The protection of personal data (hereinafter referred to as PD) of customers and their processing according to the existing legislation of the Personal Data Protection Act (Act 101/2001 Coll.), the Civil Code (Act 89/2012 Coll.) is newly changed according to the European Union General Data Protection Regulation (GDPR) No. 2016/679 of 25 May 2016 with effect from 25 May 2018.

1. ADMINISTRATOR

SIKO KOUPELNY a.s., with registered office at Prague 9 - Kyje, Skorkovská 1310, Postal Code 198 00, ID No.: 260 65 801, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, Insert 9124 (hereinafter referred to as the "Administrator").

2. PURPOSE OF PROCESSING PERSONAL DATA

Marketing and commercial communications (offering trade and services and sending commercial communications, including commercial communications relating to goods and/or services of third parties), Customer registration (on the Controller's e-shop and at its sales outlets), Customer identification (Purchase of goods and services on the Controller's e-shop and at its sales outlets, Delivery of goods, Delivery of construction works), Purchase of goods, Delivery of goods, Delivery of construction works, Identification of payment, Processing of complaints, Conclusion of contractual arrangements for the purchase of construction works.

3. SCOPE OF PERSONAL DATA PROCESSED

By registering on the elitebathkitchen.cz and elitebathkitchen.sk website and by filling in the contact form, the user agrees that his/her personal data within the scope specified herein will be processed in an automated database by the administrator, or by a processor with whom the administrator has a contract, for defined purposes.

Scope of the processed personal data:

• Name,
• surname,
• telephone number,
• email.

4. PERIOD OF PROCESSING OF PERSONAL DATA

Personal data will be processed according to the purposes and for the maximum period of time indicated in the table below:

TITLE	TYPE OF PURPOSE	MINIMUM DURATION OF VALIDITY
Offer, proposal to conclude a purchase contract (paid service)	Legitimate interest	24 months
Offer, without proposal to conclude a purchase contract (unpaid service)	Legitimate interest	12 months
Origination, administration and termination of the contract	Legitimate interest	36 months
Complaints procedure	Legal obligation	according to the longest warranty period, minimum 36 months
Fulfilling statutory obligations - financial accounting agenda - invoices, payments (part of contract creation, administration and termination)	Legal obligation	according to the legislation financial accounting 10 years
Marketing and business communication (offering own products and services and improving quality)	Legitimate interest / Consent	36 months: customer / 24 months: from consent
Protection of property and persons (security video recordings)	Legitimate interest	1 month

If, by the time the expiration date, the customer does not renew or does not implement any of the steps defined in point 7, the customer's personal data will be anonymized. Each customer is entitled to revoke the consent given for the processing of personal data, to request an overview of the personal data processed, to request the transfer of personal data in machine-readable format or to remove their personal data ("to be forgotten") from the processor's database. The Customer agrees that the Controller shall in such case terminate the processing of personal data for the purpose referred to in point 2 within 30 days of the date on which the withdrawal of consent to the processing of personal data was delivered to the Customer; the provisions of Section 5, paragraph 9 of Act No. 101/2000 Coll., the Personal Data Protection Act, as amended (hereinafter referred to as the "Act") are not affected.

The Customer agrees that the Controller may make enquiries of the Customer as to the validity of the previously mentioned personal data.

5. FURTHER INFORMATION ON THE PROCESSING OF PERSONAL DATA

5.1. Method of processing personal data.

The personal data of customers will be processed by machine or manually in written form and by automated electronic means in accordance with the laws mentioned above.

5.2. Recipients of personal data.

The Customer agrees that the Controller may transfer the Customer's personal data to another controller in accordance with the provisions of Section 5(6) of the Act. The Customer consents to the transfer of the necessary personal data to other processors of personal data within the meaning of the purpose of Origination, Administration and Termination of the contract, namely to transport, installation or construction companies. The Controller has agreed with the individual companies the rules for the handling of the Customer's personal data within the meaning of these data protection rules as well as the applicable laws and regulations (see header). For transport companies, the "Legitimate Interest" reason applies, where Siko transfers personal data to transport companies for the completion of business cases, always on the basis of a personal request from the customer (the customer orders goods with transport by the carrier of his choice and to the address defined by him).

6. INFORMATION ON CUSTOMER RIGHTS  

6.1 Customer's right of access to personal data

The customer has the right to request the Controller to provide information on the scope of processing of his/her personal data. The customer shall make the request in person at any branch of the Controller. The data customer shall also receive the requested information at the branch, after his/her identification has been made. The time limit for providing the requested information is 30 days. For the provision of the information, the Data Controller is entitled to request a reasonable fee not exceeding the costs necessary to provide the information.

6.2 Right to the transmission of personal data in machine-readable format

The Customer has the right to request the Controller to transmit his/her personal data in machine-readable format. The request shall be made by the Customer in person at any branch of the Controller. Upon the customer's identification upon receipt of the request, the 30-day period for the transfer of personal data begins. The personal data will be prepared in machine-readable code and will be handed over to the customer personally, after identification, at a branch of the Controller. The Controller reserves the retention of the customer's personal data in connection with legal obligations (Invoices, Warranty Periods) according to the time limits set out in the relevant laws (Act 563/1991 Coll. and as amended and Civil Code 89/2012 Coll. and as amended). For the provision of information, the Administrator is entitled to demand a reasonable payment not exceeding the costs necessary to provide the information.

6.3 Customer's right to erasure of personal data

The Customer has the right to request the Administrator to delete his/her personal data. The Customer shall submit the request at any branch of the Administrator. Upon the customer's identification upon receipt of the request for deletion of personal data, the 30-day period for its execution begins. The personal data will be deleted from marketing communication databases. The Controller reserves the retention of the customer's personal data in connection with legal obligations (Invoices, Warranty Periods) according to the time limits set out in the relevant laws (Act 563/1991 Coll. and as amended and Civil Code 89/2012 Coll. and as amended). For the provision of information, the Administrator is entitled to demand a reasonable payment not exceeding the costs necessary to provide the information.

6.4 Voluntary provision of personal data

The Customer is not obliged under any generally binding legal regulation to provide the Controller with its personal data; the provision of personal data and the granting of consent to its processing is entirely voluntary on the basis of the Customer's free and informed expression of will given in accordance with Article 6.

6.5 Other customer rights

Any customer who discovers or believes that the Controller is processing his/her personal data contrary to the purpose of the consent given, the protection of his/her private life or contrary to the law or applicable regulations (e.g. GDPR, etc. ), he/she may (i) request an explanation from the Controller, (ii) request that the Controller remedy the situation, (iii) if necessary, contact the supervisory authority (the Data Protection Authority). The deadline for the investigation of the request is 30 days from the receipt of the request. The request to the Controller can only be made in writing, for customers in the Czech Republic at info@elitebathkitchen.cz and for customers in the Slovak Republic at info@elitebathkitchen.sk. If the Customer's request is found to be justified, the Administrator shall promptly remedy the defective condition. If the Administrator does not comply with the request, the Customer may contact the Office for Personal Data Protection; the Customer's right to contact the Office for Personal Data Protection directly is not affected.

7. CONSENT TO THE PROCESSING OF PERSONAL DATA AND DISSEMINATION OF COMMERCIAL COMMUNICATIONS 

By completing the contact form, the customer gives consent to the Administrator to process personal data for the purposes and to the extent specified in Articles 2, 3 and 4 and in the law and furthermore, in accordance with Section 7 of Act No. 480/2004 Coll., as amended, consents to the dissemination of commercial communications. The Controller is entitled to process the personal data of the customer even if the web form has been filled in by a person other than the customer whose personal data was provided in the form. If the processing of the customer's personal data pursuant to the preceding sentence occurs and the authorised customer invokes it, the Controller shall proceed in a similar manner as in Article 4, unless the customer concerned requests otherwise.