Privacy policy & Cookies

PRIVACY POLICY AND COOKIES DIRECTIVE

/ Privacy policy and notifications provided by the data controller to the data subject upon collection of personal data from the data subject and cookies directive of the Online Store www.ninascrunchies.com /

Article I - Data Controller

1.1. The identity and contact details of the Data Controller are:

Business Name: PERTO H+H s.r.o.
Registered Office: Bezekova 2034/21, 841 02 Bratislava, Slovak Republic
Registration: Registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insertion No. 17078/B
Company ID (IČO): 31 705 685
Tax ID (DIČ): 2020515123
VAT ID (IČ DPH): SK2020515123
Bank Account: SK33 0900 0000 0051 7006 8078
The Data Controller is a payer of value-added tax (VAT).

1.2. The e-mail and telephone contact details of the Data Controller are:

E-mail: info@ninascrunchies.com
Tel. No.: +421 918 78 72 74

1.3. Address of the Data Controller for the delivery of correspondence: PERTO H+H s.r.o., Bezekova 2034/21, 841 02 Bratislava, Slovak Republic.

1.4. In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation" or "GDPR"), furthermore in accordance with Act No. 18/2018 Coll. on Personal Data Protection, and in accordance with Act No. 452/2021 Coll. on Electronic Communications, as amended, the Data Controller hereby provides the Data Subject (Buyer), from whom it collects personal data concerning them, with the following information, notifications, and explanations:

Article II - References and Data Sources

2.1. This Privacy Policy and notifications form an integral part of the General Terms and Conditions published on the Seller's Website.

2.2. In accordance with applicable consumer legislation (Act No. 108/2024 Coll. on Consumer Protection), the Seller informs the consumer that there are no specific relevant codes of conduct to which the seller has contractually committed or which the seller would be obliged to adhere to.

2.3. The Data Controller obtains personal data of data subjects directly from them (when filling out the order form on the website) or from third parties – operators of online marketplaces (Sashe.sk, Fler.cz), through which the data subject placed an order for goods with the Data Controller.

Article III - Personal Data Protection and Use of Cookies. Information and Explanation of Cookies, Scripts, and Pixels

3.1. The website operator provides this brief explanation of the function of cookies, scripts, and pixels:

Cookies: These are text files containing a small amount of information that are downloaded to your device when you visit a website. Thanks to this file, the website remembers information about your actions and preferences (such as login name, language, font size, and other display settings) for a certain period, so you do not have to re-enter them upon your next visit to the website or when browsing its individual pages.
Script: A piece of program code used for the correct and interactive functioning of a website. This code runs on the data controller's server or on your device.
Pixels: A small, invisible piece of text or an image on a webpage used to monitor website traffic (e.g., Meta Pixel to measure advertising effectiveness).

3.1.2. Cookies are divided into:

Technical or Functional Cookies: They ensure the proper functioning and use of the Data Controller's website. These cookies are used without consent.
Statistical Cookies: The Data Controller collects statistics regarding the usage of its website. These cookies are used only with consent.
Marketing / Advertising Cookies: Used to create advertising profiles and perform similar marketing activities on social networks. These cookies are used only with consent.

3.2. How to control cookies: 3.2.1. You can control and/or delete cookies at your discretion – for details, see aboutcookies.org. You can delete all cookies stored on your computer or other device, and you can set most browsers to prevent them from being stored.

3.3. The Data Controller's website uses the following cookies: All cookies utilized by the Data Controller can be found on the website https://www.cookieserve.com/ by entering the Data Controller's web address: https://www.ninascrunchies.com. The duration of technical, statistical, and marketing cookies is a maximum of 2 years.

Article IV - Processed Personal Data

4.1. The Data Controller processes the following personal data on its website: first name, surname, residential address, e-mail address, telephone number, billing address, delivery address, data obtained from cookies, IP addresses, and potentially materials (reviews, visual content) within the scope of marketing and collaboration with content creators.

Article V - Contact Details of the Data Protection Officer

5.1. The Data Controller has appointed a Data Protection Officer (DPO) in accordance with the Regulation. Contact details: E-mail: info@ninascrunchies.com, Tel. No.: +421 918 78 72 74.

5.2. The Data Controller is simultaneously the Seller within the meaning of the term established in the General Terms and Conditions of this internet website.

Article VI - Purposes of Processing Personal Data of the Data Subject and Retention Period

6.1. The purposes of processing the personal data of the Data Subject are primarily:

6.1.1. Registration, generation, and processing of contracts and client data for the purpose of concluding and performing purchase contracts (including orders received via the Sashe.sk and Fler.cz platforms).
6.1.2. Processing of accounting documents and documents related to the business activities of the Data Controller.
6.1.3. Compliance with legal regulations regarding the archiving of documents and records pursuant to Act No. 431/2002 Coll. on Accounting, as amended.
6.1.4. Activities of the Data Controller in connection with fulfilling a request, order, or contract of the Data Subject.
6.1.5. Newsletter, marketing campaigns, targeted advertising, social media management, and the use of UGC (User-Generated Content) for brand promotion (exclusively in the event of voluntary consent granted by the Data Subject or on the basis of a legitimate interest).

6.2. The Data Controller stores the personal data of the Data Subject only for the period strictly necessary to fulfill the contract and for subsequent archiving in accordance with statutory periods (accounting documents for a period of 10 years). In the case of marketing and sending newsletters, data is processed until the Data Subject withdraws their consent, but for a maximum period of 10 years.

Article VII - Legal Basis for Processing Personal Data of the Data Subject

7.1. In the event that the Data Controller performs processing of personal data based on the consent of the Data Subject (marketing, optional cookies, use of specific content from creators), this processing will be initiated only after such consent is granted by the Data Subject.

7.2. If the Data Controller processes the personal data of the Data Subject for the purposes of pre-contractual relations, conclusion and performance of a purchase contract, and the related delivery of goods, the Data Subject is obliged to provide this data. Otherwise, it is not possible to fulfill the contract. Personal data for this purpose is processed without the specific consent of the data subject.

Article VIII - Recipients or Categories of Recipients of Personal Data (Third Parties)

8.1. The recipients of the personal data of the Data Subject shall or may be:

8.1.1. Statutory organs of the Data Controller and persons performing work activities for the Data Controller.
8.1.2. Collaborators of the Data Controller, its business partners, contractual suppliers (accounting company, IT support, sales platforms, transport and shipping companies, payment gateways, marketing agencies, social media and campaign managers, contractual content creators).
8.1.3. Courts, law enforcement authorities, the tax office, and other state authorities on the basis of the legal regulations of the Slovak Republic.

8.1.4. List of contractual third parties – processors and recipients:

Devendo s.r.o., with its registered office at Sološnica 250, 906 38 Sološnica, Company ID: 55589723 (marketing agency handling campaign management and digital marketing).
Vivienne Víghová, with its place of business at Gaštanová 15, 949 01 Nitra, Company ID: 56892594, Tax ID: 1130287598 (external management of Facebook and Instagram social networks and UGC content creation).
Meta Platforms Ireland Central Ltd., with its registered office at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (operator of Facebook and Instagram social networks and provider of analytical and advertising tools).
GO balík s.r.o., with its registered office at Dolní Libchavy 297, 561 16 Libchavy, Czech Republic, Company ID: 21380716 (shipping company ensuring logistics, collection, and distribution of shipments for carriers Packeta and DPD).
Packeta Slovakia s. r. o., with its registered office at Kopčianska 3338/82A, 851 01 Bratislava, Company ID: 48136999 (courier service and pick-up points).
Direct Parcel Distribution SK s.r.o. (DPD), with its registered office at Technická 7, 821 04 Bratislava, Company ID: 35834498 (courier and transport service).
SAShE s.r.o., with its registered office at Gerulatská 1395/2A, 851 10 Bratislava, Company ID: 46036491 (intermediary sales portal Sashe.sk).
Fler s.r.o., with its registered office at Vysoká 534/12, Štýřice, 639 00 Brno, Czech Republic, Company ID: 29379946 (intermediary sales portal Fler.cz).
Global Payments s.r.o., Vajnorská 100/B, 831 04 Bratislava, Company ID: 50010301 (provision of the GP webpay / GoPay payment gateway).
DOHAT, s. r. o., Mamateyova 1547/22, 851 04 Bratislava-Petržalka, Company ID: 50361251 (accounting processing).
WEBY GROUP s.r.o., Nižovec 2a, 960 01 Zvolen, Company ID: 36046884 (software, hosting, and website maintenance).
Heureka Shopping s.r.o., Karolinská 650/1, 186 00 Prague 8 – Karlín, Czech Republic, Company ID: 02387727 (the "Verified by Customers" / Overené zákazníkmi service).

8.2. We determine your satisfaction with your purchase via e-mail questionnaires within the scope of the "Verified by Customers" (Overené zákazníkmi) program. We send you the questionnaire every time you make a purchase, unless, in accordance with Act No. 452/2021 Coll., you object to receiving electronic mail for direct marketing purposes. We perform this processing on the basis of a legitimate interest, which consists of determining feedback. For evaluation, we use the processor Heureka.sk, to whom we transmit your e-mail address and information about the purchased goods. You may object to this processing at any time using the link directly in each e-mail containing the questionnaire.

Article IX - Information on the Provision of Personal Data to Third Countries and Cross-Border Transfer

9.1. Personal data of Data Subjects are processed exclusively within the territory of the Slovak Republic and other member states of the European Union (EU) and the European Economic Area (EEA).

9.2. Cross-border transfer of personal data takes place to the Czech Republic within the scope of performing the purchase contract and business activity (logistics and distribution of shipments through the processor GO balík s.r.o., order processing through the sales portal Fler s.r.o., and marketing purposes through Heureka Shopping s.r.o.). The Data Controller does not transfer personal data to third countries outside the EU/EEA that do not guarantee an adequate level of personal data protection.

Article X - Notification of the Existence of Relevant Rights of the Data Subject

10.1. Pursuant to the GDPR Regulation, the Data Subject has, in particular, the following rights:

Right of access to data (Art. 15): The right to obtain confirmation as to whether we process your data, to what extent, for what purpose, and the right to be provided with a copy of the processed data (provided it does not adversely affect the rights of others).
Right to rectification (Art. 16): The right to have the Data Controller rectify incorrect or complete incomplete personal data concerning the data subject without undue delay.
Right to erasure / Right to be forgotten (Art. 17): The right to request the deletion of data if it is no longer necessary for the specified purposes, if you withdraw your consent, or if the data was processed unlawfully (does not apply if processing is necessary to fulfill a legal or archiving obligation).
Right to restriction of processing (Art. 18): The right to request that the Data Controller restrict processing (e.g., if you contest the accuracy of the data, for a period enabling verification).
Right to data portability (Art. 20): The right to receive your data in a structured, commonly used, and machine-readable format and to transmit those data to another controller, if the processing is carried out by automated means.
Right to object (Art. 21): The right to object at any time to the processing of data for direct marketing purposes, including profiling. If the Data Subject objects, the data must no longer be processed for marketing.
Rights related to automated decision-making (Art. 22): The right not to be subject to a decision based solely on automated processing, including profiling, except where necessary for entering into or performing a contract.

Article XI - Notification of the Data Subject's Right to Withdraw Consent

11.1. The Data Subject is entitled to withdraw their consent to the processing of personal data at any time (in whole or in part) without affecting the lawfulness of processing based on consent before its withdrawal.

11.2. The Data Subject may exercise the right to withdraw consent in paper form sent to the address of the Data Controller's registered office or in electronic form by sending an e-mail to the e-mail address: info@ninascrunchies.com.

Article XII - Notification of the Data Subject's Right to Lodge a Complaint with a Supervisory Authority

12.1. The Data Subject has the right to lodge a complaint with a supervisory authority if they believe that the processing of personal data relating to them violates the GDPR Regulation or the Personal Data Protection Act.

12.2. The supervisory authority in the Slovak Republic is:

Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
Address: Hraničná 12, 820 07 Bratislava 27, Slovak Republic
Tel. contact: +421 /2 3231 3214
E-mail: statny.dozor@pdp.gov.sk

Article XIII - Information Related to Automated Decision-Making Including Profiling

13.1. Since the Data Controller does not perform processing of the Data Subject's personal data in the form of automated decision-making, including profiling as referred to in Article 22(1) and (4) of the Regulation, this type of processing does not apply.

Article XIV - Final Provisions

14.1. This Privacy Policy, notifications, and cookies directive form an integral part of the General Terms and Conditions and the Complaint Procedure of this Website.

14.2. This Privacy Policy comes into force and takes effect upon its publication on the Seller's Website on June 12, 2026.