These personal data protection policies (hereinafter referred to as „Policies“) describe the method of acquiring, using, and further handling personal data obtained through the web interface https://megbrand.cz (hereinafter referred to as „web interface“).

These Policies are governed by the regulation of the European Parliament and Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as „Regulation“) and by Act No. 110/2019 Coll., on personal data processing (hereinafter referred to as „Act“).

The operator of the e-shop on the web interface https://megbrand.cz is:

1. M.E.G dream s.r.o., ID No. 04626168, VAT ID CZ04626168, with its registered office at Libušina 514/34, Karlovy Vary 360 01.

For the purposes of these Policies, the buyer is understood to be the person with whom a purchase contract is concluded for goods offered in the e-shop of the web interface.

1. The data controller in accordance with the Law is M.E.G dream s.r.o., ID No. 04626168, VAT ID CZ04626168, with its registered office at Libušina 514/34, Karlovy Vary 360 01 (hereinafter referred to as „Controller“);
2. The contact details of the controller are: email: info@megbrand.com, tel.: +420 774 444 104;
3. Personal data means all information that identifies or can identify a specific individual. Personal data particularly includes (but is not limited to):
   • identification data, such as name and surname, date of birth, identification number, tax identification number, username for the user account;
   • contact details, such as residential address (or delivery address), telephone number, email address;
   • electronic data, such as information obtained using cookies, IP address (network identifier) including the type of browser, device and operating system, the number and duration of accesses to the web interface, and other similar information,
   • other data that you provide to the Controller or that the Controller collects in connection with the processing of your order, or the conclusion and fulfillment of the purchase contract.
4. The Controller does not process any special categories of personal data as defined in Article 9 of the GDPR.
5. The legal basis for processing personal data is as follows:
   • consent of the data subject according to Article 6(1)(a) GDPR,
   • performance of the contract according to Article 6(1)(b) GDPR,
   • compliance with a legal obligation according to Article 6(1)(c) GDPR,
   • legitimate interest according to Article 6(1)(f) GDPR.
6. Providing personal data is a necessary requirement for the fulfillment of the purchase contract. Without providing personal data, the purchase contract cannot be concluded.

1. The administrator processes personal data provided by the buyer and obtained through the fulfillment of the purchase contract and processing of electronic orders on the web interface in the M.E.G Bio bachovky online store.
2. During the visit and use of the web interface, some personal data may be acquired and stored through cookies. Cookies are small text files that are sent from the web server to your browser and stored on your computer's hard drive. Most of the cookies we use are so-called 'session cookies'. They are automatically deleted after your visit. Other cookies remain on your computer and allow us to recognize your computer on your next visit (so-called 'persistent cookies'). Our web interface processes the following cookies:
   • Essential (technical) – are absolutely necessary for the proper functioning of websites. These cookies provide basic functions and security features of the websites, anonymously. These cookies cannot be turned off and do not require user consent;
   • Functional – help to perform certain functions, such as sharing website content on social media platforms, collecting feedback, and other third-party features;
   • Performance – used to understand and analyze key performance indicators of websites that help provide a better user experience for visitors;
   • Analytical – used to understand how visitors interact with websites. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.
3. Without your consent, the Administrator processes only necessary cookies, other categories of cookies are processed always only based on your explicit consent.

1. The controller processes personal data for the purpose of delivering goods, accounting for payments, and necessary communication between the contracting parties for the period required by specific legal regulations. Personal data will not be disclosed and will not be transferred to other countries.
2. The controller processes the personal data of the buyer for the following reasons:
   • for the purpose of registration on the website www.megbrand.cz;
   • for the purpose of sending commercial communications;
   • for the purpose of fulfilling rights and obligations arising from the contractual relationship between the buyer and the Controller;
   • for the purpose of fulfilling the Controller's legally established obligations (especially record-keeping, archiving tax documents, etc.);
   • for the purpose of ensuring the functioning of the websites.

1. The controller processes personal data to the extent necessary to achieve the specified purpose and only for the time necessary to achieve it, but no longer than the period specified by the relevant legal regulations and in compliance with them.
2. After the retention period of personal data has expired, the Controller is obliged to delete the personal data.

1. The third party receiving the personal data of the buyer are the subcontractors of the Controller. The services of these subcontractors are intrinsically linked to the successful fulfillment of the purchase contract and electronic order between the Controller and the buyer.
2. The personal data of the buyer will not be transferred to countries outside the European Union unless it is necessary for the fulfillment of the purchase contract or for another reason in accordance with the rules of such transfer established by the Law or Regulation.

• Zásilkovna s.r.o., ID No.: 28408306, located at Českomoravská 2408/1a, Libeň, 190 00 Prague 9 (delivery service);
• Google Analytics (website analytics);

1. Under the conditions set out in the Law, the buyer has the following rights:

Right of access to personal data

Upon request, the Controller will inform the customer whether it processes personal data concerning them and will provide it electronically, via email. In such a case, the customer has the right to request additional information according to Article 15 of the GDPR.

Right to rectification of personal data

The Controller shall promptly correct personal data if they are inaccurate or incomplete. The correction is made by the Controller immediately upon discovering the inaccuracy or incompleteness of the personal data.

Right to erasure of personal data

If there are no legal grounds for refusing to erase personal data, the Controller shall comply with the buyer's request.

Right to object to processing

The buyer has the right to object at any time to the processing of personal data if the Controller processes them for direct marketing purposes. In such a case, the Controller is obliged to stop processing the buyer's personal data for these purposes.

Right to data portability

The buyer has the right to obtain personal data that they have provided to the Controller, in a structured, commonly used, and machine-readable format, and to transfer them to another personal data controller.

Right to withdraw consent to the processing of personal data

The buyer has the right to withdraw consent given to the Controller for the processing of his personal data, either in writing or electronically at the email address: info@megbrand.com. If the buyer has consented to the sending of commercial communications, this consent can be withdrawn in the manner stated in each email containing the commercial communication (by clicking on the unsubscribe link or in another way).

Withdrawing consent does not affect the legality of data processing carried out before the withdrawal of consent to processing.

Right to restrict processing

The buyer can request the Controller to restrict the processing of his personal data if:

• the buyer disputes the accuracy of his personal data;
• the processing is unlawful and the buyer requests the restriction of the processing of personal data instead of their erasure;
• the Controller no longer needs the personal data for processing purposes, but the buyer requires them for the establishment, exercise, or defense of legal claims;
• the buyer has objected to processing.

When processing is restricted, the Controller is authorized to store the buyer's personal data only; further processing is possible only with the consent of the buyer or for legal reasons.

If the processing of personal data is restricted due to an objection to processing, the restriction lasts for the time necessary to determine whether the Controller is obliged to comply with the buyer's objection.

If the processing of personal data is restricted due to a dispute over the accuracy of the data, the restriction lasts for the duration of the verification of the accuracy of the data.

Right to lodge a complaint with the Data Protection Authority

If the buyer believes that their right to personal data protection has been violated, they have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection.

1. The Controller declares that all appropriate technical and organizational measures necessary to secure the buyer's personal data have been taken.
2. The Controller has implemented technical measures to secure the data storage of personal data, in particular, securing computer access with a password, using antivirus software, and regular computer maintenance.

1. By submitting an electronic order on the website www.megbrand.cz, the buyer confirms that they have been informed of these Policies and that they accept them in their entirety.
2. The Controller is entitled to change these Policies at any time. The new version of the Policies will be published by the Controller on the web interface.