PRIVATLIVSPOLITIK

The company RENDL lighting a.s., ID: 282 00 896, with registered office at Masarykovo nábřeží 2018/10, 122 00 Prague 2 - Nové Město, registered in the Commercial Register of the Municipal Court in Prague, Section B, Insert 12955 (hereinafter referred to as the "Seller"), as a personal data controller, hereby informs about the processing of personal data that takes place in connection with the operation of the online store available at https://www.rendl.cz/ (hereinafter referred to as the "E-shop"), the conclusion of purchase contracts with customers of the E-shop (hereinafter referred to as "Buyers") and the registration of Buyers in the E-shop. This document also contains information about the rights of data subjects in connection with the aforementioned processing.

For any questions regarding privacy protection and the exercise of your rights, please use the following contact:

• email: info@rendl.cz

1. For what purpose, on what legal basis, and what personal data do we process?
   • 1.1 Conclusion and fulfillment of the purchase contract

     In order for the Seller to negotiate and conclude a purchase contract with the Buyer regarding goods offered in the E-shop, the Seller needs the following personal data of the Buyer - natural person:

     • identification data of the Buyer (name, surname, date of birth, in case of a business entity also ID number, VAT number, registered office address),
     • contact details of the Buyer (email, phone number, delivery and billing address),
     • depending on the chosen payment method for ordered goods, also bank account number and other payment details,
     • information from communication with you, information about the conclusion and fulfillment of the purchase contract.

     Without the above-mentioned data, it is not possible to conclude or fulfill the purchase contract. The legal basis for processing these data is the conclusion and fulfillment of the purchase contract at the request of the Buyer.

   • 1.2 Registration and management of user account in the E-shop

     The Seller allows Buyers to register and create a user account in the E-shop. If the Buyer registers and creates a user account, a contract for registration and management of the user account is concluded. For the purposes of fulfilling this contract, we process the data mentioned in point 1.1 and additionally the access data of the Buyer - natural person (email in encrypted form). Furthermore, within the user account, we process the data mentioned in point 1.1 for the purposes of recording previous orders of the Buyer. The Buyer can add additional identification data and addresses to the user account.

     The above-mentioned data are necessary for the registration of the Buyer and the establishment and management of their User Account; without them, it is not possible to conclude or fulfill the contract for registration and management of the user account. The legal basis for processing these data is the conclusion and fulfillment of the contract at the request of the Buyer.

   • 1.3 Fulfillment of obligations arising from legal regulations

     The Seller must process personal data in cases where required by law. For this purpose, the Seller processes personal data especially in the scope required by relevant legal regulations in connection with the Seller's obligation to handle complaints from Buyers, maintain accounting records, and fulfill related tax obligations, or for fulfilling obligations imposed by the Archives Act.

   • 1.4 Legitimate interests of the Seller

     In justified cases, the Seller may process personal data also on the basis of a legal title, which is the protection of its legitimate interests. However, the Seller always carefully assesses and ensures that the interest in processing your data for this purpose does not disproportionately interfere with your privacy.

     Identification of persons acting on behalf of the Buyer - legal entity: These are typically members of statutory bodies, employees, or other authorized persons who are not a contracting party to the contract with the Seller, but who conclude the contract on behalf of the Buyer, communicate with the Seller, and otherwise act with the Seller on behalf of the buyer. We need personal data of these persons to be able to communicate and act with the Buyer for the purpose of concluding a purchase contract or a contract for registration and management of the user account with the buyer, its further fulfillment, or enforcement of the Buyer's rights. For these persons, we typically process name, surname, email, phone number, delivery address, information about their position or other relationship to the Buyer, and data from communication with them.

     Proof of consent to terms and conditions: In case of concluding a contract with the Buyer online (by electronic means), we store data necessary for identifying the Buyer as a contracting party, so that we have a timestamp available as proof of the conclusion of the contract and consent to our terms and conditions in a specific wording in case of any subsequent doubts or disputes.

     Defense and enforcement of legal claims: We process personal data for the purpose of protecting our legitimate interest, which is ensuring the possibility of our defense in potential legal disputes, court proceedings, or during inspections by state authorities or other public administration authorities (typically the Czech Trade Inspection Authority, etc.). We process the data to be able to prove, if necessary, that we have acted in accordance with our contractual obligations and legal regulations. In this context, we typically process identification and contact data of the Buyer, or persons acting on behalf of the Buyer, data about concluded contracts, their fulfillment, and communication with the Buyer, or persons acting on behalf of the Buyer.

   • 1.5 Sending commercial communications

     In the case of Buyers with whom we have concluded a purchase contract or who have registered in the E-shop and created a user account, and in connection with this, we have obtained their email and/or phone number, or in the case of other persons who have actively and voluntarily subscribed to our newsletters, we process personal data of these persons in the scope of email and phone number for the purpose of sending information and news about our services and products (commercial communications).

     The legal basis for processing personal data for the purpose of sending commercial communications is, in the case of Buyers with whom we have concluded a purchase contract or who have a user account, the legitimate interest of the Seller in informing about the latest offers of the Seller.

     The legal basis for processing personal data for the purpose of sending commercial communications in the case of persons who have actively subscribed to the newsletter themselves, without us having concluded a contract with them, is their consent, which was given by subscribing to commercial communications.

     If you no longer wish to receive these messages from us, you have the possibility to unsubscribe from them free of charge at any time, using the procedure indicated in each sent commercial communication, or within the user account, or you can contact us at any time at the contact email address mentioned above in this document.

2. From whom do we receive personal data and to whom do we transfer it?

   We obtain personal data primarily from data subjects. We do not seek any additional information about you, except for what you provide to us yourself, or what arises from your activity within the E-shop. You are obliged to provide us only accurate data, and if your personal data changes, you must update the data.

   We may transfer personal data to public administration authorities under conditions set by legal regulations, where the legal regulation requires us to do so, or if the relevant authority requests it within its competence.

   For data processing, we use our own software.

   Personal data may also be transferred to our business partners, who act as independent personal data controllers in relation to your personal data. These are especially operators of payment gateways, through which online payments are enabled in the Online Store, or cooperating carriers used for delivering goods.

   Personal data may be transferred to these business partners:

   • General Logistics Systems Czech Republic s.r.o., ID: 26087961, with registered office at Průmyslová 5619/1, 586 01 Jihlava,
   • PPL CZ s.r.o., ID: 25194798, with registered office at K Borovému 99, Jažlovice, 251 01 Říčany,
   • Zásilkovna s.r.o., ID: 28408306, with registered office at Českomoravská 2408/1a, Libeň, 190 00 Prague 9,

   Personal data are not transferred outside the EU, unless stated otherwise above.

3. How do we process personal data?

   We process your personal data primarily in electronic form by automated means in our IT systems, or in the systems of our individual processors. Personal data may also be processed manually in accordance with the relevant purpose, where manual processing is necessary or appropriate.

   Our employees or other persons working for us may be involved in managing your data, among other things, for the purpose of removing errors, inaccuracies, etc. However, these persons may process personal data only under the conditions and to the extent mentioned above and are bound by the obligation to maintain confidentiality about personal data and security measures, the disclosure of which would endanger the security of personal data.

   We always process personal data in accordance with relevant legal regulations and ensure them proper care and protection. We ensure that you do not suffer any harm to your rights, especially the right to human dignity and your private and personal life.

4. How long do we process personal data?
   • 4.1 Purchase contract and contract for registration and management of user account

     We process personal data for the purpose of concluding and fulfilling the contract with the Buyer for the duration of concluding and fulfilling the respective Contract (i.e., for the period necessary to fulfill the obligations arising from the purchase contract, or for the duration of your registration in the E-shop).

     Even after that, we may process personal data for the following purposes:

   • 4.2 Fulfillment of legal obligations

     We process personal data for the purpose of our legal obligations within the time limits set by these laws.

     Personal data required by legal regulations governing the Seller's tax and accounting obligations (typically, billing data and information about the provided service) must be processed for accounting and fulfillment of tax obligations. The processing period is 5 years from the end of the accounting period; in the case of documents relevant for VAT payments, it is 10 years from the end of the tax period in which the service took place. We archive personal data in accordance with the requirements of the Archives Act for the periods specified therein. Data processed for the purpose of handling complaints are stored for the period of the limitation period for claiming rights from defective performance, or for the warranty period.

   • 4.3 Legitimate interests

     We process personal data even after the termination of the contract with the Buyer for the protection of our legitimate interests (i.e., defense against potential claims of the Buyer or third parties, including in court) for the duration of the relevant limitation periods. If the relevant procedure is not initiated, we keep this data for 5 (five) years from the termination of the contractual relationship with the Buyer.

   • 4.4 Sending commercial communications

     We send commercial communications, as mentioned above, and process personal data for these purposes until you unsubscribe using the procedure indicated in point 1.5 of this document.

   • 4.5 Longer processing

     Personal data may be processed for a longer period than mentioned above if a relevant reason for further processing arises, for example, if an administrative or judicial procedure is initiated for which the personal data are relevant.

5. What rights do you have?

   First of all, you have the right to request access to your personal data, including obtaining a copy of all your personal data. You can do this using the email address mentioned in the header of this document.

   Withdrawal of consent to processing: If we process your personal data on the basis of your consent, you can withdraw your consent to their processing at any time, freely and free of charge, through your user account, the contact email address mentioned above, or otherwise as indicated elsewhere in this document. In such a case, we will no longer process your personal data on the basis of consent.

   For personal data that are not processed on the basis of consent, it is not possible to withdraw consent to processing. However, based on your request, we will always assess whether it is necessary to continue processing your personal data for any of the purposes mentioned above.

   Your other rights:

   We will always inform you about:

   • the purpose of processing personal data,
   • personal data or categories of personal data that are the subject of processing, including all available information about their source,
   • the nature of automated decision-making, including profiling, and information about the procedure used, as well as the significance and expected consequences of such decision-making for the data subject,
   • the recipient or categories of recipients to whom personal data have been or will be transferred, and in the case of transfer of personal data to a third country, also about appropriate safeguards relating to the transfer to ensure the security of personal data,
   • the planned period for which personal data will be stored, or if it is not possible to determine this period, the criteria used to determine this period,
   • all available information about the source of personal data, if they are not obtained from you.

   Among your other rights are:

   • to request an explanation from us,
   • to request that we remove the created situation, especially it may be about blocking, rectification, completion, restriction of processing, or deletion of personal data (right to be forgotten),
   • to request a copy of the processed personal data, or to request personal data concerning you in a structured, commonly used, and machine-readable format, and to transmit these data to another controller, without us preventing this in any way,
   • to submit a request or complaint to the Office for Personal Data Protection,
   • to object to the processing of personal data concerning you.
6. How we protect your personal data

   We protect your data. For this purpose, we use mainly the following security measures: implementation and enforcement of internal regulations for the protection of personal data, antivirus protection, firewalls, encryption, access control to personal data and authorization data, backup, physical protection measures, and others.