Protection of Personal Data

1. Controller

The controller who determines the purposes and means of processing your personal data is:

• Business name: V.J.K. GUMKÁČI s. r. o.
• Registered office: Karadžičova 4111/47, 811 07 Bratislava, Slovak Republic
• Company ID (IČO): 44212844
• Tax ID (DIČ): 2022621502
• VAT ID (IČ DPH): SK2022621502
• Registration: Commercial Register of the Bratislava III City Court, section: Sro, insert No. 52786/B
• Managing director: Jaroslav Kubica
• Phone: +421 903 266 076
• E-mail: vjk@vjk.sk
• Brick-and-mortar shop: Rubber goods shop, Karadžičova 47, 811 07 Bratislava
• Opening hours: Monday–Thursday 9:00–17:00, Friday 9:00–13:00
• E-shop: vjk.sk (also gumkaci.sk)

In matters of personal data protection, you can contact us at the e-mail address vjk@vjk.sk or at the postal address of the registered office stated above.

2. What personal data we process

The scope of the personal data processed depends on which service you use. We process in particular the following categories of data:

• Identification data – first name and surname, or business name, Company ID, Tax ID and VAT ID if you purchase as an entrepreneur (necessary for the conclusion and performance of the contract).
• Contact data – e-mail address and telephone number (necessary for the confirmation and handling of the order and communication).
• Delivery data – delivery address, or the chosen pickup point (necessary for the delivery of the goods).
• Billing data – billing address and data needed to issue a tax document (necessary for the fulfilment of statutory obligations).
• Order data – the content and history of orders, the chosen shipping and payment method, data on payments, complaints and withdrawal from the contract (necessary for the performance of the contract).
• Customer account data – login data and access password, if you create an account (optional).
• Marketing data – e-mail address for sending the newsletter and data related to verified reviews (optional, only on the basis of your consent).
• Technical data about the visit – IP address, the date and time of access, the address of the page visited, the type and language of the browser, the type of device and operating system and other technical data about the request, including data on the course of the verification when a protected form is displayed and submitted (necessary for the operation, availability and security of the e-shop).

We need the data marked as necessary for the conclusion and performance of the contract and for the fulfilment of statutory obligations. Without it, the order cannot be handled. We process optional data only if you provide it to us, or grant consent to it.

3. Purposes and legal bases of processing

We always process your personal data for a specific, predetermined purpose and on a corresponding legal basis:

Purpose of processing	Legal basis	Categories of data
Handling the order, delivery of goods, handling complaints and withdrawal from the contract	Performance of the contract (Art. 6(1)(b) GDPR)	Identification, contact, delivery, order data
Issuing and retaining accounting and tax documents	Legal obligation (Art. 6(1)(c) GDPR)	Identification, billing, order and payment data
Sending the newsletter and marketing communications	Consent (Art. 6(1)(a) GDPR)	E-mail address
Measuring traffic and use of the e-shop (Google Analytics)	Consent (Art. 6(1)(a) GDPR)	Visit data: a pseudonymous identifier in a cookie, a shortened IP address, pages viewed, the source of the visit and data about a completed order
Obtaining verified reviews (Google Customer Reviews, Heureka)	Consent (Art. 6(1)(a) GDPR)	E-mail address, order data
Maintaining the customer account	Performance of the contract or consent (Art. 6(1)(b) or (a) GDPR)	Identification, contact and login data
Protection of the controller's rights, fraud prevention, e-shop security and assertion of legal claims	Legitimate interest (Art. 6(1)(f) GDPR)	Identification, contact and technical data
Delivery of the website, its availability and protection against bots and the misuse of forms	Legitimate interest (Art. 6(1)(f) GDPR)	Technical data about the visit

We are obliged to retain accounting and tax documents for reasons of fulfilling statutory obligations, generally for a period of 10 years.

4. Recipients and processors

We make your personal data accessible only to the extent necessary and only to trustworthy partners who help us ensure the operation of the e-shop and the delivery of goods. These are in particular:

• The delivery companies GLS and SDS – transport and delivery of the ordered goods.
• The provider of e-mail (SMTP) services – sending order confirmations and notifications.
• The provider of server infrastructure (netcup GmbH, Germany) – operation and security of the website and e-shop.
• Google Customer Reviews and Heureka – obtaining verified reviews, exclusively on the basis of your consent.
• Google Analytics (Google Ireland Ltd.) – measuring traffic and use of the e-shop for statistical purposes, exclusively on the basis of your consent.
• Google Maps and OpenStreetMap – displaying the map of the shop and selecting the pickup point, exclusively on the basis of your consent.
• bunny.net – content delivery network (CDN) for web fonts.
• Cloudflare, Inc. (USA) – a protective proxy server and content delivery network (CDN) through which the traffic of our website passes, and the Cloudflare Turnstile service, which verifies that a form is submitted by a human and not by a bot. In doing so, it processes the IP address, technical data about the request and data on the course of the verification. This is a measure necessary for securing and protecting the e-shop, which does not depend on your consent.

We have concluded contracts with the processors that guarantee an adequate level of protection of your personal data. Personal data may also be provided to public authorities if a special legal regulation requires us to do so.

5. Retention period

We retain personal data only for the period necessary to achieve the purpose for which it was obtained:

• Data for the performance of the contract – for the duration of the contractual relationship and subsequently for the period needed to assert or defend legal claims (in particular during the warranty period and limitation periods).
• Accounting and tax documents – for reasons of statutory obligation, generally for a period of 10 years.
• Data processed on the basis of consent (newsletter, marketing, verified reviews, optional cookies) – until consent is withdrawn, but at the latest until the purpose ceases to exist.
• Customer account data – for the period of the account's existence, or until its cancellation.
• Technical data about the visit (IP address, technical data about the request and data on the course of the form verification) – we retain it only for the period necessary to ensure the operation, availability and security of the e-shop and for the possible investigation of a security incident. The data processed in the network of Cloudflare, Inc. is subject to the retention periods stated in its privacy policy.

After the expiry of the relevant retention period, we securely delete or anonymise the personal data.

6. Transfer to third countries

Some of our partners, in particular Google (Google Analytics, Google Customer Reviews, Google Maps), may, in providing their services, also process data in the United States of America. Such a transfer is secured in accordance with the applicable safeguards under the GDPR, in particular within the Data Privacy Framework (the EU–US framework for the protection of personal data), or on the basis of standard contractual clauses. The transfer related to these services takes place exclusively on the basis of your consent granted in the relevant cookie category.

Separately from the above, a transfer to a third country also takes place in the very operation and security of our website: we use the network and security services of Cloudflare, Inc., with its registered office in the United States of America (a protective proxy server and CDN, and the Cloudflare Turnstile form verification). In doing so, Cloudflare processes your IP address, technical data about the request and, when a protected form is displayed and submitted, also data on the course of the verification. Such a transfer is safeguarded on the basis of the European Commission's decision on an adequate level of protection for the Data Privacy Framework, in which Cloudflare, Inc. is registered, and at the same time on the basis of the standard contractual clauses adopted by the European Commission. Unlike the tools listed above, this processing is not based on your consent, but on our legitimate interest in the secure and available operation of the e-shop (Art. 6(1)(f) GDPR), and it therefore cannot be switched off in the cookie settings; you do, however, have the right to object to it under Art. 21 GDPR.

7. Cookies

On our website we use cookies and similar technologies to ensure the functionality of the e-shop, measure traffic and (on the basis of consent) for marketing purposes. You can find detailed information about which cookies we use, for what purposes and how you can manage your preferences on the separate Cookie Policy page.

8. Rights of the data subject

In connection with the processing of your personal data, you have the following rights under the GDPR and Act No. 18/2018 Coll.:

• Right of access – to obtain confirmation of whether we process your personal data, and a copy of that data.
• Right to rectification – to request the correction of inaccurate data or the completion of incomplete data.
• Right to erasure (“right to be forgotten”) – to request the deletion of data if there is no longer a legal reason for its processing.
• Right to restriction of processing – to request a temporary restriction of the processing of your data.
• Right to portability – to obtain your data in a structured, commonly used and machine-readable format and to transfer it to another controller.
• Right to object – to object to processing that is based on our legitimate interest.
• Right to withdraw consent – to withdraw the granted consent at any time; the withdrawal does not affect the lawfulness of processing prior to its withdrawal.

You can exercise your rights by e-mail at vjk@vjk.sk, by phone at +421 903 266 076 or in writing at the address of our registered office. We will handle your request without undue delay within the statutory periods.

9. Right to lodge a complaint

If you believe that your rights were violated during the processing of your personal data, you have the right to lodge a complaint with the supervisory authority, which is:

• Office for Personal Data Protection of the Slovak Republic
• Hraničná 12, 820 07 Bratislava 27
• Web: www.dataprotection.gov.sk

Before lodging a complaint, however, we ask you to first contact us – we will be happy to resolve your matter directly.

10. Provision of data

The provision of the personal data needed to handle the order is a contractual requirement that is necessary for the conclusion and performance of the purchase contract, and in the case of billing data also a statutory requirement. If you do not provide us with this data, it is not possible to process your order and deliver the goods. The provision of data for marketing purposes and other optional processing is always voluntary and based on your consent.

We may update this privacy policy from time to time so that it corresponds to the current legal situation and our processing activities. Related documents: Terms and Conditions, Complaints Procedure, Shipping and Payment and Cookie Policy.