Information on the processing of personal data


Consent to the processing of personal data - user registration

  1. When registering for a user account, as well as when ordering goods, the personal data entered by the buyer is processed. This processing is used for the creation and functioning of the account and for the administration of orders. Information about the personal data processed for the purpose of ordering goods is displayed to the buyer for confirmation before the order is placed. The personal data entered when registering for a user account for the purpose of administration are listed below. Carun (hereinafter also referred to as the "Administrator") processes the following personal data of the Buyer within the meaning of the GDPR - Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "Regulation"):
    • name and surname;
    • telephone number;
    • e-mail address;
    • delivery address;
    • billing address;
    • company name;
    • registered office;
    • company ID, tax number;
    • bank account number.
  2. The aforementioned personal data of the buyer will be processed for the purpose of identification of the contracting parties, communication between the contracting parties and the performance of the concluded contract, for the duration of the contractual relationship and for a period of 10 years, unless the legislation requires processing for a longer period or unless such processing is necessary for the purpose of protecting the rights and legally protected interests of the Administrator.

  3.  The email address in case of purchase of goods may be processed for the purpose of sending bills and inclusion in the database for sending commercial communications. This procedure is allowed by Section 7(3) of Act No. 480/2004 Coll., on Information Society Services, on the basis of the purchase of goods, unless you refuse it. These communications may only relate to similar goods and can be opted out at any time in a simple way - by sending a letter, emailing faktury@carun.cz or clicking on the link in the commercial communication.

  4. The Seller declares that all personal data is confidential and will not be disclosed to any third party. The exceptions are carriers to whom the Buyer’s' personal data is transferred to the minimum extent necessary for the delivery of goods, providers of evaluation services to whom the Buyer’s personal data is transferred to the minimum extent necessary for the evaluation to take place, providers of payment gateways to whom the Buyer’s personal data is transferred to the minimum extent necessary to enable the payment of the order, as well as processors, which may be:
    1. Web hosting provider, WEDOS Internet, a.s., ID 28115708, with registered office at Masarykova 1230, Hluboká nad Vltavou, 373 41, registered in the public register kept by the Regional Court in České Budějovice in section B, insert 1886.
    2. Provider of the cloud solution for the accounting system, iPodnik Cloud s.r.o., with registered office at Jiráskova 306, Jinočany, 252 25, C 159262, registered with the Municipal Court in Prague.
    3. The payment gateway provider - PayU S.A. , ul. Grunwaldzka 186, 60-166 Poznan, Poland.
    4. Individual dispensing points, if the customer chooses to have the goods delivered to the dispensing point of the franchised retailer or carrier.
    5. Alternatively, other providers of processing software, services and applications, but not currently used by the Administrator.

  5. The Buyer acknowledges that under the Regulation, the Buyer has the right to:
    • request information from the Seller as to what personal data it processes;
    • request access to such data from the Seller and have it updated or corrected, or request a restriction of processing;
    • to request the company to delete personal data - the company will delete the personal data if the deletion is not contrary to paragraph 4 of this information and the legitimate interests of the company;
    • object in the case of processing carried out on the basis of a legitimate interest of the Seller;
    • to data portability and the right to request a copy of the personal data processed, to lodge a complaint with the Data Protection Authority and the right to effective judicial protection if he considers that his rights under the Regulation have been infringed as a result of the processing of his personal data in breach of the Regulation.