1. Legal framework of processing

   1. Personal data of customers and other persons (hereinafter also " data subject ") whose personal data is processed by Investleg s.r.o. are processed in accordance with applicable legal regulations. In particular, with Regulation (EU) No. 2016/679 of the European Parliament and of the Council, on the protection of natural persons in connection with the processing of personal data and on the free movement of such data, and on the repeal of Directive 95/46/EC (General Data Protection Regulation).

2. Personal data manager

   1. The administrator of the obtained personal data is the trading company Investleg s.r.o., with its registered office at Čihalíkova 352/15, Michálkovice, 715 00 Ostrava, identification number: 14244012, registered in the commercial register kept by the Regional Court in Ostrava, section C, file 88401, (hereinafter also " administrator ") .

3. Accuracy of personal data

   1. The data subject is obliged to provide his personal data correctly and truthfully (e.g. during registration, in his user account, when ordering from the store's web interface) and is obliged to inform the administrator of changes in his personal data without undue delay.

4. Processing purposes and legal basis for personal data processing

   1. First name, surname (including any supplement characterizing more closely the person or business establishment of the natural person doing business), title (if stated by the data subject), address of residence or registered office, delivery address, ID number, VAT number, e-mail address of the data subject, telephone number and data about the completed purchase are processed for the purpose of fulfilling the contract (e.g. identification of the data subject, confirmation of the order, information on the status of the order, delivery of the order, issuance of a tax document); the legal basis for the processing of these data for the stated purpose is their necessity for the fulfillment of a contract to which the data subject is a contracting party, or for the implementation of measures taken prior to the conclusion of the contract at the request of the data subject.
      The above-mentioned personal data are further processed after the fulfillment of the contract, if it is necessary to fulfill the legal obligation that applies to the Investleg s.r.o. company.

   2. Personal data referred to in Article 4.1 and data on the history of orders placed by the data subject, purchases made and claims made may be processed for the purposes of maintaining the data subject's internet user account; the legal basis for the processing of this data for the stated purpose is the consent granted by the data subject.

   3. The personal data of the data subjects referred to in Article 4.1 may be processed for the purposes of direct marketing, i.e. in particular the sending of business communications regarding the goods and services of Investleg s.r.o.; the legal basis for the processing of this data in this case is the legitimate interest of Investleg s.r.o. If the data subject participates in a competition organized by Investleg s.r.o., said data may be processed for direct marketing purposes based on the data subject's consent.

   4. The name, surname, bank account number, identity card or passport number of the data subject, or other identification and contact data may be required and processed by Investleg s.r.o. for the purpose of identifying the person when returning a monetary or non-monetary payment due to the termination of the contractual relationship (e.g. cancellation purchase contract due to withdrawal), when accepting a prize in a competition organized by Investleg s.r.o., or when picking up goods, and the related protection of the parties against the delivery of performance to an unauthorized person. In this case, the legal basis for processing this data is the administrator's legitimate interest.

   5. Identification data of the data subject in the form of a camera recording obtained in the sales and warehouse premises of Investleg s.r.o. may be processed by Investleg s.r.o. for the purpose of protecting its property, life and health of persons. In justified cases, they may be transferred to law enforcement authorities, or to other interested parties for the fulfillment of the processing purpose (e.g. insurance company). In this case, the legal basis for processing this data is the legitimate interest of Investleg s.r.o

   6. By using the website www.brickinvest.eu (hereinafter referred to as the " website "), Investleg s.r.o. receives and records information from the Internet browser, which may include personal data. It uses a variety of methods to collect this information, such as so-called cookies; this information may include the data subject's IP address, a unique identifier using "cookies", information about cookies and information regarding whether the data subject's device has the software needed to access certain elements, a unique identifier of the device and device type, domain, browser type and language, type of operating system and its settings, country and time zone, previously visited websites, information about the data subject's steps on Investleg s.r.o. websites, such as clicks, purchases made and marked preferences and access time and reference URLs.
      Cookies are used by Investleg s.r.o. to monitor how customers use the website and to understand their customers' preferences (for example, the choice of country and language). This enables us to provide services to customers and improve their internet experience. It also uses cookies to obtain summary data about traffic on the website and its communication, to identify trends and obtain statistical data with the aim of further improving the website. The website basically uses three categories of cookies.

      1. Functional: These cookies are required for the basic functioning of the site and are therefore always on; these include cookies that enable the data subject to be remembered when browsing the website. They help create the contents of the shopping cart and go through the checkout process, as well as help with security and compliance with legal requirements.

      2. Improving functioning (performance): These cookies make it possible to improve the functionality of websites by Investleg s.r.o. monitoring their use. In some cases, these cookies improve the speed of response to customer requests and make it possible to remember customer choices selected for the given site. If the data subject rejects these cookies, this may lead to the recommendations not being accurate and the site running slower.

      3. Social media and advertising: Cookies for social media offer the possibility to connect the customer to social networks and share content from the website of Investleg s.r.o. Cookies for advertising (third-party cookies) collect information that helps to better adapt advertising to the interests of the customer, on the company's website Investleg s.r.o. and beyond. In some cases, these cookies also include the processing of the customer's personal data. Rejecting these cookies may result in the display of advertising that will not be as relevant to the customer, or the inability to effectively connect with accounts on Facebook, Instagram or other social networks, and/or not allowing the customer to share content on social media.

The legal basis for the processing of the above-mentioned data for the given purposes is the consent granted by the data subject, or the legitimate interest of the administrator for the purposes of basic website traffic analysis.

5. Necessity of data

   1. The provision of personal data referred to in Article 4 is a contractual requirement of Investleg s.r.o. Name, surname, residential address, telephone number and e-mail address of the buyer, who is a non-entrepreneurial natural person, and the name, surname (including any addendum characterizing more closely the person or business undertaking natural person), registered office address, ID number, VAT number (for VAT payer), telephone number and e-mail address for the buyer who is a natural person doing business are also data that must be included in the contract; failure to provide this information may lead to the impossibility of concluding a contract.

6. Storage time

   1. Personal data will be stored at Investleg s.r.o. for the period required by applicable legal regulations, if the period is not specified in this way, for the period during which the legal reason for processing lasts or for the period necessary for the specified performance or defense of legal claims.

7. Categories of recipients of personal data

   1. Investleg s.r.o. can entrust the processing of personal data to a third party as a processor.

      1. Deliveries of parcels
         In order to deliver the ordered goods, the administrator is entitled to provide the customer's name, surname (including any supplement characterizing more closely the person or business establishment of the natural person), title (if specified by the customer), delivery address, e-mail address and telephone number of the customer to the entity ensuring the delivery of the ordered goods goods.

      2. Providers of accounting, tax and legal services
         The administrator is entitled to provide personal data also to persons providing the administrator with accounting, tax and legal services for the purpose of fulfilling their legal obligations and in cases where this is necessary for the establishment, exercise or protection of legal claims, whether in judicial, extrajudicial or administrative proceedings.

      3. Entities assessing the legitimacy of complaints
         The administrator is authorized to provide the entity providing for the administrator the assessment of the validity of the claim with tax documents for the purchased goods containing, in addition to the legally required details, the customer's e-mail address and telephone number.

      4. Entities providing services within the framework of direct marketing
         The administrator is authorized to provide an e-mail address and telephone number for the purpose of sending business communications to entities that perform this activity for the administrator as processors.

      5. Entities providing point of sale/advertising services
         The administrator is authorized to provide identification and contact data, data on orders made, purchases made and claims made to entities providing delivery point services and places for claiming goods.

      6. Entities contacting customers to obtain reviews
         The administrator is authorized, with the consent of the data subject, to provide information about the order and e-mail address to entities contacting customers in order to obtain an evaluation of the purchased goods and services provided.

   2. The administrator does not intend to transfer personal data to a third country (a country outside the EU) or an international organization.

8. Right of access to personal data

   1. The data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning him is being processed and, if so, he has the right to obtain access to such personal data.

9. The right to correct personal data

   1. The data subject has the right to have the administrator correct inaccurate personal data concerning him without undue delay. Taking into account the purposes of the processing, the data subject has the right to supplement incomplete personal data, including by providing an additional statement.

10. The right to erasure of personal data

    1. The data subject has the right to have the administrator delete personal data relating to the data subject without undue delay, and the administrator has the obligation to delete personal data without undue delay if any of the reasons set out in the General Regulation on Personal Data Protection are given.

11. The right to restrict the processing of personal data

    1. The data subject has the right to have the administrator limit the processing of his personal data in cases stipulated by the General Regulation on the Protection of Personal Data.

12. The right to portability of personal data

    1. Under the conditions set out in the General Data Protection Regulation, the data subject has the right to obtain personal data concerning him and which he has provided to the administrator in a structured, commonly used and machine-readable format, and the right to transfer this data to another administrator without the original administrator preventing him from doing so . At the same time, the data subject, if requested, also has the right for the administrator to transfer his personal data in a structured, commonly used and machine-readable format to another administrator, if this is technically feasible.
       General conditions for the application of the right to portability:

       1. it must be processing based on a legal reason, consent or contract,

       2. processing is done automatically.

The rights and freedoms of other persons must not be adversely affected by the exercise of the right to portability.

13. The right to object to the processing of personal data

    1. The data subject has, for reasons relating to his specific situation, the right to object at any time to the processing of his personal data processed for the legitimate interest of the controller, including profiling based on the legitimate interest of the controller. If personal data is processed for the purposes of direct marketing, the data subject has the right to object at any time to the processing of personal data concerning him for this marketing, which includes profiling, if it relates to this direct marketing.

14. The right to withdraw consent to the processing of personal data

    1. The data subject has the right to revoke the consent to the processing of personal data at any time. Revocation of consent does not affect the lawfulness of processing based on consent granted before its revocation. Consent can be revoked via e-mail by means of a notice sent to the administrator's electronic address: info@brickinvest.eu, by a written notice sent to the address of the administrator's seat, or to the administrator's mailbox (ID: ph8dm2f). Consent to the sending of information about news and discount and marketing events regarding the administrator's goods and services can also be revoked via the electronic opt-out system by clicking on the link for unsubscribing from the newsletter directly in the sent e-mail commercial communication.

15. Exercise of rights

    1. The above-mentioned rights can be exercised by the data subject via e-mail with a notification sent to the e-mail address: info@brickinvest.eu, by a written notification sent to the address of the administrator's seat, or to the administrator's data box (ID: ph8dm2f).

16. Trustee

    1. The administrator has not appointed a personal data protection officer.

17. The right to file a complaint

    1. The data subject has the right to file a complaint with the supervisory authority, in particular in the EU member state of his habitual residence, place of employment or place where the alleged violation occurred, if he believes that the processing of his personal data violates the General Data Protection Regulation. In the Czech Republic, the supervisory authority is the Office for the Protection of Personal Data.