Personal Data Protection Document (GDPR)

1. Controller Identification Details

Controller:

Business Name: AIDASTYLE s.r.o.
Registered Office: Dunajská 2330/60, 811 08 Bratislava, Slovakia
ID No. (IČO): 50112082
Registration in Commercial Register: Municipal Court Bratislava III, Section: Sro, Entry No.: 125915/B
Contact Details (e-mail): aidastyle@aidastyle.sk

The Controller has adopted all reasonable technical and organizational measures to protect personal data in accordance with the GDPR.

2. Purposes, Legal Bases, and Categories of Processed Data

Your personal data is processed based on the following legal grounds and for the purposes listed below:

Purpose of Processing	Legal Basis (GDPR)	Categories of Data	Retention Period
A. Conclusion and performance of the Purchase Agreement (Order processing, goods delivery, payment transactions, contract communication).	Art. 6(1)(b) – Contract Performance	Identification (name, surname); contact (address, tel. number, e-mail); order and payment details.	For the duration of the contract and subsequently 10 years due to limitation periods and accounting requirements.
B. Handling complaints, exercising rights and claims.	Art. 6(1)(b) – Contract Performance / Art. 6(1)(f) – Legitimate Interest (defence of legal claims).	Identification, contact, order details, date of claim application and settlement.	10 years (after the expiry of the warranty period and limitation periods).
C. Fulfilment of legal accounting and tax obligations.	Art. 6(1)(c) – Legal Obligation (Accounting Act, Tax Laws).	Identification, contact, transaction details.	10 years following the year they relate to.
D. Service improvement and direct marketing (sending newsletters and updates).	Art. 6(1)(a) – Consent of the Data Subject	Contact details (email address, name).	For the duration of the consent, max. 3 years, or until consent is withdrawn.
E. Protection of rights and legitimate interests (e.g., in case of legal disputes).	Art. 6(1)(f) – Legitimate Interest	All relevant data concerning the dispute.	For the time necessary to assert, demonstrate, or defend legal claims.

2.1. Obligation to Provide Personal Data

The provision of personal data for purposes A, B, and C is a contractual/statutory requirement and is necessary for the conclusion and performance of the purchase agreement. Without providing them, it is not possible to process the order and deliver the goods.

The provision of data for purpose D is voluntary and based on consent.

3. Recipients and Processors

Your personal data may be provided to the following categories of recipients:

Shipping and Courier Companies: Data (name, address, tel. number, e-mail) necessary for the delivery of the ordered goods (e.g., Slovenská pošta, a.s., GLS General Logistics Systems Slovakia s.r.o.).
Payment Service Providers: In the case of online payments, payment details are transferred to payment gateway providers (e.g., Tatra banka a.s.) for payment processing.
External IT Service Providers: Companies ensuring the operation of the e-shop and web hosting. These entities act as Processors and process data only on the Controller's instructions.
Public Authorities: In the case of a legal obligation (e.g., courts, law enforcement agencies, tax authorities, SOI).

Transfer to Third Countries: The transfer of personal data to third countries (outside the EU/EEA) does not take place, unless strictly necessary for the performance of the contract (e.g., if the delivery address is outside the EU and data must be handed over to a local carrier).

4. Personal Data Retention Period

Personal data is retained only for the period necessary to fulfil the purpose of processing, as listed in the table in section 2, specifically:

Data for contract performance and accounting: Retained for a period of 10 years from the end of the year in which the contract was concluded/payment was made, due to statutory requirements and limitation periods.
Data processed based on consent (Newsletter): Retained until consent is withdrawn or for a period of 3 years, whichever occurs first.

5. Data Subject Rights

As a Buyer (Data Subject), you have the following rights regarding the processing of your personal data:

Right	Description
Right of access	You have the right to obtain confirmation as to whether or not your personal data is being processed, and, where that is the case, access to the data and information on the manner of its processing.
Right to rectification	You have the right to have inaccurate personal data concerning you rectified without undue delay, or to have incomplete personal data completed.
Right to erasure (Right to be forgotten)	You have the right to the erasure of personal data if they are no longer necessary for the purposes for which they were collected, or if consent has been withdrawn.
Right to restriction of processing	You have the right to obtain restriction of processing where you contest the accuracy of the data, or the processing is unlawful and you request restriction of processing instead of erasure.
Right to data portability	You have the right to receive the personal data concerning you, which you have provided to the Controller, in a structured, commonly used, and machine-readable format.
Right to object	You have the right to object to the processing of data which is based on the Controller's Legitimate Interest (e.g., direct marketing). In the case of direct marketing, the objection has immediate effect.
Right to withdraw consent	Where processing is based on consent (e.g., Newsletter), you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
Right to lodge a complaint	You have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava.

You can exercise your rights in writing at the Controller's registered office or by email to aidastyle@aidastyle.sk. The Controller will respond to you within one month.