Information about the processing of personal data

1. Identification of the controller and the person responsible

The controller of the personal data is the company NAY as, with registered office at Tuhovská 15, 830 06 Bratislava, company ID 35 739 487, registered in the Commercial Register of the City Court of Bratislava, section III Sa, file number 1640/B (hereinafter referred to as “NAY as”), which processes personal data in accordance with the following conditions. NAY as has appointed Tomáš Skladaný as its responsible representative, email address gdpr@nay.sk or telephone number 02 44 555 444 (contact call center).

2. Processing of personal data for individual purposes:

and. Purchases through the e-shop, delivery of goods, handling of complaints and settlement of insurance claims

NAY (i) processes the following personal data of the customer for the purchase and delivery of goods through the e-shop: name, surname, telephone number, e-mail address, address, data on the purchased goods and data related to the payment of the goods (account number, amount paid, date of crediting the payment to NAY’s account); (ii) for the handling of complaints, in addition to the data specified in point (i), data on the goods complained about and the data provided by the customer when submitting a complaint; (iii) for the settlement of insurance claims, in addition to the data specified in point (i), data on the insured goods and the data provided by the customer when reporting an insurance claim.

The legal basis for the processing of personal data is (i) in the case of purchases through the e-shop, delivery of goods to the customer and settlement of insurance claims, i.e. Article 6 (1) (a) GDPR. Article 1(b) of the Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR Regulation”), and (ii) in the case of complaints, Article 6(1)(a) c) of the GDPR Regulation.

NAY processes personal data (i) where it is necessary for the performance of the contract for the purchase of goods or, in the case of goods purchased through the e-shop, for the delivery of the goods to the customer and for the settlement of insurance claims under an insurance agreement; and (ii) in the case of claims for compliance with a legal obligation to which NAY is subject.

The recipients of personal data are as follows:

The operator of the website naysk12110@gmail.com,

HP TRONIC Zlín, s.r. Company ID: 499 73 053 (hereinafter referred to as “Affiliates”)

Service providers for the distribution of analytical and marketing information,

Payment service providers and payment intermediaries to ensure the transfer of funds,

Couriers or transport companies that ensure the delivery of goods to the customer as another operator or intermediary,

Contractual partners that provide IT systems and delivery route planning systems,

Service partners, suppliers, insurance companies, external legal representatives, other institutions in consumer litigation, transport companies that handle complaints and insurance claims as operators or intermediaries,

Service partners that provide gas, electrical appliances, air conditioning installation

By credit providers, in cases where NAY acts as a loan intermediary; specifically, these companies are Home Credit Slovakia, s., Company ID: 36 234 176) and Všeobecná úverovábanka as, Company ID: 31 320 155.

If NAY mediates insurance products, Generali Poisťovňa, as, company ID 35 709 332 and BNP Paribas Cardif Poisťovňa, as, company ID 36 534 978,

CrossFingers, sro, company ID 50 657 445, as intermediaries for processing extended warranty services,

Evaluation of purchases with consent, company number: Heureka Group, Czech Republic, company number: 07822774,

Financial institutions, tax advisors and auditors may be engaged as controllers or intermediaries if necessary to fulfil NAY’s legal obligations.

Personal data are processed during the performance of the contract for the purchase of goods and during the warranty period of the delivered goods.

b. Sale of goods outside the online store

For the sale of goods outside the e-store, NAY processes the following personal data of customers: name, surname and order details.

The legal basis for the processing of personal data is Article 6(1) GDPR. 1 letter b) GDPR Regulation. NAY is required to process personal data when a customer requests to purchase goods that are not available in the e-shop. The personal data is processed during the performance of the contract for the purchase of goods and upon expiration of the warranty period for the delivered goods.

c. Non-binding orders for goods

For non-binding orders for goods, NAY processes the following personal data of potential customers: name, surname, telephone number, e-mail address and data for non-binding orders.

The legal basis for the processing of personal data is Article 6(1) GDPR. 1 letter b) GDPR Regulation. NAY is required to process personal data based on a potential customer's request for a non-binding order for goods.

The recipients of the personal data are the operator of the website naysk12110@gmail.com, its affiliates and the contractual partners providing IT systems.

The processing of personal data takes place from the submission of a non-binding order request until the conclusion of the contract for the purchase of goods or the cancellation of a non-binding order for goods.

d. Guard dog service

For the provision of the surveillance service, NAY processes the following personal data of potential customers: e-mail address and tracked goods.

The legal basis for the processing of personal data is GDPR Art. 6(1) 1 letter b) GDPR Regulation. NAY processes personal data for the purpose of providing a watchdog service, i.e. informing potential customers about the availability of their specified goods.

The recipients of the personal data are the operator of the website naysk12110@gmail.com, its affiliates and the contractual partners who provide IT systems.

The personal data are processed during the use of the watchdog service by the potential customer.

e.g. ordering goods on behalf of the customer through the store's electronic store

In order to order goods on behalf of the customer through the store's electronic store, the company NAY processes the following personal data: name, surname, telephone number, e-mail address and data on the goods ordered.

The legal basis for the processing of personal data is GDPR Art. 1 letter b) GDPR Regulation. NAY processes personal data necessary for the performance of the contract for the purchase of goods.

The recipients of personal data are the following intermediaries:

The operator of the website naysk12110@gmail.com,

Service providers for analytical and marketing information distribution,

Payment service providers and payment intermediaries to ensure the transfer of funds,

Couriers or transport companies that, as another operator or intermediary, ensure the delivery of goods to the customer,

Contractual partners for the provision of IT systems and delivery route planning systems,

Service partners, suppliers, insurance companies, affiliated companies.

The processing of personal data takes place until the customer takes delivery of the goods or the contract for the purchase of goods is terminated earlier.

f. Registration and operation of the online shop

NAY processes the following personal data for the purposes of registration and operation of the e-shop: name, surname, telephone number, e-mail address, address and order history.

The legal basis for the processing of personal data is Art. 6(1) GDPR Art. 1 letter b) GDPR Regulation. NAY processes personal data necessary to ensure registration in the e-shop and the operation of the e-shop.

The recipients of personal data are the following intermediaries:

Operator of the website naysk12110@gmail.com,

Service providers for analytical and marketing information distribution,

Contractual partners and related companies that provide IT systems. Personal data are processed during registration in the e-shop.

Providing telephone and e-mail support to customers

For the provision of telephone and e-mail support, NAY processes the following personal data of customers: name, surname, telephone number, e-mail address, address, order history, NAY extra club card number if the customer is a NAY extra club member and, in case of telephone support, call center call logs.

The legal basis for the processing of personal data is Art. 6(1) GDPR. 1 lit. b) GDPR and, in relation to telephone recordings, Art. 6 sec. 1 lit. a) GDPR. NAY processes personal data for the purpose of providing support and, in relation to recordings, consent and processing of personal data through recordings is voluntary.

The recipients of personal data are the following intermediaries:

IT service providers and related companies in the field of call center operation.

Contractual partner providing IT systems

Personal data are processed during the warranty period of the purchased goods.

h. NAY Extra Club Membership

For membership of the NAY extra club, NAY processes the following personal data: name, surname, date of birth, telephone number, email address, address, NAY extra club card number and the member's order history.

The legal basis for the processing of personal data is GDPR Art. 6(1) 1 letter b) GDPR regulation. NAY processes the personal data necessary for the performance of the NAY extra club membership contract.

The recipients of the personal data are the following intermediaries:

Contractual partner providing IT systems and related companies.

The personal data are processed during the period of your membership of the NAY extra club and until the expiration of the validity period of the purchased goods.

and. Market research on the quality of goods sold

In order to carry out market research on goods sold using the customer's NAY Extra card, NAY Company processes the following personal data of customers: NAY Extra card member identification number; customer name; customer email; date of purchase; receipt number; goods and services sold and their prices.

The legal basis for the processing of personal data is GDPR Art. 6(1) 1 letter f) GDPR Regulation. NAY processes personal data necessary for the legitimate interests of NAY.

The recipients of personal data are the following intermediaries:

Contractual partners and related companies that provide IT systems.

Providers of analytical and marketing information distribution services

NAY processes personal data in the course of conducting surveys and evaluations.

j. Reviews of purchased products

Product reviews may be submitted only if the customer has placed an order or made a reservation to purchase a product in the NAY.sk e-store and the product has been properly delivered. Any customer who can verify that he or she has actually purchased a product from NAY through the above purchase methods may post a product review. Each customer may only review a product once. Each review is checked by the administrator. If the comments do not violate the law, do not contain offensive language, etc., they are published directly without editing the content, so even negative comments are published.

For the public's evaluation of products and services, NAY sends email questionnaires for review. Processing for this purpose is only carried out with the customer's prior consent.

To. Marketing communications

After obtaining consent, NAY sends marketing communications about news general information (general newsletters) by email and SMS. This consent is also considered as consent to send advertising information and email information. This consent is valid for three years. Before the expiration of this period, the customer will receive an email in which they will have the opportunity to choose whether to continue to receive the newsletter. If they give their consent again, the newsletter will continue to be sent by email and SMS.

Based on consent, newsletters are also sent when the customer participates in a marketing campaign and agrees to send commercial communications. In order to complete the marketing campaign, evaluate, terminate and issue any bonuses, NAY does not need the customer's consent, because it is impossible to complete the campaign without processing personal data. Personal data is only processed during the marketing campaign.

l. Login using a social media account

To log in to a customer account on the online store naysk12110@gmail.com, it is possible to use services provided by third parties to log in via an existing account, such as Facebook, Google or Apple (hereinafter referred to as "social media service providers").

The login information is verified by the website operating the social network service. NAY's social media service provider only provides data that is sufficient to identify you and securely create an account on the nay.sk website. The data is taken from the customer's public profile and mainly includes first name, last name and email address.

If the customer chooses to log in via an account on a third-party service, NAY automatically creates an identifier for this account and for each social network service that the customer uses to log in. These identifiers are used to pair the customer account on the nay.sk website with the technology with which the customer logs in via a third-party service.

NAY does not have any rights in the customer's social media account, in particular in relation to any content posted. The customer's personal data processed by NAY will not be sent to the service provider of the account that the customer used to register. The customer can find more information about the data used on social networks in the privacy policy of the specific social network service provider.

The social networking site used by the customer when registering on the nay.sk website will not inform the company of the deletion of the customer's account on the relevant social networking site and the customer's decision not to log in through this account, so the customer data used for login will remain in our database.

m. Handling customer complaints

To resolve customer complaints, NAY processes the following personal data: name, surname, data provided in the complaint and, depending on the way the customer filed the complaint, their address, telephone number or email address.

The legal basis for the processing of personal data is GDPR Art. 6(1) 1 letter b) GDPR Regulation. NAY processes personal data necessary to resolve customer complaints.

Personal data will be processed until the customer complaint is resolved.

n. Verification of eligibility for Orange student or employee discounts

If a customer wants to receive a student discount or Orange employee discount when purchasing goods in a NAY store, he or she needs to show the relevant employeeISIC card or ID card for inspection. Orange employee ID card.

The purpose of this processing of personal data is to verify whether the customer is entitled to a discount and the legal basis for this processing is GDPR Art. 1 letter b) GDPR Regulation. Providing personal data for verification is necessary for NAY to provide the discount upon request of the customer.

NAY will not process this data in any further way.

Oh. Facebook and Instagram Contest

To run the contest via Facebook, NAY processes the following personal data: the data provided in the entrants’ profile, as well as the winners’ name, surname, telephone number, address and prize photo.

The legal basis for the processing of personal data is GDPR Art. 1 letter b) GDPR Regulation. NAY processes the personal data as necessary for the implementation of the contest in accordance with its terms and conditions.

The recipient of the personal data within the scope of the winners’ photo and, if applicable, name and surname is Facebook Ireland Ltd. (Republic of Ireland), which acts as the controller and will process the personal data in accordance with its privacy policy (www.facebook.com/policy.php).

Support provided by Facebook

If the data subject decides to request support via Facebook, NAY will process the personal data provided by the data subject in the Facebook profile and the data provided by the data subject in the course of the communication.

The purpose of processing these personal data is to provide support in accordance with the customer's request and the legal basis for the processing of personal data is GDPR Art. 6(1) 1 letter b) GDPR Regulation. NAY provides the personal data and processes them in order to provide support in accordance with the customer's request.

The recipient of the personal data is Facebook Ireland Ltd., Republic of Ireland, which, as the controller, will process the personal data in accordance with its privacy policy ( www.facebook.com/policy.php ).

The personal data will be processed for the purpose of providing the support requested by the customer.

Ask. Claims against

NAY processes the following data for the exercise of NAY's claims: data specified in contracts with customers and suppliers, data specified in complaints, data required for NAY to initiate legal proceedings, data specified in proceedings against NAY, data specified in records of theft, data kept in accounting and other necessary data in connection with any possible exercise of claims or the defence of NAY's interests.

The processing of these personal data is carried out for the legitimate interests of the controller and the legal basis for the processing is GDPR Art. 6(1) Art. 1 letter f) GDPR Regulation. NAY processes the personal data for the purposes of NAY's legitimate interests. NAY's legitimate interests are the protection of its assets and the prevention of unjustified claims against NAY.

The recipients of the personal data are the following:

Courts, public administration bodies, legal representatives, tax advisors and other professional advisors as controllers.

The personal data will be processed for the duration of the legal proceedings and for the period of limitation for the establishment of claims against NAY or for the Company to assert its own claims.

NAY fulfils its legal obligations

NAY processes the personal data specified in letters a. a) to m) for the purpose of fulfilling NAY’s legal obligations.

The legal basis for the processing is GDPR Art. 6(1) 1 letter c) GDPR regulations (e.g. Accounting Act, VAT Act, Income Tax Act, Consumer Protection Act, Archives and Registration Act). NAY processes the personal data for the purpose of fulfilling its legal obligations.

The recipients of personal data are the following:

Tax advisors, auditors, courts and public administration authorities as controllers.

Personal data are processed for the period required by applicable law.

3. Rights of the data subject

If the data subject considers that his or her rights under the GDPR or relevant laws and regulations are directly affected, the data subject has the right to submit an application for the initiation of a lawsuit to the Office for Personal Data Protection of the Slovak Republic.

The data subject has the right to (i) request access to personal data, (ii) rectification of personal data, (iii) deletion of personal data, (iv) restriction of processing of personal data, (v) right to data portability and (vi) right to object to processing of personal data. The data subject may exercise these rights by contacting NAY:

a) in writing to the address of the company's registered office, specifying the name of the person responsible under the company name,

b) by sending an email to the above-mentioned email address or

c) by contacting at the above-mentioned telephone number.

d) electronically via the website naysk12110@gmail.com

e) Relevant laws

Relevant laws and regulations are, in particular, the GDPR, the applicable Act on the Protection of Personal Data (as amended) and other applicable general binding laws and regulations.