General Information on the Processing of Personal Data

General Information on the Processing of Personal Data

Data Subject: Buyer/website visitor.

Controller: Neon World s.r.o., Námestie sv. Mikuláša 27, 06401 Stará Ľubovňa, Slovakia, Company ID: 53215052

Recipients of Personal Data:

• Slovenská pošta, a.s., Partizánska cesta 9, 975 99 Banská Bystrica 1, Company ID: 36631124

Contact Information of the Controller: Due to the scope and nature of its activities, the controller is not required to appoint a Data Protection Officer. For any questions regarding your personal data, please contact us at info@neonworld.ae, call +421 918 140 769, or visit us at the above address.

Legal Bases for Personal Data Processing: The website controller is responsible for processing personal data in accordance with Regulation (EU) 2016/679 (GDPR).

Rights of the Data Subject: The data subject has the right to:

• File a complaint with a supervisory authority
• Object to processing
• Request access to their personal data
• Request rectification, erasure, or restriction of processing
• Data portability

Instruction on Data Subject Rights: The data subject has the right to request the following from the controller based on a written request: a) Confirmation whether their personal data are being processed b) Information about the processing of personal data c) Precise information about the source of their personal data d) A list of their personal data being processed e) Rectification or deletion of incorrect, incomplete, or outdated personal data f) Deletion of personal data whose purpose of processing has ended g) Deletion of personal data processed unlawfully h) Blocking personal data due to consent withdrawal before its validity expires

These requests can be addressed to the controller at the above address, by phone at +421 918 140 769, or via email at info@neonworld.ae.

Right to Access Personal Data: The data subject has the right to request the controller to confirm whether they process personal data concerning them. If so, the data subject has the right to access these data and additional information about the purpose of processing, categories of processed personal data, recipients of personal data, and retention period.

Right to Rectification of Personal Data: The data subject has the right to request the controller to promptly correct any incorrect personal data concerning them. Depending on the purpose of processing, the data subject has the right to complete their incomplete personal data.

Right to Object to Personal Data Processing: The data subject has the right to object to the processing of their personal data for reasons related to their specific situation if the controller performs profiling or processes their personal data for the purposes of the legitimate interests of the controller or a third party.

Right to Erasure of Personal Data: The data subject has the right to request the controller to promptly delete personal data concerning them if the personal data are no longer necessary for the purpose they were collected or otherwise processed, if consent is withdrawn, if there is an objection to processing, and other reasons.

Right to Restrict Personal Data Processing: The data subject has the right to request the controller to restrict the processing of their personal data if they contest the accuracy of their personal data, if the processing is unlawful and they request restriction instead of erasure, if the controller no longer needs the personal data but they are needed for legal claims, or if there is an objection to the processing.

Notification Obligation Related to Rectification, Erasure, or Restriction of Processing: The controller is obliged to inform the recipient (anyone to whom your personal data were provided) about the rectification, erasure, or restriction of processing of personal data.

Right to Data Portability: The data subject has the right to obtain personal data concerning them, which they have provided to the controller, in a structured, commonly used, and machine-readable format. They also have the right to transfer these personal data to another controller.

Right to Lodge a Complaint with the Data Protection Authority: If you are directly affected in your rights established by the Personal Data Protection Act, you have the right to file a complaint with the Office for Personal Data Protection of the Slovak Republic.

Processing of Personal Data for Order Fulfillment and Complaint Handling: Purposes of processing personal data: issuance of a tax document, contacting the customer regarding the order, contract fulfillment, handling liability for product defects. Legal basis for personal data processing: a) Act No. 222/2004 Coll. on Value Added Tax, b) contract fulfillment. Personal data retention period: one year. Providing personal data is a contractual obligation.

Processing of Personal Data for Sending Marketing Information: Purposes of processing personal data: sending marketing information. Legal basis for personal data processing: Article 6(1)(a) GDPR – consent of the data subject. Personal data retention period: one year. Providing personal data for legitimate interest is mandatory to achieve this legitimate interest. For processing based on consent, providing personal data is voluntary.

Automated Individual Decision-Making Including Profiling: The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Processing of Personal Data for Cookies: Purposes of processing personal data: providing services, personalizing ads, analyzing traffic, AdWords, Google Analytics, Heureka, Facebook Pixels. Legal basis for personal data processing: Article 6(1)(a) GDPR – consent of the data subject. Personal data retention period:

• Session cookies – temporary, stored in your browser only until it is closed.
• Persistent cookies – remain stored on your device for a longer period or until manually deleted. Providing personal data is necessary to achieve the purpose.

Conditions and Methods of Processing Personal Data of Data Subjects: The controller processes personal data of data subjects in its information systems using automated and non-automated processing means. The controller does not disclose processed personal data unless required by a specific legal regulation or court or other state authority decision. The controller will not process your personal data without your explicit consent or other legal basis for a purpose other than stated in this information and the controller’s individual information system records.

Automated Individual Decision-Making Including Profiling and Cookies: The controller uses an analytical tool to monitor its websites, which prepares a data string and tracks how visitors use the websites. When someone browses the site, the system generates cookies to record visit-related information (pages visited, time spent on the site, browsing data, exit data, etc.), but these data must not be linked to the visitor’s person. This tool is used to improve the ergonomic design of the website, create a user-friendly website, and enhance the online experience of visitors. Most internet browsers accept cookies, but visitors have the option to delete or automatically reject them. As each browser is different, visitors can set their cookie preferences individually using the browser’s toolbar. If you choose not to accept cookies, you will not be able to use some features on our website.

Types of Cookies, Use, and Validity of Cookies:

• Absolutely Necessary/Essential Cookies: Used for the most important functions needed/essential for the website, allowing the website to function correctly. Validity: 1 year.
• Functional Cookies: Used to improve the service for the user, customize the user interface, remember items in the shopping cart, or errors encountered. Validity: until leaving the site.
• Performance and Targeting Cookies – Analytical Cookies: Used by third-party analytical tools (e.g., Google Analytics) to improve quality and provide analytical content for site visitors. Validity: automatically deleted 2 years after the last visit to the website.
• Social Media Sharing: Used by third-party social media to allow sharing content on social media from our sites. Validity: automatically deleted 2 years after the last visit to the website.
• Quality Display: Used by embedded cookies that improve performance for faster content loading and help with compatibility. Validity: deleted after closing the browser.

The controller uses the Google AdWords advertising program, which allows creating online ads and targeting people interested in the products and services provided by the controller. The Remarketing or Similar Audiences functions in AdWords enable us to reach people who have visited your website in the past. It allows ads to be displayed in search, on YouTube, and in emails. Dynamic remarketing allows users to show ads for products or services they viewed in the past. Cookies ensuring remarketing codes can be disabled by visitors to the website by appropriately setting the given browser.

The controller can also be contacted via Facebook. The purpose of data management is to share the content of the controller’s websites and present the controller. Guests can learn about news, current special offers from the controller, and view photos of selected controller projects on the Facebook page. By clicking “like” on the controller’s Facebook page, subjects agree that the controller will post its news and offers on their Facebook wall. The controller also publishes photos/videos from various events on its Facebook page. The controller publishes this data of natural persons only if their written consent was previously obtained. More information on data management from the Facebook page can be found in the data protection guide and policy at www.facebook.com.

For presentation purposes, the controller also has a profile on the social network Instagram, where it presents photos of selected projects along with descriptions. By clicking “follow,” you agree to display the photos posted by the controller.