Information on the processing of personal data in accordance with the GDPR.
The data controller is Next Chapter s. r. o., Nitrianska 8637/6, 010 08 Žilina, Slovenská republika, company ID 57 435 383, operator of the Parvi Lectores e-shop. Contact e-mail for data protection matters: info@parvilectores.sk.
The controller is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR, as personal data processing is not its core activity and does not take place on a large scale.
When processing an order, we collect the following personal data: first and last name, e-mail address, phone number, delivery address (street, city, postal code, country) and any order note provided.
We do not process any special categories of personal data under Article 9 GDPR (e.g. health data, biometric data, political opinions, etc.).
Performance of the sales contract (Article 6(1)(b) GDPR) – processing is necessary to fulfil the order, communicate with the customer and deliver the goods.
Compliance with a legal obligation (Article 6(1)(c) GDPR) – maintaining accounting and tax records in accordance with applicable Slovak law.
Legitimate interests of the controller (Article 6(1)(f) GDPR) – fraud prevention and debt recovery. This interest prevails over data subjects' interests given the reasonable expectations of customers.
Data forming part of an accounting record is retained for 10 years, as required by Act No. 431/2002 Coll. on accounting. Other order data, such as a customer note or the chosen pickup point, is retained for the duration of the contractual relationship and for 2 years thereafter, matching the period of liability for defects.
After the statutory retention period, personal data is securely deleted or anonymised.
The delivery address and contact details necessary for delivery are provided to the carrier that delivers the parcel. If the buyer selects a pickup point, the identifier of the chosen point is also processed. On request, the seller will name the carrier handling a particular parcel.
For online payments, payment data is processed by the GoPay payment gateway (GoPay Czech Branch, Company ID 22177469, Senovážné nám. 1736, 370 01 České Budějovice, Czech Republic); the controller does not have access to card payment details.
Personal data is not sold, rented or otherwise disclosed to third parties for commercial purposes. Data is not transferred to third countries outside the European Economic Area.
If a visitor uses the form for reporting a problem or a suggestion, we process the text of the message, an optional e-mail address, the address of the page the form was opened from, the browser window dimensions, the browser identification (user agent) and the time of sending. Providing an e-mail address is voluntary and serves only to send a reply.
The legal basis is the controller's legitimate interest (Art. 6(1)(f) GDPR) in fixing faults and improving the website. The optional e-mail address is data provided voluntarily for the purpose of a reply.
The report is not stored in a database or in the shop's files — it is sent solely by e-mail to the controller's mailbox and kept only for as long as is needed to deal with it. To protect the form from being abused for bulk sending, we keep separately a count of submissions attached to a fingerprint (hash) of the IP address; that record is removed automatically within one hour and is not linked to the content of the message.
When a title is sold out, a visitor may ask to be told once it is back. For that purpose we process the e-mail address and the time of the request. Giving the address is voluntary and the title remains available to browse without it.
The legal basis is the consent of the data subject (Art. 6(1)(a) GDPR), given by submitting the form. Consent can be withdrawn at any time through the link in the confirmation e-mail; withdrawal does not affect the lawfulness of processing carried out beforehand.
The address is kept only until a single reminder has been sent and is deleted immediately afterwards. It is not used for a newsletter or any other commercial communication and is not disclosed to third parties. To protect the form from abuse we separately keep a count of submissions against a hash of the IP address; that record is removed automatically within one hour.
Right of access – you have the right to request confirmation of whether your personal data is being processed and, if so, to obtain access to it together with information about the processing.
Right to rectification – you have the right to request correction of inaccurate or completion of incomplete personal data.
Right to erasure – you have the right to request deletion of your personal data if it is no longer needed for the purpose for which it was collected, or if processing was unlawful.
Right to restriction – you have the right to request restriction of processing in the cases provided for by the GDPR.
Right to data portability – you have the right to receive your personal data in a structured, commonly used and machine-readable format.
Right to object – you have the right to object to processing based on the controller's legitimate interests.
All requests to exercise your rights can be sent by e-mail to the controller's address. The controller will respond without undue delay, no later than 30 days.
You have the right to lodge a complaint with the Slovak Data Protection Authority, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk.
