GDPR Compliance

Last updated: January 2024

Our Commitment to GDPR

Květinový Atelier is committed to protecting the personal data of all individuals in accordance with the General Data Protection Regulation (EU) 2016/679. This document outlines how we comply with GDPR requirements and explains your rights as a data subject.

Data Controller Information

Květinový Atelier acts as the data controller for personal information collected through our website and services. Our contact details are:

• Address: Květná 42, Prague 2, 120 00, Czech Republic
• Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases as defined by GDPR Article 6:

• Consent (Article 6(1)(a)): When you explicitly agree to specific processing activities
• Contract (Article 6(1)(b)): When processing is necessary to perform our services
• Legal Obligation (Article 6(1)(c)): When we must comply with legal requirements
• Legitimate Interests (Article 6(1)(f)): When we have a valid business reason that does not override your rights

Your Rights Under GDPR

As a data subject, you are entitled to the following rights:

Right of Access (Article 15): You may request a copy of the personal data we hold about you and information about how we process it.

Right to Rectification (Article 16): You may request correction of any inaccurate or incomplete personal data we hold about you.

Right to Erasure (Article 17): You may request deletion of your personal data under certain circumstances, such as when it is no longer necessary for the purpose it was collected.

Right to Restriction (Article 18): You may request that we limit the processing of your data while we address your concerns or verify accuracy.

Right to Data Portability (Article 20): You may request to receive your data in a commonly used, machine-readable format for transfer to another controller.

Right to Object (Article 21): You may object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent (Article 7): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments when implementing new processing activities that may present high risks to individuals' rights and freedoms, as required by GDPR Article 35.

International Data Transfers

We primarily process data within the European Economic Area. If any data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and communicate with affected individuals as required by GDPR Articles 33 and 34.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month of receipt. If we need additional time due to complexity, we will inform you within the initial month.

Supervisory Authority

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with the Office for Personal Data Protection of the Czech Republic (ÚOOÚ) or your local data protection authority.