Privacy Policy

I. General Provisions

1. The controller of personal data is P&S STAV Prešov s.r.o., Company Registration Number: 53 093 232, with its registered office at Chminianska Nová Ves 39, 082 33 Chminianska Nová Ves, Slovakia (hereinafter referred to as the “Controller”).

2. The Controller’s contact details are:

• Address: Chminianska Nová Ves 39, 082 33 Chminianska Nová Ves, Slovakia

• Email: gravirs.com@gmail.com

• Telephone: +421 918 546 265

3. This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (hereinafter referred to as the “GDPR”), and Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (hereinafter referred to as the “Act”).

4. Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

5. The Controller has not appointed a data protection officer. Questions concerning the processing and protection of personal data may be sent to gravirs.com@gmail.com or in writing to the Controller’s registered office.

II. Sources and Categories of Personal Data

1. The Controller processes personal data that you provide when:

• placing or completing an order,

• communicating with the Controller,

• requesting a quotation or a custom-made product,

• submitting an enquiry or complaint,

• subscribing to marketing communications,

• using the woodlaser.sk website.

2. The Controller may process the following categories of personal data:

• identification data, such as your name and surname or company details,

• contact data, such as your billing or delivery address, email address and telephone number,

• order and contractual data, including ordered products, selected options, customisation requirements and order history,

• payment, transaction and delivery information,

• information contained in your communication with the Controller,

• technical and online data, such as an IP address, browser or device information and cookie identifiers, where analytical or marketing tools are used.

3. The Controller may also receive personal data from payment service providers, delivery companies and other service providers involved in processing and fulfilling your order.

III. Legal Bases and Purposes of Processing

1. The Controller processes personal data on the following legal bases:

• performance of a contract or taking steps at your request before entering into a contract, in accordance with Article 6(1)(b) of the GDPR and Section 13(1)(b) of the Act,

• compliance with the Controller’s legal obligations, in accordance with Article 6(1)(c) of the GDPR and Section 13(1)(c) of the Act,

• the Controller’s legitimate interests, in accordance with Article 6(1)(f) of the GDPR and Section 13(1)(f) of the Act,

• your consent, where consent is required, in accordance with Article 6(1)(a) of the GDPR and Section 13(1)(a) of the Act.

2. Personal data is processed for the following purposes:

• processing and fulfilling your order,

• concluding and performing a purchase contract,

• producing customised or personalised products,

• arranging payment, delivery and communication concerning your order,

• handling enquiries, complaints, returns and warranty claims,

• complying with accounting, tax and other legal obligations,

• establishing, exercising or defending legal claims,

• protecting the website, customer accounts and the Controller’s property against misuse or fraud,

• sending information about similar products to existing customers where permitted by law,

• sending newsletters and other marketing communications based on consent where consent is required,

• measuring and improving the operation of the website where analytical tools are used.

3. Providing identification, contact, billing and delivery information necessary to complete an order is a contractual requirement. Without this information, the Controller may be unable to conclude or perform the contract and deliver the ordered products.

4. Where processing is based on the Controller’s legitimate interests, those interests include protecting legal claims, ensuring the security and proper operation of the online shop, providing customer service and promoting similar products to existing customers where permitted by law.

5. The Controller does not carry out automated individual decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

IV. Retention of Personal Data

1. The Controller retains personal data only for as long as necessary for the purpose for which it was collected, in particular:

• for the period necessary to process the order and perform the purchase contract,

• for the period during which rights and claims arising from the contractual relationship may be exercised or defended,

• for the retention periods required by accounting, tax and other applicable legislation,

• until consent is withdrawn where processing is based on consent,

• for marketing purposes based on consent, no longer than five years from the date consent was given,

• for direct marketing based on legitimate interests, until you object to such processing or the legitimate interest ceases to exist,

• for technical and analytical data, for the periods specified in the applicable cookie settings or information.

2. After the applicable retention period has expired, the Controller will securely delete or anonymise the personal data unless further retention is required or permitted by law.

V. Recipients of Personal Data

1. Personal data may be disclosed, to the extent necessary, to:

• delivery and transport companies,

• payment service providers and financial institutions,

• providers of online shop, hosting and IT services, including Shoptet,

• accounting, tax, legal and advisory service providers,

• providers of analytical, advertising and marketing services,

• public authorities and other authorised persons where disclosure is required by law.

2. These recipients process personal data only to the extent necessary to provide their services or comply with their legal obligations.

3. In connection with the use of information technology, cloud, analytical or marketing services, particularly services provided by Google or Meta Platforms, certain personal data may be processed outside the European Economic Area.

4. Any transfer of personal data outside the European Economic Area will take place only where the requirements of the GDPR are satisfied, particularly on the basis of:

• an adequacy decision adopted by the European Commission,

• standard contractual clauses approved by the European Commission,

• or another legally permitted transfer mechanism.

VI. Your Rights

1. Under the conditions set out in the GDPR and the Act, you have the right to:

• obtain confirmation as to whether your personal data is being processed and request access to it,

• request the correction of inaccurate or incomplete personal data,

• request the erasure of personal data,

• request the restriction of processing,

• receive personal data concerning you in a structured, commonly used and machine-readable format and request its transfer to another controller where the legal conditions are met,

• object to processing based on legitimate interests,

• object at any time to the processing of personal data for direct marketing purposes,

• withdraw your consent at any time where processing is based on consent.

2. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

3. You may exercise your rights:

• by email at gravirs.com@gmail.com,

• or in writing at P&S STAV Prešov s.r.o., Chminianska Nová Ves 39, 082 33 Chminianska Nová Ves, Slovakia.

4. To protect your personal data, the Controller may request reasonable verification of your identity before responding to your request.

5. If you believe that your personal data has been processed unlawfully or that your data protection rights have been infringed, you have the right to lodge a complaint or submit a request to initiate proceedings with:

Office for Personal Data Protection of the Slovak Republic
Galvaniho 7/B
821 04 Bratislava
Slovakia
Website: https://dataprotection.gov.sk/

VII. Personal Data Security

1. The Controller has adopted appropriate technical and organisational measures to protect personal data, taking into account the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of natural persons.

2. Electronic and paper records containing personal data are protected in particular through:

• protection of user accounts and devices with access passwords,

• restriction of access to personal data to authorised persons,

• regular updating of software and devices,

• use of appropriate security and antivirus tools,

• secure transmission of data through encrypted HTTPS connections,

• appropriate backup of electronic data,

• storage of paper documents in secured or lockable premises,

• secure deletion of electronic data and destruction of unnecessary paper documents,

• appropriate instructions and training for persons authorised to process personal data.

3. Only persons authorised by the Controller have access to personal data. These persons are required to maintain confidentiality and process personal data only to the extent necessary to perform their duties.

4. The Controller regularly reviews the security measures and updates them where necessary.

VIII. Final Provisions

1. By submitting an order through the online order form, you confirm that you have been informed about the processing of your personal data and have had the opportunity to read this Privacy Policy.

2. Acceptance of this Privacy Policy is not a condition of processing where personal data is processed for the performance of a contract, compliance with a legal obligation or another legal basis provided by the GDPR.

3. Where consent is required for optional marketing, analytical cookies or another optional purpose, it will be requested separately. Providing consent is voluntary, and you may withdraw it at any time.

4. The Controller may amend this Privacy Policy. The current version will always be published on the woodlaser.sk website. Where appropriate or required by law, affected persons will also be informed of material changes by email or another suitable method.

5. This Privacy Policy is effective from 8 September 2026.