1. data controller
company name: VR Master s.r.o., registered office: Odbojárov 7, Michalovce , icko: 54154065, e-mail: info@vrmaster.sk. For data protection matters, please contact info@vrmaster.sk.
2. grounds and purposes of processing
- Google Analytics – to measure traffic and improve the site, processing of anonymised data, IP anonymised.
- data from orders in the cash register – name, address, e-mail, telephone (optional), purpose: processing of orders and performance of the contract.
Legal basis: article 6 (1) (b) GDPR – processing necessary for the performance of the contract.
3. legal basis for processing
- consent to cookies for Google Analytics (Article 6(1)(a) GDPR) – only activated after consent has been given; IP anonymisation can be activated (enabled).
- the performance of the contract with the client (Article 6(1)(b) GDPR) for orders.
4. recipients / data processors
- Google Ireland Ltd. (for Google Analytics) or Google Inc. USA – secured standard contractual clauses (SCC) and IP anonymisation.
- external processors (accountants, couriers) processing personal data under contract (Article 28 GDPR).
5. transfer to third countries
- data transfers to the US via Google Analytics are covered by IP anonymisation and standard EU-US SCC clauses; please note that EU court decisions remain sensitive on this issue
6. data retention period
- anonymised Google Analytics data – up to 26 months (default setting).
- order data – for the duration of the contractual relationship + 10 years for accounting and tax purposes.
7. rights of the data subject
You have the right to:
- request access to and correction of data,
- limit or withdraw consent,
- request erasure (“right to be forgotten”),
- object to the processing of data,
- lodge a complaint with the Data Protection Authority,
- transfer the data (only for automated processing).
8. automated decision making/profiling
We do not use. Google Analytics combines anonymised statistical data – without profiling.
9. security measures
Security of electronic and physical assets, encryption in transmission (https) and access only for authorized personnel.
10. changes to the Policy
We may update the Policy (e.g. GDPR legislation or in access to GA).
Last update: 20.6.2025