GDPR

The regulation of KULINA Group, a.s. on personal data protection.

The following regulation on the personal data protection has been prepared for our customers by the company KULINA Group, a.s. with the registered office at Výtvarná 1023/4, 161 00 Praga 6, REGON number 26155559, entered in the commercial register of the Municipal Court in Prague signature B 6384, in order to inform our customers on the way we process, use and protect your personal data in order to protect your privacy.

The entire process of working with your personal data complies with applicable law, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR) and the repeal of Directive 95/46 / EC.

1) What are personal data?

Personal data means any information relating to an identified or identifiable individual. This data defines a particular person. Personal data is not anonymous data, which cannot be assigned to a specific person.

Personal data may refer to:

• Basic personal data such as: name, surname, date of birth, address, etc.
• Other personal data, that are considered „sensitive” data – race, ethnicity, religion or health condition

In order to complete your order or send our newsletter we need only basic personal data, which are necessary to fulfill the given service.

2) Data controller and processing party

The controller determines the purposes and means of the personal data processing. We become the controller when you purchase products in our eshop or when you subscribe for newsletter. As the controller we are responsible for meeting all requirements and duties related to your personal data protection.

Below you will find the contact data of the controller of your personal data:

KULINA Group, a.s.
Výtvarná 1023/4, 161 00 Praha 6
e-mail: info@kulina.ie

Processing party only process the data but do not establish the purposes or ways of processing the data. In our case processing parties are our partners with the help of which we send commercial information. We always sign a contract with processing parties and make sure they comply with the requirements of data protection.

3) Rules of personal data processing

We approach the subject of personal data processing with due diligence and responsibility. We follow the regulations and protect your personal data to the best possible extent.

While processing your personal data we act according to the following rules:  

• The principle of lawfulness, fairness and transparency that states that the use of personal data for the purpose must be legal, it should be transparent to you that your personal data are processed and to what extent the personal data are transferred and if there was any breach or loss of your data.

• The limited purpose principle that commands us to collect personal data for specified, explicit and legitimate purposes and ensures that, after collection, data are not used for purposes that are incompatible with the original ones.
• The data minimization principle, that commands us to process only the data that are adequate, relevant and not excessive in relation to the purposes for which they are collected
• The principle of accuracy of data, that commands us to take all reasonable steps for that data to be accurate and, where necessary, kept up to date, and that all reasonable steps be taken to delete or rectify inaccurate data promptly.
• The principle of storage limitation, that commands us to store your personal data no longer than it is necessary for the execution of goals in which it is processed. Once all purposes of a processing operation are fulfilled, the processing must stop, either by deleting the data or by making it anonymous.
• The integrity and confidentiality principle, that commands us to process personal data in a manner that ensures their appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage.

4)  Purposes and lawfulness of processing of your personal data

Your data is collected for specified, explicit and legitimate purpose. They are processed lawfully, fairly and in a transparent manner. Processing of your data incompatible with those purposes or in a manner inconsistent with these objectives is unacceptable.

Below you will find the purposes of processing of your personal data:

• The performance of a contract – processing is necessary for the performance of a contract. Your personal data will be processed in order to complete your order placed in our eshop.
• Consent – we process your data on the basis of the consent given by you. The consent is given every time separately for every purpose and the scope and period of consent shall be always clearly stated. Giving your consent is always related to some kind of your activity – to give your consent you need to check the box. The consent given can always be withdrawn.
• The legitimate interests – processing is necessary for the purposes of our legitimate interests except where such interests are overridden by the interests or fundamental rights and freedoms.

5) Your rights

You have the following rights related to the personal data:

• the right to be informed – you have the right to obtain information about our identity as your personal data controller. You are entitled to obtain information about the legal basis for the processing (contract details), the purposes of the processing for which the personal data are intended (purchase agreement) or the period for which the personal data will be stored. We will always inform you about the purpose and legal basis of the data collection and processing prior to their processing.
•  the right to access – you can ask us if we process your personal data, if yes we can give you a copy of hold personal data about you.
• the right to rectification – you are entitled to request from us rectification of any personal data that is inaccurate or incomplete. Please notice that as a controller of your data we do not have the obligation to regularly check if your data is valid or complete. the right to rectification is executed to update your data.
• the right to erasure – or „right to be forgotten“ means that in certain cases with are obliged to erase your personal data – if they are no longer needed for the purpose for which we collected them or are no longer processed; if you have withdraw the consent to process your personal data or if there are no legal reasons to process them any further; if you object to processing and there are no legal basis for further data processing.
• the right to object– you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you. The law applies when your personal data is necessary to perform a task carried out in the public interest or in the exercise of official authority entrusted to the administrator (which we as an administrator don’t do) or in case of legitimate interests of the administrator. In that case we shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.
• the right to data portability – have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us to which the personal data have been provided, where the processing is based on consent or on a contract or when the processing is carried out by automated means.
• the right to restriction of processing – you have the right to obtain from the controller restriction of processing where one of the following applies:

1. You contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
2. The processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
3. We no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
4. You objected to processing – pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

• right not to be subject to a decision based solely on automated processing, which produces legal effects concerning or similarly significantly affecting you – in other words, any decision making processes that affect you must be made by a human and not be based on for example, computer program evaluation.

6) Disclosure of your information

The recipient of your personal data is a party that we disclose them to. In order to perform the services that we offer, we may disclose and share your personal data with the following recipients:

• persons who take part in delivering your order (postmen, couriers). We disclose your personal data to Courier companies to deliver the products that you have ordered and in this case they become the controller of your personal data
• persons who manage our e-shop (hosting company)
• persons who manager and send newsletters

7) Personal data protection

We have implemented appropriate organizational safeguards and security measures to protect personal data from being accidentally lost, disclosed, used or accessed in an unauthorized way.

In the unfortunate breach of a personal data (and we are sure that this is not going to happen), we will notify applicable regulator within 72 hours. If the breach will pose a risk for you, we will also inform you if we have your valid contact data.

8) Final provisions

The above regulation may be updated or changed from time to time. Please always check the website for the updated version.

In case you object to the way we process your data please contact…

The regulation is valid from 1. 9. 2023