Personal Data Processing Policy

Dear Customer,

We would like to inform you how iRefurb s. r. o., with its registered seat at Mlynské nivy 18890/5, 821 09 Bratislava – Ružinov, Slovak Republic, Company ID No.: 57 145 342, registered in the Commercial Register maintained by the Municipal Court Bratislava III, Section Sro, Insert No. 191572/B (hereinafter referred to as "we" or the "Company"), processes your personal data in connection with the operation of the online store, the sale of goods, communication with customers and the handling of complaints.

The purpose of this Personal Data Processing Policy is to provide you with clear information, in particular regarding:

what personal data we process;
for what purposes and on what legal basis we process such data;
from which sources we obtain the data;
to whom the data may be disclosed;
how long the data are retained;
what rights you have in the field of personal data protection and how you may exercise them.

If you have any questions or wish to exercise your rights, please contact us at the following e-mail address: contact@irefurb.com, or in writing at the registered seat of the Company specified in the General Terms and Conditions of our Company (hereinafter referred to as the "GTC").

Article 1 - General Information

The processing of personal data is necessary for our Company primarily for the purposes of concluding and performing a purchase agreement concluded through the online store, handling complaints, fulfilling legal obligations (in particular in the areas of consumer protection, accounting and taxation), and protecting our legal claims.
The provision of personal data to the extent necessary for processing an order constitutes a contractual requirement. Without providing such data, it is not possible to properly process the order or fulfil the legal obligations associated with the sale of Goods.
In certain cases, we may also process personal data on the basis of your consent, in particular for the purposes of sending marketing communications or personalised offers. Granting consent is voluntary and its refusal has no impact on the possibility to conclude a purchase agreement. You may withdraw your consent at any time.
Unless stated otherwise, this Personal Data Processing Policy shall also apply, as appropriate, to the processing of personal data of:
1. persons who have expressed interest in our products or services;
2. former customers;
3. persons who communicate with us;
4. representatives or contact persons of legal entities.
When processing personal data, we act in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "GDPR") and Act No. 18/2018 Coll. on Personal Data Protection, as amended, as well as other applicable legal regulations of the Slovak Republic, and we observe in particular the following principles:
1. Personal data are processed in a lawful, fair and transparent manner and solely for predetermined, explicitly stated and legitimate purposes.
2. We process only those personal data that are adequate, relevant and necessary in relation to the purpose of processing.
3. We take reasonable steps to ensure that personal data are accurate and, where necessary, kept up to date.
4. Personal data are retained only for the period necessary to achieve the purpose of processing or for the period required by applicable law.
5. We apply appropriate technical and organisational measures to ensure the protection of personal data against unauthorised access, loss, destruction or misuse.
6. Persons who come into contact with personal data are bound by a duty of confidentiality.

Article 2 - Purposes of Processing and Legal Basis for the Processing of Personal Data

1. Processing Without the Need for Consent of the Data Subject

1.1 We process personal data without the consent of the data subject where such processing is necessary for the performance of a contract, compliance with a legal obligation, or for the purposes of the legitimate interests of the controller.
1.2 We process personal data pursuant to Article 6(1)(b) of the GDPR where the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract. On this legal basis, we process personal data primarily for the purposes of:
1. receiving and processing an order;
2. concluding and performing the purchase agreement;
3. delivery of the Goods;
4. communication with the customer in relation to the order;
5. handling complaints and exercising rights arising from liability for defects;
6. provision of after-sales services.
The provision of personal data to the extent necessary for the conclusion and performance of the contract constitutes a contractual requirement. Without providing such data, it is not possible to conclude or properly perform the contract.
1.3 We process personal data pursuant to Article 6(1)(c) of the GDPR where the processing is necessary for compliance with a legal obligation to which the controller is subject. These obligations arise in particular from:
1. Act No. 108/2024 Coll. on Consumer Protection, as amended;
2. Act No. 40/1964 Coll., the Civil Code, as amended;
3. Act No. 431/2002 Coll. on Accounting, as amended;
4. Act No. 222/2004 Coll. on Value Added Tax, as amended;
5. Act No. 595/2003 Coll. on Income Tax, as amended;
6. other generally binding legal regulations of the Slovak Republic.
On this legal basis, we process personal data primarily for the purposes of maintaining accounting and tax records, retaining accounting documents, handling complaints and fulfilling statutory information and record-keeping obligations.
1.4 We may process personal data pursuant to Article 6(1)(f) of the GDPR where processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject. The legitimate interests of the controller include in particular:
1. protection of the controller's rights and legal claims;
2. recovery of receivables;
3. resolution of disputes;
4. ensuring the security of information systems;
5. protection of property (for example through the use of a CCTV system, if applied).
Prior to processing personal data on the basis of legitimate interest, we always assess the proportionality of such processing and its impact on the rights of the data subject.

2. Processing Based on the Consent of the Data Subject

2.1 We process personal data pursuant to Article 6(1)(a) of the GDPR where the data subject has given consent to the processing of their personal data for one or more specific purposes.
2.2 On the basis of voluntary consent, we may process personal data primarily for the purposes of:
1. sending marketing and commercial communications;
2. informing customers about news, promotions and discounts;
3. sending personalised product offers;
4. conducting satisfaction surveys or marketing research;
5. profiling for the purposes of adapting marketing communication (where applicable).
2.3 Providing consent is voluntary and is not a condition for the conclusion of a purchase agreement or the provision of services unless expressly stated otherwise.
2.4 The data subject is entitled to withdraw the granted consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to its withdrawal.

3. Sources of Personal Data

We obtain personal data primarily:

directly from the data subject, in particular when creating an order, concluding a contract, registering in the online store or communicating with the controller;
indirectly in connection with the performance of the contract, in particular from payment service providers (e.g. information regarding the success or failure of a payment), or from other contractual partners where necessary for the proper performance of the contract;
from the controller's own activities, in particular by recording data related to orders, complaints and mutual communication.

Article 3 - Rights of the Data Subject

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed and, where that is the case, the right to obtain access to such personal data and the information referred to in Article 15 of the GDPR, in particular information on the purposes of the processing, the categories of personal data concerned, the recipients, the retention period and the rights of the data subject.
The data subject shall have the right to obtain the rectification of inaccurate personal data concerning them and, taking into account the purposes of the processing, the right to have incomplete personal data completed pursuant to Article 16 of the GDPR.
The data subject shall have the right to obtain the erasure of personal data pursuant to Article 17 of the GDPR where one of the grounds set out therein applies, in particular where the personal data are no longer necessary in relation to the purposes for which they were collected or where the data subject withdraws consent and there is no other legal basis for the processing. The right to erasure shall not apply where the processing is necessary, in particular for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
The data subject shall have the right to request restriction of processing of personal data pursuant to Article 18 of the GDPR, in particular where the data subject contests the accuracy of the personal data or objects to the processing.
Where the processing is based on consent or on a contract and is carried out by automated means, the data subject shall have the right to receive the personal data concerning them in a structured, commonly used and machine-readable format and the right to transmit those data to another controller pursuant to Article 20 of the GDPR.
The data subject shall have the right to object at any time to the processing of personal data concerning them where such processing is carried out on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to such processing; in such a case, the controller shall no longer process the personal data for those purposes.
Where processing is based on consent, the data subject shall have the right to withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to its withdrawal.
The data subject shall have the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava 27, Slovak Republic
E-mail: statny.dozor@pdp.gov.sk
Website: www.dataprotection.gov.sk
The data subject may exercise their rights in writing or electronically using the contact details specified in this Personal Data Processing Policy. The controller shall provide information on the measures taken without undue delay and, in any event, within one month of receipt of the request, in accordance with Article 12 of the GDPR.

Article 4 - Scope of Personal Data Processed

The controller processes personal data only to the extent necessary to achieve the purposes specified in this Personal Data Processing Policy, in particular:
1. identification data (e.g. first name, surname);
2. contact details (e.g. delivery address, e-mail address, telephone number);
3. billing data (e.g. billing address and data necessary for issuing a tax document);
4. data relating to orders and purchased Goods (e.g. identification of the Goods, price, date, method of delivery and payment);
5. data related to the exercise of rights arising from liability for defects and the handling of complaints;
6. data relating to communication with the customer (e.g. the content and date of communication).
As a rule, the controller does not process special categories of personal data pursuant to Article 9 of the GDPR. Should such data be processed exceptionally (for example where the data subject voluntarily provides such data in communication), the controller shall ensure that such data are processed only to the extent strictly necessary and only for the period necessary.

Article 5 - Recipients of Personal Data

Personal data may be disclosed, to the extent necessary, to employees and collaborators of the controller who require such data for the performance of their work or contractual duties, subject to the obligation of confidentiality.
Personal data may also be provided to other recipients, in particular:
1. providers of IT services, hosting services, administrators of information systems and technical support providers;
2. carriers and logistics partners (for the purpose of delivery of the Goods);
3. payment service providers and payment gateways (for the purpose of processing payments and preventing fraud);
4. accounting, tax and legal advisers and auditors (where necessary for the fulfilment of legal obligations or the protection of legal claims);
5. public authorities, courts and law enforcement authorities, where required by law or on the basis of a lawful request.
Where the controller entrusts the processing of personal data to a processor, this shall be done only on the basis of a contract concluded in accordance with Article 28 of the GDPR, which governs the processing of personal data and requires appropriate safeguards for the protection of personal data.

Article 6 - Transfer of Personal Data to Third Countries

As a rule, the controller processes personal data within the European Union / European Economic Area.
If, in connection with the use of specific services (for example certain IT solutions), personal data were to be transferred to a third country or an international organisation, the controller shall ensure that such transfer takes place only in accordance with the GDPR, in particular on the basis of an adequacy decision pursuant to Article 45 of the GDPR, on the basis of standard contractual clauses pursuant to Article 46 of the GDPR, or on the basis of other appropriate safeguards pursuant to Articles 46 to 49 of the GDPR.

Article 7 - Retention Period of Personal Data

The controller retains personal data only for the period necessary to achieve the purpose of processing; after the expiry of this period, the personal data shall be securely deleted, anonymised or otherwise disposed of.
As a general rule, the controller retains personal data as follows:
1. for the purposes of performing the purchase agreement, for the duration of the contractual relationship and subsequently for the period necessary for the protection of legal claims;
2. accounting and tax documents for a period of 10 years following the year to which they relate, unless a specific legal regulation provides for a longer retention period;
3. in relation to the exercise of rights arising from liability for defects and complaints, for the period required for handling the complaint and subsequently for the period necessary for the protection of legal claims;
4. for marketing purposes based on consent, until the withdrawal of such consent, but no longer than 3 years from the granting of consent unless renewed.
Where the controller processes personal data on the basis of legitimate interest, such data shall be retained for the duration of the legitimate interest, while the appropriateness of the retention period shall be regularly assessed.

Article 8 - Automated Decision-Making and Profiling

The controller does not carry out automated individual decision-making within the meaning of Article 22 of the GDPR that would produce legal effects concerning the data subject or similarly significantly affect them.
Where the controller uses profiling for the purposes of adapting marketing communication (for example segmentation of customers based on purchasing behaviour), this shall be carried out only to the extent appropriate for the purpose, and the data subject has the right to object at any time to processing for direct marketing purposes.

Article 9 - Cookies and Online Tools

The controller's website may use cookies and similar technologies that enable the storage of or access to information on the user's terminal device. The use of these technologies is governed by separate rules (Cookie Policy) published on the website and by the settings available in the cookie banner.

Article 10 - Final Provisions

This Personal Data Processing Policy shall enter into force on 1 March 2026.
The controller shall be entitled to amend or supplement this Personal Data Processing Policy to a reasonable extent, in particular in the event of changes in legal regulations, changes in the scope of services provided, or changes in the manner of processing personal data.
The current version of the Personal Data Processing Policy is always published on the controller's website.
If any provision of this Personal Data Processing Policy becomes invalid or ineffective, this shall not affect the validity and effectiveness of the remaining provisions.

LANGUAGE

COUNTRY/REGION