Personal data processing principles

1. The company BIONAMED s.r.o., ID: 19094825, with registered office
   Příkop 838/6, Zábrdovice, 602 00 Brno, registered in the Commercial Register kept at the Regional Court in Brno, Section C, Insert 133007 (hereinafter also referred to as the "Administrator"), as the operator of the website www.bionamed.com and therefore the controller of the personal data provided by the customer undertakes to process such personal data in accordance with the law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.
   

2. In particular, the administrator processes the following personal data in the operation of the website: name, surname, address, telephone number, e-mail address.
   

3. Personal data are processed on the basis of the legal basis of the fulfilment of the contractual obligations of the Controller towards customers and on the legal basis of the protection of the legitimate interests of the Controller. 
   
   

4. The controller only processes personal data strictly necessary to fulfil the purposes of their processing, i.e. to fulfil its contractual obligations and to defend its legitimate interests, including direct marketing.
   

5. Name and surname and address data must be processed for legal reasons in order to properly identify and issue a tax document. Such processing is permitted under Article 6(1)(c) of the GDPR, as it is necessary for the fulfilment of a legal obligation to which the Controller is subject. The telephone number and email address must be processed for the purpose of confirming the order and, where applicable, informing the customer of important facts affecting the contractual relationship or the performance of the contract concluded between the Controller and the customer. Such processing is permitted by Article 6(1)(b) of the GDPR, as this is necessary for the performance of the contract. These personal data will be processed for the period necessary to ensure the mutual rights and obligations arising from the contract, i.e. always for at least the duration of the contract and for the period for which the Controller is obliged to store these data under generally binding legal regulations. The same applies if the contract is not concluded. Failure to provide any of these data may result in the contract not being concluded. 
   
   

6. The processing of personal data is carried out by the Controller, however, the following processors may also process personal data for the Controller:

   • Google - Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

   • Google Analytics

   • Google Tag Manager

   • providers of external services, in particular tax and legal advice

   • operators of selected direct marketing tools

   • Hotjar Inc.

   • MailerLite, J. Basanavičiaus 15, LT-03108 Vilnius, Lithuania

   • Redbit s.r.o., Antonína Dvořáka 612, 280 02 Kolín

   • Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland
     

7. Personal data will be processed for the period of time necessary for the performance of contractual obligations and the protection of legitimate interests, and after its termination, it will be handled in accordance with the applicable legislation, Act No. 499/2004 Coll. (Act on Archives and File Service and on Amendments to Certain Acts) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR).
   

8. The controller declares that it has taken all appropriate technical and organisational measures to safeguard personal data.
   

9. In particular, the customer has the following rights in relation to their personal data:

   • the right of access to personal data means that the customer has the right to obtain information from the Controller as to whether the Controller is processing his/her personal data and, if so, what the data are and how they are processed; the customer also has the right to have inaccurate personal data concerning him/her corrected or updated by the Controller without undue delay at his/her request; incomplete personal data may be completed by the customer at any time,

   • the right to erasure of personal data represents, in other words, the obligation of the Controller to erase the personal data it processes about the customer if certain conditions are met and the customer requests it,

   • the right to have the Controller restrict the processing of his/her personal data in certain cases; the customer has the right to object at any time to processing that is based on the legitimate interests of the Controller, a third party or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority,

   • the right to data portability gives the customer the possibility to obtain the personal data he has provided to the Controller in a common and machine-readable format; he can subsequently transmit this data to another controller or, if technically feasible, request that the controllers transmit it between themselves,

   • the right to withdraw consent to the processing of personal data at any time does not apply, as the customer's personal data is processed for the performance of the contract concluded with the customer, not on the basis of consent to processing.

   • In the event that the customer is in any way dissatisfied with the processing of his/her personal data by the Controller, he/she may lodge a complaint directly with the Controller in person, in writing to the address of the Controller's registered office or by e-mail. info@bionamed.com, or contact the Office for Personal Data Protection.
     

10. The customer confirms his/her acceptance of this policy by checking a box via the online form before completing the order. By ticking the box, the customer confirms that he/she is aware of the personal data processing policy and accepts it in its entirety.
    

11. The administrator is entitled to change this policy. It shall publish the new version of the Personal Data Processing Policy on its website and shall also send the new version of this Policy to the Customer at the email address provided by the Customer to the Controller.

This policy shall come into force and effect on 1 June 2023.