1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you have visited our website Kaufland.sk (hereinafter referred to as the “website”) and thank you for your interest. Below, we inform you about the processing of your personal data when using our website. Personal data includes all data that can personally identify you.

1.2 The entity responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is Natural Production s.r.o., Tolstého 5, 81106 Bratislava – Staré Mesto, Slovakia, Tel.: +421910411159, Email: kovacs@ecoheart.sk. The controller is a natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

2) Contacting Us

If you contact us (e.g., via the contact form or email), personal data will be collected. The specific data collected can be seen in the contact form. These data are stored and used solely for the purpose of responding to your request or contacting you and handling the associated technical processes. The legal basis for processing the data is our legitimate interest in responding to your request in accordance with Article 6(1)(f) GDPR. If your contact aims at concluding a contract, an additional legal basis for processing is Article 6(1)(b) GDPR. Your data will be deleted after the final processing of your inquiry, provided it can be inferred from the circumstances that the matter has been conclusively resolved and there are no legal retention obligations to the contrary.

3) Processing of Personal Data for Order Handling

3.1 If necessary for contract processing in terms of delivery and payment, the personal data collected by us will be transmitted to the assigned shipping company and the assigned financial institution in accordance with Article 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or digital products under the respective contract, we will process the contact details (name, address, email address) you provided when placing the order to personally inform you about upcoming updates within the legally required period. This is done in accordance with our legal obligation to inform you under Article 6(1)(c) GDPR via suitable communication means (e.g., mail or email). Your contact details will be used exclusively for the purpose of informing you about updates owed and will only be processed to the extent necessary for this purpose.

We also collaborate with the following service providers to process your order, who fully or partially assist us in fulfilling concluded contracts. Certain personal data will be shared with these service providers as detailed below.

3.2 Payment processing is carried out via cflox GmbH, Brunnenstraße 122, 22763 Hamburg, Germany, to whom we transmit the information you provided during the ordering process along with details about your order in accordance with Article 6(1)(b) GDPR. Cflox GmbH does not process payments itself through PayPal, Sofortüberweisung, and Klarna but transfers your required payment data to the selected payment service provider for payment processing in accordance with Article 6(1)(b) GDPR:

  • PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

  • SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany, as part of Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden)

  • Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden Your data will only be shared for the purpose of payment processing via Kaufland.sk and only to the extent necessary for this purpose. More information on Kaufland.sk’s privacy policies can be found at: https://www.kaufland.sk/ochrana-osobnych-udajov.html

4) Rights of the Data Subject

4.1 Applicable data protection laws grant you extensive rights as a data subject regarding the processing of your personal data, which we inform you about below:

  • Right to access (Article 15 GDPR)

  • Right to rectification (Article 16 GDPR)

  • Right to erasure (Article 17 GDPR)

  • Right to restriction of processing (Article 18 GDPR)

  • Right to notification (Article 19 GDPR)

  • Right to data portability (Article 20 GDPR)

  • Right to withdraw consent (Article 7(3) GDPR)

  • Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

4.2 Right to Object

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR LEGITIMATE INTEREST IN A BALANCED INTEREST CONSIDERATION, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH FUTURE EFFECT FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS OR IF PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES. YOU CAN LODGE AN OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE RELEVANT DATA FOR DIRECT MARKETING PURPOSES.

5) Duration of Personal Data Retention

The duration of personal data retention is determined based on the respective legal basis, processing purpose, and, where relevant, the applicable statutory retention period.

Personal data processed based on explicit consent under Article 6(1)(a) GDPR will be stored until the data subject withdraws their consent.

If statutory retention periods apply for personal data processed under contractual obligations in accordance with Article 6(1)(b) GDPR, these data will be routinely deleted after the retention periods expire, provided they are no longer required for contract fulfillment or initiation and no legitimate interest exists in continued storage.

For personal data processed under Article 6(1)(f) GDPR, they will be stored until the data subject exercises their right to object under Article 21(1) GDPR unless we demonstrate compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject or if processing serves the assertion, exercise, or defense of legal claims.

For personal data processed for direct marketing purposes under Article 6(1)(f) GDPR, they will be stored until the data subject exercises their right to object under Article 21(2) GDPR.

Unless otherwise specified in this privacy policy for specific processing situations, stored personal data will be deleted when they are no longer required for the purposes for which they were collected or otherwise processed.