Detailed overview of the deadlines for data storing are listed in the table below:
|Purpose of data processing||Time period of data being stored|
|Communication regarding our services or responding to requests||6 months from the end of the communication|
|Conclusion and fulfilment of obligations arising from entering a contract||5 years from the execution of the contract|
|Directly notifying customers about special offers, discounts and other content via e-mail or SMS||Until revoked|
|Directly notifying customers about special offers, discounts and other content by phone or regular mail||Until revoked|
|Access to past orders and other information by customer support consultants in order to provide a better service||Until revoked|
|Processing data on undelivered parcels with the purpose of fraud prevention||5 years from the start of processing|
|Automated e-mail communication with the user based on the beginning of the online buying process||Until revoked|
|Basic personalised communication (e-mail, SMS, phone calls, mail, browser notifications, website information, social networks) with personalised offers and content||Until revoked|
|Facebook Custom Audiences Advertising Tool||Until revoked|
|Using an online account||Until revoked|
|Access to specific information on the website||Until revoked|
|Personalised e-magazines||Until revoked|
|Market communication using user profiles||Until revoked|
Contractual processing of personal data
- an accounting service, law firms and other providers of legal counsel;
- providers of data processing and analytics;
- maintenance of IT systems,
- e-mail marketing services (e.g. MailChimp);
- providers of payment systems (e.g. PayPal, Klarna, Sofort, Multibanco, dotPay and others);
- providers of systems for managing customer relations (e.g. Microsoft);
- providers of solutions for online advertising (e.g. Google, Facebook)
The provider will not forward your personal information to third unauthorised parties. Contractual processors can only process personal data within the framework of the controller’s instructions and must not use it to pursue any interests of their own. The controller and recipients of personal data do not transmit personal data to third countries (outside of member countries of the European economic area – members of EU and Iceland, Norway and Liechtenstein) and to international organisations, except the USA – all contractual processors in the USA are in the Privacy Shield programme.
Freedom of choice
You are in control of any information you give out about yourself. If you decide you do not wish to share your data, we may not be able to provide you with certain services. Individuals that wish to unsubscribe from the e-newsletter, please notify us through our e-mail address firstname.lastname@example.org. If there are any changes to your personal information (zip code, e-mail address, physical address, phone number), please notify us through our e-mail address email@example.com.
Automatically recorded information (non-personal information)
Whenever you visit our website, the general, non-personal information (browser users, number of visits, the average duration of the visit, pages visited) are being automatically recorded (not as a part of registration). This information is used to measure the attractiveness of our website and to improve the content and usability. Your information is not subject to further examination and is not disclosed to a third party.
The provider is strongly committed to ensuring personal data security. Your data is, at all times, protected from loss, destruction, falsification, manipulation and unauthorised access and unauthorised disclosure. In order to protect personal data, we take organisational and technical measures, such as:
- Employee education
- Supervision of employees and regular reviews of individual employees
- Careful selections and overview of contractors
- A backup of electronically stored data
- Regular maintenance and updating of technical equipment
- Adopting appropriate internal policies and instructions for the protection of personal data
Consent of a minor in relation to the services of the information society
Minors under 16 years of age should not transmit any personal data to websites without the permission (consent or approval) of a parent or a legal guardian. The provider will never knowingly collect personal information from minors (under 16 years of age) or in any way use or disclose them to an unauthorised third party without their parent’s or legal guardian’s permission. The above does not affect the general law of contract of member states, like regulations about validity, drawing up or effects of the contract regarding minors. Bearing in mind the available technology, the provider will show reasonable efforts to verify that a parent of a legal guardian gave or approved consent.
Rights of the individual regarding data processing
As an individual, you have the following rights regarding fair and transparent processing, based on regulation: The right to withdraw consent: if you have, as an individual, consented to the processing of personal data (for one or more purposes), you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Consent can be withdrawn through a written statement that is sent to the provider to one of the contacts at the provider’s website www.ehorti.com/contact/. Withdrawal of consent for personal data processing has no negative consequences or sanctions for the individual. However, it is possible that the controller may not be able to offer one or more of its services after the withdrawal of consent if those services cannot be performed without personal data (e.g. the benefit club or customised communication).
The right to access personal data: as an individual, you have the right to obtain from confirmation from the provider (processor of personal data) as to whether or not your personal data are being processed, and, where that is the case, access to the personal data and the following information: the purposes of the processing, the categories of personal data concerned, its users, the period for which the personal data will be stored, or the criteria used to determine that period, the right to request rectification or erasure of personal data or restriction of or objection to processing of personal data, the right to lodge a complaint with a supervisory authority, the source of the data if the data were not collected from you, the existence of automated decision-making, including profiling and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you, in accordance to Article 15 of GDPR.
The right to rectify personal data: as an individual, you have the right to obtain from the provider without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement; The right to deletion of personal data (“the right to be forgotten”): you have the right to obtain from the provider without undue delay the deletion of your personal data when one of the below reason exists: (a) the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, (b) you have withdrawn your consent, and there is no legal basis for further processing, (c) you have objected to the processing of your personal data, and there are no overriding legitimate grounds for the processing, (d) your personal data have been unlawfully processed, (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the provider is subject, (f) the personal data has been collected in relation to the offer of an information society. As an individual under certain circumstances, as defined in Article 17, paragraph 3, you do not have the right to data deletion;
The right to restriction of processing: as an individual, you have the right to obtain from the provider restriction of processing where one of the following applies: (a) you contest the accuracy of the personal data for a period enabling the provider to verify the accuracy of the personal data, (b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead, (c) the provider no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims, (d) you have objected to processing pending the verification whether the legitimate grounds of the provider override yours;
The right to data portability: you have the right to receive the personal data concerning you, which you have provided to the provider, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the provider to which the personal data have been provided, where: (a) the processing is based on consent or on a contract; and (b) the processing is carried out by automated means. In exercising your right to data portability, you have the right to have your personal data transmitted directly from one controller (provider) to another, where technically feasible;
The right to object to data processing: as an individual, you have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the provider (Article 6 (1), point (e) of GDPR), processing is necessary for the purposes of the legitimate interests pursued by the provider or by a third party (Article 6 (1) point (f) of GDPR), including profiling based on the data; the provider shall no longer process your personal data unless the provider demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing; where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. Where data are processed for scientific or historical research purposes or statistical purposes, you have the right, on grounds relating to your particular situation, to object to the processing of your data, unless it is necessary for the performance of a task carried out in the public interest;
The right to lodge a complaint with a supervisory authority: without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes data protection regulations. Without prejudice to any other administrative or non-judicial remedy, you have the right to an effective judicial remedy, against a legally binding decision of a supervisory authority concerning it, as well as where the supervisory authority which is competent does not handle a complaint or does not inform you within three months on the progress or outcome of the complaint lodged.
Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established. The individual may address all her or his requests regarding personal data in written form to the provider, through one of the contacts at the website https://ehorti.com/contact/. In order to ensure reliable identification in case of a user exercising his or her rights regarding personal data, the provider may request additional data from the user and shall not refuse to act on the request of the individual, unless the provider demonstrates that it is not in a position to identify the user. The provider must, by user’s request to exercise his or her rights in regards to data processing, provide information without undue delay and in any event within one month of receipt of the request.
Notifying the supervisory authority of personal data breach
In the case of a personal data breach, the provider is obligated to notify the supervisory authority without undue delay, unless the provider is able to demonstrate that the data breach is unlikely to result in a risk to the rights and freedoms of individuals. When there is a suspicion of a criminal offence, the provider is obligated to notify the police and/or prosecutor. In the case of a breach that is likely to result in a high risk to the rights and freedoms of natural persons, the provider is obligated to notify the individual immediately or, if that’ is not possible, without undue delay. The notification should be in clear and comprehensible language.
Social media access
Through our website, you can access the following web pages, which the provider utilizes in their work:
- Instagram https://help.instagram.com/519522125107875
- Facebook: https://www.facebook.com/about/privacy/
- Youtube: https://policies.google.com/privacy?hl=en
Publishing of changes