1. Definitions

  1. the consent of the data subjects means any serious and freely given, specific, informed and unambiguous expression of the will of the data subject in the form of a declaration or unambiguous confirmatory act by which the data subject consents to the processing of their personal data,
  2. the processing of personal data means a processing operation or set of processing operations relating to personal data or personal data files, in particular the acquisition, recording, organization, structuring, storage, alteration, retrieval, browsing, exploitation, transmission, dissemination or otherwise, regrouping or combining, restricting, deleting, whether by automated means or by non-automated means,
  3. the data subject is any natural person (customer/consumer) whose personal data are processed,
  4. the provider is the company Wuly s.r.o., located at Anton Florek 8780/1A, 841 06 Bratislava – mestská časť Záhorská Bystrica, IČO: 53 424 336, registered in the Commercial Register of the District Court Bratislava I, Section: Sro, vložka č. 149145/B,
  5. web address, resp. the website is www.wuly.eu,
  6. a third country is a country which is not a Member State,
  7. an international organization means an organization and its subsidiary bodies governed by public international law, or any other body established by or under an agreement between two or more countries.

2. Processing of personal data of data subjects

The operator processes the personal data of data subjects in accordance with the provisions of the regulations of the European Parliament and of the Council (EU) 2016/679 of 27.04.2016 on the protection of natural persons with respect to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/ES and in accordance with the provisions of Law No. 18/2018 Z. z. on the protection of personal data and on amendments to certain laws, subject to compliance with the principles of personal data processing set out in Law No. 18/2018 Z. z. and other applicable legislation.

The operator shall take the necessary technical and organizational measures to ensure the security and protection of the personal data of the data subject throughout the processing and storage of the personal data of the data subject, taking into account the latest knowledge of security standards.

3. Legal bases on which the operator processes the personal data of data subjects and the scope of the personal data processed

  1. Processing of personal data necessary for the performance of the contract or for the execution of necessary measures before the conclusion of the contract:The processing of personal data of the data subjects by the operator takes place on this legal basis:
    • when purchasing goods (concluding and performing the contract and, where appropriate, taking measures before concluding the contract) in the scope of mandatory data: name, surname, e-mail address, telephone contact, address of residence of the data subject, delivery address if different from addresses of the data subject and within the scope of optional data: other personal data that the data subject shall state in the order.
  2. Consent of the data subject:The processing of personal data of the data subjects by the operator takes place on this legal basis:
    • in the context of the operator’s marketing communication with the data subject without the existence of a prior relationship between the operator and the data subject and with the consent of the data subject,
    • when registering the data subject on the operator’s website and creating a user account the mandatory data exclusively includes the name, surname, e-mail address of the data subject, username and password, likewise optional data are e.g. the address of residence of the data subject, address for service, telephone number and other data which the data subject shall provide when registering and creating a user account,
    • in the case of loyalty programs maintained by the operator for the data subjects, the data processed being the name, surname, residential address of the data subject and e-mail address,
    • in the context of customer competitions organized by the operator for the data subjects,
    • via cookies (for more information on cookies, see section 8 of this document).
  3. Processing of personal data is necessary for the purpose of the legitimate interests of the operator:The processing of personal data of the data subjects by the operator takes place on this legal basis:
    • in the context of marketing communication with the data subject, in particular in the form of a newsletter or other forms of direct marketing consisting in informing the data subjects of new goods,
    • as part of improving the services provided by the operator.
  4. Fulfillment of legal obligations of the operator:The processing of personal data of data subjects by the operator takes place on this legal basis in connection with the fulfillment of accounting and tax obligations of the operator or in the fulfilment of the operator’s obligations towards state or other competent authorities that supervise the activities of the operator or against the authorities competent for the decision-making of disputes or the enforcement of decisions of courts, state or other bodies.

4. Retention period

The personal data of the data subjects, related to their user account, shall be kept by the operator for the period of maintaining the user account.

In the case of personal data of the data subjects listed in the order, who do not have a user account, the operator keeps them for the necessary time, during the complaint period (usually 24 months) and until the expiration of potential claims of the parties (data subject and operator) applicable in court or other bodies (usually 3 years after performance of the contract).

In the case of processing personal data on the basis of the consent of the data subject, the operator shall retain the personal data until the data subject withdraws that consent.

For the purposes of fulfilling accounting and tax obligations, the operator keeps the personal data of the data subjects stated on invoices or other tax documents during the archiving periods resulting from the valid legal regulations of the Slovak Republic.

5. Recipients of personal data

The recipients of the personal data of the data subject are the courier companies with which the operator cooperates, but only if the data subject chooses such a form of transport of the ordered goods. The operator currently cooperates with the following courier companies:

  • GLS General Logistics Systems Slovakia s.r.o., With its registered office at 1039, 962 33 Budča, Company Identification Number: 36 624 942, entered in the Commercial Register of the District Court of Banská Bystrica, Section: Sro, File no. 9084/S
  • Direct Parcel Distribution SK s.r.o., with its registered office at Technická 7, 821 04 Bratislava, Company Identification Number: 35 834 498, entered in the Commercial Register of the District Court Bratislava I, Section: Sro, File no. 26367/B
  • Sociedad Estatal Correos y Telégrafos, SA ( Correos ) , with its registered office at Vía Dublín no. 7 ( Campo de las Naciones ), 28070 Madrid, Spain
  • PPL CZ s.r.o., with its registered office at K Borovému 99, Jažlovice, 251 01, Říčany, Company Identification Number: 251 947 98, sp. zn: C 105858 u rejstříkového soudu v Praze
  • Hermes s.r.o., with its registered office at Na Vartičke 10, 965 01 Žiar nad Hronom, Company Identification Number: 31 572 201, entered in the Commercial Register of the District Court of Banská Bystrica, section: Sro, file no. 737/S,
  • La Poste (colissimo), with its registered office at Rue du Colonel Pierre Avia 75015 Paris, France
  • DHL Parcel Slovensko spol. s.r.o., with its registered office at Na pántoch 18, 831 06 Bratislava – Rača, Company Identification Number: 47 927 682, entered in the Commercial Register of the District Court of Bratislava, section: Sro, file no. 100759/B.

Recipients of the personal data of the data subject also include the following companies:

  • Stripe Payments Europe, Limited, with its registered office at C/O A&L Goodbody, Ifsc, North Wall Quay Dublin 1., Dublin 1, Dublin, Ireland
  • SuperFaktura, s.r.o.., with its registered office at Pri Suchom mlyne 6, 811 04 Bratislava, IČO: 46 655 034
  • Ecosam, s.r.o., with its registered office at Veterná 42, 91701 Trnava, Company Identification Number: 52 582 469, entered in the Commercial Register, Trnava District Court, Section: Sro, File No.: 45291/T

6. Transfer of personal data

When processing the personal data of data subjects, the operator does not transmit or intend to transfer them to a third country or an international organization.

7. Rights of data subjects

  1. Right of access to personal dataThe data subject has the right to obtain from the operator confirmation as to whether personal data relating to him or her are being processed, he/she has the right to obtain access to such personal data and information on the purpose of their processing, the category of personal data processed, the identification of the recipient to whom the personal data have been or are to be disclosed, the retention period of the personal data and other information specified in section 21 of Act No. 18/2018 Z.z.
  2. The right to correct personal dataThe data subject shall have the right to have incorrect personal data concerning him or her corrected by the operator without undue delay. With regard to the purpose of the processing of personal data, the data subject has the right to supplement incomplete personal data.
  3. The right to delete personal dataThe data subject shall have the right to have the operator delete personal data concerning him without undue delay.The operator shall delete personal data without undue delay if the data subject has exercised the right to delete personal data if:
    • personal data are no longer required for the purpose for which they were obtained or otherwise processed,
    • the data subject withdraws his consent to the processing of his personal data on the basis of which the processing of personal data is carried out and there is no other legal basis for the processing of personal data,
    • the data subject objects to the processing of personal data and there are no legitimate grounds for processing personal data,
    • personal data are processed illegally,
    • the reason for cancellation is the fulfillment of obligations under Act no. 18/2018 Z. z., a special regulation or an international agreement by which the Slovak Republic is bound,
    • personal data of a child (persons under the age of 16) have been collected for which the data subject is responsible as a legal representative regarding the use of IT services, e.g. social media.

    The operator is not obliged to delete the personal data of the data subject at his request if the processing of personal data is necessary for:

    • exercising the right to freedom of expression or the right to information,
    • fulfilling obligations under Act no. 18/2018 Z. z., a special regulation or international agreement by which the Slovak Republic is bound, or for the fulfillment of a task carried out in the public interest or in the exercise of public power entrusted to the operator,
    • for archiving purposes,
    • to assert a legal claim.
  4. The right to restrict the processing of personal dataThe data subject has the right to have the operator restrict the processing of personal data if:
    • the data subject objects to the accuracy of the personal data during a period allowing the operator to verify the accuracy of the personal data,
    • the processing of personal data is illegal, and the data subject objects to the deletion of personal data and instead calls for restrictions on their use,
    • the operator no longer needs personal data for the purpose of processing personal data, but needs the data subject to exercise a legal claim,
    • the data subject objects to the processing of personal data, until it is verified that the legitimate reasons on the part of the operator outweigh the legitimate reasons of the data subject.

    If the processing of personal data has been restricted, aside from storage the operator may process personal data only with the consent of the data subject or for the purpose of asserting a legal claim for the protection of persons or for reasons of public interest.

  5. The right to the transfer of personal dataThe data subject shall have the right to obtain personal data, concerning themselves which they have provided to the operator, in a structured, commonly used and machine-readable format and shall have the right to transfer such personal data to another operator if technically possible and if:
    • the personal data is processed with the consent of the data subject or on the basis that the processing of the data subject’s personal data is necessary for the performance of the contract or for the performance of a pre-contractual measure at the request of the data subject.
    • the processing of personal data is carried out by automated means.
  6. The right to object to the processing of personal dataThe data subject has the right to object to the processing of their personal data on the grounds of their specific situation carried out for the purpose of the legitimate interests of the operator, including profiling based on the legitimate interest of the operator.The data subject has the right to object to the processing of personal data concerning them for the purpose of direct marketing, including profiling, to the extent that it relates to direct marketing. If the data subject objects to the processing of personal data for direct marketing purposes, the operator may not further process personal data for direct marketing purposes.
  7. The right not to be subject to automated individual decision-making, including profiling, for the data subjectThe data subject shall have the right not to be the subject of a decision which is based exclusively on automated processing and which has legal effects affecting them and which have a similarly significant effect on him or her. However, this does not apply if the decision is:
    • necessary for the conclusion of the contract or the performance of the contract between the data subject and the operator,
    • carried out on the basis of a special regulation or an international agreement by which the Slovak Republic is bound, and in which appropriate measures guaranteeing the protection of the rights and legitimate interests of the data subject are also laid down,
    • based on the express consent of the data subject.
  8. The right to withdraw consent to the processing of personal dataIf the operator processes the personal data of the data subject with the consent of the data subject, the data subject may withdraw his or her consent to the processing at any time.The data subject may exercise any of the rights listed above with the operator by a written request to the operator’s address or by e-mail to the operator’s e-mail address published on the operator’s website in the Contact section.

8. Cookies

The operator’s website uses cookies in order to improve its services. The data subject consents to the use of cookies by the operator via a pop-up bar, which is displayed automatically the first time you visit the operator’s website.

What is a cookie?

A cookie is a small text file that a data subject’s Internet browser stores and/or loads on the hard drive of a terminal device (such as a computer, laptop, or smartphone) through a website that the data subject visits. Cookie files provide safer and faster interaction with the website, because the account is able to memorize the preferences of the data subject (e.g. Login and languages) by sending the information they contain back to the original website or any other website to which they belong as the data subject visits the website via the same terminal.

What does the operator use cookies for?

The operator uses the cookie files for the purpose of improving the services of the website for visitors, remembering the user settings and for the necessary functionality of the website. The purpose of cookies is to facilitate and make the use of the operator’s website easier and more pleasant for the data subject.

Revocation of the data subject’s consent to the processing of personal data via cookies

Consent to the processing of personal data through cookies may be revoked by the data subject at any time. If the data subject wants to delete cookies stored in terminal devices or set the web browser of the end device to refuse cookies, they can do so by setting the preferences of the web browser of the end device. As a rule, this can be done in the settings of the web browser of the terminal equipment in the section “Options”, “Tools” or “Preferences” in the web browser used by the data subject to access the operator’s website. Depending on existing web browsers, cookies can be turned off by various means. For more information, visit the appropriate browser website.

What Cookie Files Do We Use?

Type Name Purpose Expiration Address Details
Necessary Shopping cart Identification and pairing of shopping cart contents of unregistered users of websites. 2 days Wuly
Analytical Google Analytics Getting anonymised statistics on website usage. 12 months Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland You can find more information about Cookies here, while you may install a software add-on to reject cookies here.

Using plug-ins

The operator may use so-called plug-ins, of social networks, on its website through which data subjects can share the content of the website with their contacts on social networks. It is a plug-in of social networks Facebook and Instagram.

In case of any questions regarding the protection of personal data the data subjects may contact the operator via e-mail to the e-mail address of the operator info@wuly.eu.

In case of doubt about compliance with the controller’s obligations related to the processing of personal data, data subjects have the right to contact the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27, e-mail contact: statny.dozor@pdp.gov.sk, website: www.dataprotection.gov.sk.

The protection of personal data within the scope of this document shall enter into force and effect on July 1st 2021