1. Introductory Provisions
1.1 The company:
Business name: BONNDI s.r.o.
Registered office: P. O. Hviezdoslava 2306/36, 955 01 Topoľčany, Slovak Republic
Company ID (IČO): 51 449 676
Registered in: the Commercial Register of the District Court Nitra, Section Sro, Insert No. 45219/N
Tel.: +421 949 864 765
E-mail: info@bonndi.eu
(hereinafter the “Controller” or the “Company”) hereby provides information on the manner and scope of processing your personal data, including the rights related to such processing (hereinafter the “Policy”).
1.2 We fully respect everyone’s right to privacy and the protection of personal data. We have adopted technical, organisational, and personnel measures in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, hereinafter “GDPR”) and with Act No. 18/2018 Coll. on the Protection of Personal Data, as amended (hereinafter the “Personal Data Protection Act”).
1.3 The Controller operates the website www.bonndi.eu, through which it offers its products.
1.4 The Controller obtains, stores, and uses (and otherwise processes) personal data of, in particular, the following data subjects:
- persons who create an order on the Controller’s website;
- visitors to the website.
(hereinafter “you” or “data subjects”).
1.5 The individual purposes for which specific personal data are processed are defined in more detail in Article 3 of this Policy.
2. Scope of Personal Data
2.1 During your visit to our website, we may process the following personal data: first name, surname, e-mail address, telephone number, address (street, house number, postcode, city, country), the password to your account, preferred website language, your marketing preferences, registration information, and communication with you in connection with handling your requests.
2.2 To access the website, data subjects may enter without the need to provide personal data. Even in this case, however, a minimum amount of personal data is collected and stored, without which efficient access to the website could not be ensured.
2.3 Cookies: The Controller may collect personal data via cookies. Cookies are small text files stored in your browser. For more information, see the Cookie Policy.
3. Purposes of Processing Personal Data
3.1 The Controller is entitled to process personal data, in particular, for the following purposes:
- fulfilment of an order for goods or a service – we collect mainly the data marked as mandatory in the order process (name, e-mail, telephone number, delivery address, and the subject of the order);
- creation and operation of an account on the website and subsequent log-in;
- compliance with legal obligations – in particular accounting and tax obligations, and the provision of data to public authorities in accordance with law; under Act No. 452/2021 Coll. on Electronic Communications, the Controller must retain the consent granted to receiving marketing communications for the prescribed period;
- legitimate interests of the Controller – improving the website’s functionality, customisation, and the development of business strategies;
- direct marketing – based on consent given, in line with your preferences;
- handling of requests – if you contact us by telephone or by e-mail at info@bonndi.eu.
3.2 The legal bases for processing personal data are:
- consent – Section 13(1)(a) of the Act; resp. Art. 6(1)(a) GDPR (direct marketing, marketing cookies);
- performance of a contract – Section 13(1)(b) of the Act; resp. Art. 6(1)(b) GDPR (order fulfilment, account management);
- compliance with a legal obligation – Section 13(1)(c) of the Act; resp. Art. 6(1)(c) GDPR (accounting, taxes);
- legitimate interest of the Controller – Section 13(1)(f) of the Act; resp. Art. 6(1)(f) GDPR (analytics, website security).
4. Personal Data Processed by Purpose
| Purpose | Data processed |
|---|---|
| Order fulfilment | first name, surname, e-mail, telephone, address |
| Creation and operation of an account | first name, surname, e-mail, telephone, address, password |
| Compliance with legal obligations | data required by law (billing details) |
| Legitimate interests of the Controller | data on website behaviour for analytics |
| Direct marketing | first name, surname, e-mail, telephone, address |
| Handling of requests | e-mail, telephone, content of communication |
5. Manner of Processing Personal Data
5.1 The Controller will store personal data securely, primarily in electronic form, although storage in paper form may also occur. Processing will be carried out primarily by automated means, although manual processing may also occur.
6. Recipients of Personal Data (Processors)
6.1 Personal data are made available only to authorised employees and collaborators of the Controller.
6.2 Your personal data may, to the extent necessary for the performance of the contract and legal obligations, be provided to the following categories of recipients / processors with whom the Controller has concluded a data processing agreement:
- hosting provider – DigitalOcean LLC (Cloudways platform), Vultr data centre, Frankfurt;
- e-mail and office services provider – Google Ireland Limited (Google Workspace);
- transport and shipping company – Packeta (Zásielkovňa s.r.o. / Packeta Slovakia) for the purpose of delivering goods;
- payment gateway provider – Comgate a.s.;
- web analytics and marketing tool providers – Google Ireland Limited (Google Analytics, Google Ads), Microsoft Corporation (Microsoft Advertising), Meta Platforms Ireland Limited (Meta/Facebook Pixel);- public authorities – in cases provided for by law.
7. Processing of Personal Data Outside the EU/EEA
7.1 Processing of your personal data takes place principally within the EU or the European Economic Area.
7.2 In connection with the use of web analytics and marketing service providers (in particular Google, and possibly Microsoft and Meta), however, data may be transferred to recipients in so-called third countries, in particular the USA.
7.3 Where information transferred to third countries contains personal data, the Controller will, prior to such transfer, ensure adequate protection, in particular on the basis of an adequacy decision of the European Commission (the EU–US Data Privacy Framework) or on the basis of EU standard contractual clauses agreed with the recipient in the third country.
8. Retention Period of Personal Data
8.1 The Controller processes personal data for the period strictly necessary to achieve the given purpose or legitimate interest, and further for the period for which it is obliged to retain personal data under generally binding legal regulations. Specific retention periods:
- orders and invoices (accounting and tax documents): 10 years (the Accounting Act and the VAT Act) — a mandatory statutory period;
- user account data: until the account is deleted by the user;
- marketing consent: until consent is withdrawn, but no longer than 3 years from the last interaction;
- handling of e-mail and telephone requests: 1 year after the request is resolved.
9. Rights of Data Subjects
9.1 As a data subject, you have the following rights in connection with the processing of personal data, which you may exercise with the Controller at any time:
- (a) the right of access to personal data;
- (b) the right to rectification of inaccurate data and completion of incomplete data;
- (c) the right to erasure where the data are no longer necessary for the purposes of processing or were processed unlawfully;
- (d) the right to restriction of processing;
- (e) the right to data portability;
- (f) the right to object to processing based on legitimate interest;
- (g) the right to withdraw consent at any time where consent was the legal basis for processing (by sending notice to info@bonndi.eu or by registered letter to the Controller’s address);
- (h) the right to lodge a complaint with the supervisory authority, which in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, https://dataprotection.gov.sk.
9.2 In the case of repeated or manifestly unfounded requests, the Controller is entitled to charge a reasonable fee for exercising the right, or to refuse to act on the request. You will be informed of such a course of action.
9.3 The contact point in connection with the processing of personal data is the Controller’s registered office. Information will also be provided at the e-mail address info@bonndi.eu. The same contact details may be used to exercise your rights. The Controller reserves the right to verify, in a reasonable manner, the identity of the data subject exercising these rights.
9.4 The Controller is entitled to amend or supplement this Policy at any time. In the event of a change, the Controller will notify data subjects of the changes sufficiently in advance and in an appropriate manner.
10. Effectiveness
10.1 This Personal Data Processing Policy takes effect on 9 June 2026.
