1. Controller

The controller of the website tatraderm.com and the e-shop is:

DARTAN s.r.o., registered office: Jelenia 3131/1, Bratiislava 811 05, Company ID (IČO): 44 090 030, Tax ID (DIČ): 2022580021, VAT ID (IČ DPH): SK2022580021, registered in  the Commercial Register of the District Court Bratislava I, Section: Sro
Email: info@tatraderm.com | Phone: [phone]

(hereinafter the “Controller”)

We process personal data in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter the “Regulation” or “GDPR”) and Slovak Act No. 18/2018 Coll. on the protection of personal data.

2. Purposes of processing, legal basis and scope of data

1. Order of goods – conclusion of a purchase contract and related activities
Order processing, payment, delivery of goods, withdrawal from the contract, liability for defects (complaints), etc.
The legal basis for processing for this purpose is the performance of a contract – Art. 6(1)(b) of the Regulation.
Scope of data: first name and surname, billing and delivery address, email, phone number, order content, bank account number (when refunding a payment).
Retention period: until the order, complaint or withdrawal from the contract has been dealt with, and thereafter for the limitation period of claims arising from the contract.

2. Compliance with legal obligations
Keeping accounts, recording tax documents and fulfilling other obligations arising from legal regulations.
The legal basis for processing for this purpose is compliance with a legal obligation – Art. 6(1)(c) of the Regulation.
Scope of data: billing data and payment data.
Retention period: 10 years, or for the period set by specific legislation.

3. Customer account – easier ordering and an overview of previous purchases
The legal basis for processing for this purpose is the consent of the data subject – Art. 6(1)(a) of the Regulation.
Scope of data: name, email, password (stored in encrypted form), addresses, order history.
Retention period: until the account is deleted or consent is withdrawn.

4. Cookies – ensuring the operation of the website, monitoring the behaviour of customers and visitors, and personalising marketing offers
The legal basis for processing for this purpose is the consent of the data subject – Art. 6(1)(a) of the Regulation (except for strictly necessary cookies, see section 6).

5. Contact form – answering questions and resolving problems
The legal basis for processing for this purpose is the legitimate interest of the Controller – Art. 6(1)(f) of the Regulation. The legitimate interest of the Controller, and at the same time of the person making contact, arises from the aim of answering their questions or resolving problems that have arisen, and thereby maintaining and promoting the satisfaction of customers and users of the website.
Scope of data: name, email, content of the message.
Retention period: until the request has been dealt with, at most [1] year.

6. Protection of legal claims
Establishing, exercising and defending the Controller’s legal claims.
The legal basis for processing for this purpose is the legitimate interest of the Controller – Art. 6(1)(f) of the Regulation.
Retention period: for the duration of the limitation period.

Providing the data necessary to conclude and perform the purchase contract is a contractual requirement; without it we cannot process your order. Providing data for other purposes is voluntary. We do not use automated decision-making or profiling that produces legal effects concerning you.

3. Recipients of personal data

We disclose data only to the extent necessary and only to the following categories of recipients and processors:

• hosting and email service provider: Websupport s.r.o.,
• carriers: [to be added],
• payment gateway provider: [to be added],
• accounting service provider: [to be added],
• providers of analytics and advertising tools: [Google Ireland Ltd., Meta Platforms Ireland Ltd. – only if deployed],
• public authorities, where required by law.

We do not sell personal data.

4. Transfers to third countries

We process data primarily within the EU/EEA. If any provider transfers data outside the EU/EEA, this takes place on the basis of a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or standard contractual clauses under Art. 46 of the Regulation.

5. Rights of the data subject

You have the right to:

• access your personal data and obtain a copy (Art. 15),
• rectification of inaccurate or incomplete data (Art. 16),
• erasure of data (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
• lodge a complaint with a supervisory authority: the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk, or the supervisory authority in your Member State.

You can exercise your rights by emailing objednavky@tatraderm.com. We will respond within 30 days at the latest.

6. Cookies

Cookies are small text files stored on your device when you visit a website. We use them in accordance with Slovak Act No. 452/2021 Coll. on electronic communications and the Regulation.

• Strictly necessary cookies ensure the operation of the website (shopping cart, login, security, storing your cookie choices). They are stored without consent because the e-shop would not work without them.
• Analytics cookies allow us to monitor visitor behaviour and improve the website ([e.g. Google Analytics]). They are stored only with your consent.
• Marketing cookies are used to personalise marketing offers and measure advertising ([e.g. Meta Pixel]). They are stored only with your consent.

A detailed list of cookies, including their duration, can be found in the cookie settings: [link]. You can change or withdraw your consent at any time via [link to cookie settings] or in your browser settings.

7. Data security

We protect your data with appropriate technical and organisational measures: an encrypted connection (HTTPS), restricted access, backups and system updates. We do not store payment card data; it is processed exclusively by the payment gateway provider.

8. Changes

We may update this policy. The current version is always published on this page together with its effective date.