Privacy Policy

Information of the controller on the processing of personal data of Data Subjects – customers

pursuant to the provisions of Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), (hereinafter referred to as the “GDPR”) and Article 19 of Act No. 18/2018 Coll. on the Protection of Personal Data (hereinafter referred to as the “Act”) (hereinafter referred to as the “Information”)

Company:
Business Name: Liptov Farm Trade s. r. o.
Registered office: Trnavská cesta 32/C
821 08 Bratislava – Ružinov, Slovak Republic
Company ID No.: 54 104 785
Registration: in the Commercial Register maintained by the Municipal Court Bratislava III
Section Sro, Insert No. 155666/B
Statutory representative: Igor Lúčanský, Managing Director
Contact details: igor.lucansky@konopnafarmaliptov.sk, +421 915 452 922
(hereinafter referred to as the “Company” or the “Controller”),

informs the Data Subjects about the protection of personal data (hereinafter referred to as “PD”) pursuant to the provisions of Article 13 of the GDPR Regulation and Section 19 of the Act as follows:

For the purposes of this Information, a data subject is understood to be a natural person who purchases goods from the Operator, registers on the Operator’s website, is sent a newsletter or other notifications (e.g. in case of order incompletion ), who has participated in a consumer contest, loyalty program, who has published a reference or comment to the product, who has added the product to the wishlist or who contacts the Operator via the contact form.
The Data Controller is in the legal position of a Data Controller in relation to the Data Subject under the GDPR Regulation and the Act, i.e. a person who, alone or jointly with others, defines the purpose and means of processing of the Personal Data and processes the Personal Data on its own behalf.
Legitimate interests of the Controller or a third party if the Personal Data is processed pursuant to Article 6(1)(f) of the GDPR and Article 13(1)(f) of the Act (Article 13(1)(d) of the GDPR Regulation and Article 19(1)(d) of the Act ): The Controller processes OI on such a legal basis in the case of natural persons to whom the Controller has provided a service or who have expressed an initial interest in the services offered and sends them a newsletter to promote the provision of services. The data subject may at any time object to such communication. On the basis of this expression, the Operator will not contact these Data Subjects further. The controller further processes personal data on this legal basis in cases where it concerns personal data of a natural person who publishes his or her reference to a purchased product or a comment on a selected product. The data subject may, at any time, object to such publication by deleting the published references or comments, through his or her user profile or by sending a request to the Data Controller. On the basis of this expression, the Operator will not publish these references and/or comments.
The Controller shall process the following Client PI, for the purposes, on the legal basis and for the duration of the processing as follows (Article 13(1)(c), (e) and (2)(e) of the GDPR; and § 19(1)(c), (e) and (2)(a) of the Act ):

List of personal data processed	Purpose of the processing of personal data (Article 5(1) of the GDPR and Article 7 of the Act )	Legal basis for the processing of personal data (Article 6(1) of the GDPR and Article 13(1) of the Act )	Legal/contractual requirement/requirement necessary for the conclusion of a contract/obligation of the data subject to provide personal data/possible consequences of not providing personal data (Article 6(1) of the GDPR and Article 13(1) of the Act )	Period of processing of personal data (Article 5(1)(e) of the GDPR and Section 10 of the Act )
Personal data relating to the purchase of goods, including registration in the e-shop, in particular: Identification data: title, name, surname, payment data Contact details: address of permanent/temporary residence or other correspondence address, telephone number, e-mail address	Identification of the contracting party to the contract. Compliance with the legal and contractual obligations of the Operator arising from generally binding legal regulations(in particular accounting regulations) and from the contract	The processing of personal data is necessary for the performance of a contract to which the data subject is a party or for the performance of a pre-contractual measure at the request of the data subject (Article 6(1)(b) of the GDPR Regulation and Article 13(1)(b) of the Act ) following special regulations or international treaties to which the Slovak Republic is bound (Article 6(1)(c) of the GDPR Regulation and Article 13(1)(c) of the Act )	The provision of personal data is a requirement that is necessary for the conclusion of a contract between the Data Subject and the Data Controller. Consequently, it is a contractual requirement in conjunction with the requirements arising from specific legislation. Failure to provide personal data will result in the impossibility of identifying the Data Subject and, therefore, the impossibility of concluding a contract establishing cooperation between the Data Subject and the Controller and the impossibility of fulfilling legal obligations.	For the duration of the cooperation and the legislation of the Slovak Republic.
Profile photo, cover photo stored in the user account	Personalisation of the registered user account and publication of the photo on the Operator’s website	The data subject’s consent to the processing of his or her personal data for at least one specific purpose (Article 6(1)(a) of the GDPR and Article 13(1)(a) of the Act )	Voluntary provision of data. Possible consequences of non-provision: failure to provide personal data will result in the Personal Data of the Data Subject not being used for the intended purpose	For the duration of the existence of the user account, or until the removal of the photos from the user account of the Concerned Person
Email address and name for the purpose of sending reminders about incomplete orders	Sending promotional offers in case of order incompletion	Legitimate interest of the Operator (Article 6(1)(f) of the GDPR Regulation and Article 13(1)(f) of the Act )	Legal authorization of the Controller The data subject may cancel the receipt of newsletters at any time	For a period of 7 days, or until the time of receipt of a request to cancel the newsletter
Title, name, surname, e-mail address for the purpose of sending the newsletter	Sending general advertising notices about the Operator’s products and information leaflets about the Operator’s activities to persons who have requested it on the Operator’s website	The data subject’s consent to the processing of his or her personal data for at least one specific purpose (Article 6(1)(a) of the GDPR and Article 13(1)(a) of the Act)	Voluntary disclosure. Failure to provide consent will result in commercial offers of products and services not being sent.	For a period of 3(three) years, or until the consent is withdrawn.
Title, name, surname, telephone number and e-mail address for the purpose of sending the newsletter	Sending advertising notices about the Operator’s products and information leaflets about the Operator’s activities to persons who have ordered goods	Legitimate interest of the Operator (Article 6(1)(f) of the GDPR Regulation and Article 13(1)(f) of the Act )	Legal authorization of the Controller The data subject may cancel the receipt of newsletters at any time	For a period of 3(three) years, or until the time of receipt of a request to cancel the newsletter
Personal data necessary for the organisation of the consumer competition, in particular title, name, surname, address and other data depending on the type of competition	Identification of the natural person who has participated in consumer competitions organized for the purpose of promotion and visibility of the Operator	The data subject’s consent to the processing of his or her personal data for at least one specific purpose (Article 6(1)(a) of the GDPR Regulation and Article 13(1)(a) of the Act )	Voluntary provision of data. Consent is granted by entering the competition/quiz. Possible consequences of non-provision: failure to provide personal data will result in the Data Subject’s Personal Data not being used for the intended purpose	For the duration of the competition and its evaluation, and in the case of the winner until the time of the prize handover
Title, name, surname, e-mail address in connection with the selected preferred product	Sending e-mail notifications about the availability of the selected product or about the discounted price of the selected product to registered persons(wishlist)	The legitimate interest of the controller to provide the Data Subject with the requested products (Article 6(1)(f) of the GDPR Regulation and Article 13(1)(f) of the Act )	Legal entitlement of the Controller. The data subject shall include the selected product in the wishlist himself. The data subject shall have the possibility to refuse such service.	For a period of 6 months from the date of inclusion of the selected product in the wishlist or until further notifications are refused.
Personal data obtained via the contact form: in particular the e-mail address and, where applicable, other Personal data provided in the text of the message sent	Personal data collected through the contact form for the purpose of storing the enquiry and drafting the response to the enquiry of the Data Subject	The data subject’s consent to the processing of his or her personal data for at least one specific purpose (Article 6(1)(a) of the GDPR Regulation and Article 13(1)(a) of the Act )	Voluntary provision of data. Possible consequences of non-provision: failure to provide personal data will result in the Personal Data of the Data Subject not being used for the intended purpose and the Data Controller may not provide the requested response to the query.	For the duration of the consent for which the data subject has given his/her consent(1 year)
Title, first name, last name, permanent/temporary residence address or other correspondence address e-mail address, telephone number, purchase details for the purposes of the loyalty program	Inclusion of the Data Subject in a loyalty program for the purpose of providing a discount or other benefit, and thereby making the Operator’s services more visible	The data subject’s consent to the processing of his or her personal data for at least one specific purpose (Article 6(1)(a) of the GDPR and Article 13(1)(a) of the Act )	Voluntary provision of data. Possible consequences of non-provision: failure to provide personal data will result in the Personal Data of the Data Subject not being used for the intended purpose	For the duration of the consent for which the data subject has given his or her consent(3 years from the date of the last benefit)
Title, first name, last name, profile photo and, where applicable, other Personal Data included in the text of published references or comments	Publication of references or comments of the Data Subject on the Operator’s website for the selected product	The legitimate interest of the controller in ascertaining the satisfaction of the Data Subject (Article 6(1)(f) of the GDPR Regulation and Article 13(1)(f) of the Act )	Legal authorization of the Controller. The data subject himself/herself publishes reviews of the purchased product or comments on the selected product. The data subject has the possibility to refuse such a service.	For as long as the selected product is on sale, up to a maximum of 10 years

Identification of the beneficiary or category of beneficiary, if any (Article 13(1)(e) of the GDPR Regulation and Article 19(1)(e) of the Act ):
1. external collaborator,
2. external data storage provider,
3. external provider of accounting and tax services,
4. external provider of warehousing, logistics and courier services,
5. external legal service provider,
6. external marketing service provider,
7. an external payment service provider.
Information on whether the Data Controller intends to transfer the personal data to a third country or international organisation, identification of the third country or international organisation (Article 13(1)(f) of the GDPR; and § 19(1)(f) of the Act ): The operator does not intend such a transfer.
The right of the Data Subject to request from the Data Controller access to the Personal Data concerning the Data Subject, the right to rectification of the Personal Data, the right to erasure of the Personal Data or the right to restriction of the processing of the Personal Data, the right to object to the processing of the Personal Data, as well as the right to portability of the Personal Data (Article 13(2)(b) of the GDPR Regulation and Article 19(2)(b) of the Act ): The data subject has the following rights in relation to the Controller in relation to the OU:
1. Right to request access to personal data relating to the Data Subject: the Data Subject has the right to obtain confirmation from the Data Controller as to whether the Data Subject’s personal data is being processed and, if so, the right to obtain access to that personal data and information about
- the purpose of the processing of personal data,
- the category of personal data processed,
- the identification of the recipient or the category of recipient to whom the personal data have been or are to be disclosed, in particular the recipient in the third country or international organisation, if applicable,
- the period of retention of the personal data; if this is not possible, information on the criteria for determining it,
- the right to require the controller to rectify, erase or restrict the processing of personal data relating to the data subject, or to object to the processing of personal data,
- the right to initiate proceedings pursuant to Section 100 of the Act or to lodge a complaint with the supervisory authority pursuant to Article 77 of the GDPR,
- the source of the personal data, unless the personal data were obtained from the data subject,
- the existence of automated individual decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and Article 28(1) and (4) of the Act (in these cases, the controller shall provide the data subject with information, in particular, on the procedure used, as well as on the significance and the envisaged consequences of such processing of personal data for the data subject).

The controller shall provide a copy of the OA being processed. For any additional copies requested by the Data Subject, the Controller may charge a reasonable fee corresponding to the administrative costs. Where the Data Subject has made a request by electronic means, the information shall be provided in a commonly used electronic form, unless the Data Subject has requested otherwise.

The information must be provided immediately and at the latest within 1 month. The controller shall have the right to extend the processing time for the request by a further 2 months if the request is complex or frequent. However, it must notify the Data Subject within 1 month of the reason for the extension of the processing period.

In the event of an unreasonable or excessive request, the Operator shall have the right to charge a fee proportionate to the cost or to refuse the request. It must explain the reason for the refusal and the right of the Data Subject to lodge a complaint with the supervisory authority.

Right to rectification of personal data: the data subject has the right to have incorrect personal data concerning him or her rectified by the Controller without undue delay. With regard to the purpose of the processing of the personal data, the Data Subject has the right to have incomplete personal data completed.The information must be provided immediately and at the latest within 1 month. The controller has the right to extend the processing time for the request by a further 2 months if the request is complex or frequent. However, it must notify the Data Subject within 1 month of the reason for the extension of the processing period.In the case of a request that is unjustified or too frequent, the Data Controller has the right to charge a fee proportionate to the cost or to refuse the request. It must explain the reason for the refusal and the right of the Data Subject to lodge a complaint with the supervisory authority.
Right to erasure of personal data or right to restriction of processing of personal data: the data subject has the right to have the Controller erase the personal data concerning him or her without undue delay. The Data Controller is obliged to erase the personal data without undue delay if the Data Subject has exercised the right to erasure pursuant to the preceding sentence, if

The PI is no longer needed for the purpose for which it was collected or otherwise processed,
The data subject withdraws his or her consent to the processing of personal data and there is no other legal basis for the processing of personal data
The data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing of personal data,
OUs are processed illegally,
the reason for deletion is the fulfilment of an obligation under the GDPR Regulation, the Act, a special regulation or an international treaty by which the Slovak Republic is bound, or
OUs were obtained in the context of offering information society services.

The preceding two sentences shall not apply if the processing of personal data is necessary

to exercise the right to freedom of expression or the right to information,
to fulfil an obligation under the GDPR Regulation, the Act, a special regulation or an international treaty to which the Slovak Republic is bound, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller,
for reasons of public interest in the field of public health,
for archiving purposes, scientific purposes, historical research purposes or statistical purposes where the law is likely to render impossible or seriously impede the achievement of the purposes of such processing, or
to assert a legal claim.

The data subject has the right to have the Controller restrict the processing of the Personal Data if

The data subject objects to the accuracy of the Personal Data during a period allowing the Data Controller to verify the accuracy of the Personal Data,
the processing of the Personal Data is unlawful and the Data Subject objects to the erasure of the Personal Data and requests instead that their use be restricted,
the controller no longer needs the PII for the purpose of processing the PII, but the Data Subject needs it to assert a legal claim, or
The Data Subject objects to the processing, pending verification whether the legitimate grounds on the part of the Controller outweigh the legitimate grounds of the Data Subject.

If the processing of personal data has been restricted, except for storage, the Data Controller may only process the Personal Data with the consent of the Data Subject or for the purpose of asserting a legal claim, for the protection of individuals or for reasons of public interest.

Right to object to the processing of personal data: if personal data is processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing of his or her personal data, including profiling. If the Data Subject objects to processing for direct marketing purposes, the Data Controller may no longer process his or her personal data for these purposes.
Right to portability of personal data: the data subject has the right to obtain the personal data concerning him or her which he or she has provided to the Data Controller in a structured, commonly used and machine-readable format and has the right to transfer such data to another controller. The right of portability shall not adversely affect the rights and freedoms of others. This right shall apply if:
- the processing is based on consent or contract; and
- the processing is carried out by automated means

The data controller has a time limit of 1 month for the transfer of data, which may be extended by 2 months if the transfer is complex. He must inform the Data Subject thereof and justify why the time limit has been extended. In the case of steps to transfer by the Data Controller, he must inform the Data Subject why he has not done so and of the Data Subject’s right to lodge a complaint with the supervisory authority.

The right of the Data Subject to withdraw consent to the processing of Personal Data at any time (Article 13(2)(c) of the GDPR Regulation and Article 19(2)(c) of the Act ): The data subject has the right to withdraw consent to the processing of personal data concerning him or her at any time. Withdrawal of consent shall not affect the lawfulness of the processing of Personal Data based on consent prior to its withdrawal. The data subject may withdraw consent in the same way as he or she gave consent.
The right of the Data Subject to file a petition under Section 100 of the Act or a complaint to the supervisory authority under Article 77 of the GDPR (Article 13(2)(d) of the GDPR Regulation and Article 19(2)(d) of the Act ): Without prejudice to any other administrative or judicial remedies, the Data Subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if he or she considers that the processing of personal data concerning him or her is in breach of the GDPR.The Data Subject shall have the right to bring an action for the initiation of data protection proceedings before the Data Protection Authority. The purpose of the procedure is to determine whether the rights of natural persons in the processing of their personal data have been violated or whether there has been a violation of the GDPR Regulation, the Act or a special regulation in the field of personal data protection, and, in the event of a finding of deficiencies, to impose, if reasonable and expedient, remedial measures or, where appropriate, a fine for a violation of the GDPR Regulation, the Act or a special regulation in the field of personal data protection.The petition for the initiation of the procedure must contain the following information

the name, surname, correspondence address and signature of the applicant,
identification of the person against whom the application is directed, stating his name, surname, permanent residence or name, registered office and identification number, if any,
the subject matter of the request, indicating the rights allegedly infringed by the processing of personal data,
evidence in support of the claims made in the application,
a copy of the document or other evidence proving the exercise of the right under the Act or a special regulation, if such right has been exercised by the Concerned Person, or a statement of the reasons worthy of special consideration for not exercising the right in question, if the application has been submitted by the Concerned Person.

A template for the initiation of the procedure will be published on the website of the Office for Personal Data Protection.

The existence of automated individual decision-making, including profiling (Article 13(2)(f) of the GDPR Regulation and Article 19(2)(f) of the Act ): The controller does not use automated individual decision-making or profiling.

Bratislava, 1 January 2021

Hemp Farm Trade s.r.o.

Igor Lúčanský, Managing Director