Löwenbooks

TERMS OF PERSONAL DATA PROTECTION AND PROCESSING

Löwenware s.r.o.

Company ID: 06203051

with its registered office at U Jezu 525/4, Liberec IV-Perštýn, 460 01 Liberec

registered in the Commercial Register kept by the Regional Court in Ústí nad Labem, Section C, Insert 39870

contact e-mail: books@lowenware.com

contact phone: +420 775 422 922

website: https://lowenbooks.cz/ (hereinafter the “Website”)

(hereinafter the “Controller”)

in the course of its activities administers and processes personal data of the data subjects listed below. These personal data processing principles (hereinafter the “Principles”) inform data subjects about the circumstances of the processing of their personal data and about the rights they have in relation to such processing.

  1. DATA SUBJECTS, PURPOSES, SCOPE, PERIOD AND LEGAL BASIS OF PROCESSING

A. USERS

The Controller processes users’ personal data for the following purposes, in the following scope, on the following legal basis and for the following periods:

a. Purpose: Providing performance to users in accordance with the user’s contract with the platform and the contract between users of the platform (conclusion of the contract, provision of digital content/service and handling of complaints).

Scope of data: First name, surname, e-mail address, telephone number, delivery address, and where applicable billing address, and where applicable company ID and registered office.

Legal basis: Necessity of processing personal data for the performance of a contract.

Period: For the period necessary for the performance of the contract and for the running of limitation periods.

b. Purpose: Maintaining a user account.

Scope of data: First name, surname, e-mail address, delivery address, telephone number.

Legal basis: Consent.

Period: From registration until deletion of the user’s account or until deletion of the account by the Controller due to the user’s inactivity (no earlier than 5 years after the user’s last login to the user account).

c. Purpose: Accounting and tax purposes and fulfilment of archiving obligations.

Scope of data: First name, surname, address.

Legal basis: Necessity of processing for compliance with legal obligations imposed on the Controller by law.

Period: For the necessary period of 10 years, unless legal regulations provide for longer periods.

d. Purpose: Sending commercial communications for marketing and advertising purposes.

Scope of data: First name, surname and e-mail address.

Legal basis: Consent.

Period: For a period that is necessary and proportionate, at the latest until withdrawal of consent.

e. Purpose: Sending unsolicited commercial communications.

Scope of data: First name, surname and e-mail address.

Legal basis: Legitimate interest (direct marketing).

Period: For a period that is necessary and proportionate.

B. WEBSITE VISITORS

The Controller processes cookies in relation to website visitors. More information about the processing of cookies on the website can be found here.

Cookies are text files containing a small amount of information that are downloaded to the mobile phone, computer or other device of the website visitor when visiting the website. On each subsequent visit to the website, the cookie files are then sent back to the website or to another page that recognises the cookies. Simply put — using cookies, the website stores information about the visit to the website.

The website uses various categories of cookie files for various purposes. Essential cookies are necessary for the basic functionality of the website. In other words, for the website to perform its basic function, the Controller cannot do without these cookies. The Controller may process essential cookies without the consent of the website visitor. The Controller may process all other cookies only with the consent of the website visitor, which the website visitor may withdraw (refuse) at any time in the cookie settings. However, withdrawal or non-granting of consent may affect browsing of the website.

C. PERSON WHO CONTACTS THE CONTROLLER

The Controller processes personal data of persons who contact the Controller by e-mail or telephone for the following purpose, in the following scope, on the following legal basis and for the following period:

a. Purpose: Answering enquiries of the enquiring person.

Scope of data: First name, surname, e-mail address, telephone number.

Legal basis: Legitimate interest in providing a response.

Period: Strictly necessary for answering the enquiry.

  1. VOLUNTARY NATURE OF PROVIDING DATA

The data subject provides the Controller with their personal data voluntarily. Failure to provide personal data may affect the Controller’s ability to conclude a contract or provide the data subject with performance that is based on necessary knowledge of information about the data subject, including personal data.

  1. RIGHT TO WITHDRAW CONSENT

If the processing of personal data is based on the data subject’s consent, the data subject may withdraw their consent to processing at any time by sending an electronic message to books@lowenware.com or via the link stated in the commercial communication. Withdrawal of consent does not affect the processing of personal data carried out by the Controller on another legal basis, in particular for the purpose of performing the user’s contract with the platform or the contract between users, providing the service, or processing that was based on consent until the moment of its withdrawal.

  1. PROCESSORS OF PERSONAL DATA

Processors of personal data:

  • payment method service providers — Stripe, LLC

Please note, however, that given the changing identity of providers of certain services, it is not possible to list all current and future processors of personal data by name. The list of processors above may therefore change over time.

The Controller does not transfer personal data to a third country (outside the EU) or to an international organisation.

  1. METHOD OF PROCESSING PERSONAL DATA

The Controller and, where applicable, its processors process personal data manually (in electronic form) and electronically by automated means.

  1. RIGHTS OF DATA SUBJECTS

The data subject has the following rights:

a) Right of access to personal data

The data subject has the right to obtain from the Controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the following information:

  1. the purposes of the processing of personal data;

  2. the categories of personal data concerned;

  3. the recipients or categories of recipient to whom the personal data have been or will be disclosed

  4. the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

  5. the existence of the right to request from the Controller rectification or erasure of personal data concerning the data subject or restriction of processing of personal data concerning the data subject or to object to such processing;

  6. the right to lodge a complaint with a supervisory authority;

  7. where the personal data are not collected from the data subject, any available information as to their source.

The data subject further has the right to request from the Controller a copy of the personal data undergoing processing, unless this adversely affects the rights and freedoms of others. For any further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

b) Right to rectification

The data subject has the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

c) Right to erasure (right to be “forgotten”)

The data subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay, and the Controller has the obligation to erase personal data without undue delay where one of the following grounds applies:

  1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

  2. the data subject withdraws consent on which the processing is based, and where there is no other legal ground for the processing;

  3. the data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing;

  4. the personal data have been unlawfully processed;

  5. the personal data have to be erased for compliance with a legal obligation in Union or Czech Republic law;

  6. the personal data have been collected in relation to the offer of information society services on the basis of consent given by a child.

d) Right to restriction of processing

The data subject has the right to obtain from the Controller restriction of processing where one of the following applies:

  1. the accuracy of the personal data is contested by the data subject, for a period enabling the Controller to verify the accuracy of the personal data;

  2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

  3. the Controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.

e) Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Controller, where:

  1. the processing is based on consent to the processing of personal data or on a contract with the data subject; and at the same time

  2. the processing is carried out by automated means.

In exercising their right to data portability, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible. The right to data portability shall not adversely affect the rights and freedoms of others.

f) Right to object

The data subject has the right to object to processing of personal data. If the data subject raises a justified objection to processing for direct marketing purposes or profiling, the personal data shall no longer be processed for such purposes.

The objection will be assessed and the Controller will then inform the data subject whether the objection was upheld and the Controller will no longer process the data, or that the objection was not justified and processing will continue. Pending resolution of the objection, processing will be restricted.

g) Right not to be subject to automated decision-making, including profiling

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling (i.e. any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to the data subject), which produces legal effects concerning them or similarly significantly affects them. This right shall not apply if the automated decision is necessary for entering into, or performance of, a contract between the data subject and the Controller or is based on the data subject’s explicit consent; in these cases, however, the data subject has the right to obtain human intervention on the part of the Controller, to express their point of view and to contest the automated decision.

h) Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint against the processing of their personal data by the Controller with the supervisory authority, which for the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7.

8. Final provisions

The Controller has not appointed a data protection officer.

The Controller is entitled to unilaterally amend these principles of personal data protection and processing.

These principles of personal data protection and processing take effect on 31.08.2026.