Opens in a new tab

Privacy Policy

Information on the Processing of Personal Data under the GDPR

1. Data Controller

The controller responsible for processing personal data is:

KRASPOL s.r.o.

  • Address: Staničná 796, 906 13 Brezová pod Bradlom, Slovakia

  • Company ID (IČO): 47019131

  • Tax ID (DIČ): 2023695564

  • VAT ID: SK2023695564

  • Email: kraspol.m@gmail.com

  • Telephone: +421 918 474 129

  • Website: https://www.kraspol.eu

KRASPOL s.r.o. (hereinafter referred to as the “Controller”) takes the protection of personal data seriously and processes it in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection.

2. What Personal Data We Process

Depending on how you use our website, we may process the following personal data:

  • First and last name

  • Company name, company registration number, tax identification number and VAT identification number, where provided

  • Billing and delivery address

  • Email address

  • Telephone number

  • Information about orders, purchased products and payments

  • Information required to create and manage a customer account

  • Content of messages submitted through contact and enquiry forms

  • Technical data, such as IP address, device and browser information

  • Website usage data, where consent is required and has been given for its processing

We only process data necessary for a specific purpose.

3. Purposes and Legal Bases for Processing Personal Data

3.1 Order Processing and Product Purchases

We process personal data to receive, fulfil and deliver orders, communicate with customers and handle related requests.

Legal basis: Performance of a contract or taking steps prior to entering into a contract under Article 6(1)(b) GDPR.

3.2 Registration and Customer Accounts

Our website allows customers to create an account through the WooCommerce system.

We use personal data to create and manage accounts, enable login, display order history and simplify future purchases.

Legal basis: Performance of a contract for the provision of a customer account under Article 6(1)(b) GDPR.

3.3 Contact and Enquiry Forms

You can contact us through our forms with questions about products, services, prices, availability or individual delivery arrangements.

We use the information provided to respond to your enquiry and communicate with you.

Legal basis: Taking steps prior to entering into a contract under Article 6(1)(b) GDPR for commercial enquiries, or legitimate interests under Article 6(1)(f) GDPR for other routine communications.

3.4 Order Payments

When purchasing online, payments may be processed through the Comgate payment gateway.

Payment information necessary to complete a transaction is processed by the payment service provider in accordance with its terms. The Controller receives the information necessary to identify and record the payment.

Legal basis: Performance of a contract under Article 6(1)(b) GDPR and compliance with legal obligations under Article 6(1)(c) GDPR.

3.5 Invoicing and Accounting

We process personal data included in invoices and accounting documents to comply with statutory accounting and tax obligations.

Legal basis: Compliance with a legal obligation under Article 6(1)(c) GDPR.

3.6 Complaints and Customer Rights

We process personal data to handle product complaints, withdrawals from contracts and other statutory customer rights.

Legal basis: Compliance with legal obligations under Article 6(1)(c) GDPR or, where applicable, performance of a contract under Article 6(1)(b) GDPR.

3.7 Website Security and Technical Operation

To ensure the proper and secure operation of our website, we may process technical data, including IP addresses and security logs.

Legal basis: Legitimate interests in protecting the website, information systems and preventing misuse under Article 6(1)(f) GDPR.

3.8 Website Analytics

We plan to use Google Analytics 4 to analyse website traffic and improve our website.

Where consent is required for analytics processing, such processing will only take place after consent has been given.

Legal basis: Consent under Article 6(1)(a) GDPR.

You may withdraw your consent at any time through the cookie settings on our website.

4. Recipients of Personal Data

Personal data may be disclosed, to the extent necessary, to the following categories of recipients:

  • Hostinger, our web hosting provider, which supplies the website’s server infrastructure.

  • SiskaDesign, our technical website administrator, where access to personal data is necessary for website management, maintenance or technical support.

  • Comgate, our payment service provider, for processing online payments.

  • Transport and logistics companies responsible for delivering goods.

  • Providers of accounting and related administrative services, where used.

  • Google, as an analytics service provider, if analytics processing is enabled.

  • Public authorities where disclosure is required by law.

We do not disclose personal data to third parties for their own marketing purposes without an appropriate legal basis.

5. Transfers of Personal Data to Third Countries

When using certain external services, particularly analytics or technical services, personal data may be processed or transferred outside the European Economic Area.

Such transfers are carried out only where the requirements of Chapter V of the GDPR are met, for example on the basis of an adequacy decision or appropriate safeguards, such as Standard Contractual Clauses.

The specific transfer mechanisms depend on the services actually used and their current terms.

6. How Long We Retain Personal Data

We retain personal data only for as long as necessary to fulfil the purpose of processing or for the period required by applicable law.

  • Orders: For the duration of the contractual relationship and subsequently to the extent necessary to comply with legal obligations or protect legal claims.

  • Accounting and tax documents: Generally for 10 years, unless applicable legislation requires a different retention period.

  • Customer accounts: For as long as the account exists and subsequently only to the extent necessary to comply with legal obligations or protect legal claims.

  • Contact and enquiry forms: For the time necessary to handle the request and subsequently for a reasonable period depending on the nature of the communication and any potential legal claims.

  • Technical and security logs: For the period necessary to ensure the operation and security of the website.

  • Analytics data: According to the settings of the relevant service and the applicable consent.

After the relevant retention period expires, personal data will be deleted or anonymised unless there is another lawful basis for retaining it.

7. Rights of Data Subjects

In connection with the processing of your personal data, you have the following rights, subject to the conditions set out in the GDPR:

  • The right to request access to your personal data.

  • The right to request correction of inaccurate or incomplete data.

  • The right to request deletion of personal data.

  • The right to request restriction of processing.

  • The right to object to processing based on legitimate interests.

  • The right to data portability in cases provided for by the GDPR.

  • The right to withdraw consent at any time where processing is based on consent.

  • The right to lodge a complaint with the competent supervisory authority.

You can exercise your rights by contacting us at kraspol.m@gmail.com.

We generally respond to requests within one month of receipt. This period may be extended in cases permitted by law.

The competent supervisory authority is:

Personal Data Protection Office of the Slovak Republic

Website: https://dataprotection.gov.sk

8. Cookies

Our website uses cookies and similar technologies necessary for its operation, to support the purchasing process and, where applicable, to analyse website traffic.

Strictly necessary cookies may be used without consent to the extent permitted by law.

Analytics and other optional cookies that require consent are only used after consent has been given.

Detailed information about the cookies used, their purposes and retention periods will be provided in a separate Cookie Policy.

9. Personal Data Security

The Controller implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or destruction.

Access to personal data is restricted to authorised persons and service providers to the extent necessary for the performance of their duties.

10. Requirement to Provide Personal Data

Providing certain personal data is necessary to enter into and perform a purchase contract, deliver an order or comply with legal obligations.

If you do not provide the required information, we may be unable to process your order or request.

Creating a customer account is voluntary where purchasing without registration is available.

11. Automated Decision-Making

In the ordinary processing of orders and customer requests, we do not carry out automated individual decision-making, including profiling, that produces legal effects or similarly significantly affects individuals within the meaning of Article 22 GDPR.

12. Changes to This Privacy Policy

We may update this Privacy Policy, particularly in response to changes in legislation, services used or the way personal data is processed.

The current version will always be available on our website at https://www.kraspol.eu.

Last updated: [to be completed upon approval and publication]