PERSONAL DATA PROTECTION POLICY AND CONSUMER RIGHTS
In accordance with the applicable Personal Data Protection Act, the Electronic Communications Act and the General Data Protection Regulation (GDPR), EYWINEO eterična olja, Vinko Nedelko s.p. (hereinafter the seller) assures the following rights regarding the protection of personal data, which are listed below:
- data operator
- purpose of data processing and type of personal data
- visit and use of the website
- retention period
- the right of access to data
- the right to rectification
- the right to erasure of personal data (“right to be forgotten”)
- the right to restrict the processing of personal data
- the right to data portability
- the right to objecting to processing
PERSONAL DATA PROTECTION POLICY AND CONSUMER RIGHTS
Data operator
The operator of consumer’s personal data is EYWINEO eterična olja, Vinko Nedelko s.p., Rošpoh-del 157B, 2351 Kamnica, Slovenia.
Purpose of data processing and type of personal data
Any personal data provided by the consumer will be treated confidentially and used only for the purposes for which the consumer provided it. If there is a need to further process consumer’s data for any other purpose, the data operator will inform the consumer in advance and ask for consumer’s consent.
Visit and use of the website
Each time the consumer visits the web page www.eywineo.eu the web server automatically saves the log file (e.g. IP number — a number that identifies each computer or other device associated with the Web; browser version, visit time, and the like). This data are processed for the purposes of keeping statistics about the website visit. EYWINEO eterična olja, Vinko Nedelko s.p. processes the collected data separately and does not associate them with other data.
Retention period
The data operator assures the consumer that consumer’s data will be kept only for the period that is necessary to fulfill the purpose for which the data were collected and used, namely:
- Web server log files are retained for 3 (three) months;
- consumer’s contact details for communication purposes are processed until the transaction is completed or the communication is completed;
- if there is a different legal retention period for contractual agreements (e.g. accounting or tax data) the retention period shall be 10 (ten) years. In that period data processing is limited;
- when the data are no longer required they will be immediately, securely and permanently disposed of.
The Right of access to data
The consumer has the right to obtain information from the data operator whether his/her personal data are being processed, and if this is the case, the consumer has the right to access the following information regarding the processing of personal data:
- purpose of the processing,
- categories of personal data being processed,
- recipient or categories of recipients of the personal data, especially third (non EU) countries and international organizations,
- where possible, retention periods or the criteria used to determine them,
- the right to demand a rectification or erasure or restricted processing of personal data ,
- the right to file a complaint with a supervisory authority,
- sources of personal data when those are not provided by the consumer,
- the existence of automated decision-making, including profiling, and meaningful information on the reasons for it, as well as the significance and foreseeable consequences of such processing for the consumer.
Based on consumer’s request, the data operator will provide the consumer with a free copy of consumer’s personal data that are being processed. For additional required copies the data operator may charge to the consumer a reasonable fee, taking into account administrative costs.
The Right to rectification
The consumer has the right to require that data operator rectifies consumer’s inaccurate personal data without undue delay. Taking into account the purpose of the processing, the consumer has the right to supplement incomplete personal data.
The Right to erasure (“right to be forgotten”)
The consumer has the right to request that the data operator erases his/her personal data without undue delay, and the data operator is required to erase consumer’s personal data without undue delay in the following cases:
- the personal data are no longer necessary for the reason they were originally collected or processed;
- when the consumer withdraws his/her consent which has been the lawful basis for holding the data;
- when the data operator is processing consumer’s personal data for direct marketing purposes and the consumer objects;
- when the data operator has processed consumer’s personal data unlawfully;
- when personal data need to be erased in order to comply with a legal obligation of EU or Slovenian laws.
The data operator shall take reasonable steps, including technical measures, to be able to inform data processors that the consumer requests that any links to or copies of personal data be erased.
The right to restrict processing
The consumer has the right to limit the way the data operator uses consumer’s data. The right is not absolute and only applies if:
- the consumer contests the accuracy of his/her personal data and the data operator is verifying it;
- the data have been unlawfully processed and the consumer doesn’t want them erased but requests instead a restricted use of them;
- when the data operator no longer needs personal data for the purpose of processing but is required by the consumer to keep them in order to establish, exercise or defend a legal claim;
- when the consumer has raised an objection to processing of his/her data and the data operator is considering whether legitimate grounds override those of the consumer.
The right to data portability
The consumer has the right to receive personal data that he/she provided to the data operator in a structured, commonly used and machine-readable format and the right to transmit those data to another data operator. The right applies when the following conditions are met:
- processing is based on the consumer’s consent or a contract;
- processing is carried out by automated means.
The right to object to processing
The consumer has the right to object to the processing of his/her personal data at any time. The applicability of this right depends on the purposes that the data operator has for the processing and on the lawful basis for processing. The consumer has the absolute right to object to the processing of his/her data if it is for direct marketing purposes. When direct marketing is based on the consumer’s consent, the right to object to the processing may be exercised by consumer withdrawing the consent.
The procedure for the exercise of the rights
The consumer may exercise his/her rights in regards to the personal data protection by addressing his/her claim in writing to the data operator: by e-mail to info@eywineo.eu or by post to: EYWINEO eterična olja, Vinko Nedelko s.p., Rošpoh-del 157B, 2351 Kamnica, Slovenia.
If the consumer submits the claim by e-mail, the response will be provided by e-mail, as well, unless the consumer specifically demands that the response be provided by another means.
For the purposes of a reliable identification, the data operator may request that the consumer provides additional information necessary for the authentication of consumer’s identity, and may refuse to act in accordance with this chapter if it proves that the consumer cannot be reliably identified.
The data operator will respond without undue delay and no later than one month after the receipt of the claim with which the consumer is exercising his/her right to the personal data protection. The data operator may extend the response deadline by maximum two additional months on the reason of complexity and number of claims. In that event the data operator will inform the consumer within one month of the reception of consumer’s claim, giving the reasons for a delayed response.
If consumer’s claims under this chapter prove to be manifestly unfounded or excessive or repetitive the data operator may:
- charge a reasonable fee based on the administrative costs of complying with the claim,
- refuse to deal with the claim.
The right to file a complaint concerning the processing of personal data
The consumer may file a complaint regarding the processing of his/her personal data in writing to the data operator: by e-mail to info@eywineo.eu or by post to: EYWINEO eterična olja, Vinko Nedelko s.p., Rošpoh-del 157B, 2351 Kamnica, Slovenia.
The consumer may also file a complaint directly with the Information Commissioner if the consumer believes that the processing of his/her personal data violates Slovenian regulations or the EU Data Protection Directive.
Validity
The personal data protection policy is in force as of 1st of June 2020 and may be amended or supplemented at any time. The consumer is therefore asked to check for the most recent version prior to communicating his/her personal data.
