Privacy policy

Pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR), the operator of this website provides the following information on how the personal data of customers and visitors (the “customer”) is processed.

1. Controller

The purposes and means of processing are determined by the controller: Šperky VIA, registered at Sama Chalupku 1227/1, 071 01 Michalovce, phone +421 949 515 940, e‑mail (the “controller”).

2. Data we process

Basic data: name and surname, home or delivery address; for a legal entity the company name, registered office, company ID and VAT ID.
Contact data: e‑mail, phone number.
Booking data: visit type, chosen date and time, your note, records of communication about the booking.
Orders and account: ordered products, order history, billing data, transaction data (payment and payment‑method information – card numbers are never stored by the controller), customer account login, products you showed interest in.
Service usage: newsletter subscription, participation in contests run on the site, purchase reviews.
Marketing data (consent only): day and month of birth, jubilee or anniversary.

3. Purposes and legal basis

Handling your booking (receipt, confirmation, change, reminder, communication) – performance of a contract or pre‑contractual steps, Art. 6(1)(b) GDPR. Name and phone are required to process a booking.
Purchases in the e‑shop (receiving and processing the order, invoicing, recording the payment, delivery to the given address, running your customer account) – performance of a purchase contract, Art. 6(1)(b) GDPR. A natural person provides name, address incl. postcode, phone and e‑mail; a legal entity its company name, registered office, company ID, VAT ID, phone and e‑mail. Without them an order cannot be processed.
Legal obligations (accounting, complaints, records management) – Art. 6(1)(c) GDPR.
Direct marketing to existing customers (news, discounts and offers by e‑mail after goods were delivered or a service provided) – legitimate interest, Art. 6(1)(f) GDPR; you may object at any time.
Newsletter and marketing communication to people who are not yet customers, contests, anniversary greetings – consent, Art. 6(1)(a) GDPR, voluntary and revocable at any time (link in every e‑mail or via the contacts below).
Protecting forms from abuse (bot check), establishing and defending legal claims, out‑of‑court debt recovery – legitimate interest, Art. 6(1)(f) GDPR.
Purchase reviews (feedback after an order) – consent, Art. 6(1)(a) GDPR.
Analytics cookies – consent, see the Cookie policy.

4. Recipients

Data may be disclosed to these categories of recipients: hosting, e‑mail and IT providers, the newsletter tool provider, payment service providers (payment gateways), accountants, auditors and tax advisers, law firms, transport and courier companies, law enforcement authorities and courts, bailiffs. All processors are bound by data processing agreements. We do not transfer data outside the EU/EEA unless a processor’s tool requires it with the safeguards of Chapter V GDPR. No automated individual decision‑making or profiling with legal effects takes place.

5. Retention

Contract: for the duration of the contractual relationship (booking or order) and the warranty and complaint period; booking data without a purchase 12 months after the appointment. Customer account until it is closed.
Consent: until withdrawn, at most 3 years from granting.
Legal obligation: as required by Slovak law (accounting and tax records up to 10 years).
Legitimate interest: until you object, at most 3 years after the last service.

6. Your rights

right to review and change your data in the customer account at any time, or to close the account,
right of access and to a copy of the data, including purpose, recipients and retention (further copies may incur a fee covering administrative costs),
right to rectification,
right to erasure once the purpose ends, consent is withdrawn or processing is unlawful,
right to restriction of processing,
right to object to processing based on legitimate interest, including direct marketing – we then stop processing for that purpose,
right to data portability,
right to withdraw consent without affecting the lawfulness of prior processing,
right not to be subject to automated individual decision‑making,
right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, phone +421 2 3231 3220, dataprotection.gov.sk.

7. Exercising your rights

Contact us by phone at +421 949 515 940, in writing at Sama Chalupku 1227/1, 071 01 Michalovce or by e‑mail at . We reply within 30 days; for complex or numerous requests this may be extended by a further 60 days, of which you will be informed with reasons. Manifestly unfounded or repetitive requests may incur a reasonable administrative fee. A person without full legal capacity is represented by their legal guardian.

8. Final provisions

The controller collects personal data solely for the purposes stated here, processes it in line with the principles of Art. 5 GDPR and does not combine it with data collected for other purposes. By sending a booking or an order you confirm you have read this information. This document may be updated; the current version is always published on the site.