> **Legal notice:** The Czech version of this policy is the legally binding text. This English translation is for convenience only.
I. Basic provisions
1. Controller of personal data
1.1. The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) is: 1.1.1. Apple Genius s.r.o. 1.1.2. Company ID (IČO): 23107430 1.1.3. Registered office: Vosmíkových 930/12, Praha 8, 180 00 1.1.4. Entered in the Commercial Register kept by the Municipal Court in Prague, file C 421516/MSPH 1.1.5. Operator of the AGSTORE online shop (www.agstore.cz) 1.1.6. (the “controller”)
2. Controller’s contact details
2.1. E-mail: info@agstore.cz 2.2. Store address: Mukařovského 2590, Praha 13, 155 00
3. Data protection officer
3.1. The controller has not appointed a data protection officer, because the law does not require one.
4. Definition of personal data
4.1. Personal data means any information about an identified or identifiable natural person. 4.2. Personal data includes in particular: 4.2.1. name, 4.2.2. address, 4.2.3. e-mail, 4.2.4. phone number, 4.2.5. IP address, 4.2.6. device identifiers, 4.2.7. order details, 4.2.8. other information that can identify a person directly or indirectly.
II. Sources and categories of personal data processed
1. Sources of personal data
1.1. The controller processes personal data that the data subject has provided, in particular when: 1.1.1. placing an order, 1.1.2. registering a customer account, 1.1.3. contacting customer support, 1.1.4. filling in a contact form, 1.1.5. subscribing to a newsletter.
2. Categories of personal data processed
2.1. The controller processes in particular the following categories of personal data: 2.1.1. identification data (first name, surname), 2.1.2. contact data (e-mail, phone, address), 2.1.3. payment / accounting data, 2.1.4. order and payment-transaction details, 2.1.5. technical data (IP address, cookies, device type, browser).
III. Legal basis and purposes of processing
1. Legal basis
1.1. The legal basis for processing personal data is: 1.1.1. performance of a contract under Article 6(1)(b) GDPR, 1.1.2. compliance with a legal obligation under Article 6(1)(c) GDPR, 1.1.3. the controller’s legitimate interest under Article 6(1)(f) GDPR (protection of legal claims, marketing to existing customers), 1.1.4. the data subject’s consent under Article 6(1)(a) GDPR.
2. Purposes of processing
2.1. Personal data is processed in particular for: 2.1.1. handling an order and performing the purchase contract, 2.1.2. bookkeeping and tax records, 2.1.3. handling claims and withdrawal from a contract, 2.1.4. communication with customers, 2.1.5. sending commercial messages (newsletter, marketing), 2.1.6. keeping the website secure, 2.1.7. analysing website traffic.
3. Necessity of providing data
3.1. Providing personal data is necessary to enter into and perform the contract. 3.2. Without this data the order cannot be fulfilled.
4. Automated decision-making
4.1. The controller does not carry out automated individual decision-making or profiling within the meaning of Article 22 GDPR.
IV. Retention of personal data
1. Retention period
1.1. The controller keeps personal data: 1.1.1. for the duration of the contractual relationship and afterwards for the time needed to protect legal claims, but no longer than 10 years after the relationship ends, 1.1.2. for accounting documents, for the period required by law, 1.1.3. for marketing data, until consent is withdrawn, but no longer than 5 years.
2. Deletion
2.1. After the retention period, personal data is securely deleted or anonymised.
V. Recipients of personal data (processors)
1. Recipients
1.1. Recipients of personal data may include in particular: 1.1.1. carriers (for example PPL), 1.1.2. IT and hosting providers, 1.1.3. accountants and tax advisers, 1.1.4. payment services, 1.1.5. marketing and analytics services.
2. Analytics and marketing tools
2.1. The controller may use: 2.1.1. Google Analytics, 2.1.2. Google Ads, 2.1.3. Meta Ads (Facebook / Instagram), 2.1.4. Heureka - Ověřeno zákazníky, 2.1.5. Zboží.cz, 2.1.6. Sklik.
3. Transfers to third countries
3.1. The controller does not intend to transfer personal data to third countries outside the EU unless that is necessary for a service to work technically.
VI. Rights of the data subject
1. Scope of rights
1.1. The data subject has the right: 1.1.1. of access to their personal data, 1.1.2. to rectification of personal data, 1.1.3. to erasure of personal data, 1.1.4. to restriction of processing, 1.1.5. to data portability, 1.1.6. to object to processing, 1.1.7. to withdraw consent to processing at any time.
2. Supervisory authority
2.1. The data subject may lodge a complaint with: Úřad pro ochranu osobních údajů Pplk. Sochora 27 170 00 Praha 7 www.uoou.cz
VII. Protection of personal data
1. Measures taken
1.1. The controller has put in place appropriate technical and organisational measures to protect personal data.
2. Measures
2.1. The measures include in particular: 2.1.1. SSL encryption of the website, 2.1.2. secured access to databases, 2.1.3. regular system updates, 2.1.4. data backups, 2.1.5. limited access for authorised persons.
3. Statement
3.1. Personal data is protected against unauthorised access, misuse and loss.
VIII. Cookies
1. Use of cookies
1.1. The AGSTORE website uses cookies in order to: 1.1.1. keep the website working, 1.1.2. analyse traffic, 1.1.3. run marketing activities.
2. Settings
2.1. The user can set or reject cookies in the cookie banner.
IX. Final provisions
1. Acknowledgement
1.1. By sending an order or giving consent through a web form, the data subject confirms that they have read this policy.
2. Changes
2.1. The controller may update this policy. 2.2. The new version is published at www.agstore.cz.