Privacy policy

Information regarding the processing and protection of customers' personal data

Compliance with the information obligation prior to the processing of personal data within the meaning of Article 13 of the GDPR.

Legislation

Act No. 18/2018 on the protection of personal data and on amendments to certain acts
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "GDPR")

Identification of the personal data controller

The operator of the www.victoriana.eu portal is Fantasy Enterprises s.r.o., ID No.: 51 211 971, VAT ID: SK2120643690, with its registered office at Štefanovičova 18, Bratislava 811 04 (hereinafter referred to as "we" or "controller"), which processes your personal data as a controller, i.e. determines how personal data will be processed, for what purpose and for how long.

Rights of data subjects

According to Articles 15 to 22 of the GDPR and Sections 19 to 29 of the Personal Data Protection Act, the following

rights of data subjects apply:

Right of access to personal data

Every data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. Where the controller processes personal data concerning the data subject, the data subject has the right to obtain access to and further information on:

  • the purposes of the processing of personal data;
  • the category of personal data being processed;
  • the recipient in a third country or international organization, if possible; if the personal data is transferred to a third country or international organization;
  • the period for which the personal data will be stored; if this is not possible, information about the criteria used to determine this period;
  • the right to request the rectification of personal data, their erasure or restriction of their processing, or the right to object to the processing of personal data;
  • the right to lodge a proposal to initiate proceedings under Section 100 of the Personal Data Protection Act or to lodge a complaint under Article 15(f) of the GDPR;
  • the source of the personal data, if the personal data were not obtained from the data subject;
    the existence of automated individual decision-making, including profiling the transfer of personal data to third countries or to international organizations and the appropriate safeguards pursuant to Article 46 of the GDPR or Section 48 of the Personal Data Protection Act.

The controller is obliged to provide the data subject with copies of their personal data that are being processed. The controller may charge a reasonable fee corresponding to the administrative costs for repeated provision of copies of personal data. The controller is obliged to provide personal data in the manner requested.

Right to rectification of personal data

The data subject has the right to have the controller rectify inaccurate personal data concerning him or her without undue delay. Depending on the purpose of the processing of personal data, the data subject has the right to have incomplete personal data completed.

Right to erasure of personal data

The data subject has the right to have the controller erase personal data concerning them without undue delay under the conditions set out in Article 17 of the GDPR or Section 23 of the Personal Data Protection Act.

If the data subject requests the controller to erase their personal data, the controller is obliged to erase it in the following cases:

  • the personal data is no longer necessary for the purpose for which it was obtained or otherwise processed;
  • the data subject withdraws the consent on the basis of which the controller processes their personal data

and there is no other legal basis for the processing of personal data;

  • the data subject objects to the processing of personal data pursuant to Article 21(1) of the GDPR or Section 27(1) of the Personal Data Protection Act and there are no overriding legitimate grounds for the processing of personal data, or the data subject objects to the processing of personal data for direct marketing purposes, including profiling to the extent that it is related to direct marketing;
  • the personal data are unlawfully processed;
  • the reason for erasure is to comply with a legal obligation;
    personal data has been collected in relation to the offer of information society services pursuant to Article 8(1) of the GDPR or Section 15(1) of the Personal Data Protection Act.

If the controller has made the personal data of the data subject public and is obliged to erase it on the basis of the above conditions, it shall also have the obligation, taking into account available technology and cost, to inform other controllers who process the personal data to erase any links to, or copies or replications of, the personal data.

The controller is not obliged to erase the personal data of the data subject if they are necessary:

  • for exercising the right of freedom of expression or information;
    for compliance with a legal obligation or international treaty, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • for reasons of public interest in the area of public health;
  • for archiving purposes, scientific purposes, historical research purposes, or statistical purposes, if erasure is likely to render impossible or seriously impair
  • the achievement of the objectives of such processing;
  • for the establishment, exercise, or defense of legal claims.

Right to restriction of processing of personal data

The data subject has the right to have the controller restrict the processing of their personal data if:

  • they contest the accuracy of their personal data; the controller shall restrict the processing of such personal data for the period necessary to verify their accuracy;
  • the processing of personal data is unlawful and, instead of erasure, the data subject requests restriction of use;
  • the controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
  • the data subject objects to the processing of personal data; the controller shall restrict the processing of their personal data until it is verified whether the legitimate reasons on the part of the controller outweigh the legitimate reasons of the data subject.

If the processing of personal data has been restricted, the controller may, except for storage, process the personal data only with the consent of the data subject or for the purpose of exercising a legal claim, for the protection of the rights of another natural or legal person, or for reasons of public interest.

The controller is obliged to inform the data subject before the restriction on the processing of personal data is lifted.

Notification obligation in connection with the correction, deletion, or restriction of personal data processing:

The controller is obliged to notify the recipient (anyone to whom personal data has been provided) of the rectification of personal data, erasure of personal data or restriction of processing of personal data, unless this proves impossible or involves disproportionate effort.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format.

At the same time, they have the right to transfer this personal data to another controller, if technically possible

and if the processing of their personal data is carried out by automated means (i.e. electronically),

where the personal data is processed either:

  • on the basis of the consent of the data subject,
  • or is necessary for the performance of a contract to which the data subject is a party, or
  • for the implementation of measures prior to the conclusion of a contract at the request of the data subject.

This right shall not adversely affect the rights of others.

The right to portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to file a motion to initiate proceedings on personal data protection

If a citizen's rights under the Personal Data Protection Act are directly affected, they have the right under Section 100 of the Personal Data Protection Act to file a motion with the Slovak Data Protection Authority to initiate proceedings on personal data protection or a complaint under the GDPR. The purpose of the proceedings is to determine whether the rights of natural persons have been violated in the processing of their personal data or whether the law has been violated and, if deficiencies are found, to impose corrective measures or a fine for violation of the law, if justified and appropriate.

The Office publishes a template for the proposal on its website. The proposal to initiate proceedings must contain evidence to support the claims made in the proposal and a copy of the document or other evidence proving the exercise of the right with the controller (the right of access to personal data, the right to request the rectification of personal data, the right to erasure or restriction of processing of personal data, the right to object to the processing of personal data, the right to data portability), if the data subject has exercised such a right, or stating the reasons worthy of special consideration for not exercising the right in question.

Pursuant to Section 100(3) of the Personal Data Protection Act, the proposal in question must contain:

  1. a) the name, surname, mailing address, and signature of the proposer,
  2. b) the name, surname, permanent residence or name, registered office and identification number, if assigned, of the person against whom the proposal is directed,
  3. c) the subject matter of the proposal, specifying the rights that were allegedly violated in the processing of personal data,
  4. d) evidence in support of the claims made in the proposal,
  5. e) a copy of the document or other evidence proving the exercise of the right under Part II, Chapter II of this Act or a special regulation, if such a right has been exercised by the data subject, or a statement of reasons worthy of special consideration for not exercising the right in question, if the complaint was filed by the data subject.

The Office shall then decide on the applicant's proposal within 90 days of the date of commencement of the proceedings. In justified cases, the Office may extend this period appropriately, but by no more than 180 days. The Office shall inform the parties to the proceedings in writing of the extension of the period.

Right to object to the processing of personal data

The data subject has the right to object to the processing of their personal data on the grounds that the controller does not perform profiling or processes their personal data on the following legal bases:

  • the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • the processing of personal data is necessary for the purposes of the legitimate interests pursued by the controller or a third party.

The controller may not continue to process personal data unless it demonstrates compelling legitimate grounds for the processing which override the rights or interests or the grounds for the legal claim.

Everyone has the right to object to the processing of personal data concerning them for the purposes of direct marketing, including profiling to the extent that it is related to direct marketing.

If the data subject objects to the processing of personal data for direct marketing purposes, the controller shall no longer process the personal data for direct marketing purposes.

Furthermore, the data subject has the right to object to the processing of personal data concerning him or her on grounds relating to his or her particular situation, if the personal data are processed for scientific purposes, for historical research purposes or for statistical purposes, except where the processing of personal data is necessary for the performance of a task carried out for reasons of public interest.

Filling in the "Write to us" section

By filling in the information in the "Write to us" section, clicking to agree to the processing of personal data, and submitting the form, we collect your personal data in the form of your first name, last name, and email address so that we can communicate with you. We store the personal data you provide based on your consent.

Completing the registration when creating an account

By filling in the registration form, clicking to agree to the processing of personal data, and sending the form, we collect your personal data in the form of your email address (which may contain your personal data) so that we can communicate with you. We store the personal data you provide based on your consent. You can easily cancel your client account by logging into the client zone and clicking on the "delete account" option.

Account settings after logging into your account

By filling in your personal data in the "my account settings" section, we process your personal data in the scope of your first name, last name, email, billing address, and delivery address so that we can deliver the goods you have ordered without you having to fill in this information for each order.

Filling in the order form in the e-shop

By filling in the order form, clicking to agree to the processing of personal data, and sending the form, we collect your personal data in the scope of your first and last name, email address, telephone number, billing address, and delivery address so that we can deliver the goods you have ordered. We store the personal data you provide on the basis of your consent.

Participate in koloo, get a discount

By filling in your first name, last name, and email address and clicking to agree to the processing of personal data, we collect your personal data in the form of your first name, last name, and email address so that we can assign your discounts to your order.

Consent to the use of your email address for Meta and Google platforms

By providing your email address and checking the box to consent to the use of your personal data, you agree that Fantasy Enterprises s.r.o. may:

Upload your email address to Meta (Facebook, Instagram) and Google platforms for the purpose of pairing and targeted advertising.

Use this information to create personalized advertising campaigns on Meta and Google platforms.

What this means for you:

You may see more relevant ads from our company on Facebook, Instagram, and the Google advertising network (including YouTube and partner websites).

Your email address will only be used for matching purposes and will not be shared with third parties outside of the aforementioned platforms.

Your email address is processed securely and in accordance with strict personal data protection standards.

We will not share your email address with any other third parties except for the advertising platforms mentioned above.

Contact details for questions regarding the processing of personal data

If you have any questions regarding the protection of your personal data, please do not hesitate to contact us at info@victoriana.eu and we will respond to your questions within 7 days.

Withdrawal of consent to the processing of personal data

You have the right to withdraw your consent to the processing of your personal data at any time by sending a written notice to the email address: info@victoriana.eu. In such a case, we will delete your personal data within 15 days of receiving your withdrawal of consent to the processing of personal data.

Protection of your personal data

The controller declares that the processed personal data will not be transferred to a third country or international organization that does not guarantee an adequate level of personal data protection within the meaning of the GDPR and the Personal Data Protection Act.

Your personal data is processed in accordance with Section 13(1)(f) of the Personal Data Protection Act for a period of 5 years.

 

In Bratislava, on July 28, 2025