PERSONAL DATA PROTECTION AND COOKIES POLICY

/ Privacy Policy and Privacy Notice provided by the operator to the person concerned when obtaining personal data from the person concerned and the cookie notice of the harahu.com Internet shop /

I. Operator

1.1. The identity and contact details of the Operator are:
Company name: ETERNITY & SPARK, Ltd.
Headquarters: Marcek 80, Svedernik 013 32, Slovak Republic
Registered in the Commercial Register, District court of Zilina, Section Ltd, File No. 56456/L
Merchant ID: 46621903
Tax ID: 2023486212
VAT number: SK2023486212
Bank account:
Bank account for payment SVK(€):2300244663 / 8330 (IBAN: SK2483300000002300244663)
Bank account for payment CZ(Kč):2501909895 / 2010 (IBAN: SK9483300000002501909895)
Bank account for payment in forints 12600016-17036089-72797916 (IBAN: HU71126000161703608972797916)
Seller is VAT payer.

1.2. Email contact and telephone contact for the Seller is:
Email: info@harahu.com
Tel. č.:
Zákaznícka linka pre Slovensko (komunikácia v slovenčine)
+421 918 212 326
+421 949 598 818

Zákaznická linka pro Česko (komunikace v češtině/slovenštině)
+420 775 813 116
+420 775 813 127

Magyarországi ügyfélszolgálat (magyar nyelvű kommunikáció)
+36 70 356 5665
+421 903 898 250

Kundenservice für Deutschland / Österreich (Kommunikation auf Deutsch)
+421 910 232 033

Telefon kontaktowy dla Polski (komunikacja w języku polskim)
+421 911 232 188

Customer service for Romania (communication in English/German)
+421 910 232 033

Customer service for English speakers
+421 910 232 033

1.3.Seller's address for sending documents:
ETERNITY & SPARK, Ltd., Marcek 80, Svedernik 013 32, Slovak Republic

1.4.In accordance with Article 13 Sec. 1. a 2. Regulation of the European Parliament and of the Council (EU) 2016/679 dated 27. May 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/ES, the General Data Protection Regulation (hereinafter referred to as the "Regulation"), in accordance with Act No. 18/2018 Coll. Personal Data Protection Art as amended and in accordance with Act No. 452/2021 Coll., the Electronic Communications Act as amended the Operator (the Seller) provides the Data Subject (the Buyer), from whom the Operator (the Seller) obtains personal data concerning him/her, with the following information, instructions and explanations:

II. Links

2.1.This Policy and the Privacy Notice form part of the Terms and Conditions published on the Seller's Website.

2.2.In accordance with §3, par. 1, letter. n), Act No. 102/2014 Coll. The Seller informs the Consumer that there are no specific relevant codes of conduct to which the Seller has committed to adhere, whereby a code of conduct is understood to be an agreement or set of rules that define the Seller's conduct, which the seller has undertaken to comply with that code of conduct in relation to one or more specific commercial practices or sectors, unless they are laid down by law or regulation or by an act of a public authority, which the seller has undertaken to comply with, and the manner in which the consumer may become acquainted with them or obtain their text.

III. Privacy policy and use of cookies. Instructions and explanation of cookies, scripts and pixels

3.1. The website operator provides the following brief explanation of the function of cookies, scripts and pixels:

3.1.1.Cookies are text files that contain small amounts of information that are downloaded to your device when you visit a website. This file allows the website to store information about your actions and preferences (such as login name, language, font size and other display settings) for a certain period of time so that you do not have to enter them again the next time you visit the website or browse its individual pages. A script is a piece of program code that is used to make a website function properly and interactively. This code runs on the server of the provider or on your device. A pixel is a small, invisible text or image on a website that is used to monitor website traffic. In order for this to happen, various data is stored via pixels.

3.1.2. Cookies are divided into:
Technical or functional cookies - ensure the proper functioning of the Operator's website and its use. These cookies are used without consent. Statistical cookies - the Operator obtains statistics regarding the use of its website. These cookies are only used with consent. Marketing/Advertising Cookies - Used to create advertising profiles and similar marketing activities. These cookies are only used with consent.

3.2. How to manage cookies:

3.2.1.You can control and/or delete cookies at your discretion - see aboutcookies.org for details. You can delete any cookies stored on your computer or other device and you can set most browsers to prevent them from being stored.

3.3.The Operator's website uses the following cookies:
All cookies used by the Provider can be found on https://www.cookieserve.com/ by entering the Provider's web address https://www.harahu.com Technical or functional cookies - the information is accessed by the Website Operator. The duration of cookies is 2 years. Statistical cookies - the information is accessed by the Website Operator. Duration of cookies 2 years. Marketing and advertising cookies - the information is accessed by the Website Operator. Duration of cookies 2 years.

3.3.1.Cookies available to third parties:
Google Analytics, Google ADS: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For more information on privacy, please visit https://support.google.com/analytics/topic/2919631?hl=cs&ref_topic=1008008 META Pixels: Facebook Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland. For more information on privacy, please visit https://www.facebook.com/about/privacy/

IV.Processed personal data

4.1.The operator processes the following personal data on its website: first name, surname, residential address, e-mail address, home telephone number, mobile telephone number, billing address, shipping address, data obtained from cookies, IP address.

V.Contact details of the Data Protection Supervisor

5.1.The Operator has appointed a data protection officer in accordance with Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Contact: E-mail: info@harahu.com

5.2.The Operator is also the Seller as defined in the Terms and Conditions of this website.

VI.Purposes of the processing of personal data Data subjects and duration of the processing of personal data

6.1.The purposes of the processing of personal data of the data subjects are mainly:

6.1.1.registration, creation and processing of contracts and client data for the purpose of concluding contracts with third parties.

6.1.2.processing of accounting documents and documents related to the Operator's business activities.

6.1.3. observing legal regulations in connection with archiving documents and records, e.g. according to Act No. 431/2002 Coll., the Accounting Act as amended and other relevant regulations.

6.1.4.the activities of the Operator in connection with the fulfillment of the request, order, contract and similar institutes of the Concerned Party.

6.1.5. Newsletter, marketing and similar advertising activities of the Operator. In case of consent given by the Concerned Person to the Operator for marketing and similar advertising activities.

6.2. Personal data of the Data Subject shall be stored by the Operator only for the time necessary for the purposes of contract performance and their subsequent archiving in accordance with the statutory time limits imposed on the Operator by law. If the Data Subject has given his/her consent to receive promotional emails and similar offers, the Data Subject's personal data will be processed for these purposes until the Data Subject withdraws his/her consent. However, for a maximum period of 10 years.

VII. Legal basis for processing personal data

7.1. In case that the Operator carries out the processing of personal data based on the consent of the Data Subject, this processing will be initiated only after the Data Subject has given his/her consent.

7.2. In case that the Operator processes the personal data of the Data Subject for the purposes of negotiating pre-contractual relations and concluding and executing a purchase contract and the related delivery of goods, products or services. The data subject is obliged to provide personal data for the proper performance of the purchase contract, otherwise the performance cannot be ensured. Personal data for this purpose is processed without the consent of the person concerned.

VIII.Recipients or categories of recipients of personal data

8.1.Recipients of personal data The data subjects will be, or at least may be:

8.1.1.the statutory authorities or their members of the Operator.

8.1.2. persons doing work for the Operator in an employment or similar relation.

8.1.3. business representatives of the Operator and other persons cooperating with the Operator in the performance of the Operator's tasks. For the purposes of this document, all natural persons performing dependent work for the Operator on the basis of an employment contract or agreements on work performed outside the employment relationship shall be considered to be employees of the Operator.

8.1.4. The recipients of personal data will also be the operator's co-workers, business partners, suppliers and contractors, in particular: accounting company, company providing services related to the creation and maintenance of software, company providing legal services to the operator, company providing consulting services to the operator, companies providing transportation and delivery of products to buyers and third parties, marketing companies, companies operating social networks, companies providing payment gateways and other payment methods.

8.1.5. The recipients of personal data will also be courts, law enforcement authorities, the tax office and other state authorities, if so provided by law. Personal data will be provided by the Operator to the authorities and state institutions on the basis of and in accordance with the legislation of the Slovak Republic.

8.1.6. List of third parties - intermediaries and recipients who process personal data Data subjects:
Packeta Slovakia Ltd., based Kopčianska 3338/82A, 851 01 Bratislava, Merchant ID: 48136999 - a third party providing transport services
Global Payments Ltd., Vajnorská 100/B, 831 04 Bratislava - Nové Mesto, Merchant ID: 50 010 301 - a third party providing payment gateway
Yolen Ltd., Bottova 1149/20 014 01 Bytča – a third party providing bookkeeping
Internet Mall Slovakia Ltd, Galvaniho 6 821 04 Bratislava - city District Ružinov – a third party providing selling the goods
Kaufland Slovenská republika v.o.s., Trnavská cesta 41/A, 831 04 Bratislava - a third party providing selling the goods
MINET Ltd., L. Svobodu 552/46 976 32 Badín - a third party providing monitoring satisfaction with the functioning of the website
Inspigroup Ltd., Ulice: Újezd 450/40, City: Praha 1 - Malá Strana - a third party providing monitoring satisfaction with the functioning of the website
Zboží.cz, Radlická 3294/10, 150 00 Praha, Smíchov - a third party providing monitoring satisfaction with the functioning of the website
Online Comparison Shopping Kft., 1074 Budapest, Rákóczi út 70-72.; Cg. 01-09-186759, Hungary - a third party providing monitoring satisfaction with the functioning of the website
Heureka Shopping Ltd, Karolinská 650/1, 186 00 Praha 8 – Karlín, CZ, Merchant ID: 02387727 – a third party providing monitoring satisfaction with the functioning of the website and ensuring the functioning of the service Verified by customers

8.2.The e-shop Operator determines satisfaction with the purchase through e-mail questionnaires within the framework of the Verified by Customers program, in which the e-shop of the Operator is involved. The Operator sends the Concerned Person - Buyer every time the Concerned Person - Buyer makes a purchase from the Operator's e-shop, unless the Concerned Person - Buyer refuses to receive e-mails for direct marketing purposes in accordance with Act No. 452/2021, as amended. The processing of personal data for the purpose of sending questionnaires within the framework of the Verified by Customers program is carried out by the Operator on the basis of the Operator's legitimate interest, which consists in determining the satisfaction of the Concerned Person - Buyer with the purchase through the Seller's e-shop. For sending questionnaires, evaluating the Buyer's feedback and analysing the market position, the Operator uses a processing agent, which is the operator of the Heureka.sk portal.For these purposes, the Operator may transfer information about the purchased goods and the e-mail address of the Buyer. The personal data of the Buyer are not passed on to any third party for their own purposes when sending e-mail questionnaires. The Buyer may object to the sending of e-mail questionnaires within the framework of the Customer Verified programme at any time by rejecting further questionnaires using the link in the e-mail containing the questionnaire. In case of an objection by the Customer, the Operator will no longer send the questionnaire to the Customer.

IX. Information on the disclosure and retention period of personal data to third countries:

9.1.Not applicable. The operator does not transfer personal data of persons to third countries

X. Information on the existence of relevant rights of the person concerned:

10.1.The person concerned shall have the following rights, whereby:

10.1.1.Clause 10.1 is without prejudice to the other rights of the concerned Persons.

10.1.2.The data subject's right of access under Article 15 of the Regulation, which includes:

the right to obtain confirmation from the Operator whether it processes the personal data of the Data Subject and, if so, to what extent. At the same time, if they are processed, he has the right to find out their content and to request information from the Operator about the reason for processing them, in particular information about: The reason for their processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations, the expected period of retention of the personal data or, if this is not possible, information on the criteria for their determination, the existence of the right to request from the Data Controller the rectification of personal data relating to the Data Subject or their erasure or restriction of processing and the existence of the right to object to such processing, the right to lodge a complaint with a supervisory authority if the personal data were not obtained from the Data Subject, any available information as to their source, the existence of automated decision-making, including profiling as referred to in Article 22 par. 1. and 4. of the Regulation and, in such cases, at least meaningful information about the procedure used as well as the relevance and foreseeable consequences of such processing of personal data for the Data Subject, about the adequate safeguards pursuant to Article 46 of the Regulation concerning the transfer of personal data where personal data are transferred to a third country or an international organisation.

10.1.3.the right to provide a copy of the personal data that is being processed, subject to the condition that the right to provide a copy of the processed personal data must not have adverse consequences on the rights and freedoms of others.

10.1.4.the right of the Data Subject to rectification under Article 16 of the Regulation, which includes the right: for the Operator to correct incorrect personal data concerning the Data Subject without undue delay; the right to supplement incomplete personal data of the Data Subject, including through the provision of a supplementary statement by the Data Subject; the right of the Data Subject to erasure of personal data (the so-called "right to forget") under Article 17 of the Regulation, which includes:

10.1.5.the right to obtain from the Operator, without undue delay, the deletion of personal data concerning the Person concerned, if one of the following reasons is met: the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, the data subject withdraws the consent on the basis of which the processing is carried out, provided that there is no other legal basis for the processing of the personal data, the data subject objects to the processing of the personal data pursuant to Article 21 par. 1. of the Regulation and there are no overriding legitimate grounds for the processing of personal data, or the Data Subject objects to the processing of personal data pursuant to Article 21 par. 2. of the Regulation, the personal data has been unlawfully processed, the personal data must be erased in order to comply with a legal obligation under European Union law or the law of a Member State to which the Operator is subject, the personal data was obtained in connection with the offer of information society services pursuant to Article 8 Sec 1. of the Regulation;;

10.1.6.the right for the Operator who has disclosed the Personal Data of the Data Subject to take reasonable measures, including technical measures, taking into account the technology available and the cost of implementing the measures, to inform other Operators who process Personal Data that the Data Subject requests that they erase all references to, copies of or replicas of such Personal Data, subject to the right to erasure of Personal Data containing the rights under Article 17 par. 1 and par. 2. Regulation shall not arise if the processing of the personal data is necessary:

10.1.7.to use the right to freedom of expression and information.

10.1.8.to comply with a legal obligation requiring processing under European Union law or the law of a Member State to which the Operator is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the Operator.

10.1.9.for reasons of public interest in the field of public health in accordance with Article 9 par. 2 letter h) and i) of the Regulation as well as Article 9 par. 3 of the Regulation.

10.1.10.for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes as referred to in Article 89 par. 1 of the Regulation, where the right referred to in Article 17 par. 1 is likely to Regulation will render impossible or seriously impede the achievement of the purposes of such processing of personal data; or for the establishment, exercise or defence of legal claims;

10.1.11.the right of the Data Subject to restriction of the processing of personal data pursuant to Article 18 of the Regulation, which includes:

10.1.12.the right to have the Operator restrict the processing of personal data in one of the following cases: the Data Subject contests the accuracy of the personal data for a period of time allowing the Operator to verify the accuracy of the personal data, the processing of the personal data is unlawful and the Data Subject objects to the erasure of the personal data and requests instead the restriction of its use, the Operator no longer needs the personal data for the purposes of the processing but the Data Subject needs it for the establishment, exercise or defence of legal claims, the Data Subject has objected to the processing pursuant to Article 21 Sec. of the Regulation, pending verification that the legitimate grounds on the part of the Operator outweigh the legitimate grounds of the Data Subject

10.1.13.the right that, where the processing of personal data has been restricted, such restricted personal data shall, with the exception of storage, be processed only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State;

10.1.14.the right to be informed in advance of the lifting of restrictions on the processing of personal data;

10.1.15.the right of the Data Subject to comply with the obligation to notify recipients under Article 19 of the Regulation, which includes: the right for the Controller to notify each recipient to whom personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out pursuant to Articles 16, 17 par. 1 and 18 of the Regulation, unless this proves impossible or requires disproportionate effort; the right for the Controller to inform the Data Subject about these recipients if the Data Subject so requests;

10.1.16.the Data Subject's right to data portability under Article 20 of the Regulation, which includes: the right to obtain personal data relating to the Data Subject that he or she has provided to the Controller in a structured, commonly used and machine-readable format and the right to transfer such data to another controller without hindrance from the Controller if:
a/ the processing is based on the consent of the Data Subject pursuant to Article 6 par. 1 letter a) of the Regulation or Article 9 par.2 letter a) of the Regulation, or on a contract pursuant to Article 6 par. 1 letter b) of the Regulation, and at the same time
b/ processing is carried out by automated means, and at the same time:

10.1.17.the right to obtain personal data in a structured, commonly used and machine-readable format and the right to transfer this data to another administrator without the Administrator preventing it, will not have adverse consequences on the rights and freedoms of others;

10.1.18.the right to transfer personal data directly from one administrator to another administrator, if this is technically possible;

10.1.19.the right of the person concerned to object under Article 21 of the Regulation, which includes::

10.1.20.the right to object at any time for reasons related to the specific situation of the person concerned against the processing of personal data concerning him, which is carried out on the basis of Article 6 par. 1. letter e) or f) of the Regulation, including an objection to profiling based on these provisions of the Regulation

10.1.21.in the case of exercising the right to object at any time on grounds relating to the particular situation of the Data Subject to the processing of personal data concerning him or her which is carried out on the basis of Article 6 par.1 letter e) or f) of the Regulation, including an objection to profiling based on these provisions of the Regulation, the right for the Controller not to further process the Personal Data of the Data Subject unless he or she demonstrates the necessary legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or the grounds for establishing, exercising or defending legal claims

10.1.22. The right to object at any time to the processing of personal data relating to the Data Subject for direct marketing purposes, including profiling to the extent that it is related to direct marketing; however, if the Data Subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes;

10.1.23. In connection with the use of information society services, the right to exercise the right to object to the processing of personal data through automated means using technical specifications;

10.1.24. The right to object, on grounds relating to the particular situation of the Data Subject, to the processing of personal data concerning the Data Subject where the personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89 par. 1 of the Regulation, except where the processing is necessary for the performance of a task for reasons of public interest

10.1.25. The right of the affected person related to automated individual decision-making according to Article 22 of the Regulation, the content of which is:

10.1.26. The right not to be subject to a decision based solely on automated processing of personal data, including profiling, which has legal effects concerning him or her or similarly significantly affects him or her, except pursuant to Article 22 par. 2 of the Regulation [i.e. except where the decision is: (a) necessary for the conclusion or performance of a contract between the Data Subject and the Controller,

10.1.27.(b) permitted by the law of the European Union or the law of the Member State to which the Controller is subject and which also establish appropriate measures guaranteeing the protection of the rights and freedoms and legitimate interests of the Data Subject or (c) based on the express consent of the Data Subject.

XI. Instruction on the right of the concerned person to withdraw consent to the processing of personal data:

11.1.The data subject shall be entitled to withdraw his or her consent to the processing of personal data at any time, without this affecting the lawfulness of the processing of personal data based on the consent given prior to its withdrawal. The data subject shall be entitled to withdraw his or her consent to the processing of personal data at any time, in whole or in part. The partial withdrawal of consent to the processing of personal data may relate to a specific type of processing operation(s), while the lawfulness of the processing of personal data to the extent of the remaining processing operations remains unaffected. A partial withdrawal of consent to the processing of personal data may relate to a specific specific purpose of processing personal data / certain specific purposes of processing personal data, while the lawfulness of the processing of personal data for the other purposes remains unaffected. The right to withdraw consent to the processing of personal data may be exercised by the Data Subject in writing to the address of the Controller listed as its registered office in the Commercial Register at the time of withdrawal of consent to the processing of personal data or electronically by electronic means (by sending an email to the Controller's email address listed when identifying the Controller in this document.

XII. Instruction on the right of the affected person to file a complaint with the supervisory authority:

12.1. The person concerned has the right to file a complaint with the supervisory authority, in particular in the Member State of his habitual residence, place of work or place of alleged violation, if he believes that the processing of personal data concerning him is contrary to the Regulation, and all without prejudice to any other administrative or judicial remedies. The person concerned has the right to have the supervisory authority to which he filed the complaint informed, as the complainant, about the progress and outcome of the complaint, including the possibility of filing a judicial remedy pursuant to Article 78 of the Regulation.

12.2. The supervisory authority in the Slovak Republic is the Personal Data Protection Office of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovak Republic. Tel. contact: +421 /2 3231 3214, Email: statny.dozor@pdp.gov.sk,

XIII. Information related to automated decision-making, including profiling:

13.1. As the Controller is not processing the Data Subject's personal data in the form of automated decision-making, including profiling, as referred to in Article 22 par. 1 and 4 of the Regulation, the Controller is not obliged to provide information pursuant to Article 13 par. 2 letter f) of the Regulation, i.e. information about automated decision-making, including profiling, and the procedure used, as well as the significance and foreseeable consequences of such processing of personal data for the Data Subject. Not applicable.

XIV. Final clauses

14.1. These Principles and instructions of personal data protection and cookies policy form an integral part of the General Terms and Conditions and the Complaints Procedure. The documents – General Terms and Conditions and Complaints Rules of this Website are published on the domain of the Seller's Website.

14.2. This Personal Data Protection Policy becomes valid and effective upon its publication on the Seller's Website on 27.12.2023