PRIVACY POLICY AND COOKIE NOTICE
Privacy Policy and Cookie Notice provided by the data controller to the data subject when collecting personal data from the data subject, and the Cookie Notice for the online store www.vionys.store
I. Data Controller
1.1. The identity and contact information of the Data Controller are as follows:
Business Name: Viola Galbová - VIONYS
Place of business: 96241 Čekovce 214, Slovak Republic
Registered with the Zvolen District Office, Trade License No. 670-35010
Company ID: 56410662
Tax ID: 1129959457
The Seller is not a VAT payer
1.2. The Operator’s email and phone contact information is:
Email: vionys.business@gmail.com
Phone: +421901710204
1.3. The Operator’s mailing address:
Viola Galbová – VIONYS, 96241 Čekovce 214, Slovensko
1.4. The Controller hereby, in accordance with Article 13(1) and (2) Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “Regulation”), as well as in accordance with Act No. 18/2018 Coll., the Act on the Protection of Personal Data and on Amendments to Certain Acts, as amended, and in accordance with Act No. 452/2021 Coll. the Act on Electronic Communications, as amended, provides the Data Subject—(the Buyer)—from whom the Controller (the Seller) collects personal data concerning the Data Subject with the following information, instructions, and explanations:
II. Links
2.1. This Privacy Policy and these instructions on personal data protection form part of the General Terms and Conditions published on the Seller’s website.
2.2. The Merchant informs consumers that there are no specific applicable codes of conduct to which the Seller has committed to comply; a “code of conduct” is understood to mean an agreement, or a set of rules defining the Seller’s conduct, which the Seller has undertaken to comply with in relation to one or more specific commercial practices or business sectors, provided that such practices or sectors are not governed by law, other legal regulations, or measures issued by a public authority to which the Seller has undertaken to comply, and regarding the manner in which a consumer may become familiar with them or obtain their text.
III. Duration
3.1. The Controller retains the Data Subject’s personal data only for as long as is strictly necessary to fulfill the contract and for subsequent archiving in accordance with the statutory retention periods imposed on the Controller by law. If the Data Subject has consented to receiving promotional emails and similar offers, the Data Subject’s personal data will be processed for these purposes until the Data Subject revokes their consent. However, this will not exceed a period of 5 years.
IV. Personal Data Processed
4.1. The Controller processes the following personal data on its website: first name, last name, address, email address, phone number, billing address, shipping address, data obtained from cookies, and IP addresses.
4.2. In connection with the various forms and features of the website, the Controller further processes, in particular:
4.2.1. for the contact form (available on the Contact page): first name, last name, email address, and the content of the question or specific request, such as an inquiry about the offered handmade products (jewelry, decorations, accessories) or the possibility of custom production,
4.2.2. when subscribing to the newsletter: email address, based on the consent provided upon subscription,
4.2.3. When registering and managing a user account (the “My Account” feature natively offered by the WooCommerce platform): first name, last name, email address, phone number, billing and shipping addresses, password (in encrypted form), and order history.
V. Contact Information for the Data Protection Officer
5.1. The Controller has not appointed a data protection officer in accordance with Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
5.2. The Controller is also the Seller as defined in the General Terms and Conditions of this website.
VI. Purposes of Processing the Data Subject’s Personal Data and the Duration of Such Processing
6.1. The purposes of processing the Data Subject’s personal data are, in particular:
6.1.1. recording, creating, and processing contracts and client data for the purpose of entering into contracts with third parties.
6.1.2. processing accounting documents and documents related to the Controller’s business activities.
6.1.3. compliance with legal regulations regarding the archiving of documents and records, e.g., pursuant to Act No. 431/2002 Coll., the Accounting Act, as amended, and other relevant regulations.
6.1.4. The Operator’s activities related to fulfilling the Data Subject’s requests, orders, contracts, and similar arrangements, including handling inquiries and special requests submitted via the contact form on the website, particularly regarding the handmade products offered.
6.1.5. Ensuring the operation, functionality, and security of the website and the purchasing process on the WooCommerce (WordPress) platform.
6.1.6. The Controller’s newsletters, marketing, and similar promotional activities, including sending updates via the subscription form. This applies if the Data Subject has granted the Controller consent for marketing and similar promotional activities.
VII. Legal Basis for the Processing of the Data Subject’s Personal Data
7.1. If the Controller processes personal data based on the Data Subject’s consent, such processing will commence only after the Data Subject has granted such consent.
7.2. If the Controller processes the Data Subject’s personal data for the purposes of negotiating pre-contractual relationships and the conclusion and performance of a sales contract, as well as the related delivery of goods, products, or services. The Data Subject is required to provide personal data for the proper performance of the sales contract; otherwise, performance cannot be ensured. Personal data for this purpose is processed without the Data Subject’s consent.
7.3. In the case of personal data processing through analytical and marketing cookies and similar technologies, the legal basis for processing is the Data Subject’s consent granted via the cookie consent management tool on the website. The legal basis for the processing of personal data through essential cookies (in particular, cookies ensuring the functionality and security of the WooCommerce platform and the shopping cart) is the Controller’s legitimate interest in ensuring the functionality and security of the website.
VIII. Recipients or Categories of Recipients of Personal Data
8.1. The recipients of the Data Subject’s personal data will be, or at a minimum may be:
8.1.1. the Controller’s statutory bodies or their members;
8.1.2. persons performing work for the Controller in an employment or similar relationship.
8.1.3. the Controller’s sales representatives and other persons cooperating with the Controller in the performance of the Controller’s tasks. For the purposes of this document, all natural persons performing dependent work for the Controller on the basis of an employment contract or agreements regarding work performed outside of an employment relationship shall be considered employees of the Controller.
8.1.4. Recipients of the Data Subject’s personal data will also include the Controller’s collaborators, business partners, suppliers, and contractual partners, specifically: an accounting firm, a company providing services related to the creation, hosting, and maintenance of the e-shop platform, a company providing legal services to the Controller, a company providing consulting services to the controller, companies handling the transportation and delivery of products (handmade items) to buyers and third parties, marketing companies, companies operating social media platforms, companies providing payment gateways and other payment methods.
8.1.5. Recipients of personal data will also include courts, law enforcement agencies, the tax office, and other government authorities, if required by law. Personal data will be provided by the Controller to the relevant authorities and government institutions based on and in accordance with the laws of the Slovak Republic.
8.1.6. List of third parties—processors and recipients—who process the Data Subject’s personal data:
Web hosting provider ensuring the technical operation of the website on the WooCommerce (WordPress) platform—a third party providing hosting, technical operation, and website tools, including the contact and newsletter forms.
Packeta Slovakia s. r. o., with its registered office at Sliačska 1E, 831 02 Bratislava – Nové Mesto district, Company ID No.: 48136999 – a third party providing shipping services
GoPay Czech, Senovážné nám. 1736, 370 01, České Budějovice, Czech Republic, Company ID No.: 22177469 – a third party providing a payment gateway.
IX. Information on the Transfer of Personal Data to Third Countries and the Retention Period:
9.1. Applicable. The controller transfers individuals’ personal data in the form of cookies to third countries to the following entities:
GOOGLE Pixels: Google HQ. 1600 Amphitheatre Parkway. Mountain View, CA 94043, USA. For more information on privacy, please visit:
https://business.safety.google/privacy/
https://business.safety.google/privacy/google-services/
https://business.safety.google/privacy/display-advertising/
9.2. In the event of a transfer of personal data to a third country, the Controller, or the relevant tool provider, ensures appropriate safeguards in accordance with Article 46 of the Regulation, in particular through standard contractual clauses approved by the European Commission.
X. Notice Regarding the Data Subject’s Relevant Rights:
10.1. The Data Subject has, among others, the following rights, provided that:
10.1.1. Section 10.1 does not affect the Data Subject’s other rights.
10.1.2. The Data Subject’s right of access to data pursuant to Article 15 of the Regulation, which includes: the right to obtain confirmation from the Controller as to whether the Controller is processing the Data Subject’s personal data, and if so, to what extent. Furthermore, if such data is being processed, the Data Subject has the right to ascertain its content and to request from the Controller information regarding the purpose of its processing, in particular information regarding: The purpose of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly in the case of recipients in third countries or international organizations, the anticipated period of retention of the personal data or, if this is not possible, information on the criteria for determining that period; the existence of the right to request from the Controller the rectification of personal data concerning the Data Subject or their erasure or restriction of processing; and the existence of the right to object to such processing; the right to lodge a complaint with a supervisory authority; if the personal data were not obtained from the Data Subject, any available information regarding their source; the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, and in such cases, at least meaningful information regarding the procedure used, as well as the significance and anticipated consequences of such processing of personal data for the Data Subject, on the appropriate safeguards pursuant to Article 46 of the Regulation concerning personal data, if the personal data are transferred to a third country or an international organization.
10.1.3. the right to receive a copy of the personal data being processed, provided that the right to receive a copy of the processed personal data does not adversely affect the rights and freedoms of others.
10.1.4. The Data Subject’s right to rectification under Article 16 of the Regulation, which includes the right: to have the Controller rectify, without undue delay, any inaccurate personal data concerning the Data Subject. the right to have incomplete personal data concerning the Data Subject completed, including by means of a supplementary statement from the Data Subject; the Data Subject’s right to erasure of personal data (the so-called “right to be forgotten”) pursuant to Article 17 of the Regulation, which provides for:
10.1.5. the right to obtain from the Controller, without undue delay, the erasure of personal data concerning the Data Subject if any of the following grounds apply: the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, the Data Subject withdraws the consent on which the processing is based, provided that there is no other legal basis for the processing of personal data; the Data Subject objects to the processing of personal data pursuant to Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing of personal data, or the data subject objects to the processing of personal data pursuant to Article 21(2) of the Regulation, the personal data has been processed unlawfully, the personal data must be erased to comply with a legal obligation under European Union law or the law of the Member State to which the Controller is subject, or the personal data was collected in connection with the provision of information society services pursuant to Article 8(1) of the Regulation;
10.1.6. the right to have the Controller who has disclosed the Data Subject’s personal data take appropriate measures, including technical measures, taking into account available technology and the cost of implementing such measures, to inform other controllers who process personal data that the Data Subject requests that they erase all links to such personal data, as well as any copies or replicas thereof; provided, however, that the right to erasure of personal data, as set forth in Article 17(1) and (2) of the Regulation, shall not apply if the processing of personal data is necessary:
10.1.7. to exercise the right to freedom of expression and information;
10.1.8. to comply with a legal obligation that requires processing under European Union law or the law of a Member State to which the Controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the Controller.
10.1.9. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) of the Regulation, as well as Article 9(3) of the Regulation.
10.1.10. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) of the Regulation, provided that the right referred to in Article 17(1) of the Regulation would prevent or seriously impede the achievement of the purposes of such processing of personal data; or for the establishment, exercise, or defense of legal claims;
10.1.11. the Data Subject’s right to restrict the processing of personal data pursuant to Article 18 of the Regulation, which includes:
10.1.12. the right to have the Controller restrict the processing of personal data in any of the following cases: The Data Subject contests the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data; the processing of personal data is unlawful, and the Data Subject opposes the erasure of the personal data and requests, instead, the restriction of its use; the Controller no longer needs the personal data for the purposes of processing, but the Data Subject needs it to establish, exercise, or defend legal claims; the Data Subject has objected to the processing pursuant to Article 21(1) of the Regulation, pending verification of whether the legitimate grounds of the controller override those of the data subject;
10.1.13. the right, in the event that the processing of personal data is restricted, such restricted personal data, with the exception of storage, be processed only with the data subject’s consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of an important public interest of the European Union or a Member State;
10.1.14. the right to be informed in advance of the lifting of restrictions on the processing of personal data;
10.1.15. the Data Subject’s right to have the Controller fulfill the notification obligation to recipients pursuant to Article 19 of the Regulation, which provides for: the right to have the Controller notify each recipient to whom personal data has been disclosed of any rectification or erasure of personal data or restriction of processing carried out pursuant to Article 16, Article 17(1) and Article 18 of the Regulation, unless this proves impossible or involves disproportionate effort; the right for the Controller to inform the Data Subject of these recipients if the Data Subject so requests;
10.1.16. the Data Subject’s right to data portability pursuant to Article 20 of the Regulation, which includes: the right to receive personal data concerning the Data Subject and provided to the Controller in a structured, commonly used, and machine-readable format, and the right to transmit such data to another controller without hindrance from the Controller, if:
a/ the processing is based on the Data Subject’s consent pursuant to Article 6(1)(a) of the Regulation or Article 9(2)(a) of the Regulation, or on a contract pursuant to Article 6(1)(b) of the Regulation, and at the same time
b/ the processing is carried out by automated means, and at the same time:
10.1.17. the right to receive personal data in a structured, commonly used, and machine-readable format and the right to transmit such data to another controller without hindrance from the Controller, provided that this does not adversely affect the rights and freedoms of others;
10.1.18. the right to have personal data transmitted directly from one controller to another controller, where technically feasible;
10.1.19. the Data Subject’s right to object pursuant to Article 21 of the Regulation, which provides for:
10.1.20. the right to object at any time, on grounds relating to the specific situation of the Data Subject, to the processing of personal data concerning him or her that is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including the right to object to profiling based on these provisions of the Regulation;
10.1.21. In the event that the right to object at any time, on grounds relating to the specific situation of the Data Subject, to the processing of personal data concerning him or her, which is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including an objection to profiling based on these provisions of the Regulation; the right to have the Controller cease further processing of the Data Subject’s personal data unless the Controller demonstrates compelling legitimate grounds for the processing that override the interests, rights and freedoms of the Data Subject, or grounds for the establishment, exercise, or defense of legal claims
10.1.22. the right to object at any time to the processing of personal data concerning the Data Subject for direct marketing purposes, including profiling to the extent that it is related to direct marketing; provided that if the Data Subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes;
10.1.23. in connection with the use of information society services, the right to exercise the right to object to the processing of personal data by automated means using technical specifications;
10.1.24. the right to object, on grounds relating to the specific situation of the Data Subject, to the processing of personal data concerning the Data Subject, where the personal data are processed for the purposes of scientific or historical research or for statistical purposes pursuant to Article 89(1). of the Regulation, except where the processing is necessary for the performance of a task carried out for reasons of public interest;
10.1.25. the Data Subject’s right regarding automated individual decision-making under Article 22 of the Regulation, which includes:
10.1.26. the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects him or her, except in cases provided for in Article 22(2) of the Regulation, i.e., with the exception of cases where the decision is: (a) necessary for the conclusion or performance of a contract between the Data Subject and the Controller, (b) permitted by European Union law or the law of a Member State to which the Controller is subject, and which also provides for appropriate measures to safeguard the rights, freedoms, and legitimate interests of the Data Subject; or (c) based on the Data Subject’s explicit consent.
XI. Information on the Data Subject’s Right to Withdraw Consent to the Processing of Personal Data:
11.1. The Data Subject is entitled to withdraw their consent to the processing of personal data at any time, without this affecting the lawfulness of the processing of personal data based on the consent given prior to its withdrawal.
The Data Subject is entitled at any time to withdraw their consent to the processing of personal data—in whole or in part. A partial withdrawal of consent to the processing of personal data may relate to a specific type of processing operation or operations, while the lawfulness of the processing of personal data with respect to the remaining processing operations remains unaffected. A partial withdrawal of consent to the processing of personal data may relate to a specific purpose of processing personal data or specific purposes of processing personal data, while the lawfulness of the processing of personal data for other purposes remains unaffected.
The Data Subject may exercise the right to withdraw consent to the processing of personal data in writing to the Controller’s address registered as its registered office in the Commercial Register at the time of withdrawal of consent to the processing of personal data, or electronically via electronic means (by sending an email to the Controller’s email address provided in the Controller’s identification section of this document).
XII. Information on the Data Subject’s Right to File a Complaint with a Supervisory Authority:
12.1. The Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work, or in the place where the alleged infringement occurred, if the Data Subject believes that the processing of personal data concerning him or her is in violation of the Regulation, all without prejudice to any other administrative or judicial remedies.
The data subject has the right to be informed by the supervisory authority to which the complaint was filed, in their capacity as the complainant, of the progress and outcome of the complaint, including the possibility of seeking judicial remedy pursuant to Article 78 of the Regulation.
12.2. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Center II; Galvaniho 7/B; 821 04 Bratislava, Slovakia.
Phone: +421 2 32 31 32 14, Email: statny.dozor@pdp.gov.sk,
XIII. Information Regarding Automated Decision-Making, Including Profiling:
13.1. Since, in the case of the Controller, the processing of the Data Subject’s personal data does not involve automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, the Controller is not required to provide the information specified in Article 13(2)(f) of the Regulation, i.e., information regarding automated decision-making, including profiling, and the procedure used, as well as the significance and anticipated consequences of such processing of personal data for the Data Subject. Not applicable.
XIV. Protection of Personal Data and Use of Cookies. Information and Explanation Regarding Cookies, Scripts, and Pixels
14.1. The website operator provides the following brief explanation of the function of cookies, scripts, and pixels:
14.1.1. Cookies are text files containing a small amount of information that are downloaded to your device when you visit a website. Thanks to these files, the website temporarily stores information about your actions and preferences (such as your username, language, font size, and other display settings), so you do not have to re-enter them the next time you visit the website or browse its individual pages
A script is a piece of code used to ensure the proper and interactive functioning of web pages. This code runs on the operator’s server or on your device.
A pixel is a small, invisible piece of text or an image on a web page that is used to track website traffic. To enable this, various types of data are stored via pixels.
14.1.2. Cookies are categorized as follows
Essential cookies – ensure the proper functioning of the Operator’s website and its use. These cookies are used without consent.
Functional cookies – relate to users’ choices regarding the use of cookies on the website, including the options to accept, reject, or customize cookie settings based on their privacy preferences.
Statistical cookies – The Operator collects statistics regarding the use of its website. These cookies are used only with consent.
Advertising cookies – Used to create advertising profiles and for similar marketing activities. These cookies are used only with consent.
14.2. How to manage cookies:
14.2.1. You can manage and/or delete cookies at your discretion—see aboutcookies.org for details. You can delete all cookies stored on your computer or other device, and you can configure most browsers to prevent them from being stored. You can also change your preferences regarding individual categories of cookies at any time directly on the Operator’s website using the cookie consent management tool.
14.3.1. Cookies Used
Essential cookies
Cookie | Location / Duration | Description / Purpose |
PHPSESSID | First-party / Session | A first-party session cookie generated by the WordPress platform. It is used to maintain user session variables, such as keeping the user logged in across pages. |
woocommerce_cart_hash | First-party / Session | A necessary WooCommerce cookie that helps detect changes to the shopping cart contents. |
woocommerce_items_in_cart | First-party / Session | A required WooCommerce cookie that indicates whether there are items in the cart. |
wp_woocommerce_session_ | First page / 2 days | An essential cookie containing a unique code for each customer, which allows the WooCommerce platform to retrieve order data stored in the database. |
14.3.2. Cookies Shared with Third Parties:
Google HQ. 1600 Amphitheatre Parkway. Mountain View, CA 94043, USA. For more information on privacy, please visit:
https://business.safety.google/privacy/
https://business.safety.google/privacy/google-services/
https://business.safety.google/privacy/display-advertising/
XV. Special Provisions
15.1. This Privacy Policy, Privacy Notice, and Cookie Policy form an integral part of the General Terms and Conditions and the Complaints Procedure. The documents—the General Terms and Conditions and the Complaints Procedure for this Website—are published on the Seller’s Website domain.
XVI. Final Provisions
16.1. This Privacy Policy shall become valid and effective upon its publication on the Seller’s Website on September 29, 2026
This online store is certified by https://www.pravoeshopov.sk