GDPR Information and Personal data processing

BHG Princ s.r.o., IČ: 073 41 199, DIČ: CZ073 41 199, with registered office: Staroměstské náměstí 460/29, Staré Město, 110 00 Prague 1, registered at the Municipal Court in Prague, file number C 302794, as the Administrator of personal data (from now on referred to as the "Administrator") as a result of this informs you about the processing of personal data on this Website.

You provide us with personal data in the following cases:

• Using the contact form
• Using the registration or inquiry form
• By purchasing goods or services in an online store

The Administrator will process the user's personal data to the extent that you enter them using this contact form (i.e. name, email address and optionally telephone number) to reply to the message you send to the Administrator via the contact form, i.e. due to legitimate interests of the Administrator to ensure that visitors to the Website can contact the Administrator. The Administrator can respond to their message. These legitimate interests of the Administrator are the legal basis for the processing of personal data.

Your personal data may be disclosed to third parties only if it fulfils the legal obligation of the Administrator. Personal data will be stored by the Administrator only for the time necessary to send a reply to your message. The provision of personal data in the range of name and email address is a contractual requirement, and you are obliged to provide this personal data to the Administrator. The contact form cannot be used without giving this personal data. Providing a phone number is voluntary, and you are not required to provide a phone number to the Administrator. In this case, the Administrator will process your message via email.

You have the right to access all your personal data with the Administrator, the right to request the correction, deletion or restriction of personal data processing, and the right to object to the Administrator regarding the processing of personal data. You may also complain with the State Supervisory Authority, the Office for Personal Data Protection.

If this information changes, the Administrator will update this document.

Personal data and e-shop

Purpose of personal data processing, the legal basis of personal data processing, the scope of processed personal data.

The administrator processes and stores the personal data of the buyer

• To conclude the purchase contract, its subsequent performance (order processing, ensuring removal and delivery of goods) and possible settlement of rights from unsatisfactory performance (complaints) in the following scope: name, surname, address, e-mail and telephone number, or data on payment card including card number, expiration date, card type, CVC code and bank details (from now on referred to as "personal data"). The legal basis for the processing of personal data is, by Article 6 (1) (a), b) GDPR performance of the contract to which the buyer is a party. The provision of personal data for this purpose is a contractual requirement, and the buyer is therefore obliged to provide the personal data to the Administrator;
• because it is necessary for the Administrator's legitimate interests to the following extent: name, surname, address, e-mail and telephone number, or payment card details including card number, expiration date, card type, CVC code and bank details. The legal basis for the processing of personal data is, by Article 6 (1) (a), f) GDPR necessary for the legitimate interests of the Administrator. The provision of personal data for this purpose is a contractual requirement, and the buyer is therefore obliged to provide the personal data to the Administrator.
• To fulfil the obligations stipulated by legal regulations in the scope of name, surname, address. The legal basis for the processing of personal data is, by Article 6 (1) (a), (c) the GDPR, as this is necessary to fulfil the legal obligation to which the Administrator is subject. The provision of personal data for this purpose is a legal requirement, and the buyer is therefore obliged to provide the personal data to the Administrator.
• To offer products and services for marketing purposes and to send commercial communications using communicated electronic means (i.e., an e-mail address) in the scope of name, surname, e-mail. The legal basis for the processing of personal data is, by Article 6 (1) (a), a) GDPR consent granted by the personal data subject (buyer) to the processing of his data. The buyer provides this personal data with his voluntary consent, and for this reason, may withdraw his consent to this processing at any time. Withdrawal of support to the processing of personal data does not affect the above grounds for processing the buyer's personal data, nor the lawfulness of the processing until the revocation of consent.

Recipients / categories of recipients of personal data

In order to fulfill the contractual obligation (including the obligation to deliver the goods), the administrator may, to the extent necessary, provide the above personal data:

• to the contractual carrier chosen by the buyer when negotiating the contract by these terms and conditions, the Administrator will provide personal data in the following scope: name, surname, billing address, delivery address, e-mail, telephone number;
• Payment gateway, which the buyer chooses when negotiating the contract according to these terms and conditions, and personal data will be provided in the following range: name, surname, billing address, shipping address, e-mail, telephone number, technical data related to the payment.

Time of storage of personal data

The Administrator will store personal data for as long as at least one of the following reasons persists.

The Administrator will store personal data for the time necessary to fulfil the contract (order processing, removal and delivery of goods) and for the duration of rights from unsatisfactory performance (24 months from receipt of goods) or quality guarantee if provided longer.

Furthermore, the Administrator will process personal data to protect the Administrator's legitimate interests in disputes before courts or other authorities for four years from the conclusion of the purchase agreement; the above paragraph is not affected.

Finally, the Administrator will process personal data for the period required by law, such as:

• according to the provisions of Section 31 of the Accounting Act (No. 563/1991 Coll.) for five years beginning at the end of the accounting period to which they relate, taking into account the Administrator's obligation to keep accounting documents and accounting records (invoices);
• according to the provisions of Section 148 of the Tax Code (No. 280/2009 Coll.) for four years beginning at the end of the tax period to which they relate (taking into account the power of the tax administrator to assess the tax within such period);
• according to the provisions of Section 35 of the Value Added Tax Act (No. 235/2004 Coll.) for ten years beginning at the end of the tax period to which they relate, taking into account the Administrator's obligation to keep tax documents relating to the transactions from which it is paid value-added tax.

The Administrator will also process personal data for the period of validity of the consent to the processing of personal data to offer products and services for marketing purposes and to send commercial communications if it has been granted to the buyer for these purposes. The controller shall terminate the processing of personal data immediately after the expiry of the consent or if the buyer withdraws the consent to the processing. This does not affect the lawfulness of the processing before the revocation of consent, nor the legality of processing for other purposes specified in these terms and conditions.

Rights of the data subject

The buyer (or the person acting on behalf of the buyer has the right according to GDPR:

• to access personal data;
• to correct inaccurate personal data concerning him;
• for erasure ("right to be forgotten");
• to limit the processing of personal data;
• on data portability;
• object to the processing of personal data.

The Administrator shall notify the authorized person no later than one month after exercising these rights. The authorized person is also entitled to complain about the processing of personal data with the competent authority, which is the Office for Personal Data Protection.