I.         BASIC PROVISIONS

1. This privacy policy governs the processing of personal data of visitors to the annatran.online website (hereinafter referred to as the „Website”), in particular its registered users (hereinafter referred to as the „User”) and customers who place orders through the Website (hereinafter referred to as the „Customer”).
2. The data controller is Tran Tra
   address: 54 Masarykova Street Luhačovice
   by e-mail: antraaan@gmail.com
   Phone: 776255116
3. Data Protection Contact Person:
   address: Tran Tra
   by e-mail: antraaan@gmail.com
   Phone: 776255116
4. Personal data means any information about an identified or identifiable natural person. An identified person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, a network identifier or to one or more specific elements of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

II.         WHAT PERSONAL DATA WE PROCESS

1. The following data may be subject to processing:
   a. address and identification data used to uniquely and unmistakably identify the data subject (e.g. name, surname, title, date of birth, permanent address, registration number, VAT number) and data enabling contact with the data subject (contact data – e.g. contact address, telephone number, e-mail address and other similar information)
   b. descriptive data (e.g. bank details)
   c. other data necessary for the performance of the contract
   d. data provided in excess of the relevant laws processed within the scope of the data subject’s consent (processing of photographs).
2. Data obtained through cookies. If you have enabled the storage of cookies in your browser and agree to their use, we may collect data about your visit to the website, products viewed and other activity on the website. We do not collect or otherwise process any sensitive personal data, including, for example, data about your health, religion or beliefs, etc.

III.         THE LAWFUL BASIS AND PURPOSE OF THE PROCESSING OF PERSONAL DATA

1. The lawful reason for processing personal data is:
   a. the performance of the contract between you and the controller pursuant to Article 6(1)(b) GDPR, the controller’s legitimate interest in providing direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6(1)(f) GDPR, including remarketing and profiling for the purpose of personalising the offer
   b. Your consent to processing for the purpose of providing direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6(1)(a) GDPR in conjunction with Section 7(2) of Act No. 480/2004 Coll., on certain services.
2. The purpose of processing personal data is to process your order and to exercise the rights and obligations arising from the contractual relationship between you and the controller.
3. If personal data is required that is necessary for the successful execution of the order (name and contact), the provision of personal data is a necessary document for the conclusion of a contract for performance, without the provision of personal data it is not possible to conclude a contract or fulfill it by the controller, sending commercial communications and other marketing activities.

IV.         DATA RETENTION PERIOD

1. The controller processes personal data for the performance of the contract throughout the processing of orders, including payment and delivery of goods. By law, we subsequently retain certain data contained in accounting documents for the period of time prescribed by law (e.g. Accounting Act, Value Added Tax Act).
2. Commercial communications are sent to users for as long as the consent to their transmission lasts. In the case of customers, commercial communications are sent until they unsubscribe or object to the processing of their data for this purpose. However, at most, commercial communications are sent for a period of 5 years. thereafter, upon request for a new consent.
3. We process the data collected for marketing purposes via cookies for as long as you consent to the use of cookies, i.e. for as long as you use the storage of cookies in your browser, or until you object to the processing of your data for this purpose.
4. Further processing of personal data beyond these time limits is carried out by the Controller only if it is necessary to comply with the requirements arising from legal regulations that apply to the Controller.

V.         WHO HAS ACCESS TO THE PERSONAL DATA (SUBCONTRACTORS OF THE CONTROLLER)

1. Your personal data is handled mainly by our staff involved in the processing of your order and delivery of goods or services.
2. The controller also delegates the processing of personal data to other entities, as so-called processors. A processor is any entity that processes personal data for the Controller for the purposes and in the ways specified by the Controller. This includes, but is not limited to:
   a. order shipping companies;
   b. companies providing e-shop operation services;
   c. our external accounting firm, etc;
   d. companies providing marketing services (sending newsletters)
   c. Facebook Inc. and Google LLC (online marketing tool);
   f. Cloud service providers.
3. The controller may transfer personal data to a third country (non-EU country) or an international organisation. Recipients of personal data in third countries are only providers of mailing/cloud services.

VI.         WHAT YOUR RIGHTS ARE

1. You can contact us and ask us about the processing of your personal data:
   a. Information regarding the personal data we process, the purpose and processing of personal data and the categories of personal data processed, recipients or categories of recipients;
   b. Access to the data you provide to us,
   c. Correction of personal data if it is inaccurate or incomplete in any way,
   d. Explanation and rectification of the defective condition (e.g. blocking, correction, completion or destruction of personal data),
   e. Erasure of personal data (the so-called right to be forgotten) or their corresponding processing if they are no longer necessary for the purposes stated.
2. The controller is obliged to comply with the request unless there is a breach of the legal
   requirements for processing personal data and storing documents.
3. We will destroy your data wholly or partially within the framework of the fulfilment of these conditions.
4. The right to withdraw consent to processing should be sent in writing or electronically to the address or email of the controller.
5. You can withdraw your right to consent to processing in writing or electronically to the address or email of the controller, or you can withdraw your consent via the link contained in each marketing email sent.

VII.         PERSONAL DATA SECURITY CONDITIONS

1. The controller takes care of the security of your data. The handling of personal data is carried out in full compliance with the applicable legislation, including the General Data Protection Regulation (GDPR). It places great emphasis on the technical and organizational security of the processed data.
2. All personal data in electronic form shall be stored in databases and systems to which only those persons who have an immediate need to handle the personal data for the purposes set out in the rules shall have access, and only to the extent necessary. Access to this personal data is password and firewall protected. The security of personal data is regularly tested and continuously improved by the Controller.

VIII.         FINAL PROVISIONS

1. By submitting orders from the online order form, you confirm that you are aware of the privacy policy and that you accept it in its entirety.
2. You agree to these terms and conditions by checking the consent box via the online form. By checking the consent form, you confirm that you are aware of the privacy policy and that you accept it in its entirety.
3. The administrator is entitled to change these conditions. It will publish the new version of the Privacy Policy on its website and will also inform you of this change by email, which you have provided to the controller. These changes do not apply to orders received before that date.

These terms and conditions shall take effect on 22.2.2025.