1. introductory provisions, description of service

1.1. These Business Terms and Conditions for the “Verified by Customers” Program (hereinafter the “Verified by Customers TaC”) are issued by Heureka Group a.s., registered office: Karolinská 706/3, 186 00 Prague 8, business ID number: 07822774, tax ID number: CZ07822774, as the operator of the Heureka.cz and Heureka.sk portal, for the purpose of setting out rights and duties resulting from a contractual relationship between the Operator and Retailers included in the “Verified by Customers” service.

1.2. These Verified by Customers TaC are part of the Special Terms and Conditions for Use of Portal in accordance with Article 1.2.2. of the Terms and Conditions of Use of Heureka Portal, available at https://heureka.group/cz-en/terms-and-conditions/terms-and-conditions-of-use-of-heureka-portal/ (hereinafter the “Terms and Conditions”) and apply to the relationship between the Retailer and the Operator to the extent to which these Verified by Customers TaC do not provide otherwise. The interpretation of terms in accordance with Article 1.3. of the Terms and Conditions applies to these Verified by Customers TaC, unless these Verified by Customers TaC designate a different term and define its interpretation.

1.3. As part of the Portal, the Operator offers the “Verified by Customers” service (hereinafter the “Service”), consisting of the obtaining and processing of reactions from Retailers’ customers through automatic electronic communication, in the form of questionnaires sent to Retailers’ customers and completed by such customers (hereinafter the “Questionnaire”). For the purposes of these Verified by Customers TaC, customers shall be understood to mean persons that concluded a purchase contract or other similar contract with the Retailer through its E-shop or with a third party offering goods through the Retailer’s E-shop (this concerns Retailers registered at the Portal with an E-shop providing the online marketplace services), where it is not decisive whether they are also users of the Portal (hereinafter “Customers”).

1.4. The Operator provides the Service to Retailers that are registered on the Portal and send the Portal offers of their Goods and services in a manner in accordance with Article 3 of the Terms and Conditions and that conclude a contract on co-operation during the performance of the “Verified by Customers” service with the Operator in accordance with these Verified by Customers TaC.

1.5. These Verified by Customers TaC apply to the relationship between the Operator and the Customer concerning the provision and use of the Service, where they form an integral part of the Contract on Co-operation during Provision of the “Verified by Customers” Service concluded in accordance with Article 2 (hereinafter the “Contract”).

2. registration for use of service, conclusion and duration of contract

2.1. A Retailer that registers to use the Portal is entitled to register for the use of the Service using its user interface, for which access was created for the purposes of use of the Portal by the Operator at https://sluzby.heureka.cz. Registration and conclusion of a Contract for Use of the Service is conditional to the Retailer offering the buyer at least one off-line payment method (bank transfer, payment on delivery). The Retailer is required to meet this condition throughout the duration of the Contract.

2.2. As a part of the registration, the Retailer is familiarized with the text of these Verified by Customers TaC, with which it expresses its consent by ticking the checkbox. The sending of the registration, including accepting the text of the Verified by Customers TaC, is regarded as a proposal for the conclusion of a Contract. The Contract is concluded by the acceptance of a confirming e-mail, sent by the Operator to the Retailer at its e-mail address registered on the Portal.

2.3. The Contract is concluded for an indefinite term. The Contract can be terminated by notice, sent electronically by e-mail, with a notice term of one month. The Operator is entitled to terminate the Contract by withdrawing for reasons in accordance with these Verified by Customers TaC. The continuance of the Contract is conditional on the continuance of the contract on use of the Portal concluded between the Operator and the Retailer in accordance with Article 2.2.1. of the Terms and Conditions.

3. rights and duties of the retailer

3.1. The Retailer undertakes to place in the last stage of all Customers’ orders made in the Retailer’s E-shops, regardless of whether the order was made through the Portal or not, an application script through which the Customer’s e-mail address is sent together with, optionally, data about the purchased Goods in the Operator’s database (hereinafter the “Script”). The Script and its technical specifications are available to the Retailer online in its user interface at http://sluzby.heureka.cz. The last stage of the order is considered the moment the Customer creates the order in the Retailer’s E-shop. The Operator grants the Retailer, in accordance with Section 2358 et seq. of Act No. 89/2012 Coll., the Civil Code, authorization to use the Script as a part of the process of ordering Goods in the E-shop, solely for the purpose set by the Contract and for its duration.

3.2. The Retailer undertakes to enable all Customers to refuse the sending of commercial statements by the Retailer in accordance with Act No. 480/2004 Coll., on some information society services, before the sending of each individual order to the Retailer’s E-shop. The option of rejecting commercial statements will be offered actively and clearly by the Retailer to Customers at least on one of the pages that is part of the order process in the Retailer’s E-shop. Making use of the options offered must be enabled for Customers by clicking on a button, ticking or unticking a checkbox in a form or in another simple manner.

3.3. The Retailer is not entitled to hand over to the Operator through the Script the e-mail addresses of Customers that, at any time before the realization of the relevant order, expressed their non-consent to the sending of commercial statements from the Retailer in accordance with Act No. 480/2004 Coll., on Some Information Society Services, or who rescind such consent. The option of rejecting the further sending of Questionnaires is provided to a Customer by the Operator in each individual Questionnaire. The Retailer is obligated to inform the Operator of each non-consent of a Customer to the sending of commercial messages that it receives in a manner other than the use of the option of stating non-consent provided to a Customer in individual Questionnaires in accordance with the previous sentence. The Retailer is fully liable for damage that the Operator suffers in connection with a breach of duties in accordance with this paragraph.

3.4. In the event the Retailer enables Customers to reject commercial messages in accordance with par. 3.3 of these TaC, personal data is processed on the basis of the Retailer’s legitimate interest in accordance with Article 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “GDPR”) in relation to the Retailer sending a questionnaire; during which time such processing is not unreasonable interference with Customers’ Rights and Freedoms and therefore does not require consent to personal data processing.

3.4.1. Such legitimate interest consists of ascertaining the Customers’ satisfaction with a purchase from the Retailer. The fact that approaching Customers that bought goods or services from the Retailer with a direct communication is a legitimate interest of the Retailer is confirmed by recital 47 of the GDPR, which states that “The legitimate interests of a controller ... may provide a legal basis for processing ... where the data subject is a client or in the service of the controller ... The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”

3.4.2. When processing personal data as a part of the Verified by Customers program, the Retailer does not hand over personal data to a third party as a personal data controller. The Operator is the processor of personal data handed over by the Retailer and is authorized to perform such processing in accordance with par. 5.1.1. Further personal data processing by the Operator, as the controller of personal data, takes place only in relation to personal data a Customer provides to the Operator.

3.4.3. Personal data processing as a part of the Verified by Customers program by the Retailer therefore does not lead to an unreasonable negative impact on Customers - a Customer can reasonably expect his/her satisfaction with a purchase to be ascertained by the Retailer, in addition he/she is transparently informed of such a possibility in accordance with par. 3.5 of these TaC and has the option of rejecting it in accordance with par. 3.3 of these TaC; only a minimum quantity of personal data is handed over to the Operator, as a personal data processor, and the data is reasonably secured by the Operator and pseudo-anonymized after a short time. On the contrary, the processing of personal data as a part of the Verified by Customers program brings positive effects for a Customer in the form of an easy option for communication with the Retailer of any negative experience with shopping.

3.5. The Retailer is obligated to notify, through the terms and conditions for personal data processing, the business terms and conditions, the terms and conditions of use, purchase contracts or other suitable documents that deal with the Retailer’s relationship with Customers, the fact that their personal data is handed over to the Operator, as a personal data processor, for the purpose of generating Questionnaires, the collection of feedback and its assessment. In order to inform Customers, the Retailer will use the following or a similar formulation: “We ascertain your satisfaction with a purchase through e-mail questionnaires as a part of the Verified by Customers program, which our e-shop is involved in. We send them to you every time you buy something from us, unless you reject their sending in accordance with Section 7(3) of Act No. 480/2004 Coll. on Some Information Society Services. We perform personal data processing as a part of the sending of questionnaires in the Verified by Customers program based on our legitimate interest, which consists of ascertaining your satisfaction with purchases from us. For the sending of questionnaires, assessment of your feedback and analyses of our market position, we use a processor, which is the operator of the Heureka portal; we can hand information about purchased goods and your e-mail address over to it for these purposes. Your personal data is not handed over to any third party for its own purposes during the sending of e-mail questionnaires. You can make an objection to the sending of e-mail questionnaires as a part of the Verified by Customers program at any time by rejecting further questionnaires using the link in the e-mail with the questionnaire. In the event you have an objection, we will no longer send you questionnaires.”

3.6. The Retailer is not entitled, in any way, to interfere with the objectiveness and distort the truthfulness of the Questionnaires, in particular by influencing the selection of Customers to which a Questionnaire is to be sent, by having employees of the Retailer or persons it authorizes complete them or by encouraging Customers to give a positive assessment. The Retailer is also not entitled to punish a Customer in any way for sending a negative assessment, for example by offering less advantageous prices in comparison with other Customers, withdrawing from a concluded purchase contract, refusing the further sale of Goods or provision of services offered by the Retailer, etc. In the event the Retailer engages in such actions, the Operator is entitled to withdraw from the Contract or suspend the provision of the Service to the Retailer for the period necessary for a remedy. The provisions of this article do not have any influence on the Retailer’s right to an assessment of Customers in the manner enabled by the Operator.

3.7. The Retailer is obligated to promptly inform the Operator of any change to its details, input on the Portal in accordance with Article 4.4.8. of the General Business Terms and Conditions of Heureka for Retailers, available at https://heureka.group/cz-en/terms-and-conditions/general-business-terms-and-conditions-for-use-of-heureka-portal-for-retailers/, (hereinafter the “Business Terms and Conditions”), which also govern the procedure in the event of a change to the operator of the E-shop.

3.8. In the event the Retailer’s E-shop, based on Customer assessments, obtains a “Verified by Customers” certificate or another assessment issued by the Operator based on pre-set criteria published on the Portal, the Retailer is not entitled to place this certificate or other assessment on the website of another E-shop, even if it is operated by the same Retailer, if the certificate or assessment was not issued for it.

3.9. The Retailer is only entitled to use a “Verified by Customers” type of certificate or other rating issued by the Operator, on the basis of previously determined criteria published on the Portal, which were allocated to it by the Operator. In the event of termination of the Contract or loss of the “Verified by Customers” certificate, the Retailer is required to refrain from using the “Verified by Customers” certificate, including other types of rating, and undertakes to immediately remove such information from its E-shop website and from its advertising or promotional materials.

4. right and duties of the operator

4.1. The Operator is obligated to generate for the Retailer a Questionnaire for the purposes of its sending to Customers whose e-mail addresses were, using the Script, handed over to the Operator, in a manner so that it is possible to send them from the Retailer’s e-mail address within ten (10) days of their handover and then again within 45 days of the first sending, if the Customer does not reject further sending of Questionnaires to its e-mail address. The Operator is entitled to arrange the sending of Questionnaires to the Customer on the Retailer’s behalf.

4.2. The Operator shall:

4.2.1. Process completed Questionnaires and publish the resulting assessment in accordance with such Questionnaires on the Portal’s website, and send a copy of a completed Questionnaire to the Retailer;

4.2.2. Enable the Retailer to respond to each completed Questionnaire, a copy of which will be sent to it;

4.2.3. Arrange the technical operation of the Service, in particular its adequate availability;

4.2.4. Ensure the functionality of the Script;

4.2.5. Draw the Retailer’s attention to any negative reactions of its Customers in connection with the Service.

4.3. The Operator undertakes to maintain a list of the e-mail addresses of Customers that have refused the sending of Questionnaires through the link stated in a Questionnaire sent (hereinafter the “Opt-out List”). If a Customer, after making a purchase from the Retailer, receives a Questionnaire and, through the link in the Questionnaire, rejects the further sending of Questionnaires, the Operator undertakes to add this Customer’s e-mail address to the Opt-out List and ensure that Questionnaires are not sent to this address. The Retailer takes note that the Operator is not entitled to send Questionnaires to any addresses in the Opt-out List, which is joint for all Retailers with regard to the protection of Customers from unrequested commercial messages.

4.4. In the case of data about purchased goods handed over, the Operator will assess the permissibility of their processing, based on their inclusion in categories, for purposes in accordance with par. 5.1.1.2 and 5.1.1.3 of these TaC, before processing for these purposes. It will exclude from further processing data that could be the sensitive data of a Customer, in particular that could provide information about the Customer’s medical condition or sex life. The Operator is not liable for the unauthorized processing of data about goods purchased caused by mistaken inclusion in categories.

4.5. The Operator is entitled to process information about Goods purchased handed over using the Script, or other means used with the Retailer’s consent within the terms of the relevant supplementary service, for the purposes of their aggregation and the subsequent provision of additional services (data products) to Retailers, consisting of the provision of information about the Retailer’s position on the market in the relevant Goods, trends in sales in the category of Goods where the Retailer is active and sales of products in the relevant category of Goods. Additional services in accordance with this article can be charged independently and can be governed by special business terms and conditions. Data compiled and processed by the Operator within the meaning of this Article and provided within the terms of supplementary services only contain the identification data of the specific Goods, during which time they do not contain any data identifying the Retailer or Customers.

4.6. The Operator is entitled, in a suitable manner, to check the performance of the Retailer’s duties stipulated in Article 3 of these Verified by Customers TaC. During a check, the Operator is entitled, in particular, to perform verification of the content of the source code of the web interface of the Retailer’s E-shop and make Trial Orders in accordance with Article 5.10. of the Business Terms and Conditions on the Retailer’s E- shop.

4.7. The sum of the total amount of the compensation paid by the Operator for all breaches of the Contract will not exceed CZK 50,000. In the event of compensation for damage, there is no compensation for lost profit of the Retailer.

5. personal data protection

5.1. Conditions for Personal Data Processing

5.1.1. Performance by the Operator in accordance herewith includes personal data processing. The Retailer, in accordance with Article 28(3) of the GDPR, authorizes the Operator to process the personal data of Customers that the Retailer hands over to it, specifically:

5.1.1.1. Data about Goods purchased for the purpose of assessing whether it is possible to process them for purposes in accordance with par. 5.1.1.2 and 5.1.1.3 of these TaC;

5.1.1.2. The E-mail address and information about Goods purchased for the purposes of creating and sending Questionnaires, gathering completed questionnaires and handing over completed Questionnaires to the Retailer;

5.1.1.3. Data about Goods purchased for the purposes of processing in accordance with Article 4.5 of these Verified by Customers TaC.

5.1.2. The Operator is obligated to process personal data for the Retailer to the extent necessary to ensure performance in accordance with Article 2 of these Verified by Customers TaC and only based on instructions of the Retailer issued in these Verified by Customers TaC and the Contract or issued by e-mail or by telephone using the contact details stated at https://heureka.group/cz-en/about-us/contacts/.

5.1.3. The limitations in accordance with Article 5.1.2. of these Verified by Customers TaC apply also to the handover of personal data to third countries or an international organization and are applied unless the Operator is instructed by legal regulations to perform other processing; in such an event, the Operator will inform the Retailer of such a legal requirement before processing, unless legal regulations prevent such a provision of information for important reasons of public interest.

5.1.4. The Operator’s duty in accordance with Article 5.1.2. of these Verified by Customers TaC does not apply to personal data that the Operator does not obtain as a part of the processor’s activities in accordance herewith. Article 5.1.2. of these Verified by Customers TaC also does not affect the Operator’s authorization to independently process the personal data of Users of the Portal and Customers of the Retailer as a personal data controller, in particular for the following purposes:

5.1.4.1. Gathering and providing of information about individual completed Questionnaires for those Customers of the Retailer that are also Portal Users;

5.1.4.2. Publication of information obtained from completed Questionnaires based on the consent of the Retailer’s Customers and the verification of the authenticity of the information obtained;

5.1.4.3. Anonymization of the information obtained from completed Questionnaires and subsequent analysis and further processing of the data obtained.

5.1.5. Personal data processing by the Operator, as the controller, including processing of the Retailer’s personal data, is governed by the Special Terms and Conditions “Protection of Personal Data on Heureka Portal”.

5.1.6. Within 30 days of the termination of the Contract, the Operator will delete personal data processed based on these Verified by Customers TaC, unless legal regulations require the storing of the relevant personal data, or the Retailer calls on it, as of the moment of termination of the Contract, to hand a copy of the personal data over in writing. The Operator’s duty in accordance with this provision does not apply to personal data that the Operator did not obtain as a part of a processor’s activities in accordance with these Verified by Customers TaC and to personal data that the Operator processes independently, in the position of a personal data controller, in particular in the cases of processing in accordance with Article 5.1.4. of these Verified by Customers TaC or in other cases, if the Operator continues to be entitled to process personal data based on consent, legitimate interest or other legitimate grounds. In order to exclude doubts, the Operator is entitled, after the end of the Contract, to store as a personal data controller, in particular, pseudo-anonymized assessments of the Retailer by a Customer.

5.2. Security of Personal Data Processing

5.2.1. The Operator has adopted and will maintain reasonable technical and organizational measures so that unauthorized or accidental access to the personal data cannot occur, that it cannot be changed, destroyed or lost, to prevent unauthorized transfer, unauthorized processing of these personal data and any other misuse thereof.

5.2.2. In the event that the Operator, during the Contract’s effective period, learns of a breach of the security of personal data processed by the Operator based on this Contract, the Operator is obligated to report to the Retailer that there has been a breach of personal data security without undue delay after it learns of this. The Operator will make a report by notification to the Retailer’s e-mail address registered on the Portal. Subsequently, without undue delay after the moment the Operator learns of a case of breach of personal data security, the Operator is obligated to report to the Retailer, in the same way, a description of the nature of the relevant case of the breach of personal data security, including, if possible, the categories and the approximate number of affected data subjects, the categories, the approximate quantity of personal data records affected and a description of the probable consequences of the breach of personal data security.

5.3. Involvement of Third Parties in Personal Data Processing

5.3.1. The Operator undertakes that it will not involve other personal data processors in the processing of personal data obtained as a part of the Verified by Customers program.

5.4. Co-operation during Personal Data Processing

5.4.1. When dealing with requests for the exercise of rights by data subjects in relation to personal data that, based on this Contract, is processed by the Operator, the Retailer is responsible for this in full. If a request of a data subject concerning personal data processing in accordance with these Verified by Customers TaC is made to the Operator, the Operator will deal with this request; this does not apply if the Retailer’s co-operation is required to deal with the request or if dealing with the request would require unreasonable efforts by the Operator.

5.4.2. The Operator will enable the Retailer to perform an audit of technical and organizational measures introduced by the Operator to protect personal data after notification sent to the Operator’s data box at least 30 business days in advance. The Retailer is entitled to request the performance of an audit only on business days from 9 a.m. to 5 p.m. If the audit date proposed by the Retailer does not suit the Operator, the Operator is entitled to reject the proposed audit date and propose another date. The Operator will enable all audits for the Retailer in accordance with Article 5.4.3 of these Verified by Customers TaC. The costs of performance of an audit are borne by the Retailer.

5.4.3. The contracting parties undertake to provide each other with all necessary co-operation and source documents for the performance of their duties related to personal data processing in accordance with these Verified by Customers TaC, in particular when performing duties resulting for the Retailer from security for personal data processing, when performing audits, when assessing the influence on personal data protection, following prior consultation with the supervisory body and when performing applications for the exercise of data subjects’ rights. The Operator’s co-operation, with the exception of reasonable co-operation when dealing with requests for the exercise of data subjects’ rights in accordance with par. 5.4.1, is charged at an hourly rate of CZK 2900/hour excluding VAT. Invoicing and the payment of charges for the provision of co-operation is governed by Article 6.5. of the Business Terms and Conditions.

6. final provisions

6.1. Rights and duties not set out by these Verified by Customers TaC shall be governed by the Terms and Conditions and the Special Terms and Conditions to the extent to which they are not in conflict with these Verified by Customers TaC, as well as by generally binding legal regulations, in particular Act No. 89/2012 Coll., the Civil Code, and Act No. 480/2004 Coll. on Some Information Society Services.

6.2. From the moment of termination of the Contract, the Operator is not obligated to generate Questionnaires to send to Customers or to inform Retailers of the results of Questionnaires.

6.3. The rules for the making of unilateral amendments to these Verified by Customers TaC by the Operator are stipulated in Article 9.1. of the Terms and Conditions.

6.4. These Verified by Customers TaC come into effect on 20 April 2023.