Protection of personal data on Heureka portal

Personal data protection on Heureka Group a.s. portals

Our company Heureka Group a.s., with its registered office at Karolinská 706/3, 186 00, Prague 8 – Karlín, Company ID: 078 22 774, entered in the Commercial Register kept by the Municipal Court in Prague, Section B, Insert 24131, pays great attention to the protection of personal data. In this document Personal Data Protection on Heureka Group as portals, you will find information about how we process your personal data in connection with the functioning of our online portals, mobile applications and in carrying out our other activities.

For the purposes of this document, when we refer to “portals”, it means not only our web portals that we operate , but also our mobile applications or other communication channels.

This document does not apply to the processing of personal data of merchants (i.e. operators of partner online stores, business partners, etc.), which is addressed in a separate document Protection of Personal Data of Merchants.

1. General information on the processing of personal data

This Article 1 applies to all processing of your personal data by us.

1.1. What legal regulations do we follow when processing personal data?

We process your personal data in accordance with the legal regulations in force and effective in the Czech Republic, in particular Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the so-called General Data Protection Regulation, hereinafter referred to as "GDPR"), Act No. 110/2019 Coll. on the processing of personal data and other related legal regulations.

1.2. What is meant by processing of personal data?

We process your personal data when we perform any operation on your personal data (such as collection, recording, organization, structuring, storage, use, disclosure, restriction, erasure or destruction). We process your personal data primarily in electronic form by automated means, in some cases they may also be processed manually. When processing your personal data, we comply with the necessary organizational and technical measures to protect personal data.

Personal data is any information we have about you as an identified or identifiable natural person, whether we have obtained it from you or obtained it in another lawful manner (typically if it has been provided to us by another entity).

1.3. What personal data do we process?

We process your personal data, i.e. the personal data of our customers, users of our online portals and services, and in some cases also customers of our partner online stores.

We collect and process your personal data primarily in connection with the provision of our services and other activities as further described in this document. If you do not provide us with your personal data that is necessary to provide one of our services, we cannot provide you with the relevant service, unless otherwise stated.

An overview of your personal data that we process can always be found for individual types of processing in Article 2 of this document.

1.4. Why and on what legal grounds do we process personal data?

We process your personal data in different situations, for different purposes and on different legal bases, depending on which services you use, as described in detail in Article 2 of this document.

An overview of the purposes of processing your personal data can always be found for individual types of processing in Article 2 of this document.

We always process your personal data on the basis of one or more of the following legal grounds:

if it is necessary for the preparation and performance of a contract concluded between you and us,
if you have given us consent to the processing,
if it is necessary for the fulfillment of our legal obligations (e.g. obligations arising from Act No. 563/1991 Coll. on Accounting, Act No. 235/2004 Coll., on Value Added Tax), and/or
if necessary for the purposes of our legitimate interest (e.g. for the purposes of protecting our legal interests and exercising claims in the event of the initiation of judicial, administrative or other proceedings).

1.5. What is our position when processing personal data and to whom do we transfer your personal data?

Our position, which differs with respect to the type of personal data processing, as further defined in Article 2 of this document may be as follows:

In most cases, we process your personal data as a personal data controller (hereinafter referred to as the "controller"), as we determine the purposes and means of their processing.
In some cases, we process your personal data together with another controller and are thus joint controllers, as we determine the purposes and means of their processing together with another controller (or other controllers).
In some cases, we process your personal data as a personal data processor (hereinafter referred to as the “processor”) if we process it for another entity, which is the controller and which gives us instructions for the processing in question.

Unless otherwise expressly stated in this document, we process your personal data as a personal data controller.

We may transfer your personal data to other entities, so-called recipients, in particular for the purpose of carrying out processing for us (in the case of processors), together with us (in the case of joint controllers) or regardless of our processing (i.e. in the case of separate controllers). These are in particular the following categories of recipients:

our processors:
- providers of internal communication and project services,
- Customer relationship management software providers,
- cloud storage providers,
- providers of data management and analysis tools,
- providers of tools for managing and recording telephone calls,
- service providers for sending e-mail messages (in particular commercial communications or confirmation of order creation),
- questionnaire service providers,
- providers of communication tools intended for communication with customers,
- contractual partners who process data through cookies and other similar technologies,
- and other suppliers who provide services to us, in particular to ensure the provision of our services.
Our processors process your personal data only on our instructions and for our purposes.
joint administrators:

partner online stores within the scope of conversion measurement (a specific store is always the store whose website you clicked through from our portal). c) independent administrators:
providers of payment gateways and other payment methods,
contractual partners who process data through cookies and other similar technologies,
partner online stores,
providers of legal and tax advice,
other entities, if this is necessary for the fulfillment of a legal obligation to which we are subject (especially if a control or other similar activity is performed by public authorities).

The list of individual recipients is listed here , which is updated at regular intervals.

As we are part of the Heureka Group, your personal data may be transferred and processed by other companies belonging to this group for the purpose of providing the requested services and fulfilling contracts, fulfilling legal obligations or protecting our legitimate interests (in particular, debt collection and litigation). Our company may act in this cooperation as a controller, joint controller or processor, always with regard to the specific method and purpose of processing. Other members of the Heureka Group are:

DATAWEPS services sro, Company ID: 026 02 059, with registered office at Nováčkova 401/53, Husovice, 614 00 Brno, Czech Republic,
Balíkobot , sro, Company ID: 062 83 799, with registered office at Karolinská 706/3, 186 00 Prague 8 – Karlín, Czech Republic,
Heureka FinCo CZ as, Company ID: 085 55 931, with registered office at Karolinská 706/3, Karlín, 186 00 Prague 8, Czech Republic,
Heureka FinCo SK as, ID number: 52 689 948, with registered office at Dunajská 4, Bratislava – municipal part of Staré Mesto 811 08, Slovak Republic,
Online Comparison Shopping Kft., identification number 01-09-186759, with registered office at Rákóczi út 70-72, H-1074 Budapest, Republic of Hungary,
HEUREKA GROUP RO srl., identification number J40/22748/2023, with registered office in Bucharest Sectorul 2, Bulevardul Dimitrie Pompeiu, Nr. 9–9A , Iride Business Park, Cladirea 14 ,
BIROUL RESCO-WORK14, Bucharest, Republic of Romania,

Price doo., identification number 6699421000, with its registered office at Dunajska cesta 155, 1000 Ljubljana, Republic of Slovenia,
sMind doo., identification number HR69167525631, Street city Vukovara 269D, 10000 Zagreb, Republic of Croatia.

Your personal data is processed by our employees and other suppliers and partners who comply with the terms of personal data protection and are obliged to maintain confidentiality.

1.6. How can you contact us regarding the processing of personal data?

For any questions, complaints or requests related to the processing of your personal data (including submitting a request to exercise your rights, objections, etc.), please do not hesitate to contact us at [email protected].

You can also contact our Data Protection Officer at [email protected].

1.7. Do we transfer your personal data to third countries or international organizations?

We do not transfer your personal data to third countries (i.e. countries that are not part of the European Economic Area) or international organizations, unless otherwise stated in this document.

If your personal data is to be transferred to a third country (see the list of recipients according to Article 1.5 of this document) or to an international organization, this will occur in accordance with Article 44 et seq. of the GDPR only if:

The European Commission has decided that the third country ensures an adequate level of protection of personal data, or
appropriate safeguards are provided, in particular by means of standard contractual clauses on the protection of personal data approved by the European Commission, supplemented where appropriate by other additional measures, or by means of other appropriate safeguards, provided that enforceable rights of data subjects and effective legal protection of data subjects are available.

1.8. What rights do you have in relation to the processing of personal data?

In connection with the processing of your personal data, you have the following rights, which you can exercise by sending a request to [email protected]:

Right to access personal data

You have the right to obtain information about whether we are processing your personal data, and if so, you also have the right to obtain information about what data we process about you, for what purpose, in what manner, for what planned period, where or from whom we obtain your personal data, to whom we transfer it, and other information related to the processing of your personal data.

If we process your personal data, you have the right to access this personal data by requesting a copy (extract) of the processed personal data. We will provide you with a copy of your personal data free of charge. and without undue delay, no later than one month from the receipt of your request. In exceptional cases, in particular due to the complexity of your request, we are entitled to extend this period by 2 months, and we will inform you of such an extension and its justification.

Right to withdraw consent to the processing of personal data

If we process your personal data based on your consent (in the cases defined in art. 2 of this document), you have the right to withdraw your consent at any time free of charge. We will not process your data further after receiving your withdrawal of consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Even if you withdraw your consent, we are entitled to continue processing your personal data if there is another legal reason for processing it.

Right to correction

If you find that the personal data we process about you is inaccurate or incomplete, you have the right to have it corrected or completed, taking into account the purposes of the processing.

Right to erasure ("right to be forgotten")

In some cases, you have the right to have your personal data erased. We will erase your personal data without undue delay if one of the following reasons applies:

1. We no longer need your personal data for the purposes for which we processed it,
2. you withdraw your consent to the processing of personal data, which is data for which your consent is necessary, and we have no other legal reason why we need to continue to process this data,
3. you exercise your right to object to processing (see Article 1.8(g) of this document) for personal data that we process based on our legitimate interests and we find that we no longer have any legitimate interests that would justify such processing,
4. you believe that our processing of personal data is not in accordance with legal regulations, or
5. whether there is or has been a legal obligation for us to delete the personal data in question.

However, please note that even if one of these reasons applies, this does not mean that we will immediately delete all of your personal data. This right does not apply if the processing of your personal data is still necessary for compliance with our legal obligation or legitimate interest for the establishment, exercise or defence of our legal claims.

Right to restriction of processing

You have the right to request that we restrict the processing of your personal data. This right allows you to request in certain cases that your personal data be marked as such and that it not be subject to any further processing operations – in this case, however, not forever (as in the case of the right to erasure), but for a limited period of time. We will restrict the processing of your personal data if:

1. you dispute the accuracy of your personal data before we verify what data is correct,
2. We process your personal data without sufficient legal basis, but you will prefer only to restrict its use rather than delete such data (e.g. if you expect that you would provide us with such data anyway in the future),
3. We no longer need your personal data for the purposes of the processing referred to in Article 2 of this document , but you require them for the establishment, exercise or defence of your legal claims, or
4. you object to the processing (for this right, see Article 1.8(g) of this document below) before we assess whether your objection is justified.

Right to data portability

You have the right to obtain from us all your personal data that you have provided to us and that we process based on your consent or based on the performance of a contract, and you also have the right to request that we transfer it to another controller.

This right to data portability can only be exercised for personal data that we process automatically in electronic databases. We will provide your personal data to you or to a designated second controller in a structured, commonly used and machine-readable format.

Right to object to processing

You have the right to object to the processing of personal data based on a legitimate interest pursued by us or a third party, including the right to object to related profiling (see Article 2.9(d) of this document).

If it concerns direct marketing activities and any related profiling, we will stop processing your personal data without further action; in other cases, we will do so unless we have compelling legitimate grounds for continuing such processing.

Right to file a complaint

The exercise of your rights does not affect your right to file a query or complaint with the relevant supervisory authority. You can exercise this right in particular if you believe that we are processing your personal data in violation of legal regulations. You can file a complaint with the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7.

All requests for the exercise of the above rights, including the performance of actions related to them, are provided and made free of charge. Only in the event that your requests for information pursuant to Articles 13 to 22 of the GDPR are repeated, we may charge a reasonable fee due to the administrative costs incurred by us in handling your request. Alternatively, if your requests pursuant to Articles 13 to 22 of the GDPR are manifestly unfounded or disproportionate, we have the right to either request you to pay a reasonable fee or we have the right to refuse to comply with such requests.

What are the consequences of not providing your personal data?

If you do not provide the required personal data, it would not be possible to conclude and fulfill the contract for the use of our portals and provide you with the services that our portals offer.

2. Types of personal data processing

This Article 2 regulates the conditions of individual types of processing of your personal data.

2.1. Registration on our portals

Personal data processed

If you register with us, we process the following personal data:

identification data (in particular, first and last name, date of birth, username, password and its hash),
contact details (in particular telephone number, e-mail address, delivery and billing address),
user account settings (especially favorite products, product price monitoring, product comparison, newsletter settings, setting notifications for responses in forums or advice centers, setting notifications for new reviews, saved payment card details),
data about your orders on Heureka Marketplace (including orders you place with your email address before creating a user account, if you ask us to pair them with your user account),
data about your reviews and their content, which relate to the ratings you have given of products or online stores (including reviews that you provide with your email address before creating a user account, if you ask us to pair them with your user account),
other content you have entered (in particular, posts you have entered in the advisory room, information about your shopping preferences).

Legal basis and purpose of processing personal data

We process the above personal data for the purpose of fulfilling the contract for the use of our portal concluded with you, which arises upon completion of your registration, for the purpose of maintaining your user account and providing functionalities associated with it, in particular the automatic recording of your orders, reviews, ratings and other contributions and storing the history of delivery and billing addresses and storing payment card details in cases pursuant to Article 2.6 letter A) paragraph II of this document.

We also process the above personal data based on our legitimate interests , which are:

improving our services by obtaining information on the basis of which we will be able to improve our services for you in the future so that you can shop with us even better (in particular by assessing your satisfaction with our services),
implementing direct marketing (providing tailored offers) and related communication,
recording and monitoring the proper provision of our services,
checking your use of our services to ensure compliance with the terms and conditions,
protecting our legal interests and exercising claims.

We also process the above personal data for the purposes of fulfilling our legal obligations.

We process your user account settings and information about your shopping preferences based on your consent for the purposes of simplifying your use of our portals, testing new functions and applications of our portal before their deployment, and sending personalized marketing communications (see Article 2.9 letter D) of this document).

Processing time

For the above purposes, we use your personal data for a period of 4 years from the last login to your user account, unless otherwise stated in this document.

For the purposes of protecting our legal interests and exercising claims, we may, in justified cases, process your personal data for the duration of the applicable limitation periods increased by 1 year (with regard to claims asserted at the end of the limitation period). In the event of the initiation of judicial, administrative, criminal or other proceedings, we process your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of any limitation period after their conclusion. When processing personal data based on our legitimate interest, you have the right to object to this processing (see Article 1.8 letter g) of this document).

In cases where some of the above personal data is processed for the purposes of fulfilling our legal obligations We are obliged to process your personal data for the period specified by the relevant legal regulation.

2.2. Communication with you

Personal data processed

If you communicate with us through various channels (in particular through the customer center, email, chat tools and social networks), we process the following personal data to enable us to contact you:

identification data (in particular, first and last name, user data on social networks, IP address and other identifiers),
contact details (especially telephone number, e-mail address),
data about the use of our services,
records of communication (including records of telephone calls or voice recordings provided by you),
any other information that you provide to us as part of your communication.

Legal basis and purpose of processing personal data

We process the above personal data for the purpose of fulfilling the contract for the use of our portal concluded with you, or another contract concluded with you, if communication is necessary for the performance of this contract, or to take measures prior to concluding this contract at your request.

We also process the above personal data based on our legitimate interests , which are:

proper handling of your requests,
records of your requests so that we can check that we are fulfilling them properly and on time,
proof that we have received and processed your request,
protecting our legal interests and exercising claims.

We also process the above personal data for the purposes of fulfilling our legal obligations. obligation , if there is a legal obligation to process information contained in or related to our communication.

We also process the above personal data based on your consent (for example, if you contact us without creating a user account or in cases not related to a purchase made through our portals).

Processing time

For the above purposes, we process your personal data for a period of 4 years from the date of our communication has occurred. If the limitation period in a given case is longer than 3 years, then we process your personal data for a longer period, namely for the duration of the relevant limitation period increased by 1 year (taking into account claims asserted at the end of the limitation period).

In the event of the initiation of judicial, administrative, criminal or other proceedings, we process your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of any limitation period after their conclusion.

When processing personal data based on our legitimate interest, you have the right to object to this processing (see Article 1.8 letter g) of this document).

2.3. Reporting illegal content

Personal data processed

If you use our contact form available in the footer of the Heureka portal under the title "Report illegal content " to report illegal content that you have encountered on our portals, we process your following personal data:

first and last name,
email address,
other data communicated to us as part of the description of the illegal content or attached attachments,
date and method of notification of illegal content and other accompanying information.

Legal basis and purpose of processing personal data

We process the above personal data based on the fulfillment of our legal obligations. obligations under Regulation (EU) 2022/2065 on the Single Market for Digital Services (the so-called Digital Services Regulation). We use your personal data for this purpose only for the period necessary to process and handle your notification and take appropriate measures, but at least for the period required by the relevant legal regulation.

We may also process the above personal data for the purposes of legitimate interests , which are:

protecting our legal interests and exercising claims,
our internal records and control of proper compliance with our legal obligations.

Processing time

We process personal data processed on the basis of fulfilling our legal obligations for the period necessary to process and handle your notification and take appropriate measures, but at least for the period required by the relevant legal regulation.

For the purposes of legitimate interest, we process your personal data for a longer period in justified cases, namely for the duration of the relevant limitation periods increased by 1 year (with regard to claims asserted at the end of the limitation period). In the event of the initiation of judicial, administrative, criminal or other proceedings, we process your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of any limitation period after their termination.

When processing personal data based on our legitimate interest, you have the right to object to this processing (see Article 1.8(g) of this document).

2.4. Inserting user content

Personal data processed

If you post a contribution to our portal, a product review or a partner online store, or use another functionality of our portal that allows the publication of user content, outside of the Verified by Customers program (for this program, see specifically Article 2.8 of this document), we process your following personal data:

identification data (especially name, surname),
contact details (especially email address),
Content you submit for publication on our portal.

Legal basis, purpose and period of processing personal data

We process the above personal data for the following purposes:

publication on our portal (we only publish the content you submit and your name and surname, if you provide it when submitting your contribution),
maintaining the associated internal database,
verifying the authenticity of your post and detecting fraudulent posts (especially reviews),
sending messages with the aim of improving the quality of reviews and other similar user messages.

For these purposes, we process your personal data on the basis of:

our legitimate interests , which are in particular the interest in providing reliable information to the public about goods and online stores, keeping records of the content posted, processing your suggestions, protecting our legal interests and exercising claims, recording and monitoring the proper provision of our services, improving our services, or ● your consent , especially if you provide your name and surname in the post.

If you were logged into your user account on our portal at the time of submitting user content, the content will be assigned to your user account (for details on this processing, see Article 2.1 of this document).

If the user content you submit contains personal data of a third party (including any image of a person), copyrighted work or other legally protected content, you are solely responsible for ensuring that you are authorized to use such content in this way (in particular to publish it), in accordance with Articles 4.3.1 and 4.3.2 of the Terms of Use of the Heureka.cz shopping gallery .

We may use the user content you submit for statistical or commercial purposes, but always without identifying you as the provider of the content. However, this anonymization does not relieve you of liability for the content provided in this way (see above).

Processing time

We process your personal data for the duration of the legitimate interest or for the duration of the consent , unless otherwise stated in this document. We subsequently process your personal data in justified cases for the duration of the relevant limitation periods increased by 1 year (with regard to claims asserted at the end of the limitation period). In the event of the initiation of judicial, administrative, criminal or other proceedings, we process your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of any limitation period after their conclusion. When processing personal data based on our legitimate interest, you have the right to object to this processing (see Article 1.8 letter g) of this document).

2.5. Sending commercial communications and other information collection

Personal data processed

So that we can send you commercial communications, which means:

newsletters or similar marketing communication (especially information about promotions, news, competitions or events),
other commercial communications – for example, notifications about responses in forums and advice rooms on our portals, notifications about changes in product prices etc.,

We process your following personal data:

identification data (especially name, surname),
contact details (especially e-mail address and possibly telephone number),
information about whether you have responded to our commercial communication, in particular whether you have opened the commercial communication or whether you have opened the link contained in it (in which case we identify you through the unique identifier contained in the link),
and other personal data that you provide to us as part of business and marketing communication (e.g. in response to reviews or when actively participating in marketing events).

Since our service is mainly to provide a price comparison tool and an online marketplace, the commercial communications sent relate not only to our services and goods, but also contain information about offers of goods or services from third parties (our partners). In some limited cases, commercial communications may also be sponsored. Commercial communications may therefore contain offers of goods and services from third parties in the following estimated proportion: 36% home and garden, 26% household appliances, 19% other electronics, 8% building materials, 6% children's goods, 4% pet supplies, 1% other; however, the estimated proportions may vary depending on the season and other factors. For more information about cooperation with third parties in sending commercial communications and providing their current list, a request can be submitted to [email protected].

Legal basis and purpose of processing personal data

1. Sending commercial communications to our customers

If you are our customer, i.e. if you have already used our services, in particular if you have used our Heureka Marketplace service or if you have registered on our portal and created a user account, and in connection with this we have obtained your personal data, we process the above-mentioned personal data on the basis of our legitimate interests , which are the implementation of direct marketing (in particular informing about our latest offers and providing tailored offers). When processing personal data on the basis of our legitimate interest, you have the right to object to this processing (see Article 1.8 letter g) of this document) or cancel the sending of commercial communications using the procedure specified in

Article 2.5, letter C) of this document. If you have a user account with us, you can also change the settings for sending commercial communications directly in your user account.

1. Sending commercial communications if you have subscribed/subscribed

If you have actively and voluntarily subscribed to some of our commercial communications, we process the above-mentioned personal data based on your consent. We process information about the consent granted, which is the date and time of subscription to commercial communications and the IP address of your device. If you do not consent, we will not use your personal data for these purposes. You can withdraw your consent at any time free of charge by following the procedure set out in Article 2.5, letter D) of this document.

Personalized business messages

In order to improve the quality and relevance of commercial communications, we may tailor commercial communications to you based on your interests and purchasing preferences. Such processing is only possible with your consent. In such a case, we may tailor the content of commercial communications to:

data that you have in your user account (see Article 2.1 of this document) or that is assigned to your user account (see Article 2.9 letter D) of this document), and
data obtained using marketing cookies if you have given us consent to use cookies for marketing purposes (see Article 2.9 letter D) of this document).

You can withdraw your consent to the personalization of commercial communications at any time by sending a request to [email protected]. Please note that in the case of some commercial communications, withdrawing your consent to personalization will also mean the end of sending the given commercial communications. You will always be notified of this.

Processing time

For the above purposes, we use your personal data for the period of consent or for the duration of our legitimate interest. If you no longer wish to receive relevant commercial communications from us, you have the option to request the cancellation of their sending at any time and free of charge, in one of the following ways:

by the procedure specified in each commercial communication sent (using the link in the footer of the commercial communication),
by changing the user account settings, if the user account allows this and if you have set up this user account,
by contacting us for this purpose by e-mail at [email protected].

Please note that due to the technical settings of the commercial communication mailing, there may be a delay between the withdrawal of consent or the sending of a request to cancel the sending of commercial communications and the recording of this action in our systems, and therefore it may happen that the commercial communication in question may still be sent to you in the meantime. In such a case, we ask for your understanding.

Based on our legal obligation, after you withdraw your consent or unsubscribe from receiving commercial communications, we may store your email address, or telephone number, and the date of withdrawal of consent or unsubscribe in a list of unsubscribed persons to ensure that we no longer send you any commercial communications (so-called Robinson list). For this purpose, we retain the above data for an unlimited period of time.

For the purposes of protecting our legal interests and exercising claims, we may, in justified cases, process your personal data based on our legitimate interest for a longer period, namely for the duration of the relevant limitation periods increased by 1 year (with regard to claims asserted at the end of the limitation period). In the event of the initiation of judicial, administrative, criminal or other proceedings, we process your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of any limitation period after their conclusion. When processing personal data based on our legitimate interest, you have the right to object to this processing (see Art. 1.8 letter g) of this document.

2.6. Heureka Marketplace

Within our online marketplace Heureka Marketplace, you can order goods from partner online stores through our portal in accordance with paragraph 1.3.5 of the Terms of Use of the Heureka.cz shopping gallery. and in accordance with the Terms of Use of Heureka Marketplace .

Personal data processed, legal basis and purpose of processing personal data, specific processing times
1. Processing as a processor personal data

Our company is a processor within Heureka Marketplace for partner online stores that are involved in the Heureka Marketplace program and process your personal data as administrators within the program. For this purpose, the partner online store concludes a processing agreement with us in accordance with Article 28(3) of the GDPR and as amended by Article 10 of the Heureka Marketplace Terms of Use .

If you order goods from a partner online store through Heureka Marketplace, the partner online store will provide us with the following personal data:

information about the order and purchased goods,
identification data,
contact details,
information about payment for purchased goods (i.e. abbreviated payment card number displaying the first 6 and last 4 digits, name or title of the payment card owner, IP address, purchase price or other amount paid),
and other additional information in connection with orders placed through Heureka Marketplace in relation to partner online stores, so that, on behalf of and on behalf of the partner online store:
collected this data, administered it and passed it on to the partner online store so that it could process your order and deliver the ordered goods to you,
kept transaction records for the partner online store,
communicate with the payment gateway operator Adyen and possibly other affected entities in the event that you have complained about payment for purchased goods in accordance with Article 8.4 Terms of Use Heureka Marketplace (i.e. in the case of resolving so-called chargebacks), or in other cases according to your instructions.

We process your personal data for the duration of the Heureka Marketplace cooperation agreement concluded between us and the partner online store. If the agreement with the partner online store for the provision of Heureka Marketplace services is terminated, we process your personal data for a reasonable period of time to implement the termination and settle the obligations with the partner online store.

1. Processing in the capacity of a controller personal data

Our company is an administrator within the Heureka Marketplace in the cases listed below.

If you place an order through Heureka Marketplace, we process the following personal data:

data on orders on Heureka Marketplace to the extent specified in Article 2.6 letter A) paragraph I. of this document,

based on the performance of the contract for the use of our portal (use of the Heureka Marketplace service) with you, in particular for the purpose of properly creating an order, keeping records of orders, communicating with you about the status of the order and other related purposes (for example, resolving a claim from the applied guarantee of reimbursement of the purchase price and returning goods within the meaning of Article 4 Terms of Use of Heureka Marketplace ) . We process this data for the period necessary to process the order or your request and for the period during which the rights and obligations under the contract for the use of the portal last (including the period during which the guarantee of reimbursement of the purchase price and return of goods can be applied within the meaning of Article 4 Terms of Use Heureka Marketplace ) .

If you have registered on our portal and created a user account, the following is your personal data:

data on orders on Heureka Marketplace in the scope according toArticle 2.6 letter A) paragraph

This document and

payment card details, if you save them as part of your user account settings, so that we can speed up the process of ordering and paying for goods purchased through Heureka Marketplace,

stored in your user account based on the performance of the contract for the use of our portal (user account management) concluded with you (for more details, see Article 2.1 of this document regarding the user account). If you use the option to store your payment card number in your user account, your full payment card number will be stored with the payment method provider, Adyen NV, as a separate administrator (for Adyen, see art. 2.7 of this document). We do not have access to the full (unshortened) number of your payment card, as we only store the last few digits of your payment card within your user account. However, in connection with the use of the payment card stored in this way, we use your identification data to verify your identity with Adyen so that you do not have to enter the payment card number again during your next purchase.

We may also process the above personal data in justified cases based on our legitimate interests , which are:

improving our services in the future to make your shopping experience with us even better (in particular by measuring your satisfaction with our services),
implementing direct marketing (providing tailored offers) and related communication,
recording and monitoring the proper provision of our services,
checking your use of our services to ensure compliance with the terms and conditions,
protecting our legal interests and exercising claims.

Based on our legitimate interests, we may, in justified cases, process your personal data for a longer period of time, for the duration of the relevant limitation periods increased by 1 year (with regard to claims asserted at the end of the limitation period). In the event of the initiation of judicial, administrative, criminal or other proceedings, we process your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of any limitation period after their conclusion. When processing personal data based on our legitimate interests, you have the right to object to this processing (see Article 1.8 letter g) of this document).

We may also process the above personal data for the purposes of fulfilling our legal obligations , for the period specified by the relevant legal regulation.

2.7. Payment method providers

When making payments for goods ordered from a partner online store via the Heureka Marketplace service, our company does not act as a controller or processor. The controller is the partner online store from which you order goods via the Heureka Marketplace, while the payment service provider acts as a processor for the partner online store, or as a separate controller, as described in more detail below.

I. Adyen as a processor for a partner online store

To pay for the goods you have ordered from the partner online store, you can use the payment service provided by Adyen NV, with its registered office at Simon Carmiggeltstraat 6-50, 1011 DJ, Amsterdam, the Netherlands. The Adyen payment service is offered by the partner online store as a possible payment method for cashless payment for the goods ordered via the Heureka Marketplace. Adyen provides payment services based on an instruction to make a payment from the partner online store and keeps records of transactions for the partner online store. Furthermore, Adyen ensures the security of the payments for the partner online store.

For the above purposes, Adyen processes the following personal data of you as a processor for the partner online store:

identification data (name, surname, IP address or other identifier),
contact details (email address, telephone number, delivery address),
payment details and related information,
information about the order and purchased goods.

Adyen obtains the above personal data directly from the partner online store, or from us as a processor for the partner online store.

In the event that you request a chargeback , we communicate with Adyen on behalf of and on behalf of the partner online store (i.e. we are in the position of processor for the partner online store) in order to resolve such request in accordance with Article 8.4. Terms of Use Heureka Marketplace .

We may also communicate with Adyen on behalf of and on behalf of the partner online store (i.e. we are in the position of processor for the partner online store) also in the case of detecting, preventing and monitoring possible fraud in connection with payment services.

We inform you that in the above cases, if we are in the position of a processor for a partner online store, the partner online store concludes a processing agreement with us for these purposes in accordance with Article 28(3) of the GDPR and as amended by Article 10 of the Heureka Marketplace Terms of Use .

II. Adyen as administrator

Adyen also acts as a separate controller within the scope of the processing, in particular for the fulfillment of its legal obligations, specifically in the cases specified in its privacy statement published by Adyen here: https://www.adyen.com/legal/data-processing-agreement .

Furthermore, Adyen acts as an independent administrator also if you use the option to save a payment card number in your user account according to Article 2.6, letter A) paragraph II of this document.

We inform you that if you have exercised your rights with us in the sense of Article 1.8 of this document regarding payment card data stored in your user account, and we assess that your request is directed at activities that are solely within the scope of Adyen, we may forward your request to Adyen for processing.

2.8. Customer Verified Program

As part of the Verified by Customers program, your satisfaction with partner online stores and goods purchased from partner online stores registered in the Verified by Customers program is assessed in accordance with Articles 8.1 and 8.2 of the General Terms and Conditions. You send your evaluation of purchased goods and evaluation of partner online stores (reviews) by completing satisfaction questionnaires. Satisfaction questionnaires are sent to you both in the form of standard forms and in the form of specific questions or the possibility of changing previously completed satisfaction questionnaires.

1. Personal data processed, legal basis and purpose of processing personal data, specific processing times
  1. Processing as a processor personal data

Our company is a processor within the framework of Verified Customers for partner online stores that are administrators within the framework of Verified Customers, in the cases specified in this Article 2.8 letter A) paragraph I of this document. For this reason, the partner online store concludes a processing agreement with us in accordance with Article 28 paragraph 3 of the GDPR and as amended by Article 8.8 General Terms and Conditions .

If you make a purchase at a partner online store that is involved in the Verified by Customers program and you have not refused to receive satisfaction surveys from the partner online store or have not subsequently requested to cancel their sending in the manner described below, the partner online store will provide us with the following personal data:

email address,
information about the purchased goods,

to create and send you satisfaction questionnaires with purchases in the partner online store and with purchased goods and other related communications on his behalf and on his account.

If you have not refused to receive satisfaction questionnaires, but have changed your mind and no longer wish to receive them, you have the option to request cancellation of their sending at any time and free of charge from individual partner online stores, in one of the following ways:

For this purpose, contact the given partner online store via the designated e-mail or other contact specified by the partner online store in its terms and conditions, personal data processing policies or other similar document,
by the procedure specified in each satisfaction questionnaire sent to the given partner online store (i.e. by using the unsubscribe link in

footer of the given satisfaction questionnaire), or

However, please note that due to the technical settings of the mailing list, there may be a time delay between the receipt of your additional refusal to send satisfaction questionnaires and its recording in our systems, and therefore it may happen that a satisfaction questionnaire will still be sent to you in the meantime. In such a case, we ask for your understanding.

If you complete the satisfaction questionnaire we receive, we will collect your reviews for the partner online store and forward them to the partner online store. In these cases, we process your personal data based on the legitimate interest of the partner online store , which consists of obtaining feedback from customers on its services and goods. When processing personal data based on the legitimate interest of a partner online store, you have the right to object to this processing with the partner online store, which is the controller.

We process your personal data for as long as the partner online store is involved in the Verified by Customers program, unless otherwise stated below. If the contract with the partner online store for the provision of services under the Verified by Customers program is terminated, we process your personal data for a reasonable period of time to implement the termination and settle the obligations with the partner online store.

Based on the fulfillment of legal obligations of partner online stores in the Verified by Customers program, we also maintain a list of e-mail addresses for the partner online store that have refused to receive satisfaction questionnaires sent on behalf of the given partner online store (the so-called opt - out list), in order to prevent the sending of commercial communications by this partner online store. For this purpose, the partner online store stores, through the list maintained by us, the e-mail addresses of customers who have refused to receive its satisfaction questionnaires for an unlimited period of time (or until the partner online store or customer informs us that the customer who previously refused to receive satisfaction questionnaires has again given consent to receive satisfaction questionnaires).

1. 1. 1. Processing in the capacity of a controller

Our company is a controller in connection with customer reviews under the Verified by Customers program , in cases where: referred to in this Article 2.8, letter A) paragraph II of this document.

From the date of completion of the satisfaction questionnaire, we process your personal data listed below:

email address,
name or nickname, if you have filled it in,
or other personal data that you yourself provided as part of the review,
information about purchased goods, for the following purposes:

a) publishing your review on our portal and maintaining the associated internal review database, verifying the authenticity of your review and detecting fraudulent reviews and sending communications with the aim of improving the quality of reviews and other similar communications - for these purposes, we process your personal data (i) on the basis of our legitimate interest , which consists in providing the public with trustworthy information about online stores and goods, for the period specified in Article 2.8 letter B) of this document (or unless legal regulations require a different retention period), and you have the right to object to this processing of personal data (see art. 1.8 letter g) of this document), or (ii) based on your consent in the case of publishing non-anonymous reviews (see more below) for an unlimited period of time (or until you withdraw your consent, or until you delete your personal data from the review, if technically possible, or until you ask us to delete it

your personal data from the review);

b) sending communications related to reviews provided, to which you have voluntarily subscribed - for these purposes, we process your personal data based on your consent , and we send you such communications for a period of 4 years from the date you subscribed to receive these communications (Article 2.5 of this document applies mutatis mutandis to the sending of these communications).

If it is useful to verify the authenticity of your review, or in the event of suspicion of a fraudulent review and to perform related actions, we may request additional information from the partner online store, in particular:

other identification data,
other contact details,
additional information about the order of goods,

We process this data for the period necessary to assess the authenticity of the review, but for a maximum of 6 months from the provision of this additional data. For these purposes, we process your additional personal data on the basis of our legitimate interest , which consists in providing trustworthy information to the public about online stores and goods, or on another legal basis. When processing personal data based on our legitimate interest, you have the right to object to this processing (see Article 1.8 letter g) of this document).

We publish your reviews from completed satisfaction questionnaires on our portal in one of the following modes:

You can fill out the satisfaction questionnaire and send it to us for publication in anonymous form on our portal, or
If you decide to fill in your first name, last name or nickname when filling out the satisfaction questionnaire, you hereby give us your consent to publish this identification data on our portal along with your review.

If you use personal data of third parties (including any image of a person) in your review, you are solely responsible for ensuring that you are authorized to use such personal data in this way, in accordance with Article 4.3.2 of the Terms of Use of the Heureka.cz shopping gallery .

We may also use the content of your review within the framework of completed satisfaction surveys for statistical or commercial purposes, however, always without identifying you as the provider of the content. However, this anonymization does not relieve you of responsibility for the content of your review (see above).

1. 1. General period of processing personal data

If not in Article 2.8 letter A) of this document, unless otherwise stated in specific cases, we process your personal data for the above purposes for a period of 6 months from the date on which the partner online store provided us with your personal data.

After this period, if you have completed the satisfaction questionnaire, we process it for the purposes specified in Article 2.8 letter A) paragraph II of this document Your personal data for a maximum period of 4 years ; otherwise, we will delete your personal data after the 6-month period has expired. After the 4-year period, we will delete or anonymize your personal data, unless otherwise stated in Article 2.8 letter A) of this document.

Notwithstanding the above, we may, in justified cases, process your personal data for the duration of the relevant limitation periods increased by 1 year (with regard to claims asserted at the end of the limitation period) for the purpose of protecting our legal interests and claims. In the event of the initiation of judicial, administrative, criminal or other proceedings, we process your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of any limitation period after their conclusion. When processing personal data based on our legitimate interest, you have the right to object to this processing (see Article 1.8 letter g) of this document).

Notwithstanding the above, we may process your personal data for the purposes of fulfilling our legal obligations for the period specified by the relevant legal regulation.

2.9. Cookies and use of personal data of portal visitors

If you visit our portal, we process data about your behavior on our portal and derived data through cookies and similar technologies for storing and reading data from your device.

A cookie is a small set of letters and numbers that we store in your Internet browser or on the hard drive of your computer, mobile phone or other device from which you view our portal. We also use web beacons , which allow us to detect that you have accessed certain content and obtain information about your device, but they are not stored in your browser for later reading. For simplicity, we will refer to all of these technologies in this document as cookies.

We use different types of cookies on our website. Some of them are stored directly on your device by our website, while others are stored and read by third-party tools that we use.

You can change your choices regarding the use of cookies and the processing of personal data on our portal in this Consent settings. K You can access the consent settings at any time via the link provided here, or via the "Consent Settings" link provided in the header of our portal. In the Consent Settings you will also find detailed information about the individual third-party cookies we use, including the specific purposes and scope of their use.

You can withdraw your consent to the storage of cookies and the processing of personal data obtained on their basis at any time by making a change in the Consent Settings.

Personal data processed (general): If you visit our portal, we may, under the conditions set out in this Article 2.9, process:

data about your behavior on our portal (in particular, the goods and services you view, the links you click on and which other websites you leave our portal to, the way you move around our portal and scroll the screen, as well as data about the device from which you view our portal, such as the IP address and the location derived from it, device identification, its technical parameters such as the operating system, its version, screen resolution, the browser used and its version, and other data obtained from cookies and similar technologies for device identification) (hereinafter referred to as "Data about your behavior"),
data about your behavior when reading messages that we send to you (in particular, the times when you open messages and also data about the device on which you read messages, such as the IP address and the location derived from it, device identification, its technical parameters such as the operating system, its version, screen resolution, the browser used and its version, and other data obtained from cookies and similar technologies) (hereinafter referred to as "Data about your behavior when reading messages"),
derived data, which is personal data derived from your settings, data about goods and services that you purchase through us, Data about your behavior and Data about your behavior when reading messages that we send to you (in particular, this includes data about your gender, age, financial situation, purchasing behavior and relationship to various goods and services) (hereinafter referred to as "Derived Data").

Processing time (general) : If you have given us your consent to use cookies or if we use cookies based on our legitimate interest, we use cookies and the personal data obtained from them for a maximum period of 12 months from the date of consent or the emergence of the legitimate interest.

Notwithstanding the above, in justified cases, for the purposes of protecting our legal interests and exercising claims, we may process your personal data for the duration of the applicable limitation periods increased by 1 year (with regard to claims asserted at the end of the limitation period). In the event of the initiation of judicial, administrative, criminal or other proceedings, we process your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of any limitation period after their termination.

When processing personal data based on our legitimate interest, you have the right to object to this processing (see Article 1.8 letter g) of this document).

Status of third parties involved in processing (general): We also use third-party tools (recipients) that use cookies to process data about website behavior. Some operators of these tools receive data from us as processors and some as independent controllers (or joint controllers). More detailed information about third parties can be found in Consent settings.

Exercising your rights : To exercise your rights regarding cookies, it is necessary to include your user ID and Didomi Token in your request. You can obtain this information in the Consent Settings by clicking on the Show our partners button and then on the Show user information button.

The individual conditions for processing personal data obtained based on cookies and similar technologies are listed below with regard to the specifics of individual types of processing.

1. 1. 1. Necessary cookies and basic functionality and security of the portal

Purpose of processing: Necessary (technical) cookies and the personal data we collect with them ensure that our portal functions properly, so that you can contact us via an online form, so that we can record that you have given us your consent, or so that we can identify you when you move between individual pages of the website, for example, so that your pending order is not deleted. These cookies and the data collected also serve to prevent attacks on our portal and threats to its functionality and the security of your data. Such cookies are necessary for the functioning of our portal, and therefore we do not need your consent to store and read them.

Legal basis for processing: We process personal data for this purpose based on our legitimate interest in ensuring the functionality of our services for you and the security of your data.

We inform you that when processing personal data based on our legitimate interest, you have the right to object to this processing (see Article 1.8 letter g) of this document).

1. 1. 1. Traffic measurement and user behavior analysis

Purpose of processing: Analytical and statistical cookies enable us to analyse how our website works in terms of visitor behaviour, specifically to measure traffic and analyse user behaviour, gain insights into visitor types and develop our products. We use these cookies to adapt and improve our website, for example to show you products you have already viewed or to show you other tailored offers. We may also use your geographical location data if you give us your consent to use this data. These cookies and the data we collect also help us to show you different versions of our website when we test new features.

Legal basis for processing personal data: We process personal data based on your consent granted in the Consent Settings.

1. 1. 1. Conversion measurement

Personal data processed and purpose of processing: As part of conversion measurement, we obtain data about your behavior on our portal and on our partner online stores that advertise and offer their goods and services on our portal based on stored cookies.

The information obtained in this way includes, in particular, information about the goods and services that you viewed on our portal; information about your clicks from our portal to the websites of partner online stores; information about your orders and ordered goods and services; information about your other activities on our portal or on the websites of partner online stores.

The aim of data processing within the framework of conversion measurement is to create statistical, pricing, marketing and other reports and documents for further activities and development of our portal and partner online stores. When processing data within the framework of conversion measurement, automated processing of personal data may occur for the purpose of predicting the development of purchases, website traffic, the success of marketing and business strategies, etc., with the result of such processing being mainly anonymized reports.

Legal basis for processing: We process personal data for the purpose of conversion measurement based on your consent given in the Consent settings. Consent to conversion measurement includes both (i) consent to the storage and use of cookies; and (ii) consent to the processing of your personal data obtained from the cookies, both by us and by partner online stores that you clicked on from our portal for the purpose of purchasing or viewing the goods and services you selected. This means that you grant your consent for conversion measurement only once, namely on our portal, and this consent is granted both for us and for the given partner online store.

Our position in the processing of personal data: Our company and partner online stores are joint controllers within the framework of conversion measurement, who cooperate and mutually transfer the necessary data in order to comply with all obligations arising from the relevant legal regulations regarding the processing of personal data. The primary contact for the exercise of your rights and freedoms in connection with the processing of personal data within the framework of conversion measurement is our company, however, you can also contact the relevant partner online store with a request to exercise them.

Transfer to third countries: Partner online stores may be located or have servers in other EU countries or outside the EU altogether. In such cases, we will take additional measures to ensure the appropriate security and processing of your personal data (see Article 1.7 of this document).

Processing period: As stated above, the processing of your personal data for conversion measurement purposes is carried out for a period of 12 months from the date of your consent. At the same time, the relevant cookies are deleted 30 days after their first installation.

1. 1. 1. Personalized advertising and content

Personal data processed and purpose of processing : We use marketing cookies and personal data that we obtain using marketing cookies or that you otherwise provide to us in this context (e.g. through questionnaires) to display or send you offers tailored to you (see Article 2.5, paragraph C) of this document). For this purpose, we process Data about your behavior on our portal (including Data about your behavior when reading messages), Derived Data and other data that you provide to us.

Legal basis for processing: We process personal data for marketing purposes based on your consent granted in the Consent Settings or by voluntarily sending or otherwise communicating your data.

Recipients: We may share your behavior on our portal with advertising and social networks so that we can display our tailored offers to you on third-party websites and social networks. If profiling is used (see details below), we may also share your personal data with partners who create profiles for us. You can find a list of our partners in the Consent Settings section.

Profiling : If you give us your consent, we may process your personal data using profiling and also associate it with the information in your user account. We carry out profiling in order to learn about your shopping preferences so that we can provide you with tailored offers – more information can also be found in the section on commercial communications, see Article 2.5 of this document.

We may also use profiling based on our legitimate interest to determine the segmentation of our customers (i.e. to identify customer groups according to various criteria) and, where appropriate, to carry out direct marketing. We inform you that when personal data is processed based on our legitimate interest, you have the right to object to this processing (see Article 1.8 letter g) of this document).

If you object to profiling related to direct marketing activities, we will stop processing your personal data without further action; in other cases, we will do so unless we have compelling legitimate grounds for continuing such processing.

Please note that for some commercial communications, withdrawing consent to personalization or profiling will also mean that you will no longer receive those commercial communications. You will always be notified of this.

2.10. User testing and research

Our company organizes and conducts user testing and research, which includes commercial research interviews (consultations) and questionnaires focused primarily on consumer behavior and marketing. For this reason, you may be shown an offer on our portal to voluntarily participate in our research panel, which serves as a database of those interested in conducting such research. The participation of participants in the research panel, who are consumers, and subsequent participation in specific research, including the conditions for processing personal data, is governed by separate Terms and Conditions for Participation in the Research Panel.

2.11. Competitions and awards

Our company organizes various competitions and awards, from one-time consumer competitions on our portal to long-established events and programs that honor the most popular and highest-quality e-shops and products, such as shoproku.cz, produktroku.cz a udrzitelnyeshop.cz.

The processing of personal data within the framework of these competitions or awards is governed primarily by their separate rules. Unless the rules of the competitions or awards provide otherwise, the principles of personal data processing set out in this document apply in a subsidiary manner.

3. Final part

We may unilaterally change this document, in particular due to changes in legal regulations or changes to our services and related changes regarding the processing of your personal data. If we make changes to this document, we will notify you in the form of an e-mail sent to your e-mail address, which we keep in the register of e-mail addresses of users of our portal or recipients of our other services to which this document applies. The notification will also include a new version of this document in. pdf format, or this document will be provided in another form enabling its textual form to be displayed and its simple archiving. We will always send you the notification in advance, usually 15 days before the date on which the new version of this document comes into effect.

This document is also available online at https://heureka.group/cz-en/terms-and-conditions/protection-of-personal-data-on-heureka-portal/

If you have any questions about the processing of your personal data, please do not hesitate to contact us at [email protected].

In the event of any discrepancies between the Czech and English versions of this document, the Czech version shall prevail.

This document is effective as of October 1, 2025.