CONDITIONS FOR PROCESSING OF PERSONAL DATA
The purpose of this document is to provide you with information on processing and protection of personal data in connection with Regulation (EU) 2016/679, on the protection of natural persons in relation to the processing of personal data ("GDPR"). This document is effective from May 25, 2018.
1. Identification of the Data Controllers
The data controllers are:
- MANUFAKTURA s.r.o., with residence at Melantrichova 970/17, 110 00 Praha 1, company reg. no. 031 27 371 (hereinafter “Manufaktura”),
- Český národní podnik s.r.o., with residence at Melantrichova 970/17B, 110 00 Praha 1, company reg. no. 496 27 371 (hereinafter “ČNP”),
- ČNP SR s. r. o., with residence at Mariánske nám. 29/6 010 01 Žilina, company reg. no. 46783393
and franchise administrators and processors who share data on customers and orders:
- Jana Dutková, based at 1. Máje 1526/66, 703 00 Ostrava – Moravská Ostrava, company reg. no. 447 34 468,
- Jana Mohylová, based at Krásná 170, 739 04, company reg. no. 017 75 791,
- VisViva, s.r.o., with residence at Bernolákova 703/54, 953 01 Zlaté Moravce, Slovakia, company reg. no. 468 83 665.
2. What personal data do we process and for what purpose?
We process only the personal data that you provide to us with regard to your interest in our products, services and their purchase, or entering into a contract for the sale of goods (e. g. within an order in our online store, visit of website presentation, registration, shopping in a brick-and mortar shop, and others).
It is personal data of the general category, i. e. mostly identification and contact details. For more information regarding specific purposes, see the chapters below.
2.1 Purchasing Goods Online, Delivery of Goods – Entering into and Performing the Contract
This data is necessary for entering into and performing the contract, billing, delivery of goods, handling complaints and other purposes resulting from the law.
It deals mainly of:
- name and surname,
- contact and/or delivery address
- telephone number,
- payment details (the first 6 digits of the payment card), which we will save with your bank account (only in case of paid services, such as shopping in our online store) – according to a payment gateway.
Personal data for these purposes is kept for as long as necessary to fulfil other legal obligations resulting from the law and/or a contractual relationship - i. e the period necessary for handling complaints is 2 years, for billing purposes 5 years, for archiving 10 years, for a limitation period 3 years.
2.2 Registration to the Customer Account on the Website, Loyalty Programme
To benefit fully from the customer system, it is necessary to sign up. For this purpose, we process the following personal data:
- name and surname,
- contact and/or delivery address,
- telephone number,
- year of birth (the registrant must be over 15 years of age, or 18 years of age for entering into a purchase contract),
- data on the purchased goods and payment behaviour.
Signing up for a loyalty programme motivates the customers to collect points for shopping in the online store and in brick-and-mortar shops throughout the Czech Republic and Slovakia. The collected points in the customer account can be turned into discount vouchers and used for a further purchase. Next, the customers can subscribe to the newsletter.
The loyalty programme also keeps track of shopping history, including electronic receipts, and pre-fills data when shopping online.
The customers can sign up for the loyalty programme via our website. Before paying in a brick-and-mortar shop it is necessary to identify oneself with the electronic loyalty card of the club member.
If you close your customer account, your personal data will continue to be processed for as long as necessary to fulfil other legal obligations, i. e. deadline for handling complaints is 2 years, for billing purposes 5 years, for archiving 10 years, for a limitation period 3 years.
2.3 Other Data (e. g. website visit - cookies)
Personal data that we get from you on the basis of using our services. It is:
- IP address,
- cookie files (in case of online services),
- Possibly another online identifier.
More information about cookies is below in this document.
2.4 Surveillance Videos from Branded Brick-and-Mortar Shops and Premises of ČNP
ČNP places security cameras to the branded brick-and-mortar shops and premises of ČNP for reasons of protection of ČNP´s customers, property and interests. It is a legitimate interest of ČNP. The premises where cameras are placed are always marked with warning. Surveillance videos are available 3 days back.
2.5 Marketing Purposes (e. g. sending newsletters)
If you have granted consent to receiving marketing information by means of email (news, information on products, special offers and others), the personal data for this purpose will be processed for 3 years, or until you withdraw your consent.
You can unsubscribe from receiving news and special offers in the setting of the service for which the users signed up themselves in order to receive such information via email@example.com or firstname.lastname@example.org.
After withdrawing your consent or upon expiry of the period of granting consent, we will keep your consent for a three-year limitation period.
Cookies are small data files due to which the visited websites remember operations and settings that individual users performed, so this data does not need to be entered repeatedly. Cookie files are stored in individual computers by means of web browsers.
Cookie files enable us e. g. to recognize a user as a current user (e.g. when logging into their email account, when authorising a payment, etc.) or to adjust websites to the user´s preference.
Cookies are used also for displaying behaviourally targeted online advertisement on Manufaktura website and outside, i. e. in simple terms for displaying only such advertisement that is relevant to a particular user without being bothered by an advertisement which is not interesting for them.
The types of used cookies:
- website setting,
- website security, verification of users, prevention of fraudulent use, protection of user data,
- processes allowing provision of website services,
- session state, customer behaviour,
- analytical cookies - Google Analytics,
- extension, social sharing plugin, third party systems.
2.7 Selection Procedures - Job Applicants
If you send us your curriculum vitae, your personal data relating to the selection procedure will be processed for the duration of the selection procedure. You curriculum vitae will be disposed of within 3 months on completion of the selection procedure. If you give us a consent to process your personal data in further selection procedures, your curriculum vitae will be stored for 5 years.
Some of your personal data can be stored for the period of 3 years on completion of the selection procedure due to legal claims resulting from the limitation period.
3. Form of Processing and Access to Personal Data
Appropriate organisational and technical security measures based on GDPR including control of access to personal data was adopted to secure your personal data. The company performs regular annual audits in the field of data security and personal data.
Your personal data will be stored both in an electronic and written form. Electronic data is stored in shared discs in the data centre of our company. Only the company´s staff has access to personal data stored in the shared discs, which is further limited and controlled.
Written documentation is stored in lockable filing cabinets accessible only by identified company´s employees. Disposal of electronic and written data is performed regularly under the disposal rule.
4. Recipients of Personal Data – Processors
The following are the recipients of personal data:
- persons participating in delivery of goods/payment processing,
- persons ensuring operation of the online store and other services associated with operation of website presentation,
- persons providing tax, accounting and other services,
- persons providing marketing services,
The data processors do not intend to directly transfer personal data to third countries (outside the EU). Personal data is transferred between the Czech Republic and Slovakia on the basis of a contract.
Personal data can be shared at the level of the following platforms: Google LLC (Google Ads, Youtube), Meta Platforms (Facebook, Instagram), Microsoft (Office, LinkedIn) – the USA. In connection with the current development of personal data protection between the USA and the EU, we are monitoring the situation.
5. What rights do you have?
You have the following rights in relation to your personal data:
- the right to information on the processing of personal data,
- the right to access personal data,
- the right to have personal data rectified,
- the right to have personal data deleted (the right to be “forgotten”) in certain cases when the purpose/period of the processing of personal data has passed,
- the right to restrict the processing of personal data,
- the right to require transferring of personal data,
- the right to object to or complain against the processing of personal data in certain cases,
- the right to withdraw your consent with the processing of personal data (for marketing purposes) at any time,
6. Final Provisions
In this context please note that we may ask you to prove your identity in an appropriate manner in order to check your identity. This is a preventive security measure aimed at preventing unauthorized persons from accessing your personal data.
In order to improve the quality of our services and to maintain the records of performance of our obligations resulting from the law every communication with you is monitored.
In Prague, on January 17, 2023