Privacy policy and Cookies

I. Operator

1.1. The identity and contact details of the Operator are:

Business name:

Registered office:

Slovak Republic Registered in the register of the District Court Košice I, Section Sro,

Insert number 55420/V Company

ID: 

Tax ID: 

Bank account: 

The Seller is not a VAT payer.

1.2. Email contact and phone contact for the Operator are:

Email: 

Phone: 

1.3. The address for sending documents to the Operator is:

Adresssssssssssssssss

1.4. In accordance with Article 13 (1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the General Data Protection Regulation (hereinafter referred to as the “Regulation”), as well as in accordance with Act No. 18/2018 Coll. on the protection of personal data and on the amendment and supplementation of certain laws in force and Act No. 452/2021 Coll. on electronic communications in force, the Operator provides the Data Subject – (Buyer), from whom the Operator (Seller) obtains personal data concerning them, with this information, instructions, and explanations.

II. Links

2.1. These principles and instructions on the protection of personal data are part of the General Terms and Conditions published on the Seller’s website.

2.2. In accordance with §3, para. 1, letter n) of Act No. 102/2014 Coll., the Seller informs the consumer that there are no specific codes of conduct to which the Seller has committed to adhere, and no such codes of conduct exist, where the code of conduct means an agreement or a set of rules that define the behavior of the Seller who has committed to comply with this code of conduct regarding one or more specific commercial practices or business sectors if they are not established by law or other legal regulation or measure of a public authority), which the Seller has committed to comply with, and how the consumer can become acquainted with them or obtain their wording.

III. Protection of Personal Data and Use of Cookies. Instruction and Explanation of Cookies, Scripts, and Pixels

3.1. The Operator of the website provides a brief explanation of the function of cookies, scripts, and pixels:

3.1.1. Cookies are text files that contain a small amount of information downloaded to your device when you visit a website. Thanks to this file, the website retains information about your steps and preferences (such as login name, language, font size, and other display settings) for a certain period, so you do not have to re-enter them on your next visit to the website or when browsing its individual pages. Script is a part of the program code used for the proper and interactive functioning of websites. This code runs on the server of the Operator or on your device. Pixels are small, invisible text or images on a website used to monitor website traffic. To do this, various data are stored through pixels.

3.1.2. Cookies are divided into: Technical or functional cookies – ensure the proper functioning of the Operator’s website and its use. These cookies are used without consent. Statistical cookies – The Operator obtains statistics on the use of its websites. These cookies are used only with consent. Marketing / Advertising cookies – Used to create advertising profiles and similar marketing activities. These cookies are used only with consent.

3.2. How to control cookies: 3.2.1. You can control and/or delete cookies at your discretion – see details on the website aboutcookies.org. You can delete all cookies stored on your computer or other device, and you can set most browsers to prevent them from being stored.

3.3. The Operator’s website uses these cookies: All cookies used by the Operator can be found on the website https://www.cookieserve.com/ by entering the web address of the Operator https://www.canfylipsacademy.com Technical or functional cookies – the Operator’s website accesses this information. Cookie lifetime is 5 years. Statistical cookies – the Operator’s website accesses this information. Cookie lifetime is 5 years. Marketing and advertising cookies – the Operator’s website accesses this information. Cookie lifetime is 5 years.

3.3.1. Cookies accessed by third parties: Google Analytics, Google Ads: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For more information on privacy, visit https://support.google.com/analytics/topic/2919631?hl=en&amp

IV. Processed Personal Data

4.1. The Operator processes the following personal data on its website: name, surname, address, email address, home phone number, mobile phone number, billing address, delivery address, data obtained from cookies, IP addresses.

V. Contact Information of the Responsible Person for Personal Data Protection

5.1. The Operator has appointed a responsible person for the protection of personal data in accordance with Regulation 2016/679 on the protection of individuals concerning the processing of personal data and on the free movement of such data. Contact: Email: info@candylipsacademy.com.

5.2. The Operator is also the Seller within the meaning set forth in the General Terms and Conditions of this website.

VI. Purposes of Processing Personal Data of the Data Subject and Duration of Processing Personal Data

6.1. The purposes of processing personal data of the Data Subject include, in particular:

6.1.1. Record keeping, creation, and processing of contracts and client data for the purpose of concluding contracts with third parties. 6.1.2. Processing of accounting documents and documents related to the business activities of the Operator. 6.1.3. Compliance with legal regulations regarding the archiving of documents and records, such as Act No. 431/2002 Coll., the Accounting Act, and other relevant regulations. 6.1.4. Activities of the Operator in connection with fulfilling requests, orders, contracts, and similar institutes of the Data Subject.

6.1.5. Newsletter, marketing, and similar advertising activities of the Operator. In case of the Data Subject’s consent to the Operator for marketing and similar advertising activities.

6.2. The Operator retains the personal data of the Data Subject only for the necessary period required for the fulfillment of the contract and its subsequent archiving in accordance with legal deadlines imposed on the Operator by regulations. In the event that the Data Subject has agreed to receive advertising emails and similar offers, the personal data of the Data Subject is processed for these purposes until the Data Subject revokes their consent. However, not exceeding a period of 10 years.

VII. Legal Basis for Processing Personal Data of the Data Subject

7.1. In the event that the Operator processes personal data based on the consent of the Data Subject, this processing will commence only after the Data Subject has given their consent. 7.2. In the event that the Operator processes personal data of the Data Subject for the purposes of pre-contractual relations, concluding and fulfilling a purchase contract, and the related delivery of goods, products, or services, the Data Subject is obliged to provide personal data for the proper fulfillment of the purchase contract; otherwise, fulfillment cannot be ensured. Personal data for this purpose is processed without the consent of the Data Subject.

VIII. Recipients or Categories of Recipients of Personal Data

8.1. The recipients of personal data of the Data Subject will be or at least may include:

8.1.1. Statutory authorities or their members of the Operator.

8.1.2. Persons performing work for the Operator in an employment or similar relationship.

8.1.3. Sales representatives of the Operator and other persons collaborating with the Operator in fulfilling the tasks of the Operator. For the purposes of this document, individuals performing dependent work for the Operator based on an employment contract or agreements on work performed outside an employment relationship will be considered as the Operator’s employees.

8.1.4. The recipients of personal data of the Data Subject will also include collaborators of the Operator, its business partners, suppliers, and contractual partners, namely: accounting company, company providing software creation and maintenance services, company providing legal services to the Operator, company providing advisory services to the Operator, companies providing transportation and delivery of products to buyers and third parties, marketing companies, companies operating social networks, companies providing payment gateways, and other payment methods.

8.1.5. The recipients of personal data will also include courts, authorities active in criminal proceedings, tax authorities, and other state authorities, if required by law. Personal data will be provided by the Operator to these authorities and state institutions based on and in accordance with the laws of the Slovak Republic.

8.1.6. List of third parties – intermediaries and recipients processing personal data of the Data Subject: Slovenská pošta, a.s., Partizánska cesta 9, 975 99 Banská Bystrica, IČO: 36631124 – a third party providing transport services STRIPE PAYMENTS EUROPE, LIMITED, C/O A & L Goodbody, Ifsc, North Wall Quay, Dublin, D01 H104, Ireland – a third party providing payment gateway

IX. Information on the Provision of Personal Data to Third Countries and the Storage Period:

9.1. Not applicable. The Operator does not transfer personal data to third countries.

X. Information about the Existence of Relevant Rights of the Data Subject:

he touched person has, among other rights:

10.1.1. Other rights of the affected persons are not affected by Section 10.1.

10.1.2. The right of the affected person to access data under Article 15 of the Regulation, which includes the right to obtain from the Controller confirmation of whether the personal data of the affected person is being processed and, if so, to what extent. Additionally, if processed, the right to know their content and request from the Controller information about the reasons for their processing, especially information about: the reasons for their processing, categories of personal data concerned, recipients or categories of recipients to whom the personal data have been or will be disclosed, especially in the case of recipients in third countries or international organizations, the expected retention period of personal data, or if not possible, information about the criteria for determining it, the existence of the right to request the Controller to correct personal data concerning the affected person or delete them or restrict processing, and the existence of the right to object to such processing, the right to lodge a complaint with the supervisory authority if the personal data were not obtained from the affected person, any available information regarding their source, the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation, and in these cases, at least meaningful information about the logic used, as well as the significance and expected consequences of such processing of personal data for the affected person, the reasonable safeguards under Article 46 of the Regulation regarding the transfer of personal data when personal data are transferred to a third country or international organization.

10.1.3. The right to provide a copy of personal data being processed, subject to the condition that the right to provide a copy of processed personal data must not have adverse effects on the rights and freedoms of others.

10.1.4. The right of the affected person to rectification under Article 16 of the Regulation, which includes the right for the Controller to correct inaccurate personal data concerning the affected person without undue delay. The right to complete incomplete personal data of the affected person, even by providing a supplementary statement of the affected person. The right of the affected person to erase personal data (the so-called “right to be forgotten”) under Article 17 of the Regulation, which includes:

10.1.5. The right to obtain from the Controller the erasure of personal data concerning the affected person without undue delay if one of the following reasons is met: personal data are no longer necessary for the purposes for which they were collected or otherwise processed, the affected person withdraws the consent on which the processing is based, and there is no other legal ground for the processing of personal data. The affected person objects to the processing of personal data under Article 21(1) of the Regulation, and there are no overriding legitimate grounds for the processing of personal data, or the affected person objects to the processing of personal data under Article 21(2) of the Regulation. The personal data have been processed unlawfully, personal data must be erased to comply with a legal obligation under the law of the European Union or the law of a Member State to which the Controller is subject, personal data have been collected in connection with the offer of information society services under Article 8(1) of the Regulation.

10.1.6. The right for the Controller who has made personal data of the affected person public to take reasonable steps, including technical measures, to inform other Controllers processing personal data that the affected person requests the deletion of all links to such personal data, their copy, or replicas. However, the right to erasure of personal data with the content of rights under Article 17(1) and (2) of the Regulation will not arise if the processing of personal data is necessary:

10.1.7. To exercise the right to freedom of expression and information.

10.1.8. To comply with a legal obligation that requires processing under the law of the European Union or the law of a Member State to which the Controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority entrusted to the Controller.

10.1.9. For reasons of public interest in the field of public health in accordance with Article 9(2)(h) and (i) of the Regulation, as well as Article 9(3) of the Regulation.

10.1.10. For archival purposes in the public interest, for scientific or historical research purposes, or for statistical purposes in accordance with Article 89(1) of the Regulation, if it is likely that the right under Article 17(1) of the Regulation will make it impossible or seriously impair the achievement of the objectives of such processing of personal data, or for the establishment, exercise, or defense of legal claims.

10.1.11. The right of the affected person to restrict the processing of personal data under Article 18 of the Regulation, which includes:

10.1.12. The right for the Controller to restrict the processing of personal data in one of the following cases: the affected person disputes the accuracy of personal data, for a period allowing the Controller to verify the accuracy of personal data, the processing of personal data is unlawful, and the affected person objects to the erasure of personal data and requests the restriction of their use instead, the Controller no longer needs personal data for the purposes of processing, but the affected person needs them for the establishment, exercise, or defense of legal claims, the affected person has objected to the processing under Article 21(1) of the Regulation until it is verified whether the legitimate grounds of the Controller override those of the affected person.

10.1.13. The right for such restrictedly processed personal data to be processed only with the consent of the affected person or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of significant public interest of the European Union or a Member State.

10.1.14. The right to be informed in advance of the lifting of the restriction on the processing of personal data.

10.1.15. The right of the affected person to fulfill the obligation to notify recipients under Article 19 of the Regulation, which includes: the right for the Controller to inform each recipient to whom personal data has been disclosed of any rectification or erasure of personal data or restriction of processing carried out under Article 16, Article 17(1), and Article 18 of the Regulation, unless this proves impossible or requires disproportionate effort, the right for the Controller to inform the affected person about these recipients if the affected person requests it.

10.1.16. The right of the affected person to data portability under Article 20 of the Regulation, which includes: the right to obtain personal data concerning the affected person and provided to the Controller in a structured, commonly used, and machine-readable format and the right to transmit this data to another Controller without hindrance from the Controller, provided that:

a/ processing is based on the consent of the affected person under Article 6(1)(a) of the Regulation or Article 9(2)(a) of the Regulation, or on a contract under Article 6(1)(b) of the Regulation, and at the same time b/ processing is carried out by automated means, and at the same time:

10.1.17. The right to obtain personal data in a structured, commonly used

10.1.17. The right to obtain personal data in a structured, commonly used, and machine-readable format and the right to transfer this data to another controller without hindrance will not have adverse effects on the rights and freedoms of others.

10.1.18. The right to transfer personal data directly from one controller to another controller, where technically feasible.

10.1.19. The right of the data subject to object, as provided in Article 21 of the Regulation, which includes:

10.1.20. The right to object at any time, for reasons relating to the specific situation of the data subject, to the processing of personal data concerning them, based on Article 6(1)(e) or (f) of the Regulation, including profiling based on these provisions of the Regulation.

10.1.21. In the event of exercising the right to object at any time for reasons relating to the specific situation of the data subject against the processing of personal data concerning them, which is carried out based on Article 6(1)(e) or (f) of the Regulation, including profiling based on these provisions of the Regulation, the right for the controller to no longer process the personal data of the data subject, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

10.1.22. The right to object at any time against the processing of personal data concerning the data subject for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. It should be noted that if the data subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes.

10.1.23. In the context of using information society services, the right to exercise the right to object to the processing of personal data through automated means using technical specifications.

10.1.24. The right to object, for reasons related to the specific situation of the data subject, against the processing of personal data concerning them when personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the Regulation, except where the processing is necessary for the performance of a task carried out for reasons of public interest.

10.1.25. The right of the data subject related to automated individual decision-making, as provided in Article 22 of the Regulation, which includes:

10.1.26. The right for a decision not to be based solely on automated processing of personal data, including profiling, and having legal effects on, or similarly significantly affecting, the data subject, except for cases under Article 22(2) of the Regulation (i.e., except when the decision is: (a) necessary for the conclusion or performance of a contract between the data subject and the controller,

10.1.27. Permitted by the law of the European Union or the law of the Member State to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests or (c) based on the explicit consent of the data subject.

XI. Information on the Data Subject’s Right to Withdraw Consent for Personal Data Processing:

11.1. The data subject is entitled to withdraw their consent for the processing of personal data at any time without affecting the lawfulness of the processing based on the consent given before its withdrawal. The withdrawal of consent by the data subject can be in full or in part. Partial withdrawal of consent for the processing of personal data may relate to specific types of processing operations, with the legality of processing personal data in the remaining scope of processing operations remaining unaffected. The data subject may exercise the right to withdraw consent for the processing of personal data in writing to the address of the controller as recorded in the commercial register at the time of consent withdrawal or electronically through electronic means (by sending an email to the controller’s email address provided for identification of the controller in this document).

XII. Information on the Data Subject’s Right to Lodge a Complaint with the Supervisory Authority:

12.1. The data subject has the right to lodge a complaint with the supervisory authority, especially in the Member State of their habitual residence, place of work, or the place of the alleged infringement if they believe that the processing of personal data concerning them is in violation of the Regulation, without prejudice to any other administrative or judicial remedies. The data subject has the right to be informed by the supervisory authority to which the complaint was submitted about the progress and the outcome of the complaint, including the possibility of seeking a judicial remedy under Article 78 of the Regulation.

12.2. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovak Republic. Contact: Tel. +421 /2 3231 3214, Email: statny.dozor@pdp.gov.sk.

XIII. Information Related to Automated Decision-Making, Including Profiling:

13.1. As the controller does not engage in the processing of the data subject’s personal data in the form of automated decision-making, including profiling, as mentioned in Article 22(1) and (4) of the Regulation, the controller is not obliged to provide information under Article 13(2)(f) of the Regulation, i.e., information about automated decision-making, including profiling, and the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. This provision does not apply.

XIV. Final Provisions:

14.1. These Principles and instructions on the protection of personal data and cookie instructions constitute an integral part of the General Terms and Conditions and the Complaints Procedure. The documents – General Terms and Conditions and the Complaints Procedure of this website are published on the domain of the Seller’s website.

14.2. These Principles of personal data protection become valid and effective upon their publication on the Seller’s website on 18.02.2023.