Security personal data

Data Controller, Roksal d.o.o. (hereinafter referred to in this point: the Controller), undertakes to protect the personal data of users carefully and permanently in accordance with Personal Data Protection Act (ZVOP-2) and General Data Protection Regulation (GDPR).

Types of data processedA: The Controller stores and processes the following personal data of registered users of the online shop for the purposes of order fulfilment and other necessary communication:

• name and surname,
• email address,
• contact phone,
• primary and delivery addresses,
• country of residence,
• an archive of communications with the controller.

Purpose of the processing of personal dataA: We process users' personal data solely for:

• order fulfilment (sending quotes, invoices),
• sending communications relating to orders and services,
• keeping you informed of important changes to services and offers,
• processing complaints and returns

Users' personal data will not be passed on to unauthorised third parties, except where this is necessary for the performance of contractual obligations (e.g. installers, delivery service for sending orders) or where required by law.

Processing of personal data for the purpose of communication (mailing list):

If the individual gives his/her consent, we may use his/her personal data (e-mail address, first and last name) to send notifications about promotions, news and offers of Roksal d.o.o. The legal basis for the processing of this data is the explicit consent of the data subject, which may be withdrawn at any time. It is possible to unsubscribe at any time via a link in the message or by sending a request to info@roksal.com. We keep the data until the consent is withdrawn or for a maximum of 5 years from the last activity of the user.

Lawfulness of processingA: The processing of personal data is carried out on the basis of:

• the contract (contract),
• the legitimate interest of the controller (e.g. communicating with users, improving services),
• the individual's consent to the processing of personal data for certain purposes (e.g. to receive newsletters and promotional communications).

Retention of personal dataA: Personal data is kept for as long as necessary to achieve the purpose for which it was collected. After the contractual obligations have been fulfilled, the data will be retained for a further 5 years in accordance with the legal obligations regarding the retention of business records. Data processed on the basis of consent (e.g. for the purpose of sending promotional notifications) will be retained until the consent is withdrawn.

User rightsA: Users have the following rights under the GDPR in relation to their personal data:

• right of access to your personal data,
• right of rectification inaccurate data,
• right to erasure personal data (right to be forgotten), in the absence of a legal obligation to continue to retain them,
• right to restriction of processing,
• the right to data portability,
• right to object against processing on the basis of legitimate interest,
• the right to withdraw consent to the processing of personal data where this is based on consent.

Users may exercise their rights by contacting the controller at info@roksal.com or by sending a written request to info@roksal.com.

Security of personal dataA: The controller shall implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, loss or destruction. Personal data transmitted online (e.g. when submitting an enquiry form) is properly encrypted and protected using advanced security technologies (e.g. SSL certificates).

Processing by third partiesA: For the purposes of fulfilling orders and providing services, the Controller may cooperate with external service providers (e.g. delivery services, payment service providers) who process personal data solely within the scope of the Controller's mandate and in accordance with the GDPR.

User responsibility: It is the user's responsibility to ensure that their device is adequately protected (e.g. by anti-virus software).

Complaint about the protection of personal data (ZVOP-2)

The Provider processes personal data in accordance with applicable law, in particular General Data Protection Regulation (GDPR) and Personal Data Protection Act (ZVOP-2). The Customer has the right to lodge a complaint regarding the processing of personal data if he/she considers that his/her rights regarding the protection of personal data have been infringed.

Complaint procedure:
Complaints about the processing of personal data may be made in writing to info@roksal.com. The complaint must include:

• a description of the alleged infringement,
• information on which rights under the GDPR or ZVOP-2 are allegedly infringed,
• contact details for keeping you informed of the progress of the procedure.

Time limit for replying to a complaint:
The operator must acknowledge receipt of the complaint in five working days and inform the customer of the estimated time to resolve the complaint. The operator must deal with the complaint and reply to it within 30 days from receipt. If the case is complex, the time limit for processing may be extended by an additional two months, in which case the operator must inform the customer.

If the customer considers that the processing of personal data has not been adequately addressed, he or she may lodge a complaint with Information Commissioner.