1. Data controllers
The Data Controller is the company Industrial Project d.o.o. (hereinafter also referred to as “Data Controller”), which can be contacted for matters relating to the protection of personal data at the email address firstname.lastname@example.org.
2. Categories of personal data
We will process the following categories of personal data: name, address, email address, financial data (such as credit/debit card number or other payment-related data), and data concerning the recipients of gift cards.
3. Origin of personal data and obligations of the person purchasing the gift card
To manage the gift card, the Data Controller shall use the data contained in the order, which shall also contain personal data relating to the recipient of the gift card. The purchaser of the gift card who provides the personal data of the recipient of the gift card is responsible for ensuring that this is done with the consent of the person concerned and for providing him/her with this policy.
4. Purposes of the processing, legal basis and storage period
Personal data will be processed by Industrial Project d.o.o. for the purposes and under the conditions indicated below.
Sale of products and services: for the conclusion and implementation of the contract for the sale of products and services offered by the Data Controller, including the management of purchase orders, the delivery of products, the communication of any circumstances relating to the order and the management of payments.
Implementation of the contract.
Data storage period
For the time necessary to process the application and for a further 10 years.
5. Refusal to disclose data
If the user refuses to provide the data requested in the form, the Data Controller will not be able to process the application received.
6. Categories of recipients of personal data
For the fulfilment of the purposes indicated above, Industrial Project d.o.o. may disclose the data collected to the following categories of subjects: IT service providers, such as internet service and cloud computing; subjects carrying out logistics and product delivery activities; subjects carrying out customer service activities; subjects providing banking, financial, insurance and credit recovery services; subjects carrying out anti-fraud payment control activities. Where necessary, data recipients will be designated as data controllers, in accordance with the provisions of Article 28 of the GDPR.
7. Transfer of data to third countries
Personal data processed by the Data Controller may be transferred to other companies based in the United States of America solely for the purposes indicated above. This transfer will take place exclusively following the signing with the companies receiving the personal data of standard contractual clauses (S.C.C.) adopted by the Commission of the European Union (pursuant to Article 46, paragraph II, points C and D of the GDPR).
8. Rights of data subjects