Consent to the processing of personal data and information for the data subject.

GDPR

1. Personal data protection1.1. By submitting the form on https://www.guardian-angels-art.com/ and its subpages, the User confirms that they are familiar with the personal data protection terms, agrees to their wording, and accepts them in full.
1.2. The Provider is the controller of Users’ personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: “GDPR”). The Provider undertakes to process personal data in accordance with applicable law and the GDPR.
1.3. Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

1.4. To order services, personal data necessary for successful order processing are required (name and address, contact details). The purpose of processing personal data is to process the User’s order and to perform the rights and obligations arising from the contractual relationship between the Provider and the User. The purpose of processing personal data also includes sending notifications, marketing communications, and carrying out other marketing activities. The legal basis for processing personal data is performance of a contract under Article 6(1)(b) GDPR, compliance with the controller’s legal obligation under Article 6(1)(c) GDPR, and the Provider’s legitimate interest under Article 6(1)(f) GDPR. The Provider’s legitimate interest is the processing of personal data for the purpose of informing the User and direct marketing.

1.5. The Provider uses subcontractors to perform the licence agreement, such as a mailing service provider (personal data are stored in third countries outside the EU) and a web hosting provider. The involved third parties are vetted subcontractors and meet GDPR requirements.

1.6. The User’s stored personal data are kept in the Provider’s system for the period necessary to exercise the rights and obligations arising from the contractual relationship between the Provider and the User, for 15 years after the end of the contractual relationship. After this period, the data will be deleted.

1.7. The Provider does not carry out automated individual decision-making within the meaning of Article 22 GDPR.

1.8. By submitting the form to order services or by signing up in the news section on the Provider’s website, the User agrees to the use of their personal data for the purpose of electronically sending marketing communications, advertising materials, direct sales, market research, and direct product offers from the Provider and third parties, but no more than once per month, and at the same time declares that they do not consider these communications to be unsolicited advertising, because the User expressly agrees to receive information. The User may withdraw consent under this paragraph at any time in writing via the contact form or in the Operator’s system, or in the designated place (newsletter subscription).

1.9. To improve service quality, personalize offers, collect anonymous data, and for analytics purposes, the Provider uses so-called cookies on its website. By using the website, the User agrees to the use of this technology.

2. Rights and obligations of the Provider

2.1. In relation to clients’ personal data that the User has obtained through their own business activity, the Provider is the processor of such data.

2.2. These terms govern the mutual rights and obligations in the processing of personal data to which the Provider gained access in the performance of the licence agreement concluded by accepting the general terms and conditions at https://wexbo.com/terms/ (hereinafter the “licence agreement”) concluded with the User.

2.3. The Provider undertakes to process, for Users, personal data for the purpose of providing the system https://www.guardian-angels-art.com/ under a licence agreement, which the User obtained in connection with their own business activity. The processing of personal data is automated. As part of the processing, the Provider will collect these personal data, store them on data carriers, retain, block, and dispose of them, including through its contractual subcontractors. The Provider is not authorized to process personal data contrary to or beyond the scope of these terms.

2.4. The Provider undertakes to process personal data only at the Provider’s or its subcontractors’ workplaces, within the territory of the European Union.

2.5. The Provider undertakes to process, for the User, the User’s clients’ personal data for the period necessary to exercise the rights and obligations arising from the contractual relationship between the Provider and the User and from the enforcement of claims arising from these contractual relationships.

2.6. The Provider undertakes to inform the User of all planned changes concerning the engagement of additional processors or their replacement, and to give the User the opportunity to object to these changes.

2.7. The Provider undertakes to impose on its subcontractors, in the position of personal data processor, the same personal data protection obligations as set out in these terms.

2.8. The Provider undertakes that personal data are processed in accordance with applicable law and for the performance of all activities necessary to provide the Guardian-angels-art system under a licence agreement.

2.9. The Provider undertakes to ensure, through technical and organizational measures, the protection of processed personal data so that unauthorized or accidental access to the data, their alteration, destruction, or loss cannot occur; unauthorized transfers; other unauthorized processing; as well as other misuse, and to ensure that all obligations of the personal data processor arising from applicable law are continuously secured in terms of personnel and organization for the entire period of data processing.

2.10. The Provider undertakes that the adopted technical and organizational measures correspond to the level of risk. Through these measures, the Provider ensures the ongoing confidentiality, integrity, availability, and resilience of processing systems and services, and timely restores the availability of and access to personal data in the event of physical or technical incidents.

2.11. The Provider hereby declares that personal data protection is subject to the Provider’s internal security regulations. Access to personal data will therefore be granted only to authorized persons of the Provider and its subcontractors, under conditions and within the scope of data processing determined by the Provider, and each such person will access personal data under their unique identifier. Authorized persons of the Provider who process personal data under these terms are obliged to maintain confidentiality about personal data and about security measures, the disclosure of which would jeopardize their protection. The Provider will ensure that this obligation for the Provider and authorized persons continues even after the end of the employment or other relationship with the Provider.

2.12. The Provider will assist the User, through appropriate technical and organizational measures where possible, in fulfilling the User’s obligation to respond to requests to exercise the data subject’s rights under the GDPR; likewise, in ensuring compliance with obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to the Provider.

2.14. After the end of providing the performance associated with processing, the Provider is obliged to delete all personal data or return them to the User, unless the Provider is required to store personal data under a specific law.

2.15. The Provider will provide the User with all information necessary to demonstrate that the obligations under this agreement and the GDPR have been fulfilled, and will allow audits, including inspections, carried out by the User or another auditor authorized by the User.

2.16. The Operator reserves the right to change these terms.

3. Rights and obligations of the User

3.1. In relation to clients’ personal data that the User has obtained through their own business activity, the User is the controller of such data.

3.2. By submitting the form on https://www.guardian-angels-art.com/ and its subpages, the User confirms that they are familiar with the personal data protection terms, agrees to their wording, and accepts them in full.

3.3. The User grants permission to engage subcontractors as an additional processor, namely the hosting provider of the WEXBO® system. The User further grants the Provider general permission to engage another personal data processor in the processing.

3.4. The User has the right to request access from the Provider, rectification, or restriction of the processing of personal data. The User has the right to erasure of personal data that are not necessary for the performance of the contractual relationship and applicable laws. The User also has the right to object to processing and the right to data portability of the obtained data.

3.5. The User has the right to lodge a complaint with the Personal Data Protection Office if they believe their right to personal data protection has been violated.

3.6. The User is not obliged to provide personal data. However, providing personal data is a necessary requirement for concluding and performing the contract, and without providing personal data it is not possible to conclude the contractual relationship with the Provider or for the Provider to perform it.

3.7. The User undertakes to immediately declare all facts known to them that could adversely affect the proper and timely fulfilment of obligations arising from these terms, and to provide the Provider with the cooperation necessary to fulfil these terms.

Valid from 1 September 2018