Dear Customer,

we would like to inform you how, as the controller of personal data, we process the personal data you have provided.

LEGAL FRAMEWORK FOR PERSONAL DATA PROTECTION

• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”);
• Act No. 110/2019 Coll., on the Processing of Personal Data (hereinafter the “Act”).

IDENTITY AND CONTACT DETAILS OF THE CONTROLLER

The controller of your personal data is Párty PP s.r.o., with its registered office at Evropská 695/73, Vokovice, 160 00 Prague 6, Company ID No.: 23299070, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 424815 (hereinafter the “Controller”).

Contact details for us as the controller of personal data:

• postal address: Evropská 695/73, Vokovice, 160 00 Prague 6,
• e-mail address: info@onlinebar.cz
• telephone: +420 725 965 595

We have not appointed a Data Protection Officer.

WHAT PERSONAL DATA WE PROCESS

• identification data – in particular first name and surname, username and password, or ID document number if you purchase on instalments, Company ID (IČO) and VAT ID if you are an entrepreneur,
• contact details – personal data that allow us to communicate with you, in particular your e-mail address, telephone number, delivery address and billing address,
• your settings – data in your account, in particular saved addresses and profiles, newsletter settings, membership in loyalty programmes, shopping lists, watched products (“watchdogs”), your product and service reviews and completed questionnaires,
• data about your orders – data about goods and services you have ordered from us, method of delivery and payment including payment account number, and data regarding complaints,
• data about your behaviour on our website, including when viewed through our mobile application, in particular the goods and services you view, links you click, how you navigate our site and scroll the screen, and also data about the device from which you view our site, such as IP address and location derived from it, device identification, its technical parameters such as operating system and version, screen resolution, browser used and its version, as well as data obtained from cookies and similar technologies for device identification,
• data related to your visit or use of our store – in particular recordings of telephone calls with our information line, identification of messages you send us, incl. identifiers such as IP addresses, and recordings from in-store camera systems.

SOURCES OF YOUR PERSONAL DATA WE USE

The only source of the personal data we process is you, our customer. We do not use any third-party services from which we would obtain your personal data.

OUR LEGAL GROUNDS FOR PROCESSING YOUR PERSONAL DATA

We process your personal data in different situations, which differ in whether your consent is required for processing or whether we do not need to request your consent. The basis for determining the legal grounds for processing is Article 6 of the GDPR.

Processing of your personal data without your consent:

• for the performance of a contract concluded between us and you as our customer,
• on the grounds of our legitimate interest – we process your identification and contact details and data about your orders based on our legitimate interest (without your consent) for the purpose of protecting legal claims and for our internal records and control. Our legitimate interests here are the protection of legal claims and the control of proper provision of our services,
• for compliance with a legal obligation – we process your personal data in order to comply in particular with the following legal regulations:
  
  • Act No. 89/2012 Coll., the Civil Code,
  • Act No. 634/1992 Coll., on Consumer Protection,
  • Act No. 235/2004 Coll., on Value Added Tax,
  • Act No. 563/1991 Coll., on Accounting.

Processing of your personal data based on your consent – e.g., sending newsletters, marketing campaigns.

PURPOSES OF PROCESSING YOUR PERSONAL DATA

We process the personal data you provide for the following purposes:

a) provision of our services,
b) performance of contractual relationships concluded (in particular purchase contracts),
c) obligations arising from concluded contractual relationships – handling complaints, returns, etc.,
d) administration of your user account on our website at www.onlinebar.cz,
e) marketing – direct offers of our products and services sent to your e-mail or communicated by phone,
f) fulfilment of accounting, tax and archiving duties under applicable legal regulations,

METHOD OF PROCESSING PERSONAL DATA

We process personal data primarily manually, and in certain cases and to a certain extent also partially by automated means in electronic information systems, both in paper and electronic form, always with the maximum possible technical, organisational and personnel security in accordance with applicable legislative requirements.

PERIOD OF STORAGE OF YOUR PERSONAL DATA

The retention (processing) period of personal data relates to the individual purposes of processing and follows from legal obligations, contractual relationships, legitimate interest or consent. Your personal data will be processed for the duration of the effects of rights and obligations under the contract and thereafter for the period necessary for archiving purposes in accordance with applicable generally binding legal regulations, but no longer than the period set by such regulations. Your personal data that we process on the basis of your consent for a given purpose are processed for as long as the consent is valid or until it is withdrawn. In line with the principle of data minimisation, our intention is to process only the personal data that are strictly necessary for the given purpose and to set retention so that the data are kept only for the time necessary to safeguard your interests or protect your rights or our interests.

Once the relevant period has expired or the reasons for retention have ceased, the personal data are deleted or anonymised.

OTHER RECIPIENTS OF YOUR PERSONAL DATA

Other recipients of your personal data include:

• carriers and other persons involved in the delivery of goods or the execution of payments under a purchase contract. These entities are:
  
  • PPL CZ s.r.o., Company ID 25194798,
  • Česká pošta, s.p., Company ID 47114983,
    ADD OTHERS AS APPLICABLE
• providers of payment services and payment processors for the purpose of ensuring the transfer of funds. These entities are:
  
  • Fio banka
  • competent public authorities, if requested in individual cases.

The entities to which we transfer your personal data are not authorised to process this data for any other purpose, nor to transfer it to any other person without our consent or instruction, unless such entities have a legal ground to do so.

TRANSFER OF YOUR PERSONAL DATA ABROAD (OUTSIDE THE EU)

We do not transfer your personal data to third countries (outside the EU) or to international organisations.

YOUR RIGHTS UNDER THE GDPR

You, our customer (the “data subject”), have the rights set out below pursuant to Articles 12 to 21 of the GDPR. If you exercise these rights with us, we are obliged to facilitate their exercise.

Your rights under the GDPR are:

• Right to information
  Your fundamental right implementing the principle of transparency of personal data processing, which guarantees you proper information about the processing of your personal data.
  You have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:
  
  • the purposes of processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of personal data concerning the data subject or restriction of processing, or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • any available information as to the source of the personal data, where the personal data are not collected from the data subject;
  • the fact of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
• Right to rectification and completion
  You have the right to have inaccurate personal data concerning you rectified without undue delay. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.
  If we receive such a request from you, we are obliged to take appropriate steps to verify the request and, where appropriate, exercise this right by rectification or completion.
  However, we are not obliged to actively seek out your inaccurate personal data.
• Right to erasure (“right to be forgotten”)
  You have the right to have personal data concerning you erased without undue delay and we are obliged to erase personal data without undue delay where one of the following grounds applies:
  
  • the personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
  • you withdraw consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal ground for the processing,
  • you object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR,
  • the personal data have been unlawfully processed,
  • the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject,
  • the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) and (2) of the GDPR.
• Right to restriction of processing
  You have the right to obtain restriction of processing where one of the following applies: you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;
  
  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
  • we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims,
    you have objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether our legitimate grounds override your legitimate grounds.
  Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future. A key feature of restriction is its temporary nature (which distinguishes it from erasure). An example is a situation where, due to an incorrectly entered e-mail address, e.g., service usage statements are sent to another person and this person contests the accuracy of the personal data (the e-mail address). The controller is obliged, until the inaccuracy is remedied, to restrict processing of the inaccurate e-mail address and not to send details of another natural person to the wrong recipient.
• Right to data portability
  You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format (e.g., CSV, XML, JSON, ZIP, etc.) and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.
  This right of the data subject can be exercised only if both of the following conditions are cumulatively met:
  
  • the processing is based on consent or on a contract, and
  • the processing is carried out by automated means.
• Right to object
  You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you, but only where the processing is based on Article 6(1) of the GDPR, point:
  
  • e – processing is necessary for the protection of your vital interests or those of another natural person,
  • f – processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms requiring protection of personal data, in particular where the data subject is a child, including profiling based on those provisions.
  We will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
• Right to withdraw consent to personal data processing
  You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal, i.e., it has no retroactive effect. If you exercise this right, we are obliged, from the moment of receipt of the withdrawal, to immediately cease processing those personal data of yours that we have processed on the basis of such consent.
• Right to lodge a complaint
  If you believe that our processing of your personal data constitutes a breach of the GDPR, you have the right to lodge a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, website https://www.uoou.cz, e-mail posta@uoou.cz, telephone +420 234 665 111 (switchboard), or with the supervisory authority of another Member State.
  You may lodge a complaint with the supervisory authority in the place of your habitual residence, place of employment, or the place where the alleged infringement took place. For details, see the supervisory authority’s website https://www.uoou.cz.

EXERCISING YOUR RIGHTS UNDER THE GDPR

We are obliged to facilitate the exercise of your rights under the GDPR. For this purpose, we have prepared the following form:

• Request to Exercise Data Subject Rights

You can submit your request in one of the following ways:

• in writing to Evropská 695/73, Vokovice, 160 00 Prague 6,
• in person at our store at Evropská 695/73, Vokovice, 160 00 Prague 6,
• electronically by e-mail to info@onlinebar.cz or to the data box ID aajcnbf.

In Prague on 18 September 2025