Privacy Policy

in relation to the European Parliament and Council Regulation (EU) 2016/679, dated April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the operator of the online store issues these general data protection principles.

1. Operator of the online store:
   Alaskan Fisherman a.s.,
   ID: 09924451,
   VAT ID: CZ09924451
   located at V celnici 1034/6, 110 00 Prague 1 - Nové Město,
   registered in the Commercial Register kept by the Municipal Court in Prague, Section B, Insert 26090
   (hereinafter referred to as the "website operator")
2. Contact information:
   Contact person (representative): Mgr. Kristýna Malá
   address: V celnici 1034/6, 110 00 Prague 1
   e-mail: [email protected]
   tel.: +420 252 252 752

I.
Introduction

1. In this informative document, you will find information about what personal data the website operator processes, especially about its customers and users of its website, i.e. on the alaskanfisherman.cz website (hereinafter referred to as the "website"), and whether the data is processed on the basis of consent or on another legal basis, for what purposes they are used, to whom the website operator is authorized to transmit personal data, and what rights the data subject (hereinafter referred to as the "data subject") has in connection with the processing of personal data.

II.
List of processed personal data

1. The website operator collects various types of data about authorized individuals, including usernames and passwords, contacts, and other settings. The website operator monitors which products the authorized person views on the website and from which device, as well as which offers from the website operator sent via email are of interest, and derives further information about authorized individuals for the purpose of displaying tailored offers and future improvement of the website's appearance. In the event that an authorized person makes a purchase or creates an account with the website operator, the website operator also works with the person's name, surname, order history, and account settings.
2. The website operator most frequently collects data about authorized individuals through a request form.
3. The website operator primarily processes the following data:
   1. Identification data, which includes names and surnames, usernames and passwords, and, if the individual is a businessperson, their company registration number and VAT number;
   2. Contact details, which are personal data that allow us to contact you, such as email address, phone number, delivery address, billing address, and your social media contact information;
   3. Settings, which refer to data about managing your created account, such as saved addresses and profiles, newsletter settings, membership in loyalty programs, shopping lists, watched products (also known as watchdogs), your product and service ratings, and completed questionnaires;
   4. Order data, which includes details about goods and services ordered by authorized individuals, delivery methods, payments, and information about complaints.
   5. Behavioral data on the website, including cases where the authorized person views the website through the website operator's mobile application, particularly the goods and services displayed, links clicked, method of navigation on the website and scrolling, as well as data on the device from which the authorized person views the website, such as IP address and derived location, device identification, technical parameters like operating system and version, screen resolution, browser used and its version, and data obtained from cookies and similar technologies for device identification;
   6. Behavioral data when reading messages, particularly the time of opening messages, as well as data on the device on which the authorized person reads messages, such as IP address and derived location, device identification, technical parameters like operating system and version, screen resolution, browser used and its version;
   7. Derived data, which refers to personal data derived from the settings, information on goods and services purchased by the authorized person from the website operator, data on the behavior of the authorized person on the website, and data on the behavior of the authorized person when reading emails sent by the website operator, specifically data on gender, age, financial situation, purchasing behavior, and relationship to various goods and services;
   8. Data related to the use of the call center or visits to the store, particularly records of phone conversations with the call center, identification of messages sent by the authorized person to the website operator, including identifiers such as IP addresses, and recordings from camera systems at the premises.

III.
Reason for processing personal data

1. Personal data is processed in various situations and for various purposes. If a legitimate person uses a website where the website operator processes cookie files, the data of the legitimate person is mainly used for monitoring traffic and improving services. If a legitimate person registers on the website of the website operator, the operator uses the data to manage the customer account and provide related functions. In the case of a purchase, the website operator uses the data of the legitimate person to process the order, protect the legal claims of the website operator, and fulfill legal obligations. Contact information of the legitimate person is used to personalize offers. With the consent of the legitimate person, data is transmitted to third parties for the purpose of displaying offers on other websites and for providing some additional services. The website operator is authorized to process personal data either by preparing or fulfilling a contract with the legitimate person, complying with legal obligations, protecting the legitimate interests of the website operator, or with the consent of the legitimate person. Personal data is processed for various purposes and to varying degrees within the activities of the website operator, either:
   1. without the consent of the legitimate person based on the fulfillment of a contract, for the protection of the legitimate interests of the website operator or for the purpose of fulfilling legal obligations, or
   2. based on the consent of the legitimate person.
2. The processing that the website operator can carry out without the consent of the legitimate person depends on the purpose of the relevant processing and the position of the legitimate person in relation to the website operator - whether they are just a visitor to the website or a registered subject or buyer. The website operator is also authorized to process personal data if the legitimate person is the recipient of goods or services ordered from the website operator, in the case of personal communication or a visit to the store.

IV.
Cookies, use and processing of personal data of website visitors

1. When a user visits the website, small files known as cookies are stored on their device and subsequently read from it. A cookie is a small file containing letters and numbers that is stored in the internet browser or on the hard drive of the user's computer. Some cookies allow the website operator to link activities during the browsing session from the moment the web browser window is opened until it is closed. Cookies are deleted when the internet browser window is closed. Others remain on the device for a set period and are activated each time the user visits a website that has created those specific cookies. In addition, pixel tags (also known as web beacons), which are small images with a similar function to cookies, are used. Unlike cookies, which are stored on the hard drive of the computer, pixel tags are a fixed part of the website. All the described technologies will be referred to as cookies.
2. Some cookies directly stored on the user's device by the website are used for the following purposes:
   1. identification of the user when navigating between different pages on the website and during subsequent visits, for example to ensure that the shopping cart is not deleted during a purchase, to remember login credentials for a specific device, or to save which version of the website to display if multiple versions are available at the time;
   2. recording consent in accordance with this document;
   3. ensuring security to prevent misuse of the user's connection to the website by a third party acting on behalf of the user;
   4. tracking, surveying, and troubleshooting of the website's malfunctioning components.
3. Such cookies and other files are necessary for the functioning of the website.
4. If an authorized person blocks websites, they may not function properly.
   1. Information is collected to improve the website,
   2. including creating statistics and overviews, particularly tracking website visits, measuring the effectiveness of advertising, and measuring website efficiency and advertising expenses. Additional derived data is obtained from the website for this purpose, and pseudonymized data may be passed on to our partners for commission settlement.
   3. New features and applications are tested before deployment.
   4. Preventing attacks on websites and endangering the functionality and security of authorized persons' data.
5. Data on the behavior of authorized persons on the website is not only obtained from cookies. It is also supplemented with information such as:
   1. IP address of the authorized person's device;
   2. Operating system of the authorized person's device, its version, and language settings;
   3. Browser used by the authorized person on their device, its version, and language settings;
   4. Website address (URL address) from which you come to the website.
6. For these purposes, the website operator uses personal data for a maximum of 38 months, and during this time, the website operator only keeps the data in pseudonymized form. The authorized person may object to this processing.

V.
Processing of customer personal data for the purpose of fulfilling contractual and legal obligations

1. Data is processed also in case of registration of authorized person on website, particularly for the purpose of fulfilling the contract, pursuing the legitimate interests of the website operator, and fulfilling legal obligations.
2. For the purpose of fulfilling legal obligations, personal data is collected mainly based on obligations specified in Act No. 89/2012 Coll., Civil Code, Act No. 634/1992 Coll., on Consumer Protection, Act No. 235/2004 Coll., on Value Added Tax, and Act No. 563/1991 Coll., on Accounting.
3. If the authorized person is the recipient of goods or services that are ordered from the website operator, identification and contact data is processed:
   1. based on the legitimate interest of the website operator for the purpose of preparing, concluding and fulfilling the contract with our authorized person. Fulfilling this contract is a legitimate interest of the website operator;
   2. based on the legitimate interest of the website operator for obtaining information, in order to improve services, or for creating internal statistics and overviews; the legitimate interest here is to improve our services for our customers;
   3. for the purpose of fulfilling legal obligations, especially according to Act No. 235/2004 Coll., on Value Added Tax, and Act No. 563/1991 Coll., on Accounting;
   4. for the purpose of protecting legal claims and internal record keeping and control; legitimate interests here are protection of legal claims and control of proper provision of services by the website operator.
4. For the preparation, conclusion, and fulfillment of a contract with an authorized person, the website operator uses personal data for the time necessary to process the order. After this period, the data is retained based on legitimate interest for the purpose of protecting legal rights and internal records and controls, for the duration of the statute of limitations of 3 years and one year after its expiration with respect to claims made at the end of the statute of limitations. In the event of judicial, administrative, or other proceedings, the website operator processes personal data of the authorized person to the necessary extent for the entire duration of such proceedings and the remaining part of the statute of limitations after its completion. The legitimate interest here is the protection of legal rights and the control of the proper provision of services. For the purposes of fulfilling legal obligations, the website operator uses personal data for a maximum of 10 years for the relevant order.
5. Personal data of the authorized person is also processed in the case of a visit to the website operator's premises or its surroundings, where a recording from a camera system may capture the authorized person, based on legitimate interest (i.e., without your consent) for the purpose of protecting property and persons moving in the premises and its surroundings.
6. In most cases, the website operator processes personal data for their own purposes as the data controller. However, in some cases, the website operator may disclose personal data of authorized persons to their business partners to ensure payment and other necessary aspects of the order.

VI.
Rights of the data subject in relation to personal data processing

1. The data subject has a number of rights in relation to their personal data. These include the right of access, rectification, erasure, restriction of processing, data portability, objection, and the right to lodge a complaint.
2. The right of access to personal data means the right to know what data is being processed about the data subject, for what purpose, for how long, where the personal data was obtained, to whom it has been disclosed, who processes it outside of the website operator, and what other rights the data subject has in relation to the processing of their personal data. The basic principles of personal data processing are set out in this document. If the data subject is unsure which personal data the website operator is processing about them, they have the right to request confirmation from the website operator whether personal data relating to them is or is not being processed by us, and if so, they have the right to access that personal data. As part of the right of access, the data subject may request a copy of the processed personal data.
3. If the data subject finds that the processed personal data is inaccurate, they have the right to request correction from the website operator.
4. In some cases, the data subject may request the website operator to erase their personal data:
   1. the website operator no longer needs the personal data for any of the above-mentioned activities,
   2. the data subject withdraws their consent to the processing of their personal data, where their consent is necessary for the processing and there is no other legal ground for the processing,
   3. the data subject exercises their right to object to the processing of personal data which is processed based on the website operator's legitimate interests and the objection is found to be justified, or
   4. the right to process personal data is no longer in compliance with applicable legal norms.
5. However, the existence of the reasons stated in Art. VI, para. 4 does not establish an obligation for the website operator to stop processing the personal data of the authorized person if the reasons for protecting their legitimate interests persist.
6. Except for exercising the right to erasure of personal data, the authorized person may exercise their right to restrict the processing of personal data. This right allows the authorized person to request in certain cases that their personal data be marked and not subject to any further processing operations. However, this is not forever (as in the case of the right to erasure) but for a limited period. The website operator is obliged to restrict the processing of personal data when:
   1. The authorized person disputes the accuracy of their personal data until their accuracy has been clarified with the website operator.
   2. Personal data is processed by the website operator without sufficient legal framework, but the authorized person prefers only their restriction before their erasure (e.g., if they expect to provide such data in the future).
   3. The website operator no longer needs the authorized person's personal data for the above-mentioned processing purposes, but the authorized person requests them to identify, perform, or defend their legal claims.
   4. The authorized person raises an objection to the processing. The right to object is described in more detail below in the chapter "The Right to Object to Processing." During the period in which the objection's legitimacy is being investigated, the website operator is required to restrict the processing of personal data.
7. The authorized person is entitled to obtain from the website operator all personal data that they have provided and that are being processed based on their consent and contract fulfillment. The website operator will provide the authorized person's personal data in a structured, commonly used, and machine-readable format.
8. The authorized person may object to the processing of personal data based on the website operator's legitimate interest. In the case of marketing activities, the website operator will stop processing the authorized person's personal data without further ado. In other cases, the operator will only continue processing if there are compelling legitimate reasons to do so.
9. Exercising the above-mentioned rights does not affect the authorized person's right to file a complaint with the relevant supervisory authority. This right can be exercised, in particular, if the authorized person believes that their personal data is being processed by the website operator without authorization or in violation of applicable laws. A complaint against the processing of personal data can be filed with the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7.
10. The data subject exercises the right to personal data protection with the commissioner, whose name and contacts are Mgr. Kristýna Malá, or at the email address [email protected].
11. The request of the data subject shall be processed without undue delay, but no later than one month. In exceptional cases, particularly due to the complexity of your request, the website operator is entitled to extend this period by another two months. The data subject must be informed about such a possible extension and its justification.

In Prague, November 30, 2022.