Privacy Policy

 

 

Privacy Policy

We, DUŠNÍ 3 Concept, s.r.o., with its registered office at Václavské náměstí 2132/47, Nové Město, 110 00 Prague 1, Company ID No. 247 94 333, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 174822 (hereinafter referred to as the “Company” or “we”), as the data controller, hereby inform you, our customers, visitors to this website, business partners and, where applicable, their representatives or other contact persons (collectively also “you”), in particular of the following:

1. what personal data we process about you in the course of our activities;
2. for what purposes and for how long we process your personal data;
3. to whom and why we disclose your personal data;
4. where we have obtained your personal data; and
5. what rights you have in relation to the processing of your personal data.

We have issued and published this policy in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (hereinafter the “GDPR”), in order to fulfil our duty to provide information as the controller of your personal data pursuant to Articles 13 and 14 of the GDPR. If you have any questions regarding this policy, please do not hesitate to contact us, for example via the email addresses obchod@voix.cz.

1. WHAT CATEGORIES OF YOUR PERSONAL DATA DO WE PROCESS

In order to provide our services to you properly, we process the following categories of personal data about you; however, we only ever process the personal data that is necessary for a specific purpose.

1. BASIC PERSONAL IDENTIFICATION DATA

This category primarily includes data necessary for the conclusion and performance of the contract between us and you.

• For natural persons, we process in particular:
• first name and surname
• permanent address and/or residential address
• For legal entities, we process in particular:
• Company registration number, VAT number
• the role of the natural person acting on behalf of the legal entity
• registered office or place of business
• billing address
• For both categories, we process in particular:
• the identification details of your representative or the contact person you designate
• and other personal data that may be collected for the purpose of providing services

2. CONTACT DETAILS

This category includes data we use to communicate with you:

• contact telephone number
• contact email address

 

3. ORDER, PAYMENT AND DELIVERY DETAILS

This category includes data relating to your purchases in our online shop or in-store:

• type and specifications of the goods ordered
• details regarding the status and progress of the order
• chosen delivery method and delivery address
• chosen payment method
• bank account number (only in the case of payment by bank transfer or instant bank payment)
• issued tax documents, advance invoices, credit notes, delivery notes, etc.

Your payment card details are held only by the secure payment gateway we use and the relevant banking institution. We only have access to a token/incomplete data enabling us to match the payment. If you have saved your payment card to speed up future purchases on our e-shop, we only have incomplete details of your payment card (the first few and last few digits of the payment card linked to your user account).

4. CUSTOMER ACCOUNT DATA

If you create a customer account with us, in addition to the data mentioned above, we will also process:

• login details (email and password in encrypted form)
• history of orders, payments and tax documents
• advance invoices, credit notes and delivery notes
• documents relating to payments received
• applied discounts and discount terms
• reviews and discussion posts for individual products

5. DATA STORED IN CONNECTION WITH THE OPERATION OF THE WEBSITE

This category includes data processed in connection with the use of our website:

• data on website activity (cookies)
• IP address and other technical data about the device from which the website is viewed
• data obtained from analytical tools (e.g. Google Ads or Google Analytics)

You can find more information in the section ‘8 ’ of this privacy policy.

6. DATE OF BIRTH

Filling in the “Date of birth” field is optional. If you fill in this field, the information provided will be used solely for the purpose of sending birthday greetings.

7. IDENTITY VERIFICATION

For certain services (e.g. purchase on instalments), you may be asked to provide additional personal data (e.g. a copy of your ID card), which we or the external financing provider use to verify your identity (whether the verification takes place in person at the shop or remotely). Any verification of your ability to repay the goods is carried out by the external financing provider.

8. CCTV RECORDINGS

We operate a CCTV system in our premises, which captures video footage of you when you visit the shop.

We operate the CCTV system for the purposes of protecting property, ensuring personal safety and preventing damage; the legal basis is our legitimate interest. We retain the recordings for a period of 72 hours, unless longer retention is necessary to resolve an incident. Monitored areas are marked with information signs; we will provide detailed information on request. Only authorised persons have access to the recordings.

9. AI CHATBOT RECORDS

We operate an AI chatbot on our e-shop, through which records of your queries and conversations may be created. These records are processed for the purpose of ensuring the chatbot’s functionality and improving the quality of the responses provided.

You can read more in the Article 7 of this personal data processing policy.

10. PRODUCT REVIEWS AND DISCUSSIONS

We allow registered users of the e-shop to post reviews and discussion comments on products; in this context, personal data contained in the text of the review or discussion comment itself is processed.

11. MARKETING COMPETITIONS

If we organise a marketing competition, whether in person or via social media, the winner may be photographed and their image, including their name, published, primarily to increase the transparency of our marketing competitions.

12. PERSONAL DATA OF THIRD PARTIES

In your user account, you can designate authorised persons who are authorised to act on your behalf – for example, to collect goods or make a complaint about them. In doing so, you will also be providing us with their personal data.

13. STATISTICAL SATISFACTION SURVEY

Based on our legitimate interest, we conduct statistical satisfaction surveys to continuously improve the quality of our online shop. These surveys are carried out directly via the website interface, where you can express your experience of using the online shop by simply selecting rating options, such as smileys. As part of this process, data necessary for the technical implementation and validation of the survey is processed, in particular your IP address, and if you are logged into your user account, the rating may also be linked to your purchase history. All information obtained in this way is subsequently processed in aggregated form for internal analytical purposes.

14. OTHER DATA ARISING IN CONNECTION WITH OUR ACTIVITIES

We may occasionally receive and process other types of personal data from you that are related to the specific nature of the service provided, but these cannot be defined in advance. In these specific cases, we will inform you individually to the extent set out in Articles 13 and 14 of the GDPR.

2. FOR WHAT PURPOSES AND ON WHAT LEGAL BASIS DO WE PROCESS YOUR PERSONAL DATA

For every instance of processing your personal data, we have a valid legal basis (title) that complies with the requirements of the GDPR, which authorises us to process your personal data. We always process personal data only to the extent necessary for a specific purpose, which may be:

1. PROCESSING TO FULFIL OUR LEGAL AND CONTRACTUAL OBLIGATIONS

If you are interested in our services or goods, you must provide us with your personal data. Without the provision and processing of personal data for these purposes, we would be unable to provide our services to you at all. We do not require your consent to process personal data for these purposes, nor can we comply with your request to have them deleted.

This relates in particular to the following specific processing purposes:

• processes related to your identification and contact for the purposes of concluding and fulfilling contracts (e.g. concluding a service contract, concluding a sales contract);
• for the purpose of sending an email notification regarding the availability of goods or the attainment of a price you have set for goods (we only send notifications regarding the availability of goods or price monitoring if you actively request this feature);
• to conclude a contract;
• performance of the contract and record-keeping;
• customer care for the purpose of resolving customer requests/suggestions/complaints;
• to verify identity when arranging hire purchase through third parties providing external financing for the purchase of goods;
• fulfilling our statutory accounting and tax obligations; and
• fulfilling our obligations under criminal law, including, for example, those relating to measures against money laundering and terrorist financing.

We process personal data for the above-mentioned purposes only to the extent strictly necessary to fulfil specific obligations and for the period specified by law or necessary to fulfil the relevant contractual obligation.

2. PROCESSING BASED ON OUR LEGITIMATE INTEREST

We also process personal data where necessary to protect our legitimate interests. Before commencing such processing, we always carefully consider whether our legitimate interest outweighs your rights and freedoms. We do not require your consent for this processing; however, you may contact us at any time to object to the processing of your personal data.

This applies in particular to the following specific purposes of processing:

• direct marketing, i.e. sending information (commercial communications) to our existing customers in connection with our service offerings; it is always clear from such commercial communications that they originate from us, and we may only send them to you until you object by unsubscribing from commercial communications;
• collection of basic network identifiers of website visitors for the purposes of technical administration of our website and diagnosis of technical faults on the website;
• sending requests to complete evaluations of goods and the purchasing process;
• monitoring of premises via a CCTV system;
• enforcing our legitimate claims against our debtors and all related legal and other actions;
• in justified cases, securing evidence in the event that we need to defend our rights.

3. PROCESSING CARRIED OUT WITH YOUR CONSENT

We may only process some of your personal data with your consent. Processing this data helps us to provide you with better services, but we will not do so without your consent. You may withdraw this consent at any time – for example, by sending a letter to our registered office or by email toobchod@voix.cz . If you do so, we will delete or anonymise your data (unless we need to continue processing it to fulfil our legal or contractual obligations or to protect our legitimate interests). However, the withdrawal of your consent does not affect the lawfulness of the processing carried out prior to the withdrawal of your consent.

With your consent, we process your data primarily for the following purposes:

• to respond to your enquiry sent via the website or the ‘Enquiry to the seller’ form;
• to display comments and reviews posted by a logged-in user in the ‘Discussion’ and ‘Reviews’ sections;
• sending commercial communications by email on the basis of explicit consent, not on the basis of the Company’s legitimate interest. You can easily unsubscribe from these commercial communications by following the instructions provided therein;
• processing of cookies from our website – if you have cookies enabled in your web browser and consent to their use on our website, we process records of your behaviour from cookies placed on our website for the purposes of ensuring better website operation and for other purposes described in the Article 8 of this personal data processing policy; You can prevent the processing of data from cookies at any time by adjusting your web browser settings.

3. How long we process your personal data

We always process your personal data only for as long as is strictly necessary, namely:

• if we provide you with services or sell goods to you, we process your basic personal, identification and contact details in our customer database, data on services and data from your communication with us for the entire duration of the contractual relationship and also for the duration of the limitation period, i.e. generally for a period of 3 years plus 1 year from the date of termination of the relevant legal relationship, i.e. 4 years from the termination of such legal relationship;
• if you create a customer account, do not actively use it to order further goods or services for more than 2 years, and do not log back into your customer account despite repeated reminders, your customer account will be deleted after3 years of inactivity;
• if you subscribe to our newsletter, generally for 3 years, or until you withdraw your consent;
• if you use the AI chatbot, we process conversation logs for 2 months;
• we process CCTV recordings for 72 hours;
• if you have been in negotiations with us regarding the conclusion of a contract but the contract was not ultimately concluded, we will process your personal data for a further 3 years from the end of the negotiations with you so that we may potentially establish further cooperation;
• we retain personal data that we process on the basis of your consent (in particular for marketing purposes) for a period of 3 years or until such consent is withdrawn;
• We process your personal data relating to any outstanding debts until our legitimate claim expires or becomes time-barred;
• the Company is obliged to process and retain personal data necessary for the proper provision of services or for the fulfilment of all obligations – whether such obligations arise from the contract between the Company and you as a customer or from generally binding legal regulations – regardless of consent granted, for the period specified by the relevant legal regulations or in accordance with them (e.g. we archive issued and received tax documents (invoices) in accordance with Section 35 of Act No. 235/2004 Coll., on Value Added Tax, as amended, for a period of 10 years from their date of issue; due to the need to provide public authorities with legal justification for the issue of such invoices, we also archive the relevant contracts and other documents relevant to tax assessment for a period of 10 years from the date of termination);
• We process your identification data from your identity document in accordance with Section 16 of Act No. 253/2008 Coll., on certain measures against the legalisation of proceeds from criminal activity and the financing of terrorism, as amended, for a period of 10 years from the date of termination of the business relationship with you;
• The retention period for your basic network identifiers and cookies can be found in the Article 8 of this privacy policy or in the information in the cookie banner.

4. To whom we disclose your personal data

In fulfilling our contractual and legal obligations, in protecting our legitimate interests, and in other activities related to the processing of your data, we regularly use the professional services of other parties – our suppliers.

These third parties primarily act as processors of your personal data. Depending on the circumstances, the following categories of processors may be involved in the processing of your data:

• courier companies (e.g. Česká pošta, Zásilkovna, PPL, DPD, Toptrans);
• payment institutions (e.g. GoPay, ComGate, PayPal) – our Company does not hold details of the payment cards you use to pay us – your card details are held solely by the secure payment gateway and the relevant payment institution;
• providers of external financing via instalment plans;
• Purchase reviews (Heureka Verified by Customers / Zboží.cz): We only pass on the necessary contact and transaction details for the purpose of sending out questionnaires and evaluating reviews. Heureka/Zboží.cz typically act as processors; we always allow you to opt out of receiving the questionnaire either during the ordering process or afterwards. When sending purchase review questionnaires, your data (email address, information about purchased goods/services) may be shared with the operator of the Heureka.cz portal (Heureka Group a.s.) or Zboží.cz (Seznam.cz, a.s.);
• the e-shop solution provider (Shoptet);
• leasing and credit companies (in the case of external financing via an instalment plan);
• providers of legal and other services;
• state supervisory authorities;
• independent external consultants bound by confidentiality;
• marketing and analytics companies, e.g. for sending commercial communications (e.g. EcoMail, MailChimp or Smartemailing) and processing data for the purpose of improving our website (e.g. Google Analytics, Google Tag Manager, Sklik.cz or Google Ads);
• suppliers providing us with accounting and tax services;
• suppliers and administrators of IT systems and IT services.

We transfer your personal data to these processors to the extent necessary for the purposes set out above. Processors are not authorised to use personal data for their own purposes or contrary to our instructions, unless they are themselves controllers of personal data.

We carefully select each processor to ensure that your personal data is safe with them. We also have a data processing agreement in place with each processor to whom we transfer personal data; in accordance with the GDPR, this agreement sets out a number of obligations and safeguards for the processor to ensure the proper processing of your personal data. In the event that even our processor is unable to ensure processing for the given purpose on its own and must therefore transfer your data to another processor, our processors are obliged to ensure the same level of protection for your personal data. We will provide you with a list of third parties acting as processors of your personal data upon request.

Personal data is processed on our behalf by entities based both in the Czech Republic and in other Member States of the European Union. At present, your personal data is not transferred outside the territory of the Member States of the European Union, with the exception of third-party services, where data may be processed outside the European Union. Should the scope of the transfer of personal data outside the European Union change significantly in the future, we will inform you in good time.

Where the use of certain partners’ services (e.g. analytics or advertising providers) involves the transfer of personal data outside the EEA, we ensure appropriate safeguards in accordance with Article 46 of the GDPR

We also transfer your personal data to public authorities, but only where we are required to do so by law.

Please note that you may also learn about the Company’s services through third-party services; in such cases, you are subject to the privacy policies of those third-party services (in accordance with the relevant provisions), including, among others:

Meta Privacy Policy https://www.facebook.com/privacy/policy/

Instagram Data Policy https://about.instagram.com/data-policy

TikTok Privacy Policy https://www.tiktok.com/legal/page/us/privacy-policy/en

Google Privacy Policy https://policies.google.com/privacy

5. How your personal data is secured

The Company is obliged to ensure, through technical and organisational measures, the protection of the personal data it processes so as to prevent unauthorised or accidental access to the data, its alteration, destruction or loss, unauthorised transfers, other unauthorised processing, and any other misuse.

The Company will take technical and organisational measures commensurate with the level of risk. The protection of personal data is subject to the Company’s internal security regulations. Access to personal data will be restricted to authorised persons within the Company or to the persons specified in Article 4 above.

6. Where we obtained your personal data

Most of the personal data we process comes directly from you – that is, from data subjects within the meaning of the GDPR.

In some cases, we also obtain your personal data for processing purposes from publicly available sources or verify it in these sources; these are primarily the following public sources and your personal data contained therein:

• public registers and collections of documents pursuant to Act No. 304/2013 Coll., on public registers of legal and natural persons, as amended;
• the insolvency register pursuant to Act No. 182/2006 Coll., on Insolvency and Methods of its Resolution (the Insolvency Act), as amended;
• the Trade Register pursuant to Act No. 455/1991 Coll., on Trade Licensing (the Trade Licensing Act), as amended;
• the register and list of documents relating to the matrimonial property regime and the register of pledges pursuant to Act No. 358/1992 Coll., on Notaries and their Activities (Notarial Code), as amended;
• the central register of enforcement proceedings pursuant to Act No. 120/2001 Coll., on Court Bailiffs and Enforcement Activities (Enforcement Code), as amended.

7. Special procedures for the processing of your personal data

As part of our e-shop operations, we use an AI chatbot provided by AI Studio s. r. o. (Selzee). We process enquiries and conversation logs for the purpose of ensuring the technical operation of the service, improving responses and resolving customer enquiries. The legal basis is our legitimate interest (providing customer support). No decisions with legal effects are made without human assessment (we do not carry out automated individual decision-making pursuant to Article 22 of the GDPR). Queries are retained for a period of 2 months from the moment you end the conversation with the AI chatbot.

If you use financing through Home Credit a.s., this provider is generally a separate controller for the purposes of verifying your identity, assessing creditworthiness and fulfilling legal obligations (e.g. AML). Copies of identity documents are typically taken by the financing provider; we only take copies where we are required to do so by law or with your consent.

8. Cookies

This website uses cookies to improve your user experience, analyse website traffic and personalise content and advertisements. Cookies are small text files stored in your browser when you visit a website, which allow the website to remember your actions and preferences for a certain period of time.

We use four types of cookies:

• essential cookies, which are necessary for the website to function properly and cannot be disabled;
• functional cookies, which enable us to provide enhanced features and personalisation based on your preferences;
• analytical cookies, which help us track and analyse user behaviour anonymously for the purpose of optimising the website; and
• marketing cookies, which are used to display adverts tailored to your interests.

On your first visit, you will see a cookie notice (the „cookie bar“), where you can choose which categories you wish to allow; essential cookies are stored automatically regardless of your consent, whilst functional, analytical and marketing cookies are stored only with your explicit consent.

You can change your preferences at any time in your browser settings; most browsers allow you to manage or block cookies, but please note that blocking certain types of cookies may affect the functionality of this website.

9. Your rights in relation to the processing of personal data

You have a number of rights in relation to the processing of your personal data. You may send your requests in this regard, for example, to our registered office address or electronically to the email addressobchod@voix.cz . Please note that we reserve the right to reasonably request proof of your identity in connection with these rights – we must always be certain that, when providing you with information about personal data, the data relates solely and exclusively to you.

1. Right of access to your personal data

Under Article 15 of the GDPR, you have the right of access to your personal data, i.e. the right to:

• obtain confirmation from us as to whether we are processing your personal data;
• to obtain from us information regarding (i) the purposes of the processing, (ii) the categories of your personal data concerned, (iii) the recipients to whom your personal data has been or will be disclosed, (iv) the envisaged period for which your personal data will be stored, (v) the existence of the right to request from us the rectification or erasure of personal data concerning you or the restriction of its processing, or to object to such processing, and the right to lodge a complaint with the supervisory authority (the Office for Personal Data Protection), all available information regarding the source of your personal data, the fact that automated decision-making, including profiling, takes place, and the appropriate safeguards in the event of data being transferred outside the European Union;
• to obtain from us, free of charge, a single copy of your personal data, provided that this does not adversely affect the rights and freedoms of others.

In the event that exercising your right to obtain a copy of your personal data could adversely affect the rights and freedoms of third parties in relation to certain categories of personal data, we will generally not be able to comply with your request in respect of those categories of data.

2. Right to rectification of inaccurate or incomplete data

Under Article 16 of the GDPR, you have the right to have inaccurate personal data rectified and to have incomplete personal data concerning you completed. Subject to the technical possibilities available, we will carry out the rectification without undue delay after you have notified us of the inaccuracy or incompleteness.

3. Right to erasure (right to be forgotten)

Under Article 17 of the GDPR, you have the right to request that we erase your personal data. We have established regular procedures to ensure the anonymisation or erasure of personal data in cases where it is no longer necessary for the purpose for which it was processed. If, however, you believe that we have not erased some of your personal data in a timely manner, you may request its erasure. You may do so in particular if you withdraw your consent to processing and this consent was our sole legal basis for processing the data. We will not be obliged to comply with requests for data erasure if we have a legitimate reason (e.g. a basis other than your consent) for further processing that is compatible with the GDPR.

4. Right to restriction of processing

Under Article 18 of the GDPR, you have the right to request that we restrict the processing of your personal data if you contest its accuracy, the lawfulness of the grounds on which we are processing the data, or if you object to the processing of the data.

5. Right to information about recipients of personal data

Under Article 19 of the GDPR, we are obliged, in the event of rectification, erasure or restriction of the processing of your personal data, to also notify all recipients of your personal data – that is, all persons to whom we have disclosed your personal data. In this regard, you have the right to request information from us regarding these recipients.

6. Right to data portability

Under Article 20 of the GDPR, you have the right to request from us the personal data you have provided to us in connection with a contract or on the basis of your consent, and which is processed by automated means. We will then provide you with the data in a structured, commonly used and machine-readable format. You also have the right to request that we transfer this data to another controller. We will not be able to comply with this request if the exercise of your right could adversely affect the rights and freedoms of third parties.

7. Right to object to the processing of personal data

Under Article 21 of the GDPR, you have the right to object to the processing of your personal data carried out on the basis of our legitimate interest. Unless we demonstrate that we have a compelling legitimate ground for processing your personal data which overrides your rights and freedoms, we will cease processing your data without undue delay.

8. Right not to be subject to a decision based solely on automated processing

Under Article 22 of the GDPR, you have the right not to be subject to any decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In this regard, we wish to inform you that we do not carry out any automated decision-making without human intervention that produces legal effects or similarly significant consequences for you. If you nevertheless believe that we are processing your personal data in this way, please inform us.

9. Right to lodge a complaint with the Office for Personal Data Protection

If you believe that our processing of your data has breached the GDPR, you have the right to lodge a complaint with the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7 (https://uoou.gov.cz/).

10. Right to withdraw your consent to the processing of personal data at any time

You have the right to withdraw your consent at any time if the processing of your personal data is based on that consent.