Data Protection

/ Privacy policy and information on the protection of personal data provided by the data controller to the data subject when collecting personal data from the data subject, and information on cookies for the online shop www.hagro.sk /

1. The Controller

1.1. The identity and contact details of the Data Controller are as follows:

Company name: HAGRO ORAVA s. r. o.

Place of business: Párnica 297, 026 01 Párnica, Slovak Republic

Registered in: the Commercial Register of the District Court in Žilina, section: Sro, file no. 77362/L
Company registration number: 53817362

VAT number: 2121503219

VAT number: SK2121503219
Bank account for payments in EUR: SK41 0200 0000 0044 7790 8858

Bank account for payments in CZK: SK42 0200 0000 0050 2452 2658

The Seller is a VAT payer

1.2. The Operator’s email and telephone contact details are:

Email: hagro@hagro.sk 

Tel. no.: +421 904 834 021

1.3. The Operator’s address for sending correspondence is:

Dominik Halamček, HAGRO ORAVA s. r. o.

Párnica 297 026 01 Párnica, Slovak Republic

1.4. The Controller hereby, in accordance with Article 13(1) and (2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 May 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the General Data Protection Regulation) (hereinafter referred to as the ‘Regulation’), and further in accordance with Act No. 18/2018 Z. z. the Act on the Protection of Personal Data and on Amendments to Certain Acts, as amended, and in accordance with Act No. 452/2021 Coll. the Electronic Communications Act, as amended, provides the Data Subject – (the Buyer), from whom the Controller (the Seller) obtains personal data relating to them, with the following information, guidance and explanations:

2. Links 

2.1. These principles and guidelines on the protection of personal data form part of the General Terms and Conditions published on the Seller’s website.

2.2. Pursuant to Section 3(1)(n) of Act No. 102/2014 Coll. the Seller hereby informs the consumer that there are no specific applicable codes of conduct to which the Seller has undertaken to adhere, where a ‘code of conduct’ is understood to mean an agreement, or a set of rules defining the conduct of the seller, who has undertaken to comply with this code of conduct in relation to one or more specific commercial practices or sectors of trade, where these are not laid down by law, or by any other legal regulation or measure of a public authority), which the seller has undertaken to comply with, and the manner in which the consumer may familiarise themselves with them or obtain a copy of their text.

III. Protection of personal data and the use of cookies. Information and explanation regarding cookies, scripts and pixels

3.1. The website operator provides this brief explanation of the function of cookies, scripts and pixels:

3.1.1. Cookies are text files containing a small amount of information that are downloaded to your device when you visit a website. Thanks to these files, the website stores information about your actions and preferences (such as your username, language, font size and other display settings), so that you do not need to re-enter them the next time you visit the website or browse its individual pages

A script is a piece of programme code used to ensure the correct and interactive functioning of web pages. This code runs on the operator’s server or on your device.

A pixel is a small, invisible piece of text or an image on a web page that is used to monitor website traffic. To enable this, various data are stored via pixels.

3.1.2. Cookies are categorised as follows

Technical or functional cookies – ensure the proper functioning of the Operator’s website and its use. These cookies are used without consent.

Statistical cookies – the Operator collects statistics on the use of its website. These cookies are used only with consent.

Marketing/advertising cookies – used to create advertising profiles and for similar marketing activities. These cookies are used only with consent.

3.2. How to manage cookies:

3.2.1. You can manage and/or delete cookies as you see fit – for details, please visit aboutcookies.org. You can delete all cookies stored on your computer or other device, and you can set most browsers to prevent them from being stored.

3.3. The Operator’s website uses the following cookies:

You can find all the cookies used by the Operator on the website https://www.cookieserve.com/ by entering the Operator’s web address https://www.hagro.sk

Technical or functional cookies – the information is accessed by the website operator. The cookies are valid for 5 years.

Statistical cookies – the information is accessed by the website operator. The cookies have a lifespan of 5 years.

Marketing and advertising cookies – the information is accessed by the website operator. The cookies have a lifespan of 5 years.

3.3.1. Cookies made available to third parties:

Google Analytics, Google Ads: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information on privacy can be found at https://support.google.com/analytics/topic/2919631?hl=sk&ref_topic=1008008

Facebook Pixels: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Further information on privacy can be found at https://www.facebook.com/about/privacy/

4. Personal data processed

4.1.The data controller processes the following personal data on its website: first name, surname, address, email address, home telephone number, mobile telephone number, billing address, delivery address, data obtained from cookies, and IP addresses.

5. Contact details of the data protection officer

5.1. The Controller has appointed a Data Protection Officer in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Contact: Email: hagro@hagro.sk, Tel.: +421 904 834 021 

5.2. The Controller is also the Seller within the meaning of the term as defined in the General Terms and Conditions of this website.

6. Purposes of processing the Data Subject’s personal data and the duration of such processing

6.1. The purposes of processing the Data Subject’s personal data are, in particular:

6.1.1. the recording, creation and processing of contracts and client data for the purpose of concluding contracts with third parties.

6.1.2. the processing of accounting documents and documents relating to the Controller’s business activities.

6.1.3. compliance with legal regulations concerning the archiving of documents and records, e.g. in accordance with Act No. 431/2002 Coll., the Accounting Act, as amended, and other relevant regulations.

6.1.4. the Controller’s activities in connection with the fulfilment of requests, orders, contracts and similar arrangements made by the Data Subject.

6.1.5. The Controller’s newsletters, marketing and similar promotional activities. Where the Data Subject has given their consent to the Controller for marketing and similar promotional activities.

6.2. The Controller retains the Data Subject’s personal data only for as long as is strictly necessary for the purposes of performing the contract and for their subsequent archiving in accordance with the statutory retention periods imposed on the Controller by law. Where the Data Subject has consented to the sending of promotional emails and similar offers, the Data Subject’s personal data shall be processed for these purposes until such time as the Data Subject withdraws their consent. However, for a maximum period of 10 years.

VII. Legal basis for the processing of the Data Subject’s personal data

7.1 Where the Controller processes personal data on the basis of the Data Subject’s consent, such processing shall commence only after the Data Subject has given their consent.

7.2 Where the Controller processes the Data Subject’s personal data for the purposes of negotiating pre-contractual arrangements and the conclusion and performance of a sales contract, and the related delivery of goods, products or services. The Data Subject is obliged to provide personal data for the proper performance of the sales contract; otherwise, performance cannot be ensured. Personal data for this purpose are processed without the Data Subject’s consent.

VIII. Recipients or categories of recipients of personal data

8.1. The recipients of the data subject’s personal data will be, or may at least include:

8.1.1. the statutory bodies of the Controller or their members;

8.1.2. persons carrying out work for the Controller in an employment or similar relationship.

8.1.3. the Controller’s sales representatives and other persons cooperating with the Controller in the performance of the Controller’s tasks. For the purposes of this document, all natural persons carrying out dependent work for the Controller on the basis of an employment contract or agreements on work performed outside an employment relationship shall be regarded as employees of the Controller.

8.1.4. The recipients of the Data Subject’s personal data will also include the Controller’s collaborators, business partners, suppliers and contractual partners, namely: an accountancy firm, a company providing services relating to the development and maintenance of software, a company providing legal services to the Controller, a company providing consultancy services to the Controller, companies responsible for the transport and delivery of products to buyers and third parties, marketing companies, social media operators, companies providing payment gateways and other payment methods.

8.1.5. Recipients of personal data will also include courts, law enforcement agencies, the tax office and other state authorities, where required by law. Personal data will be provided by the Controller to the relevant authorities and state institutions on the basis of, and in accordance with, the legislation of the Slovak Republic.

8.1.6. List of third parties – processors and recipients who process the Data Subject’s personal data:

Slovenská pošta, a.s., Partizánska cesta 9, 975 99 Banská Bystrica, Company Registration Number: 36631124 – a third party providing transport services

9. Information on the transfer of personal data to third countries and the period for which it is retained:

9.1. Not applicable. The Controller does not transfer personal data to third countries.

10. Information on the existence of the data subject’s relevant rights:

10.1. The data subject has, amongst other things, the following rights, whereby:

10.1.1. Point 10.1 does not affect the Data Subjects’ other rights.

10.1.2. The data subject’s right of access to data under Article 15 of the Regulation, which entails:

the right to obtain confirmation from the Controller as to whether the Data Subject’s personal data are being processed, and if so, to what extent. Furthermore, if such data are being processed, the Data Subject has the right to ascertain their content and to request from the Controller information regarding the grounds for their processing, in particular information on: the purpose of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular where recipients are in third countries or international organisations, the envisaged period for which the personal data will be stored or, where this is not possible, information on the criteria used to determine that period, the existence of the right to request from the Controller the rectification of personal data concerning the Data Subject or their erasure or restriction of processing, and the existence of the right to object to such processing, the right to lodge a complaint with a supervisory authority; where the personal data have not been obtained from the Data Subject, any available information as to their source; the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation and, in such cases, at least meaningful information on the procedure used, as well as the significance and envisaged consequences of such processing of personal data for the Data Subject, on the appropriate safeguards pursuant to Article 46 of the Regulation relating to the transfer of personal data, where personal data are transferred to a third country or an international organisation.

10.1.3. the right to receive a copy of the personal data being processed, provided that the right to receive a copy of the personal data being processed does not adversely affect the rights and freedoms of others 

10.1.4. the Data Subject’s right to rectification under Article 16 of the Regulation, which entails the right: to have the Controller rectify, without undue delay, any inaccurate personal data concerning the Data Subject. the right to have incomplete personal data concerning the Data Subject completed, including by means of providing a supplementary statement by the Data Subject, the Data Subject’s right to erasure of personal data (the so-called ‘right to be forgotten’) under Article 17 of the Regulation, which entails:

10.1.5. the right to obtain from the Controller, without undue delay, the erasure of personal data relating to the Data Subject, where one of the following grounds applies:

the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, the Data Subject withdraws the consent on which the processing is based, provided that there is no other legal basis for the processing of personal data, the data subject objects to the processing of personal data in accordance with Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing of personal data; or the data subject objects to the processing of personal data pursuant to Article 21(2) of the Regulation; the personal data have been processed unlawfully; the personal data must be erased in order to comply with a legal obligation under European Union law or the law of the Member State to which the Controller is subject, the personal data were collected in connection with the provision of information society services pursuant to Article 8(1) of the Regulation;

10.1.6. the right to have the Controller who has made the Data Subject’s personal data public take appropriate measures, including technical measures, having regard to the available technology and the cost of implementation, to inform other controllers processing personal data that the Data Subject requests them to erase all links to such personal data, as well as any copies or replicas thereof, provided that the right to erasure of personal data, as set out in Article 17(1) and (2) of the Regulation, shall not apply where the processing of personal data is necessary: 

10.1.7. for the exercise of the right to freedom of expression and information;

10.1.8. to comply with a legal obligation which requires processing under European Union law or the law of a Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.

10.1.9. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) of the Regulation, as well as Article 9(3) of the Regulation. 

10.1.10. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes as referred to in Article 89(1) of the Regulation, in so far as the right referred to in Article 17(1) Regulation would prevent or seriously impede the achievement of the purposes of such processing of personal data; or for the establishment, exercise or defence of legal claims;

10.1.11. the Data Subject’s right to restriction of processing of personal data pursuant to Article 18 of the Regulation, which entails:

10.1.12. the right to have the Controller restrict the processing of personal data in any of the following cases: the Data Subject contests the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data; the processing of personal data is unlawful and the Data Subject objects to the erasure of the personal data and requests, instead, that their use be restricted; the Controller no longer requires the personal data for the purposes of processing, but the Data Subject requires it for the establishment, exercise or defence of legal claims; the Data Subject has objected to the processing pursuant to Article 21(1) of the Regulation, pending verification as to whether the legitimate grounds of the Controller override those of the data subject;

10.1.13. the right, where the processing of personal data has been restricted, to have such restricted personal data processed – with the exception of storage – only with the Data Subject’s consent or for the purposes of establishing, exercise or defence of legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the European Union or a Member State;

10.1.14. the right to be informed in advance of the lifting of restrictions on the processing of personal data; 

10.1.15. the data subject’s right to have the Controller fulfil the notification obligation to recipients in accordance with Article 19 of the Regulation, the content of which is: the right for the Controller to notify each recipient to whom personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out pursuant to Article 16, Article 17(1) and Article 18 of the Regulation, unless this proves impossible or involves disproportionate effort; the right for the Controller to inform the Data Subject of these recipients, if the Data Subject so requests;

10.1.16. the Data Subject’s right to data portability under Article 20 of the Regulation, which entails: the right to receive the personal data concerning the Data Subject and which the Data Subject has provided to the Controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the Controller, where:

a/ the processing is based on the Data Subject’s consent pursuant to Article 6(1)(a) of the Regulation or Article 9(2)(a) of the Regulation, or on a contract pursuant to Article 6(1)(b) of the Regulation, and at the same time

b/ the processing is carried out by automated means, and at the same time:

10.1.17. the right to receive personal data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller, provided this does not adversely affect the rights and freedoms of others;

10.1.18. the right to have personal data transferred directly from one controller to another controller, where technically feasible;

10.1.19. the Data Subject’s right to object under Article 21 of the Regulation, which provides for:

10.1.20. the right to object at any time, on grounds relating to the Data Subject’s particular situation, to the processing of personal data concerning them which is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including the right to object to profiling based on those provisions of the Regulation;

10.1.21.where the right is exercised to object at any time, on grounds relating to the specific situation of the Data Subject, to the processing of personal data concerning him or her carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including the right to object to profiling based on those provisions of the Regulation, the right to have the Controller cease further processing of the Data Subject’s personal data, unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or grounds relating to the establishment, exercise or defence of legal claims

10.1.22. the right to object at any time to the processing of personal data relating to the Data Subject for the purposes of direct marketing, including profiling insofar as it relates to direct marketing; provided that, where the Data Subject objects to the processing of personal data for direct marketing purposes, such personal data shall no longer be processed for such purposes;

10.1.23. in connection with the use of information society services, the right to exercise the right to object to the processing of personal data by automated means using technical specifications; 

10.1.24. the right to object, on grounds relating to the specific situation of the Data Subject, to the processing of personal data concerning the Data Subject, where personal data are processed for the purposes of scientific or historical research or for statistical purposes in accordance with Article 89(1). of the Regulation, except where the processing is necessary for the performance of a task carried out in the public interest;

10.1.25. the Data Subject’s right relating to automated individual decision-making under Article 22 of the Regulation, which entails:

10.1.26. the right not to be subject to a decision based solely on automated processing of personal data, including profiling, and which produces legal effects concerning the Data Subject or similarly significantly affects them, except in the cases referred to in Article 22(2) of the Regulation [i.e. with the exception of cases where the decision is: (a) necessary for the conclusion or performance of a contract between the Data Subject and the Controller, 

10.1.27. authorised by European Union law or the law of a Member State to which the Controller is subject, which also lays down suitable measures to safeguard the rights, freedoms and legitimate interests of the Data Subject; or (c) based on the Data Subject’s explicit consent.

11. Information on the Data Subject’s right to withdraw consent to the processing of personal data:

11.1. The Data Subject is entitled at any time to withdraw their consent to the processing of personal data, without this affecting the lawfulness of the processing of personal data based on the consent given prior to its withdrawal.

The Data Subject is entitled at any time to withdraw their consent to the processing of personal data – in full or in part. Partial withdrawal of consent to the processing of personal data may relate to a specific type of processing operation / processing operations, whilst the lawfulness of the processing of personal data in respect of the remaining processing operations remains unaffected. A partial withdrawal of consent to the processing of personal data may relate to a specific purpose of processing personal data / certain specific purposes of personal data processing, whilst the lawfulness of the processing of personal data for other purposes remains unaffected.

The Data Subject may exercise the right to withdraw consent to the processing of personal data in writing to the Controller’s address registered as its registered office in the Trade Register at the time of withdrawal of consent to the processing of personal data, or in electronic form via electronic means (by sending an email to the Controller’s email address specified in the Controller’s identification details in this document). 

XII. Information on the Data Subject’s right to lodge a complaint with a supervisory authority:

12.1. The Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or in the place where the alleged infringement occurred, if they consider that the processing of personal data relating to them is in breach of the Regulation, without prejudice to any other administrative or judicial remedies.

The data subject has the right to be informed by the supervisory authority to which the complaint has been lodged, in their capacity as the complainant, of the progress and outcome of the complaint, including the possibility of seeking judicial redress in accordance with Article 78 of the Regulation.

12.2. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovak Republic. Tel.: +421 2 3231 3214, Email: statny.dozor@pdp.gov.sk, 

XIII. Information relating to automated decision-making, including profiling:

13.1. As the Controller does not process the Data Subject’s personal data by means of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, the Controller is not obliged to provide the information referred to in Article 13(2)(f) of the Regulation, i.e. information on automated decision-making, including profiling, and on the procedure used, as well as on the significance and anticipated consequences of such processing of personal data for the Data Subject. Not applicable.

XIV. Final Provisions

14.1. This Privacy Policy and the guidance on personal data protection and cookies form an integral part of the General Terms and Conditions and the Complaints Procedure. Documents – The General Terms and Conditions and Complaints Procedure for this Website are published on the Seller’s Website domain.

14.2. This Privacy Policy shall come into force and effect upon its publication on the Seller’s Website on 23 October 2024.