Privacy Policy

I. Basic Provisions

By this document, you grant consent to the entrepreneur David Baláček, ID No.: 21792526, VAT No.: CZ9604083126, with registered office at Jizerská 2923/39, Ústí nad Labem, 400 11 (hereinafter: the “Controller”), to process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: “GDPR”), for the processing of the following personal data.

II. Categories and Types of Processed Data

Your first and last name, email address, company name, postal address, and telephone number may be processed based on your consent and are necessary for fulfilling the contractual relationship.

III. Legal Basis and Purpose of Personal Data Processing

The purposes of processing personal data are:

1. Processing an order arising from a contractual relationship between the data subject and the Controller in accordance with Act No. 89/2012 Coll., or any other contractual relationship;
2. Storing your purchase preferences and subsequently customizing the offer on the Controller’s website;
3. Launching marketing and remarketing campaigns on advertising platforms such as Google, Seznam.cz, Microsoft, Facebook, as well as RTB systems like Adform, Criteo, Pubmatic and others using DSP (Demand Side Platforms) and SSP (Supply Side Platforms);
4. Sending commercial communications (newsletters, push notifications, and others) within marketing and remarketing campaigns using internal tools or third-party tools (email marketing platforms, user notification software).

3.2 The Controller performs automated individual decision-making according to Article 22 of the GDPR. You give your explicit consent to this processing. Consent may be withdrawn at any time, for example by sending an email or letter to the contact details listed on mewtwo.eu.

IV. Data Retention Period

The retention period of your personal data depends on the purpose for which the data is used:

1. For fulfilling the contractual relationship between the data subject and the Controller: for the duration of the performance;
2. For marketing purposes: for 1 year;
3. For record-keeping obligations: up to 10 years for accounting documents.

4.1 After the retention period has expired, the Controller will delete your personal data.

V. Processing of Personal Data

Your personal data may also be processed for the Controller by the following processors:

3. Providers of software solutions listed in Article III, section 3.1, letters a), b), c), and d) of this Consent to Personal Data Processing;
4. Providers of software solutions, applications, services, and other processors that the Controller may not currently be using;
5. The owner of the online shop mewtwo.eu.

5.2 The Controller and processor shall take measures to ensure that any natural person acting under the authority of the Controller or processor who has access to personal data processes such data only upon instructions from the Controller unless required otherwise by Union or Member State law.

VI. Recipients of the Controller’s Personal Data

Recipients of personal data include companies or persons who:

1. Ensure the performance of the contract between the Controller and the data subject (e.g., shipping companies, payment processors, premium services, etc.);
2. Provide marketing services as described in Article III, section 3.1, letters a), b), c), and d);
3. Ensure operation of the website www.mewtwo.eu (e.g., partners, marketplace entities, external suppliers, etc.);
4. Ensure proper administration of the business activities of David Baláček, operator of mewtwo.eu, from a legal and accounting perspective (e.g., legal services, accounting, etc.).

6.1 The Controller intends to use services located outside the EU and therefore intends to transfer personal data to third countries. Recipients in third countries include platform providers listed in Article III, section 3.1.

VII. Your Rights

Under GDPR, you have the right to:

1. Right of access to personal data under Article 15 GDPR and Articles 22 and 46 GDPR;
2. Right to rectification under Article 16 GDPR;
3. Right to erasure (“right to be forgotten”) under Article 17 GDPR;
4. Right to restriction of processing under Article 18 GDPR;
5. Right to data portability under Article 20 GDPR;
6. Right to object to processing based on Article 6(1)(e) or (f), including profiling based on these provisions, under Article 20 GDPR;
7. Right to withdraw consent to processing;
8. Right to lodge a complaint with a supervisory authority.

7.1 The Controller shall no longer process personal data unless it demonstrates compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or for establishing, exercising, or defending legal claims.

7.2 You may access your personal data only yourself or through your authorized representative. If the Controller is unsure of your identity, it may request additional information to verify it.

7.3 The Controller shall notify each recipient to whom personal data has been disclosed of any rectification, erasure, or restriction of processing carried out under Articles 16, 17(1), and 18 GDPR unless this proves impossible or involves disproportionate effort. If you request it, the Controller shall inform you of these recipients.

VIII. Use of Cookies

The online shop mewtwo.eu uses cookies for marketing, customizing website content, analytics, and social media personalization. Information regarding their use may be shared with trusted partners for advertising purposes, and all data is anonymized.

IX. Security of Personal Data

Taking into account the state of the art, implementation costs, nature, scope, context, and purposes of processing, as well as risks of varying likelihood and severity for the rights and freedoms of natural persons, the Controller shall implement appropriate technical and organizational measures — such as pseudonymization — to ensure compliance with data protection principles, including data minimization, and to integrate necessary safeguards into the processing to comply with this Regulation and protect the rights of data subjects.

8.1 The Controller shall adopt appropriate measures to ensure that, by default, only personal data necessary for each specific purpose is processed. This applies to the amount of personal data collected, their extent of processing, retention period, and accessibility. These measures shall ensure that personal data is not made accessible to an indefinite number of natural persons without human intervention.

This consent to data processing becomes effective on 11.07.2024