Privacy Policy

What personal data we process

• Basic contact details (first name, last name, phone number, email address);
• Data on the use of our websites (clicks on links, time spent) and data regarding the response to our emails (whether the message was opened, which links you clicked on);
• Data required for the fulfillment of the contract and delivery of purchased goods (item of purchase, price, delivery address, delivery time, payment method, payment date, data on complaints, invoice data, etc.).

Legal basis for the processing of personal data

We may process your personal data on the following legal bases:

• when necessary to fulfill our legal obligations (e.g., issuing invoices for purchased goods);
• when the processing of your personal data is necessary for the conclusion and fulfillment of a contract you have entered into with us or because you requested an offer from us;
• when you have given consent for the processing of your personal data for a specific processing purpose, whereby you always have the right to withdraw the given consent (e.g., for personalized information about our offer based on profiling);
• when we have a legitimate interest in processing your personal data.

Purposes of personal data processing

We may use your personal data for one or more of the following purposes:

• communicating with you regarding the provision of our services and responding to your inquiries;
• conclusion of a contract and fulfillment of obligations arising from the concluded contract;
• marketing communication (sending emails, regular mail, and SMS messages);
• marketing communication based on personalized or individualized offers and messages, based on the creation of user profiles or classification into groups, each of which can receive marketing communication with different content. When profiling, we also monitor the individual’s activity (such as the time an individual spends on certain content, which content interests them, and the opening of emails) as well as the frequency and value of past purchases;
• for the enforcement of any legal claims and resolution of disputes;
• for statistical analysis of the sale of our goods and the use of our websites;

How long we keep your personal data and what happens to it afterwards

• We keep basic personal data for as long as you have the status of our registered user on our websites or are a subscriber to our newsletter.
• Personal data that we process based on your consent is kept permanently or until you withdraw this consent.
• Data required for the conclusion and fulfillment of a contract between you and us is kept for 5 years from the fulfillment of the contract (delivery of goods).
• After the retention period expires, we effectively delete or anonymize personal data, which means that we process it in such a way that it can no longer be linked to you or attributed to you.

Voluntary nature of providing data and consequences of not providing it

Providing personal data is voluntary. You are not obliged to provide us with personal data, but if you do not provide it, you cannot receive certain services or enter into a contract with us. We will specify which data is such that its non-provision causes the stated consequences each time we obtain personal data from you.

Who has access to your personal data

We do not forward your personal data or allow third parties (outside Reforma center d. o. o.) to become acquainted with it, except for those who have a written contract with us, based on which they perform certain tasks related to data processing and are obliged to respect the legislation regarding the processing and protection of personal data (so-called contract processors). The contract processors to whom we provide personal data are:

• email delivery providers.

Contract processors may only process personal data within the scope of our instructions and may not process personal data for their own purposes. They are committed, together with their employees, to protecting the confidentiality of your personal data.

Contract processors do not export personal data to third countries (outside the member states of the European Economic Area – these are EU members plus Iceland, Norway, and Liechtenstein).

What rights you have regarding personal data, how you can withdraw consent for processing, and what the consequences of withdrawal are

Regarding your personal data, you have the right to request from us at any time:

• confirmation of whether we are processing your personal data;
• access to personal data and the following information: purposes of processing; types of personal data; users or categories of users to whom personal data has been or will be disclosed, in particular users in third countries or international organizations; the planned period of personal data retention or, if this is not possible, the criteria used to determine this period; the existence of automated decision-making, including profiling, and the reasons for it, as well as the significance and intended consequences of such processing for you;
• one (free) copy of personal data in the form you specify (if the request is made by electronic means of communication and you do not request otherwise, the copy is provided in electronic form). For additional copies you request, we may charge a reasonable fee considering the costs;
• correction of inaccurate personal data.

You can also request restriction of processing when:

• you dispute the accuracy of personal data, for a period that allows us to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the deletion of personal data and instead request a restriction on its use;
• we no longer need the personal data for processing purposes, but you need it for the enforcement, implementation, or defense of legal claims;
• deletion of all personal data (right to be forgotten), if the assumptions from Article 17 (General Data Protection Regulation) are met, and especially in the event that you withdraw consent for the processing of personal data;
• a printout of personal data in a structured, commonly used, and machine-readable format, with the right to forward this data to another controller without us hindering you;
• cessation of the use of personal data for direct marketing purposes, including profiling;
• that a decision based solely on automated processing, including profiling, does not apply to you if the assumptions from Article 22 (General Data Protection Regulation) are met.

You have the right to file a complaint against us with the Information Commissioner if you believe that the processing of your personal data violates the General Data Protection Regulation.

Procedure for exercising rights

You can address your requests concerning the exercise of rights in relation to personal data in writing to any contact listed at the top of this document under Personal Data Controller and Contact Information.

For the purposes of reliable identification in the event of exercising rights in relation to personal data, we may request additional data from you, and we can only refuse to take action if we prove that we cannot reliably identify you.

We must respond to your request to exercise your rights in relation to personal data without unnecessary delay and at the latest within one month of receiving your request.

Form protection with Cloudflare Turnstile

We use the Cloudflare Turnstile service on the website, which helps protect web forms from unwanted and automated submissions (bots). When using a form, Turnstile checks in the background whether the request is being sent by a real user, usually without requiring additional visitor interaction.

The service is provided by Cloudflare, Inc. During verification, Cloudflare may process certain technical data about the device, browser, and website usage necessary to perform the security check. We use Turnstile exclusively to ensure security and prevent abuse of web forms.

More information on data processing within the Turnstile service is available in the Cloudflare Turnstile Privacy Addendum and Cloudflare Privacy Policy.