In accordance with Article 19 et seq. of Act No. 18/2018 Coll. on the protection of personal data and on the amendment and supplementation of certain laws, as amended, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”).

Pursuant to the provisions of Articles 19 et seq. of Act No. 18/2018 Coll. on the protection of personal data, as amended (hereinafter referred to as the “Personal Data Protection Act”), we, as the data controller, provide you, as the data subject, with the following information regarding the processing of your personal data.

Data Controller: The data controller is Brian Bystričan, with registered office at Polianky 7/D, 841 01 Bratislava, Slovakia (hereinafter referred to as the “Controller”).

Contact Information:
Email: brian@bystrican.com

Access to Personal Data:
In the processing of personal data, in addition to the Controller and companies associated with Bystričan and their employees, other persons processing personal data as processors may have access to personal data. A specific, constantly updated list of processors, i.e., recipients of personal data processed on behalf of the Controller, includes:

• Companies providing marketing services

• Companies providing payroll and accounting services

• Companies providing internal and external audit services

Legal Basis:
The legal basis for processing personal data is generally the fulfillment of a legal obligation (especially Act No. 18/2018 Coll. on the protection of personal data), the conclusion, management, and fulfillment of contractual obligations arising from employment and business contracts, legitimate interests, which are the protection of the rights and interests of the Controller and its employees protected by law, as well as the consent of the data subject (particularly for marketing purposes, contests, social events, etc.).
Consent to the processing of personal data must be given voluntarily, and the data subject may withdraw consent at any time. However, consent is necessary for the Controller to carry out corporate events and similar activities, and without this consent, the Controller is not authorized to provide the relevant services. If the data subject refuses to provide personal data required for the fulfillment of contractual obligations of the Controller or compliance with legal regulations, the Controller is not obligated to enter into a contract or provide other services.

Processed Personal Data:
We collect the merchant’s customers’ names, email addresses, shipping and billing addresses, payment details, company name, phone number, IP address, information about orders you initiate, information about the stores supported by Mr. Bystričan that you visit, and information about the device and browser you use. This information is collected when you use or access the store that utilizes our services, such as when you visit a merchant’s website, place an order, or register an account on the merchant’s site.
When visiting or browsing the website bystrican.com, we collect information about the device and browser you are using, your network connection, your IP address, and information about cookies installed on your device. We also collect personal information you provide to us through any messaging feature available on our website. From forum users, we collect your name, email address, website URL, and other personal information you may disclose.

Purpose of Processing and Sharing:
We use this information to provide services to our merchants, including support and order processing, verification, and payments. We also use this information to improve our services. Bystričan.com also collaborates with third parties and service providers to assist in providing services to our merchants. We may share personal data with them to support this effort.
Your information may also be shared under the following circumstances:

• To prevent unlawful activities, fraud suspicion, investigate them, or take action against them, which represent a potential threat to the physical safety of any person, breach our terms of use, or any other agreement related to the services, or as required by law.

• If the merchant whose store you visit or access directs us to transfer this information (for example, if they allow a third-party application that has access to the customer’s personal data).

• To comply with legal requests or respond to legal court orders, subpoenas, summons, or other requests from public authorities (including meeting national security or law enforcement requirements).
  Personal data may also be shared with a company that acquires our business or the business of the merchant whose store you visit or access, either through merger, acquisition, bankruptcy, dissolution, reorganization, or other similar transaction or proceeding.

Retention of Personal Data and Duration of Processing:
The Controller is authorized to process personal data of data subjects for the period specified in accordance with applicable legal regulations. Processing personal data with consent is possible only for the period for which consent was granted. Consent is granted to the Controller for a period of three (3) years or until consent is withdrawn. After the expiration of the relevant period, personal data will be deleted, unless their storage is required by applicable Slovak legal regulations.

Rights of Data Subjects Regarding the Processing of Personal Data:
Regarding the processing of personal data, data subjects may exercise the following rights:

• The right to access and information about their personal data;

• The right to correct personal data;

• The right to delete personal data;

• The right to restrict the processing of personal data;

• The right to data portability;

• The right to object to the processing of personal data;

• The right to challenge automated individual decision-making, including profiling;

• The right to withdraw consent at any time (if consent is the legal basis for processing);

• The right to file a complaint under Article 100 et seq. of the Personal Data Protection Act with the supervisory authority, i.e., the Office for Personal Data Protection of the Slovak Republic, with registered office at Hraničná 12, 820 07 Bratislava 27, Slovakia, contact information: +421 2 3231 3214, email: statny.dozor@pdp.gov.sk.

Data subjects may exercise the above rights, which are further specified in the provisions of Article 21 et seq. of the Personal Data Protection Act, in accordance with the Personal Data Protection Act and GDPR, and other applicable legal regulations. Data subjects may exercise their rights towards the Controller by submitting a written request sent or delivered to the Controller’s registered office: Karpatské námestie 10A, 831 06 Bratislava; or by email to: brian@bystrican.com.
The request must contain the following information: first name, last name, date of birth, and permanent address, so that the Controller can identify the data subject.
The Controller may request additional information necessary to verify the identity of the data subject if there are justified doubts about the identity of the individual. The Controller is required to provide the data subject with information about the measures taken in response to their request within one (1) month of receiving the request. In justified cases, the Controller may extend this period by an additional two (2) months, repeatedly if necessary, due to the complexity and number of requests. The Controller is required to inform the data subject about any such extension within one (1) month of receiving the request, stating the reasons for the extension. If the data subject has submitted a request in electronic form, the Controller will provide the information in electronic form unless the data subject has requested information by other means.
If the Controller does not take action on the data subject’s request, the Controller is required to inform the data subject of the reasons for inaction within one (1) month of receiving the request, as well as the possibility to file a complaint under Article 100 of the Personal Data Protection Act with the Office for Personal Data Protection.
Notices regarding the actions taken will be provided free of charge. If the data subject’s request is clearly unfounded or excessive, particularly due to its repetitive nature, the Controller may charge a reasonable fee that takes into account the administrative costs of providing the information or a reasonable fee for the administrative costs of the subject providing the notice or a reasonable fee for the administrative costs of taking the requested action or refusing to act on the request. The Controller will prove that the request is unfounded or excessive.

Bystrican.com understands that you have rights to your personal information and takes reasonable steps to allow you access, correction, modification, deletion, portability, or restriction of the use of your personal data. If you are a merchant or partner, you can update many types of personal information directly in your account settings, such as payment or contact information. If you are unable to change your personal information in your account settings or if you have concerns about the data collected when visiting the bystrican.com website or when using our support services, contact us and make the necessary changes. It is important to note that if you delete or restrict the use of your personal data, the services may not function properly.

If you have any questions about your personal data or these policies, or if you would like to complain about how bystrican.com processes your personal data, please contact Mr. Bystričan by email at brian@bystrican.com.