the personal data provided. The Data Controller is not responsible for the accuracy of the data provided.

The Data Controller does not intend to transfer any personal data to a third country or international organisation.

When processing your personal data, the Data Controller does not use automated individual decision-making, including profiling according to § 28 (1) and (4) of Act No 18/2018 Coll., on personal data protection.