The company Paleto s.r.o., ID number: 17938635, with registered office at Hradecká 1172/3, Slezské Předměstí, 500 03 Hradec Králové, registered in the commercial register kept at the regional court in Hradec Králové, section C 50607 (hereinafter referred to as "The seller”), as a personal data administrator, hereby informs about the processing of personal data that it carries out in connection with purchase contracts concluded with customers who have won an auction offer on the platform available from the website www.paleto.eu (hereinafter "Buyer"), the subject of which is the Seller's goods (hereinafter referred to as "Purchase contract"). This document also includes information on the rights that data subjects have in connection with the above-mentioned processing.

For any questions regarding the protection of privacy and the exercise of your rights, use this contact:

1. For what purpose, on the basis of which titles and what personal data do we process?

1.1 Conclusion and performance of the Purchase Agreement

In order for the Seller to be able to negotiate and conclude a Purchase Agreement with the Buyer regarding the goods offered in the online auction, the Seller needs the following personal data of the Buyer - a natural person:

  • identification data of the Buyer (name, surname, in the case of an entrepreneur also ID number, VAT number),
  • contact details of the Buyer (e-mail, telephone number, delivery and billing address, in the case of an entrepreneur, address of the registered office),
  • bank account number and other payment details,
  • information from communication with you, information about the conclusion of the performance of the Purchase Agreement.

Without the above-mentioned data, it is not possible to conclude or fulfill the Purchase Agreement. The legal title of the processing of this data is the conclusion and fulfillment of the purchase contract at the request of the Buyer.

1.2 Fulfillment of obligations arising from legal regulations

The seller must process personal data in cases where it is required by law. For this purpose, the Seller mainly processes personal data to the extent required by the relevant legal regulations in connection with the Seller's obligation to handle Buyers' complaints, keep accounts and in the fulfillment of related tax obligations, or for the fulfillment of obligations imposed by the Archiving Act.

1.3 Legitimate interests of the Seller

In justified cases, the Seller may also process personal data on the basis of a legal title, which is the protection of its legitimate interests. However, the seller always consistently assesses and ensures that the interest in processing your data for this purpose does not unreasonably interfere with your privacy.

Identification of persons acting on behalf of the Buyer - a legal entity: These are typically members of statutory bodies, employees or other authorized persons who are not parties to the contract with the Seller, but conclude the contract on behalf of the Buyer, communicate with the Seller and otherwise deal with the Seller on behalf of the Buyer. We need the personal data of these persons in order to be able to communicate and negotiate with the Buyer for the purpose of concluding a purchase contract or a contract for registration and maintenance of a user account with the Buyer, its further performance, or exercising the Buyer's rights. For these persons, we usually process the first name, surname, e-mail, telephone number, delivery address, information about the job position or other relationship with the Buyer and data from communication with them.

Proof of agreement with the terms and conditions: Since the Purchase Agreement with the Buyer is concluded online (by electronic means) through a platform accessible from the website www.paleto.eu, we store the data necessary to identify the Buyer as a contractual party, so that in case of later doubts or disputes, we have a time stamp available as proof of the conclusion of the Purchase Agreement.

Defense and exercise of legal claims: We process personal data for the purposes of protecting our legitimate interest, which is to ensure the possibility of our defense within the framework of possible legal disputes, proceedings before a court or during inspections by state authorities or other public administration authorities (typically ČOI, etc.). We process the data in order to be able to prove, if necessary, that we have acted in accordance with our contractual obligations and legal regulations. In this context, we typically process the identification and contact data of the Buyer, or persons dealing with us on behalf of the Buyer, data on concluded contracts, their fulfillment and communication with the Buyer, or persons acting on behalf of the Buyer.

1.4 Sending commercial messages

We also process the e-mail and/or phone number of the Buyer for the purpose of sending information and news about our goods (business communications). The title of the processing of personal data for the purpose of sending commercial messages is the legitimate interest of the Seller.

The buyer has the option to refuse further sending of commercial communications at any time free of charge, following the procedure specified in each commercial communication sent, or we can be contacted at any time at the contact e-mail listed above in this document.

2. From whom do we receive personal data and to whom do we pass it on?

We obtain personal data primarily from data subjects. We do not collect any other data about you, except for those that you give us yourself. You are required to provide us with only accurate information and if your personal information changes, you must update the information.

We can transfer personal data under the conditions set by law to public administration bodies where the law requires us to do so, or if the given body requests it within its competences.

For data processing, we use processors, which are mainly IT service providers, the operator of the platform for e-mail and omni-channel communication, and external accountants.

Personal data may also be transferred to our business partners, who act as independent personal data administrators with respect to your personal data. These are mainly cooperating carriers used for the delivery of goods.

Should Personal Data be transferred to a third country (i.e. to a country outside the EU), the Seller undertakes to take all steps to ensure that the transfer of Personal Data to the third country complies with legal regulations.

3. How do we process personal data?

We process your personal data primarily in electronic form by automated means in our IT systems, or in the systems of our individual processors. Personal data may also be processed manually in accordance with the relevant purpose, where manual processing is necessary or appropriate.

When managing your data, our employees or other persons working for us may act, among other things, for the purpose of eliminating errors, inaccuracies, etc. However, these persons may process personal data only under the conditions and to the extent stated above and are bound by the obligation to maintain confidentiality about personal data data and security measures, the disclosure of which would jeopardize the security of personal data.

We always process personal data in accordance with the relevant legal regulations and ensure proper care and protection. We make sure that you do not suffer damage to your rights, especially the right to maintain human dignity and your private and personal life.

4. How long do we process personal data?

4.1 Purchase Agreement

We process personal data processed for the purpose of concluding and fulfilling the Purchase Agreement with the Buyer for the duration of the conclusion and fulfillment of the given Purchase Agreement (i.e. for the time necessary to fulfill the obligations arising from the Purchase Agreement).

Even after that, we may process personal data for the following purposes:

4.2 Compliance with legal obligations

We process personal data processed as a result of our legal obligations within the time limits set by these laws.

We have to process personal data that is required by the legal regulation governing the tax and accounting obligations of the Seller (typically invoicing data and information about the performance provided) for the purposes of accounting and the fulfillment of tax obligations. The processing period is 5 years from the end of the accounting period, in the case of documents relevant for VAT payments, it is 10 years from the end of the tax period in which the performance took place. We archive relevant personal data in accordance with the requirements of the Archiving Act for the period specified therein. We keep the data processed for the purpose of processing complaints for the duration of the period for exercising rights from defective performance, or for the duration of the warranty period.

4.3 Legitimate Interests

Even after the termination of the contract with the Buyer, we process personal data for the protection of our legitimate interests (i.e. defense against potential claims of the Buyer or third parties, including before the court) for the duration of the relevant limitation periods. If the relevant proceedings are not initiated, we keep this data for a period of 5 (five) years from the termination of the contractual relationship with the Buyer.

4.4. Sending commercial messages

We will send commercial communications as described above until you unsubscribe from them. The option to withdraw consent is included in each message sent and is free of charge. Consent can be revoked at any time via the contact email listed above.

4.5 Longer processing

Personal data may be processed even longer than stated above, in the event that a relevant reason for further processing arises, typically an administrative or judicial proceeding is initiated for which the personal data are relevant.

5. What are your rights?

First of all, you have the right to ask us for access to your personal data, including making a copy of all your personal data. You can do this by using the email listed in the header of this document.

In the case of personal data that is not processed on the basis of consent, it is not possible to revoke the consent to processing. However, based on your request, we will always assess whether it is necessary to still process your personal data for any of the above-mentioned purposes.

Your other rights:

We will always inform you about:

  • the purpose of personal data processing,
  • personal data, or categories of personal data that are the subject of processing, including all available information about their source,
  • the nature of automated decision-making, including profiling, and information regarding the procedure used, as well as the meaning and anticipated consequences of such decision-making for the data subject,
  • recipients, or categories of recipients to whom personal data has been or will be transferred, and in the case of transfer of personal data to a third country, also on appropriate guarantees applicable to the transfer to ensure the security of personal data,
  • the planned period for which personal data will be stored, or if it cannot be determined, the criteria used to determine this period,
  • all available information about the source of personal data, if not obtained from you.

Your other rights include:

  • ask us for an explanation,
  • demand that we remove the resulting situation, in particular it may be blocking, correction, addition, restriction of processing or disposal of personal data (right to be forgotten),
  • request a copy of the processed personal data, or request personal data relating to you in a structured, commonly used and machine-readable format, and transfer this data to another administrator, without us preventing this in any way,
  • ask a question or complaint to the Office for Personal Data Protection,
  • object to the processing of personal data concerning you.

6. How we protect your personal data

We protect your data. The following security means are used for this in particular: implementation and enforcement of internal regulations for the protection of personal data, anti-virus protection, firewalls, encryption, control of access to personal data and authorization data, backups, physical means of protection and others.