of the company Libristo Media s.r.o., ID No.: 04448367, with registered office at Sychrov 55, 755 01 Vsetín, Czech Republic, registered in the Commercial Register at the Regional Court in Ostrava, file No. C 63649, represented by Lukáš Kavina, Václav Kadlec, Josef Žák, Executive Directors, for the sale of goods and digital content on https://www.najlacnejsie-knihy.sk (hereinafter referred to as the “Controller” or “Us”)

The purpose of this document is to inform you of all information relating to the processing of your Personal Data. We encourage you to read this Privacy Policy. If you have any further questions about the processing of your Personal Data, please contact us by email at [email protected] or by post at the above address.

We process your personal data for statutory reasons, for the performance of a contract or on the basis of our legitimate interest. If the processing of personal data is not done on the basis of these three reasons, then we will ask for your consent. 

For better clarity and orientation, the terms that are often repeated in this policy are listed below.

1 WHAT PERSONAL DATA WE PROCESS, HOW WE OBTAIN IT, FOR WHAT PURPOSE AND FOR HOW LONG WE KEEP IT

We process the following Personal Data about you: 

• name and surname; 
• contact details (especially e-mail, telephone number); 
• billing details and bank details (details necessary for bookkeeping and payment for goods);
• comments written during the order process;
• information you provide to us in the course of communicating with us (in particular, your questions and answers to your questions, communication with you);
• login to the user account and behavior in the user account (in particular the data filled in by the User in the user account, purchase history, time of registration, date of last profile update);
• the comments you add to our posts on social media (in particular Facebook, Instagram, YouTube, TikTok, LinkedIn), as well as your profile name (nickname) on these social media and the information you make publicly available on your profiles,
• IP address; 
• cookies.

 We do not process Special categories of personal data. 

2 HOW WE PROCESS PERSONAL DATA?

General processing period for personal data. We process your personal data to the extent necessary and for the period required to protect our interests. Personal data is processed:

- for the entire duration of the purchase contract and thereafter for the period necessary to exercise rights and fulfil obligations arising from the contractual relationship between you and us, and to enforce any claims arising from such contractual relationships;

- for the period necessary to comply with legal obligations;
- generally, personal data is processed for a maximum of 5 years from your last participation in a meeting, communication with us, or the termination of the purchase contract, unless a longer period is required by law;
- in certain cases, personal data may be processed for up to 15 years after fulfilment of the purchase contract to protect our legitimate interests.

Processing with generative artificial intelligence (AI). In some cases, we involve AI in processing personal data or collect personal data through AI (typically via our chatbot). However, AI is not used for automated decision-making or profiling as defined under the GDPR (particularly Article 22). All processing of personal data is subject to human oversight; AI does not make decisions about you beyond the interactions within our chatbot.

3 FOR WHAT PURPOSE DO WE PROCESS PERSONAL DATA?

3.1 Registration, setting up a user account. You voluntarily provide us with Personal Data by setting up a user account in the E-shop and its subsequent updates. By setting up a user account, you can take advantage of the user account's benefits. 

3.2 E-shop website. We also process information about your visit and viewing of our website. This information may include, for example, your IP address, the date and time you accessed our website, information about your internet browser, operating system or your language settings. We may collect this data as part of a log or through the use of cookies or other tracking technologies. The rules for the use of cookies and other tracking technologies are described in more detail in our Cookie Policy.

3.3 Performance of the contractual relationship. The statutory reason for the Processing of Personal Data is the performance of the Purchase Contract or proper Order processing and related obligations.

3.4 Improving our services, promotion of goods and services. We may process Personal Data from publicly available sources, our contractors and combine it with Personal Data voluntarily provided to us.  We take steps to ensure that third parties are legally entitled to provide this information to us. For example, this will include demographic information, IP addresses and cookies. This is to improve the provision of our services and the promotion of our goods.

3.5 Personalized advertising. We work with third parties to manage and display our advertising on third party websites. 

3.6 Competitions and other promotions. We may conduct surveys, contests or other promotions on our website or through social media. Your participation in our promotions is voluntary. As part of these surveys, contests and promotions, we may ask you for Personal Information such as your name, address, date of birth, phone number, email address, username and similar information. We will use the Personal Information you provide to us to administer these promotions or for other purposes if specified in the terms and conditions of a particular promotion.

3.7 Social media. We have a profile on Facebook, Instagram, LinkedIn, TikTok and YouTube. Any information, communication or materials that are provided via a social media platform are also provided in accordance with the privacy policies of these platforms. The privacy policy is handled separately within each of the aforementioned platforms. 

3.8 Communication with our customer support or other questions. If you have contacted us by email or via the Contact form or on social media, then we process your personal data for the purpose of dealing with the enquiry. 

3.9 Withdrawal from the contract via the withdrawal button. We process your Personal Data for the purpose of enabling easy withdrawal from the purchase contract through an online form (button), thereby fulfilling our legal obligation.

3.10 Signing up for business communication (newsletter). If you sign up for our newsletter, we will send you interesting information and offers to promote our goods and services based on your consent. If you no longer wish to receive emails, then click on the unsubscribe link in the footer of each of our emails. 

3.11 Business communication to our customers (newsletter). We may send commercial communications on the basis of our legitimate interest to promote our goods and services to customers until they unsubscribe from receiving business messages. This is easily done by clicking the unsubscribe link in each of our e-mails. Based on our legitimate interest to promote our goods and services, we may also use the registered user's telephone number to distribute commercial communications by SMS. In this case, the user may unsubscribe from receiving SMS by sending a short message to the following e-mail address: [email protected]. You can object to the processing of your personal data on the basis of our legitimate interests at any time (see the section listing your rights for more details).

3.12 Chatbot. Our website features a chatbot available to Users, both as website visitors and as customers. The chatbot primarily processes your email address and order number to verify the status of your order. It may also process other personal data that you enter, provided that such processing is appropriate. We process personal data based on your consent, which you provide by entering your personal data into the chatbot. Please do not enter Special Categories of Personal Data into the chatbot, as this is neither necessary nor appropriate given its function.

3.13 Customer reviews. You can share your experience and rate individual items in the Reviews section of our website. We may use other processors to evaluate your feedback regarding individual purchased goods.

3.14 Payment by card. If you provide us with your credit card details, we do not have access to your full details. We only know that you are paying by card and the card details are processed by the recipients of these details who process the payment for us.

4 A SUMMARY OF THE REASONS AND PURPOSES FOR PROCESSING YOUR PERSONAL DATA

We understand that sometimes it is difficult for you to wade through the amount of text that covers how and why we process your Personal Data and where we obtain it. In order to provide you with a quick and clear overview of the basics of how we process your Personal Data, we have summarized everything in this table:

5 RELATED PARTIES AND JOINT CONTROLLERS

The Personal Data you provide is processed primarily by us as the controller, and we provide special training for the processing of Personal Data to all relevant employees and our other associates. We are also part of a group of companies that together form a holding company and share Personal Data within that holding company to the extent defined below. This is our parent company. These companies are therefore Joint Controllers of your Personal Data and they maintain the same level of security of Personal Data as we do.

The following companies are therefore Joint Controllers of Personal Data with us, and we are a Joint Controller with these companies of all Personal Data processed under this Policy:

Albatros Media a.s., ID No: 28377141, with registered office at 5. května 1746/22, Nusle, 140 00 Prague 4, entered in the Commercial Register kept at the Municipal Court in Prague, file B 14206.

All of these companies are Joint Controllers with us and process Personal Data in accordance with Article 26 of the GDPR. Accordingly, the Joint Controllers have a Joint Controllers Agreement between them, whereby the Joint Controllers of most Personal Data have one Joint Controllers Agreement with us and the other Joint Controllers Agreement with us is concluded with entities whose access to Personal Data is narrowly defined above.

You can exercise all the rights you have under applicable law (in particular GDPR) and this Personal Data Processing Policy with any of the companies listed above. Based on the Joint Controllers Agreement, the request will then be forwarded to the relevant company or our DPO. We publish all relevant GDPR information on our website.

6 WHAT MEASURES HAVE WE TAKEN TO PROTECT YOUR PERSONAL DATA?

6.1 Technical measures. We have adopted and undertaken to maintain appropriate technical measures, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing of Personal Data, as well as various probable and various serious risks to Users, in all areas where Personal Data is processed (in particular, website operation, E-shop operation, employee agenda, customer communication). The technical measures taken include:

6.1.1 regular backup of the User's data; 

6.1.2 updates to antivirus software systems; 

6.1.3 encrypted data on our servers;

6.1.4 access to our information system where Personal Data is processed is controlled on a per-user (employees) basis. 

6.2 Organizational measures. We have adopted and commit to maintain the following measures:

6.2.1 our employees who have access to Personal Data are bound by confidentiality; and

6.2.2 our employees are familiar with the rules of safe work with work equipment, including the principles of Personal Data protection.

7 WHEN DO WE TRANSFER YOUR PERSONAL DATA TO THIRD PARTIES?

Your Personal Data may be transferred to our business partners (Processors) or other third parties where required by law.

Processors. We only use verified Processors with whom we have a written contract and who provide us with at least the same guarantees as we provide to you. These are only Processors who are from the European Union, or from countries that have been declared and recognised as safe, or to countries with which we have standard contractual clauses in accordance with Article 46 of the GDPR, and who provide a comparable level of protection to your Personal Data as if the GDPR was applied. All such Processors are bound by our confidentiality obligations and may not use the Personal Data provided to them for any purpose other than that for which we have disclosed it in accordance with this Policy. We have listed the specific Processors above.

Legal obligations. We may disclose personal data to third parties outside the Processor if required to do so by law or in response to lawful requests by public authorities or at the request of a court in litigation.

8 WHAT RIGHTS DO YOU HAVE?

Where to contact us? By email to [email protected] or by post to our registered office. 

How fast do we respond? We will respond within one week at the latest. If providing the information would compromise the privacy of others, or if providing it would be disproportionate to the risks or costs of providing it, we may not be able to comply. We may need to verify your identity in order to better process your request.

9 FINAL PROVISIONS

This Privacy Policy may only be amended in writing. Users will be informed of this via our website.

If you have any questions about our Privacy Policy, please contact us at [email protected].

If you are dissatisfied, then you may at any time make a complaint or lodge a complaint with your relevant data protection authority, which can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en. 

This Privacy Policy is effective as of the date of 8.6.2026.