Privacy Policy

2024.07.10

Privacy Notice

In order to provide concise, transparent, understandable and easily accessible information regarding the processing of personal data of Data Subjects:
a) the Controller; and
b) the relevant Seller;

have prepared this Privacy Notice within the meaning of Article 13 and Article 14 of the GDPR and other generally binding legal regulations, the subject of which is the provision of detailed information on the processing of personal data of Data Subjects.

For better orientation in this Privacy Notice, repetitive terms with a capital letter are used, the meaning of which is stated in the General Terms and Conditions stated on the Platform or below in point 2 of this Privacy Notice.

I. General Introduction

The Controller owns and operates the Platform (shortswrap.com] through which individual Sellers sell Products or provide Services.

When using the Platform, as well as when purchasing Products or subscribing to Services, the personal data of Data Subjects is processed.

When processing personal data, the Controller and the respective Seller are in the position of separate controllers or joint controllers, depending on the individual processing activities. If the Controller and the respective Seller are in the position of joint controllers, they have jointly concluded joint controllers within the meaning of Article 26 of the GDPR. The essential parts of the joint controller agreement shall be provided to the Data Subject upon request.

In connection with the processing of personal data of Data Subjects, standard and specific protection of personal data has been designed and implemented, including the introduction of appropriate technical and organizational measures to ensure a high level of personal data security.

In case of any questions in connection with this Privacy Notice, the processing of personal data or the exercise of the rights of the Data Subject, the Controller may be contacted by:
a) post: Shorts Wrap s. r. o., Rosná 1515/10, 040 01 Košice – mestská časť Juh, the Slovak Republic;
b) e-mail: support@shortswrap.com;

II. Definitions of Terms

Data Subject means you if your personal data is processed in the manner specified in this Privacy Notice;
Privacy Notice means this privacy notice on the processing of personal data prepared in accordance with Articles 13 and 14 of the GDPR;
Act means Act No. 18/2018 Coll. on the Protection of Personal Data and on the Amendment of Certain Acts, as amended;

III. Information on the processing of personal data

Below is an overview of the individual processing activities, as well as the personal data processed, the purpose of the processing, the legal basis for the processing, the storage period and other information

Processed personal data

Purpose of personal data processing

Legal basis for the processing of personal data

Personal data retention period

Legal or contractual requirement and possible consequences of not providing personal data

Personal data necessary to register an Account on the Platform – name, surname, e-mail address of residence.

Registration of an Account on the Platform.

Pre-contractual negotiation and contractual obligation of the Controller.

By registering an Account on the Platform, the Data Subject enters into a contractual relationship with the Controller, the subject of which is the creation and use of the Account.

For the duration of the existence of the Account and subsequently for the period of limitation or limitation period applicable to the individual claims of the contracting parties arising from the contractual relationship.

The provision of personal data is a contractual requirement.

Failure to provide personal data results in the Controller not being able to enter into a contractual relationship with the Data Subject and thus allow the Data Subject to register an Account on the Platform.

Personal data necessary for the conclusion of the contractual relationship - name, surname, address of residence, e-mail address, telephone contact and subject of the contractual relationship.

In the event that the Data Subject wants to purchase a Product or Service of the Platform, the Data Subject enters into a contractual relationship with the Seller.

In carrying out this processing activity, the Controller and the Seller act as joint controllers.

Pre-contractual negotiation and contractual obligation of the Seller.

The contractual obligation arises from the contractual relationship concluded with the Data Subject.

Legitimate interest of the Controller.

The legitimate interest is the fulfilment of the Controller's obligations towards the Seller arising from their special contractual relationship

For the duration of the limitation period or the limitation period applicable to individual claims of the parties arising from the contractual relationship.

The provision of personal data is a contractual requirement.

Failure to provide personal data results in the Seller not being able to enter into a contractual relationship with the Data Subject.

Personal data necessary for the receipt and handling of the complaint - name, surname, address of residence, claimed Product or Service and other data specified in the complaint.

Receiving and handling complaints.

The Seller is obliged to accept, process, handle and keep records of complaints.

In carrying out this processing activity, the Controller and the Seller act as joint controllers (however, the Controller is not a party to the contractual relationship].

Seller's Legal Obligation.

Legal obligations arise from the following generally binding legal regulations: Act No. 40/1964 Coll., Act No. 250/2007 Coll. and Act No. 102/2014 Coll.

Legitimate interest of the Controller.

The legitimate interest is the fulfilment of the Controller's obligations towards the Seller arising from their special contractual relationship

For the period of the limitation period or the limitation period applicable to the Seller's claims arising from the contractual relationship.

The provision of personal data is a legal requirement.

Failure to provide personal data results in the Seller not being able to accept and settle the complaint.

Personal data necessary to ensure mutual communication, in particular name, surname, e-mail address, telephone contact and content of communication.

Such communication may take place online (email, contact form, etc.] or by post.

Ensuring communication (sending, receipt and recording of physical and electronic mail] between the Controller and the Data Subject.

Legitimate interest of the Controller.

The legitimate interest of the Controller is the effective and trouble-free provision of communication with the Data Subject.

For a period of 3 years from the last electronic communication between the Controller and the Data Subject.

For a period of 10 years from the date of receipt or dispatch of physical mail.

Voluntary provision of data.

The Data Subject may exercise his/her right to object to the processing of personal data within the meaning of Article 21 of the GDPR with the Controller.

Personal data necessary for sending the newsletter – e-mail address, name and surname.

Sending advertising messages about Products or Services to Data Subjects with whom the Seller has a previous business relationship.

In carrying out this processing activity, the Controller and the Seller act as joint controllers.

Legitimate interest of the Seller and the Controller.

The legitimate interest of the Seller and the Controller is the promotion of the Seller's Products or Services.

For a period of 5 years from the conclusion of the last business relationship.

Voluntary provision of data.

The Data Subject may unsubscribe from the newsletter at any time.

The Seller and the Controller process personal data for this purpose on the basis of a legal exception pursuant to Section 116 (15] of Act No. 452/2021 Coll.

Personal data necessary for sending the newsletter – e-mail address, name and surname.

Sending general advertising messages about the activities, products and services of the Controller or the Seller to Data Subjects who have requested it.

In carrying out this processing activity, the Controller and the Seller act as joint controllers.

Consent of the Data Subject to the processing of his/her personal data.

Consent can be revoked at any time.

For a period of 5 years from the granting of consent or until the withdrawal of consent to the processing of personal data.

Voluntary provision of data.

Failure to grant consent results in the fact that commercial offers about products and services will not be sent.

Personal data necessary for the promotion of the Controller's activities, services or products on social networks - name, surname, reaction, comment and profile of the Data Subject.

Operating fan pages or other profiles on social networks for the purpose of promoting the activities, services and products of the Provider.

The Controller has created various profiles on social networks (Facebook, Instagram, LinkedIn, YouTube], and as the Controller of these profiles, it also processes the personal data of users of social networks who visit these profiles. It operates these profiles for the purpose of promoting activities, services and products, and interacts with individual users of social networks as part of this activity.

Legitimate interest of the Controller.

The legitimate interest of the Controller is the promotion of the Controller's activities, services and products.

For the duration of the operation of the profile on the social network.

Voluntary provision of data.

The Data Subject may exercise his/her right to object to the processing of personal data within the meaning of Article 21 of the GDPR with the Controller.

Personal data contained in the documentation that is part of the registry, in particular title, first name, surname, signature, place of residence, e-mail address, telephone number and other data according to a special regulation.

Registry management.

Legal obligation of the Controller.

The Controller fulfils its legal obligations pursuant to Act No. 395/2002 Coll. and Decree No. 410/2015 Coll.

For a period of 10 years from the date of inclusion of the document in the registry.

The provision of personal data is a legal requirement.

Failure to provide personal data results in a breach of legal obligations.

Personal data necessary for the exercise and enforcement of the rights of the Controller, in particular name, address, date of birth and other personal data processed within the framework of individual proceedings.

These rights may be exercised by the Controller both in court and out of court.

Asserting the Controller's claims through courts, arbitration courts, bailiff's offices, law firms, notary offices, etc.

Legal obligation of the Controller.

The legal obligation lies in the identification of the Data Subject and the Controller's claim in the exercise and enforcement of rights.

This obligation arises in particular from Act No. 160/2015 Coll., Act No. 233/1995 Coll., Act No. 40/1964 Coll., Act No. 513/1991 Coll., Act No. 301/2005 Coll., Act No. 7/2005 Coll. and related legal regulations.

Legitimate interest of the Controller.

In the event that there is no legal obligation to process the personal data of the Data Subject, but these personal data are necessary for the exercise or enforcement of the rights of the Controller, the Controller processes the personal data on the basis of a legitimate interest.

The legitimate interest of the Controller is the exercise of rights and their subsequent enforcement.

For the duration of the limitation or limitation period or for a period of 10 years from the final conclusion of the proceedings.

The Controller processes the personal data of the Data Subject on the basis of his/her legal obligation.

Failure to provide personal data results in the Controller not being able to fulfil its legal obligations and thus its rights in asserting claims are limited.

The Controller processes personal data on the basis of legitimate interests due to the fact that it has carried out a test of compatibility of purposes, while the original purpose for which it processed personal data is compatible with the purpose of asserting claims.

Personal data necessary to conclude a contractual relationship, ensure communication between the contracting parties and proper performance of contractual obligations, in particular name, surname, e-mail address, telephone contact, job title and signature.

The Controller and the Seller process the personal data of the Data Subject who acts as a representative or contact person of the other contracting party (e.g. statutory representative, member of the statutory body, procurator, proxy, contact person, etc.].

Entering into a contractual relationship, ensuring communication between the contracting parties and proper performance of contractual obligations.

In carrying out this processing activity, the Controller and the Seller act as joint controllers.

Legitimate interest of the Controller and the Seller.

The legitimate interest is to conclude a contractual relationship, to ensure the fulfilment of its contractual obligations arising from the contractual relationship in question and to ensure communication between the contracting parties.

For the period of the limitation period or the limitation period applicable to the claims of the Controller and the Seller arising from the contractual relationship.

Voluntary provision of data.

The Data Subject may exercise his/her right to object to the processing of personal data pursuant to Article 21 of the GDPR with the Controller and the Seller.

Personal data necessary for the exercise of the rights of the Data Subject, in particular name, surname, e-mail address, telephone contact, personal data in question, the right exercised and other information.

Exercising the rights of Data Subjects through a request.

In carrying out this processing activity, the Controller and the Seller act as joint controllers or as separate controllers, depending on which processing activity the right applies.

Legal obligation of the Controller or Seller.

The legal obligation is to allow the Data Subject to exercise his/her rights under the GDPR by means of a request and then to deal with the request.

For a period of 5 years following the year in which the Data Subject's request was handled.

The Controller or the Seller processes the personal data of the Data Subject on the basis of a legal obligation.

Failure to provide personal data results in the Controller or the Seller not being able to fulfil its legal obligations and thus cannot handle the Data Subject's request.

Personal data necessary for keeping the accounting agenda and tax agenda, in particular name, surname, e-mail address and telephone contact and other data stated on the invoice.

Accounting and tax management.

In carrying out this processing activity, the Controller and the Seller act as joint controllers.

Seller's Legal Obligation.

The Seller fulfils legal obligations arising in particular under Act No. 431/2002 Coll., Act No. 222/2004 Coll., Act No. 40/1964 Coll., Act No. 311/2001 Coll., Act No. 595/2003 Coll., Act No. 582/2004 Coll., Act No. 283/2002 Coll. and Act No. 563/2009 Coll.

Legitimate interest of the Controller.

The legitimate interest is the fulfilment of the Controller's obligations towards the Seller arising from their special contractual relationship.

For a period of 10 years following the year in which the personal data was first processed.

The provision of personal data is a legal requirement.

Failure to provide personal data results in a breach of legal obligations.

IV. Rights of Data Subjects

In connection with the processing of personal data, the Data Subject has the following rights, which you can exercise at any time if the legal conditions are met. In such a case, the Data Subject shall be provided with information on the measures taken on the basis of his/her request without undue delay, but no later than within 1 month. This period may be extended by a further 2 months, in which case the Data Subject will be informed of any such extension within 1 month of receipt of the request, together with the reasons for the missed deadline.

a) Right of Access (Art. 15 GDPR]

The Data Subject has the right to obtain confirmation as to whether his or her personal data is being processed, and if so, the right to obtain access to such personal data. The Data Subject also has the right to be provided with all information within the scope of this Privacy Notice.

b) Right to Rectification (Art. 16 GDPR]

The Data Subject has the right to rectify the processed personal data without undue delay. At the same time, the Data Subject has the right to have incomplete personal data completed.

c) Right to Erasure/to be Forgotten (Art. 17 GDPR]

The Data Subject has the right to erasure of personal data processed about him or her without undue delay. However, the right to erasure is not absolute and is subject to the fulfilment of legal prerequisites.

d) Right to Restriction of Processing (Art. 18 GDPR]

The Data Subject has the right to have the processing of his or her personal data restricted.

e) Right to Portability (Art. 20 GDPR]

The Data Subject has the right to receive the personal data provided in a structured, commonly used and machine-readable format and has the right to transmit this personal data to another controller if he or she has provided his or her personal data on the basis of consent and such personal data is processed by automated means.

f) Right to Object (Art. 21 GDPR]

The Data Subject has the right to object to the processing of personal data if such processing is carried out on the legal basis for the performance of a task carried out in the public interest or for the legitimate purposes of the parties, including objection to profiling based on these legal bases. The Data Subject also has the right to object to the processing of personal data for the purposes of direct marketing, including profiling.

g) Right in relation to Automated Individual Decision-Making, including Profiling (Art. 22 GDPR]

The Data Subject has the right not to be subject to a decision which is based solely on automated processing, including profiling, and which produces effects concerning him or her or similarly significantly affecting him.

h) Right to Initiate Proceedings (Section 100 of the Act]

The Data Subject has the right to file a motion to initiate proceedings on the protection of personal data within the meaning of Section 100 of the Act to a supervisory authority if he/she believes that his/her personal data is being processed in violation of the GDPR.

The Data Subject may file a motion to initiate proceedings with the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava. More information is available on the website of the Office for Personal Data Protection of the Slovak Republic.

i) Right to Withdraw Consent (Art. 7 GDPR or Art. 14 of the Act]

If personal data is processed on the legal basis of the consent of the Data Subject, the Data Subject has the right to withdraw his/her consent at any time, without affecting the lawfulness of the processing based on the consent granted before its withdrawal.

The Data Subject may withdraw your consent at any time by sending an e-mail: support@shortwrap.com.

V. Sources of Personal Data Collection

Primarily, personal data is collected directly from Data Subjects. However, in some cases, personal data may also be processed from other sources:

publicly available sources within which the personal data of the Data Subject is provided;
business partners;
another person who provides the personal data of the Data Subject – in such a case, the providing person is obliged to have the consent of the Data Subject within the meaning of Section 78 (6] of the Act;

VI Recipients of Personal Data

Personal data of Data Subjects may also be provided to other natural or legal persons, public authorities or international organizations.

In such a case, the highest possible level of protection of personal data is ensured, whereby in the case of the provision of personal data by a processor or a joint controller, a contractual relationship within the meaning of Article 26 or Article 28 of the GDPR is concluded.

The personal data of Data Subjects are provided to the following categories of recipients or public authorities:

controlling or controlled entities and other entities in the horizontal or vertical hierarchy of the organisational structure;
business partners;
legal, tax, accounting, IT and other advisors;
public authorities.

VII. Personal Data Retention Period

In addition to the specified retention period for individual personal data in accordance with point 3 of this Privacy Notice, the personal data of Data Subjects may also be stored for a longer period of time, if it is necessary to store personal data for longer than the specified period due to legitimate interests or due to a change in legal obligations.

VIII. Transfer of Personal Data to Third Countries or International Organisations

Personal data of Data Subjects may be transferred to other third countries or international organizations. In the event of a possible transfer of personal data to third countries or international organizations, a sufficient level of protection of the personal data of the Data Subjects is ensured.

Some Sellers may have their registered office or place of business in a third country. In such cases, the personal data is transferred to such a country and the personal data is processed in accordance with adequacy decisions or standard contractual clauses.

IX. Automated Individual Decision-Making, including Profiling

When processing the personal data of Data Subjects, automated individual decision-making, including profiling, is not used.