Privacy policy

In accordance with § 19 of Act no. 18/2018 Coll. on the protection of personal regulations as amended (hereinafter referred to as the "Personal Data Protection Act") and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons in the processing of personal data and on the free movement of such data , which repeals Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "GDPR Regulation"), the operator of the online store www.silhouette.eu informs the users of the website www.silhouette.eu about the processing of their personal data.

1. Identification data of the controllor

TOMSTRA, S. r. o., with registered office Rozkvet 2045/90, 017 01 Považská Bystrica, Slovak Republic, ID: 53 963 156, registered in the Commercial Register of the Trenčín District Court, section Sro, insert no. 42212/R, which is the operator of the online store www.silhouette.eu (hereinafter referred to as "online store" or "E-shop"). 

Postal address: TOMSTRA, s. r. o., with registered office Rozkvet 2045/90, 017 01 Považská Bystrica, Slovenská republic 

E-mail: info@silhouette.eu 

Tel./Mob.: +421 902 152 463

2. Categories of data subjects and scope of processed personal data 

The affected person is understood as any natural person - user of the www.silhouette.eu online store, whose personal data is processed when using the www.silhouette.eu website, when ordering goods from the online store www.silhouette.eu. 

The controllor processes the personal data of the affected persons in its information systems to the extent necessary to achieve the purpose of processing personal data. This is the scope of personal data established by special legal regulations or to the extent of the consent of the person concerned for the processing of his personal data. The controlor only processes personal data that was provided voluntarily and to the extent necessary by the person concerned. 

3. Legal basis and purpose of personal data processing 

The legal basis for processing the personal data of the persons concerned is:
1. fulfillment of the contract between the affected person and the controllor according to Article 6, paragraph 1 letter b) of the GDPR regulation 

The processing of the personal data of the person concerned is necessary for the performance of a purchase contract, which would not be possible to conclude and properly fulfill with the person concerned without providing personal data. In connection with the performance of the contract, the operator processes the following personal data: name, surname, address of permanent residence, address for delivery of goods, telephone, e-mail, bank account number and records of mutual communication between the operator and the data subject through e-mail, phone or in writing.

1. performance of the contract between the affected person and the controlor according to Article 6, paragraph 1 letter b) of the GDPR regulations. The processing of the personal data of the person concerned is necessary for the fulfillment of the purchase contract, which would it was not possible to conclude and properly fulfill the contract with the person concerned without providing personal data. IN 1 in connection with the performance of the contract, the operator processes the following personal data: name, surname, address of permanent residence, address for delivery of goods, telephone, e-mail, bank account number and records of mutual communication between the operator and the data subject through e-mail, phone or in writing. 

2. consent of the person concerned to the processing of personal data for the purposes of processing direct marketing according to article 6 par. 1 letter a) of the GDPR regulation.

When filling out the order form for products from the e-shop www.silhouetter.eu, the person concerned has the option to click the "I want to receive newsletters and special offers " box. By clicking this box, the person concerned expresses explicit consent to the processing of personal data data for marketing purposes, including name, surname and e-mail. The person concerned has the right to withdraw consent at any time using the form available at the bottom of this pages. Withdrawal of consent does not affect the lawfulness of processing based on consent before his appeal. 

The controllor processes the personal data of the persons concerned for the purpose of: 

-fulfillment of rights and obligations resulting from the contractual relationship between the person concerned and by the controllor, in particular the creation, sending and processing of the order, records orders by the operator, transport and delivery of goods, invoicing and payment of the purchase price, handling possible complaints, 

-promotion of services, marketing offers, sending information about services and news, newsletter. 

4. Conditions and method of personal data processing 

When processing personal data, the controllor observes the principle of legality, purpose limitation, minimizing scope and retention, accuracy, integrity, confidentiality and liability. The operator will not process the personal data of the affected persons without their express consent or other statutory legal basis for another purpose, even to a greater extent than is necessary. 

Due to the scope and subject of its activity, the controller has no obligation to appoint the persons data protection officer. 

The controller processes the personal data of the affected persons in its information systems by means of computer technology as well as in the form of documents created manually or by using I.T. technology. 

The operator does not publish processed personal data, except in cases where it is specifically required by legal regulation or decision of a court or other state authority. In relation to personal data of the persons concerned, the controller does not perform automated individual decision-making, including profiling. The controller does not intend to provide the personal data of the affected persons to the third country or international organization.

5. Period of storage of personal data 

The personal data of the persons concerned are processed in a form that enables the identification of individuals of the persons concerned for a period not longer than is necessary to achieve the purpose of the processing. Time limit retention of personal data of the persons concerned is generally 10 years, but its duration is taking into account the purpose of the processing may differ (e.g. the period of 3 years from the granting of the consent of the concerned persons for the purpose of direct marketing). After the expiration of the personal data retention period the operator will delete the personal data of the affected persons. 

6. Recipients of personal data 

The controllor cooperates with several intermediaries (courier and transport companies, providers of web hosting and cloud services, external accounting firms), while the aim of this cooperation is the proper fulfillment of rights and obligations arising from the contractual relationship between the concerned person and controllor as well as improving the quality of services provided on the online store operator. Intermediaries process personal data during their activities for the controllor of the persons concerned, only to the extent, under the conditions and for the purpose agreed in the contract and in the manner according to of the GDPR and the Personal Data Protection Act. The controllor, when choosing a suitable one the intermediary proceeds acts in such a way as not to jeopardize the rights  of personal data protection protected by law and pays attention to professional, technical, organizational and personnel competence of intermediary. The contractor has entered into an agreement with each intermediary within the meaning of the Protection Act personal data agreement on ensuring the protection of personal data processed by the intermediary. 

7. Rights of affected persons 

The person concerned is entitled to exercise the following rights regarding his personal data: 

-the right to request access to your personal data from the controllor, 

-the right to correct incorrect personal data, 

-the right to delete her personal data, -

the right to limit the processing of personal data, 

-withdraw consent to the processing of personal data for direct marketing purposes at any time, 

-the right to portability of personal data, 

-the right to object to the processing of personal data, 

-the right to submit a proposal to initiate a procedure on personal data protection to the Office for Personal Data Protection data of the Slovak Republic (more information at: Proceedings on the protection of personal data | Office at protection of personal data of the Slovak Republic (gov.sk)). To exercise individual rights, the affected person can use the forms prepared operators, which are available below. This privacy policy becomes valid and effective as of 15.10.2023.