In order to protect your rights, the operator of the website available at www.umakovshop.com complies with the following rules when processing your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons, personal data processing and on the free movement of such data, repealing Directive 95/46 / EC (General Data Protection Regulation), hereinafter "the Regulation".

A) Basic information for you as an affected person

If you use our website and use our services, we process your personal data. As the data subject, you have the
right to the following information about us and how we handle your data.

A.1. Operator identity and contact details

The operator is UMAKOV Group, a.s., seat: Galvaniho 7 / D, 821 04 Bratislava - mestská časť Ružinov, ID number:
52 685 691. Contact e-mail of the operator: info@umakovshop.com. The controller is, in accordance with the
Regulation, a person who determines the purposes and means of personal data processing.

A.2. Contact details of the controller

If you are interested in contacting our responsible person, please contact us by e-mail at: office@vasillegal.eu.
The responsible person is a person designated by us who provides us with advice on compliance with the
Regulation and other regulations on personal data protection. The responsible person monitors the compliance
of our activities with the Regulation and, if necessary, cooperates with the supervisory body, which is the Office
for Personal Data Protection in the Slovak Republic.

A.3. The purposes of the processing for which the personal data are intended as well as the legal
basis of the processing

The personal data provided by you is processed for various purposes as follows:

• a) in order to process the order, i.e. order confirmation, issuance of a tax document - invoices, delivery of goods,
  handling of complaints, acceptance of payment for our goods. The legal basis for such processing of personal
  data is the fulfillment of obligations arising from the purchase contract concluded with you through our online
  store. Personal data that we process about you: name, surname, residence, e-mail address, billing address,
  delivery address, contact telephone number, IP address, web logs, cookies. If you visit our website only as a
  person interested in the goods, but you do not order anything, then we only process information about you, IP
  address, web logs and cookies. This data is necessary for the smooth operation of our website (IP addresses and
  web logs), but if you do not want us to process cookie data about you, you can limit this in your browser settings
  (see below in section D.4. Use of cookies) .


• b) in the case of registered users, the purpose is to process your registration and provide loyalty benefits for
  you. The legal basis in this case is your consent. By granting your consent, you allow us to process your personal
  data on the basis of which we distinguish you from other (unregistered) users and provide you with various
  loyalty benefits, especially complete management of your orders, archiving of your reviews, loyalty discount
  program and virtual library. If you do not wish to be a member, you can revoke this consent at any time. Personal
  data that we process about you: e-mail address, password, IP address, web logs, cookies, history of your orders
  and reviews in the e-shop. As part of your registration, we also process some of these personal data if you
  voluntarily provide them to us in your account settings: name, surname, company data, telephone, profile photo,
  date of birth, gender.
  
  If you register on our website via social networks (Facebook, Google accounts), we also process the data provided
  by these social networks, such as: gender and date of birth, as well as your personal data. However, we only
  process data that you enter (as social network users) into the social network system or create yourself by working
  with the system. If you do not want us to process this data about you, you can withdraw your consent to the
  processing of this personal data at any time.


• c) in the case of consent to the sending of advertising information for the purpose of promoting the UMAKOV
  online store and its products, the purpose of the processing is to promote us, our online store and the goods
  offered. The legal basis is again your consent, which you can revoke at any time. Personal data we process about
  you: e-mail address, IP address, web logs and cookies.

A.4. Recipients or categories of recipients of personal data

According to the Regulation, the recipient is any person to whom we provide your personal data. We always do
this only when the regulations allow it and when it is necessary for the quality provision of services for you. The
following categories of recipients are currently eligible for your personal data:

• a) administrators, programmers and consultants who work for us but are not formally our employees.
• b) an external accounting service provider
• c) a web hosting service provider
• d) external dispatch center
• e) transport companies, such as Slovenská pošta, a. s., GLS General Logistics Systems Slovakia s.r.o. etc.,

All recipients are required to comply with the law in order to protect your personal data. Recipients may also not
use personal data for any purpose other than the purpose defined above in point A.3 of these Terms.

After the end of the purpose of processing, personal data may be further processed only to the extent necessary
for statistical or archival purposes, which is not considered incompatible with the original purpose of processing
and is permitted with regard to the purpose limitation principle under Art. 5 par. 1 letter b) Regulations. After
the end of the purpose of processing, we will subsequently delete your data. The persons to whom we provide
your data (ie the recipients of your personal data) are also obliged to follow this procedure.

B) Additional information for the person concerned

B.1. Retention period of personal data or criteria for its determination

The retention period of your personal data depends on the purpose for which you provided us with the data.
(Purpose of personal data processing - see above in point A.3. Of these Rules).

If the purpose of processing is the processing of your order (point A.3.a), we only actively process this data until
the processing of your order. Subsequently, they are archived in the case of a tax audit for a maximum period of
10 years from the taxable supply. The right to process personal data is granted if it is necessary for proving,
asserting or defending legal claims.

If the purpose of the processing is your registration and the use of loyalty benefits (point A.3.b), we will only
process this data as long as we have your consent. Upon revocation of your consent, we may only archive this
data if this is necessary to protect our interests. For example, if, in order to be granted a loyalty rebate and a
claim subsequently made by you in court proceedings, it would be necessary to prove that you were a member
of the loyalty program and to which rebate you were entitled to. The right to process personal data is granted if
it is necessary for proving, asserting or defending legal claims. However, if you do not initiate any legal or other
proceedings, we may archive this information about you for a maximum of 3 and a half years from the
termination of your membership in the loyalty program.

If the purpose of the processing is to send advertising information (point A.3.c), we will only process this data as
long as we have your consent. Upon revocation of your consent, we are obliged to delete all your personal data
processed for the given purpose without delay, no later than within one month of the revocation of the consent.

B.2. Existence of rights against the operator

As an affected person, you have a number of rights under the Regulation that you may, in your sole discretion,
exercise against us and claim. These rights are:

• a) the right to request access to personal data concerning the data subject from the controller,
• b) the right to correct personal data,
• c) the right to erase personal data (the right to "forget"),
• d) the right to restrict processing,
• e) the right to object to the processing,
• f) the right to data portability.

All these rights are explained in detail in part C of these Terms and Conditions of Personal Data processing below.

B.3. The right to withdraw consent at any time

In cases where we process personal data about you on the basis of your consent (ie for the purposes under points
A.3.b) and A.3.c) of these Rules), you have the right to withdraw your consent at any time. Withdrawal of your
consent does not affect the lawfulness of the consent-based processing granted prior to its withdrawal. Thus,
even if you revoke our consent, we have lawfully performed the acts performed until the revocation of your
consent.

B.4. The right to lodge a complaint to the supervisory authority

If you believe that your rights specified in these Rules or in the Regulation have been violated, you have the right
to file a complaint with the supervisory body, which is the Office for Personal Data Protection of the
Slovak Republic.

B.5. Obligation or possibility to provide personal data

In order to process your orders (purpose in accordance with point A.3.a) of the Rules), we necessarily need you
to provide us with personal data, without which we cannot process the order. If you do not want to provide us
with this personal data, we are unfortunately unable to properly deliver the ordered goods.
Conversely, for your registered person as a member of the loyalty program and for sending advertising
information (purposes within the meaning of point A.3.b) and A.3.c), you are not obliged to provide us with your
personal data. We may only process them with your consent, which you may or may not give us. You are also
entitled to revoke it at any time.

B.6. Existence of automated decision making, including profiling

When processing your personal data for the purpose of sending advertising information (purposes pursuant to
point A.3.b) and A.3.c), we perform profiling of your person. Profiling means the automated processing of
personal data, which means that personal data relating to a natural person are used to evaluate his or her
personal traits or characteristics. It serves us to tailor the website to your needs. As part of profiling, you are
shown content that might be of interest to you, and when you send an ad, we send you an ad that is relevant to
you. The consequence of such processing is a more efficient provision of information for you, which makes it
easier for you to use our website and shop.

C) Your rights of the person concerned vis-a-vis the operator

C.1. The right to request access from the controller to personal data concerning the data
subject

As the data subject, you have the right to request confirmation from us whether personal data concerning you
are being processed and, if so, you have the right to access this personal data and the following information:

• a) the purposes of the processing
• b) the categories of personal data concerned
• c) the recipients or categories of recipients to whom the personal data have been or will be provided,
      in particular recipients in third countries or international organizations
• d) if possible, the estimated retention period for personal data or, if that is not possible, the criteria for
      determining it
• e) the existence of the right to require the controller to correct or delete or restrict the processing of personal
      data concerning the data subject, or the right to object to such processing
• f) the right to lodge a complaint to the supervisory authority
• g) if personal data have not been obtained from the data subject, any available information as to their source
• h) the existence of automated decision-making, including profiling, as referred to in Article 22 sec. 1 and 4 of the
      Regulation and in these cases at least meaningful information on the procedure used, as well as the meaning and
      expected consequences of such processing for you as the data subject.

We have provided you with all this information in sections A and B of these Terms and Conditions of Personal
Data Processing. If any of this is not clear to you, do not hesitate to contact us.

If personal data are transferred to a third country or an international organization, the data subject has the right
to be informed of the adequate safeguards under Article 46 of the Regulation concerning the transfer. In your
case, there is no transfer of data to a third country or international organization.

As the controller, we are obliged to provide you with a copy of the personal data that is processed. We may
charge you a reasonable fee for any additional copies you request, commensurate with the administrative costs.
If you submit the application by electronic means, the information will be provided to you in a commonly used
electronic form, unless you have requested another method. This right of yours to obtain a copy must not
adversely affect the rights and freedoms of others.

C.2. The right to correct personal data

As an affected person, you have the right to have incorrect personal data concerning you corrected without undue
delay. With regard to the purposes of processing, you have the right to supplement incomplete personal
data, including by providing a supplementary statement.

C.3. Right to erase personal data (right to "forget")

As the person concerned, you have the right to have our personal data concerning you deleted without undue
delay. And we, as the operator, are obliged to delete personal data without undue delay if any of the following
reasons is met:

• a) personal data are no longer needed for the purposes for which they were obtained or otherwise
      processed
• b) the person concerned withdraws the consent on the basis of which the processing is carried out, in
       accordance with Article 6 (1) (a) of the Regulation or Article 9 (2) (a) of the Regulation, and if there is no
       other legal basis for the processing
• c) the person concerned objects to the processing pursuant to Article 21 (1) of the Regulation and no
      legitimate grounds for processing prevail or the person concerned objects to the processing pursuant to
      Article 21 (2) of the Regulation
• d) personal data were processed illegally
• e) personal data must be deleted in order to comply with a legal obligation under Union law or the law of
      the Slovak Republic
• f) personal data were collected in connection with the offer of information society services pursuant to
      Article 8 (1) of the Regulation.

If we have disclosed personal data and we are obliged to delete personal data under any of the above conditions,
taking into account the available technology and the cost of implementing the measures, we are obliged to take
appropriate measures, including technical measures, to inform the controllers that you we asked us to delete all
references to this personal data, a copy of them or replicas.

The above paragraphs shall not apply if processing is necessary:

• a) to the exercise of the right to freedom of expression and information
• b) to fulfill a legal obligation requiring processing under Union law or the law of the Member State to which
      the controller is subject, or to fulfill a task carried out in the public interest or in the exercise of official
      authority conferred on the controller
• c) for reasons of public interest in the field of public health in accordance with Article 9 (2) letter (h) and
      (i) of the Regulation as well as 3 Regulations
• d) for archiving purposes in the public interest, for scientific or historical research purposes or for statistical
      purposes in accordance with Article 89 (2) of the Regulation, where the right of erasure referred to in
      the first paragraph of this Part is likely to make it impossible or seriously difficult to achieve the
      objectives of such processing, or
• e) to establish, assert or defend legal claims.

C.4. Right to restrict processing

As the data subject, you have the right to (as the operator) limit processing in one of the following cases:

• a) the data subject challenges the accuracy of the personal data during a period allowing the controller to
      verify the accuracy of the personal data
• b) the processing is illegal and the data subject objects to the deletion of the personal data and calls instead
      for their use to be restricted
• c) the controller no longer needs personal data for processing purposes, but the data subject needs them
      to prove, assert or defend legal claims
• d) the person concerned objected to the processing under Article 21 (1) of the Regulation, until it is verified
      that the legitimate reasons on the part of the operator outweigh the legitimate reasons of the person
      concerned.

2. Where processing is restricted in accordance with paragraph 1 above, such personal data, with the exception
of storage, shall be processed only with the consent of the data subject or for proving, asserting or defending
legal claims, or for protecting the rights of another natural or legal person, or for reasons of overriding public
interest. Union or a Member State.

3. The controller shall inform the person concerned who has reached the processing restriction referred to in
paragraph 1 above before the processing restriction is lifted.

C.5. The right to object to processing

1. As a data subject, you have the right to object at any time, on grounds relating to your specific situation, to
the processing of personal data concerning you, provided that such processing is carried out in accordance with
Article 6 (1) letter e) or f) Regulations. That is, in cases where:

• the processing is necessary for the performance of a task carried out in the public interest or in the
  exercise of official authority entrusted to the controller, or
• the processing is necessary for the purposes of legitimate interests pursued by the controller or a third
  party, except where such interests outweigh the interests or fundamental rights and freedoms of the
  data subject which require the protection of personal data, in particular if the data subject is a child.

You can also object to profiling based on these provisions. In such a case, we may not further process your
personal data unless we demonstrate the necessary legitimate reasons for processing that outweigh your
interests, rights and freedoms, or reasons for proving, asserting or defending legal claims.

2. If personal data are processed for the purposes of direct marketing, you have the right at any time to object
to the processing of personal data concerning you for the purposes of such marketing, including profiling to the
extent that they relate to such direct marketing.

3. If you object to processing for direct marketing purposes, we may no longer process your personal data for
such purposes.

4. We hereby expressly draw your attention as a data subject to the right to object to the processing (including
the right to object to profiling) referred to in paragraphs 1 and 2 above.

5. With regard to the use of information society services, and notwithstanding Directive 2002/58 / EC, the data
subject may exercise his or her right to object by automated means using technical specifications.

6. Where personal data are processed for the purposes of scientific or historical research or for statistical
purposes in accordance with Article 89 (2) of the Regulation, the data subject has the right to object, on grounds
relating to his or her specific situation, to the processing of personal data concerning him or her, except where
the processing is necessary for the performance of a task in the public interest.

C.6. Right to data portability

The essence of this right is that you can ask us to provide all personal data that we process about you to another
operator in a technically acceptable form.

1. Thus, as the data subject, you have the right to obtain personal data concerning you and which you have
provided to us in a structured, commonly used and machine-readable format and you have the right to transfer
this data to another operator without we preventing you if:

• a) processing shall be based on consent in accordance with Article 6 (1) letter (a) Regulation or Article 9 (2)
      letter a) of the Regulation, or in the contract pursuant to Article 6 (1) letter (b) Regulations, and
• b) if the processing is carried out by automated means.

2.In exercising his right to data transfer pursuant to paragraph 1, the data subject shall have a higher right to
transfer personal data directly from one controller to another, as far as technically possible.

3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17 of the
Regulation. That right shall not apply to processing necessary for the performance of a task carried out in the
public interest or in the exercise of official authority vested in the controller.

4. The law referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

D) Other rights and rules in the processing of personal data

D.1. Personal information when paying for goods through electronic banking

If you use any of the versions of the offered electronic banking to pay for goods in our online store, we do not
come into contact with any data such as login details. Payments are made directly on the bank's website. It will
provide us with payment success information and your name and account number so that we can identify
the payment.

D.2. Handling of personal data

We protect personal data against damage, destruction, loss, alteration, unauthorized access and disclosure,
provision or disclosure, as well as against any other unacceptable processing methods. We process personal data
in accordance with generally binding legal regulations, in particular in accordance with the Regulation and also
in accordance with good morals. Persons who come into contact with personal data are informed in advance
how they should be processed and are informed of the obligation to maintain the confidentiality of data.

D.3. Accuracy of personal data

The personal information you provide to us must be correct. If you find that you have provided us with incorrect
information or if your personal data changes, please let us know. We will process your data correctly and, in the
event of a change, we will update it.

D.4. Deletion of personal data

You can change your information in your account settings after logging in. To delete all your personal
information, you must cancel your account. If you want to cancel your account, write to us at
umakov@umakov.sk.

D.5. Use of cookies

Website operated by Sprinx systems, a. s., seat: Údolní 212/1, 14700 Praha, ID no.: 26770211 use cookies and
similar technologies to provide better services to their customers. This document explains what cookies are, how
their sites use them and how you can influence their use.

What are cookies?

Cookies are usually small text files that are created by the website you are browsing and stored on your
device (eg your computer, smartphone, tablet or other device from which you access the website). This
information may sound scary, but don't worry. We use the information solely to improve the services we
provide. You can find more information about cookies at www.allaboutcookies.org.

Use of cookies on the site
The cookies we use can be divided into several groups. They are used for:

• ensuring basic functionality
• Ensuring extended functionality
• monitoring and analysis

The necessary cookies ensure the basic functionality of the website / e-shop. For example, they allow users
to log in or add products to the shopping cart. These are cookies that are used by the core of our system.
Without these cookies, you would not be able to view our site.

Extended functionality - cookies that make browsing the site easier. They allow us to remember your
preferences, such as closing a floating window. We can use them to provide online chat.

Monitoring and analysis - These cookies allow us to monitor and analyze the number and activity of users
on the site. For example, they let you know if you are a new or regular customer. They know how you
discovered the page, what your movement is like. But you do not have to worry, all this information is
sufficiently anonymous and does not pose any threat to you. They ensure that the information you are
interested in is displayed on the site. They help us deliver relevant advertising and monitor how effective it
is. Only on the basis of this information are we able to modify our website so that shopping and browsing
is an experience for you. Cookies of applications of third parties :
http://www.heureka.sk
(http://onas.heureka.sk/resources/attachments/p0/23/pruvodce-svetem-internetovych-susenek.pdf),
https://www.doubleclickbygoogle.com
(http://www.google.com/policies/technologies/cookies/,
http://www.google.com/intl/sk/policies/privacy/partners/)

How can you influence the use of cookies?

By default, most Internet browsers allow you to use these files. You can delete cookies, disable their storage
or enable storage for specific sites.
Below are links to articles on how to set a cookie policy in your most popular browsers. However, please
note that by disabling the use of cookies on our website, you will lose access to certain functions or areas
of individual websites (shopping cart, login,…).

• a) Mozilla
• b) Google Chrome
• c) Safari
• d) Opera