The commercial company INSTINKT Gaming essentials s.r.o., Company ID: 05611270, with its registered office at: Náměstí 40, 739 21 Paskov (hereinafter referred to as the “Controller”), manages and processes the personal data of its customers as part of its activities. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) informs data subjects about the circumstances of the processing of their personal data and about the rights they have in relation to this processing.

Purposes of Personal Data Processing

The Controller processes personal data for the following purposes:

1. To provide fulfillment to customers in accordance with the purchase contract;
2. The proper course and evaluation of events and competitions organized by the Controller, provided that the data subject has given consent to the processing of personal data for these purposes;
3. Sending commercial communications and for marketing and advertising purposes, provided that the data subject has given consent to the processing of personal data for these purposes;
4. Sending unsolicited commercial communications based on the legitimate interest of the Controller, which is direct marketing, in accordance with applicable law (especially Article 13 of the European Parliament and Council Directive 2002/58/EC and Section 7 of Act No. 480/2004 Coll. on Certain Services of the Information Society);
5. Contacting customers if the customer fills out a contact form.

Scope of Personal Data

The scope of personal data processed by the Controller varies depending on the purpose for which the processing is carried out.

1. For the purpose of fulfilling obligations under the purchase contract, the Controller processes personal data that is necessary for these purposes, namely: first name, last name, email and delivery address, phone number, or company name.
2. For the purpose of contacting the customer or transferring prizes from competitions, the Controller processes personal data that is necessary for these purposes and that will be provided by the customer. These may include, for example: first name, last name, email address, phone number, mailing address, age, or other data.
3. For sending commercial communications based on the legitimate interest of the Controller and/or for sending commercial communications for marketing and advertising purposes based on the consent given by the data subject, the Controller processes the following personal data: first name, last name, email address, or other data provided by the customer.
4. For contacting the customer based on their request through the contact form, the Controller processes the customer's first name, last name, and email.
5. In connection with customer movement on the website, the Controller also processes data such as IP address, time and duration of movement on the pages, location, country, etc.

Voluntary Provision of Personal Data

The data subject provides their personal data to the Controller voluntarily. However, not providing personal data may affect the Controller's ability to provide services to the data subject, which are based on the necessary knowledge of the data subject's information, including personal data.

Duration of Personal Data Processing

For the proper course of competitions, evaluation, and the transfer of prizes, the Controller processes personal data for the period necessary to fulfill this purpose.

For the purpose of sending commercial communications and for marketing and advertising purposes, the Controller processes personal data for a period that is necessary and appropriate for these purposes, but no longer than until the consent is revoked.

If the processing of personal data is based on the consent of the data subject, the data subject has the option to withdraw their consent to processing at any time by sending an electronic message to info@instinkt.gg or via the link provided in the commercial communication. The withdrawal of consent does not affect the processing of personal data carried out by the Controller on the basis of another legal title, especially for the purpose of fulfilling the purchase contract, providing services, or processing based on consent until the moment of its withdrawal.

Recipients of Personal Data

The Controller does not share personal data with anyone and does not provide it to any third parties. The recipients of personal data may only be the Processor(s) of the Controller who process personal data for the purposes stated above.

Processors of Personal Data:

• Packeta.com
• Gls-group.com
• PayPal.com
• ComGate Payments, a. s.
• GpWebpay.com

Methods of Processing Personal Data

The Controller and, if applicable, its Processors process personal data manually (in electronic form) and electronically through automated means.

Rights of the Data Subject

The data subject has the following rights:

a) Right of Access to Personal Data

The data subject has the right to obtain confirmation from the Controller as to whether personal data concerning them is being processed or not, and if so, they have the right to access such personal data and the following information:

1. Purposes of processing;
2. Categories of personal data concerned;
3. Recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly recipients in third countries or international organizations;
4. Planned duration for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
5. Existence of the right to request from the Controller rectification or erasure of personal data concerning the data subject or restriction of processing and to object to such processing;
6. Right to lodge a complaint with a supervisory authority;
7. All available information about the source of personal data, if it has not been obtained from the data subject.

The data subject also has the right to request a copy of the processed personal data from the Controller, unless this adversely affects the rights and freedoms of others. For additional copies at the request of the data subject, the Controller may charge a reasonable fee based on administrative costs. If the data subject submits the request in electronic form, the information will be provided in the commonly used electronic form unless the data subject requests another form.

b) Right to Rectification

The data subject has the right to have the Controller rectify inaccurate personal data concerning them without undue delay. Taking into account the purposes of processing, the data subject has the right to complete incomplete personal data, including by providing a supplementary statement.

c) Right to Erasure (Right to be Forgotten)

The data subject has the right to have the Controller erase personal data concerning them without undue delay, and the Controller is obliged to erase personal data without undue delay if one of the following grounds applies:

1. The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
2. The data subject withdraws consent on which the processing is based, and there is no other legal ground for the processing;
3. The data subject objects to the processing of personal data for direct marketing purposes;
4. The personal data have been unlawfully processed;
5. The personal data must be erased for compliance with a legal obligation in Union or Member State law;
6. The personal data were collected in relation to the offer of information society services based on the consent granted by a child.

d) Right to Restrict Processing

The data subject has the right to obtain from the Controller restriction of processing in any of the following cases:

1. The data subject contests the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
2. The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use;
3. The Controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise, or defense of legal claims.

e) Right to Data Portability

The data subject has the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller without hindrance from the Controller, where:

1. The processing is based on consent to the processing of personal data or on processing personal data for the purposes of entering into and performing a contract with the data subject; and at the same time
2. The processing is carried out by automated means.

In exercising the right to data portability, the data subject has the right to have their personal data transmitted directly from the Controller to another controller, where technically feasible. The right to data portability shall not adversely affect the rights and freedoms of others.

f) Right to Object

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling (i.e., any form of automated processing of personal data that consists of using personal data to evaluate certain personal aspects relating to the data subject), to the extent that it relates to such direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

g) Right not to be subject to automated decision-making, including profiling

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling (i.e., any form of automated processing of personal data that consists of using personal data to evaluate certain personal aspects relating to the data subject), which produces legal effects concerning them or similarly significantly affects them. This right shall not apply if the automated decision is necessary for entering into or performance of a contract between the data subject and the Controller or is based on the data subject's explicit consent; in such cases, the data subject shall have the right to obtain human intervention on the part of the Controller, to express their point of view, and to contest the automated decision.

h) Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint against the processing of their personal data by the Controller with a supervisory authority, which in the Czech Republic is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7.

Contact email of the Controller: info@instinkt.gg