You have logged in on an account that is not able to order. Thus, you will not be able to place any order, nor check any price. Continue, Switch Account or Contact your Customer Service.
Please wait while processing...
Dear customer,
We are processing your request.
Please do not leave the session, this operation can take several minutes.
You will be informed when it is complete.
Thank you for your patience.
Logout
Thank you for your visit, see you soon on Lyreco
Next day delivery for online orders before 17:00
Free delivery - orders from 49,95 EUR
Call us 0800 10 14 14
This notice provides information on the processing of personal data of data subjects pursuant to Section 19 and Section 20 of Act No 18/2018 on the protection of personal data and amending certain acts (the “Act”) and Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “Regulation”).
The purpose of this notice is to inform you which personal data we process, how we process and handle them, for what purposes they are used, to whom they may be disclosed, where you may obtain information about your personal data, and how you may exercise your rights in relation to such processing.
Identification and contact details: the controller processing your personal data is Lyreco CE, SE, Panholec 20, 902 01 Pezinok, Registration number 35 958 120.
Contact details of the data protection officer: dpo5@proenergy.sk
The data subject has the right to request that the controller provide access to the personal data processed about him or her, the right to the rectification of personal data, the right to erasure, the right to the restriction of the processing of personal data, the right to object to the processing of personal data, the right not to be subject to automated individual decision-making, including profiling, the right to data portability, and the right to lodge a complaint (initiate proceedings) with a supervisory authority.
Where the controller processes personal data on the basis of the data subject’s consent, the data subject has the right to withdraw such consent at any time. The withdrawal of consent does not affect the lawfulness of personal data processing based on consent before its withdrawal.
The data subject may exercise these rights by sending an email to gdpr.sk@lyreco.com or by writing to the controller’s address.
Personal data are processed for the purpose of selling goods to buyers, issuing invoices, and dispatching goods. Personal data are processed on the basis of a pre-contractual and contractual relationship pursuant to Section 13(1)(b) of the Act, Article 6(1)(b) of the Regulation, and other laws, in particular:
Act No 513/1991, the Commercial Code, as amended (the “Commercial Code”);
Act No 40/1964, the Civil Code, as amended (the “Civil Code”);
Act No 22/2004 on electronic commerce;
Act No 250/2007 on consumer protection, as amended (the “Consumer Protection Act”);
Act No 108/2000 on consumer protection in door-to-door sales and mail-order sales, as amended.
Legitimate interests of the controller or a third party Personal data are not processed on the basis of the legitimate interests of the controller or a third party.
Personal data processed in respect of data subjects Data subjects: customers/buyers. Scope of personal data processed: title, first name, surname, company name (business name), delivery address, telephone number, email address.
The controller may provide personal data to authorised entities, such as institutions and organisations where processing is permitted by specific legislation, or to contractual partners (in particular processors) who are contractually bound to adopt appropriate safeguards, as follows:
· delivery companies, carriers, and contractual partners on the basis of a contract – Article 28 of the Regulation;
· other authorised entities pursuant to Article 6(1)(c) of the Regulation.
With the consent of the data subject, or on his or her instruction, personal data may be provided to other recipients.
Transfer of personal data to a third country or international organisation Personal data are not transferred to third countries or international organisations.
Source of personal data Personal data are obtained directly from the data subject (via the e-shop website, by email, or by telephone).
Retention period The controller processes personal data for the period necessary to fulfil the purpose of processing or, upon termination of cooperation, for a maximum of 10 years.
Profiling The controller does not process personal data by means of profiling or in a similar manner based on automated individual decision-making.
Obligation to provide personal data The provision of personal data is necessary for the conclusion of a contract. The data subject is obliged to provide personal data. If such data are not provided, the controller will not guarantee the processing and delivery of the order.
Calls are recorded in order to enable the controller to demonstrate, in a verifiable manner, the receipt and handling of a client’s request within the scope of pre-contractual and contractual relationships. Call recordings may be used as evidence in the event of complaints, claims, or disputes, including in connection with the processing of accounting documents and contracts, complaints, and the establishment, exercise, or defense of legal claims, in accordance with Article 6(1)(b) and (f) of the Regulation.
Personal data processed in respect of data subjects Data subjects: clients and potential clients.
Scope of personal data processed: the controller obtains and processes only such personal data as are voluntarily provided by the data subject and which the controller considers necessary for handling the request and providing the service. These include ordinary (i.e. not special categories of) personal data: identifying data, contact details, and, where necessary, financial data to the extent required by the nature of the request, and the recording of the telephone call. The recording of a telephone call does not constitute biometric data.
The controller may provide personal data to authorised entities, such as institutions and organisations where processing is permitted by specific legislation, or to contractual partners (in particular processors) who are contractually bound to adopt appropriate safeguards, as follows:
· service providers, data storage providers, and contractual partners on the basis of a contract pursuant to Article 28 of the Regulation;
· other authorised entities pursuant to Article 6(1)(c) of the Regulation.
With the consent of the data subject, or on his or her instruction, personal data may be provided to other recipients.
Transfer of personal data to a third country or international organisation Personal data may be transferred to third countries.
Source of personal data Personal data are obtained directly from the data subject or his or her legal representative (by telephone).
Retention period The controller processes and retains personal data for the period necessary to fulfil the purpose, but for a maximum of 90 days. For the purpose of protecting legal claims, the limitation period is three years. If court, administrative, or other proceedings are initiated, the data are processed for the entire duration of such proceedings and for the remaining part of the limitation period after their conclusion.
Profiling The controller does not process personal data by means of profiling or in a similar manner based on automated individual decision-making.
In relation to call recording: the controller respects the client’s right to protection of personality under the Civil Code (Section 12(1)(a) of Act No 40/1964) and audio recordings are made with the client’s consent. If the data subject does not agree to the recording, he or she has the right to use an alternative method of handling the request, namely in writing to the controller’s address or electronically by email to gdpr.sk@lyreco.com. If the data subject objects to the recording after it has been made, a transcript of the communication may be created to preserve evidence.
In relation to the processing of personal data: the data subject has the right, within the meaning of the GDPR, to request that the controller provide access to the personal data processed about him or her, the right to the rectification of personal data, the right to erasure, the right to the restriction of the processing of personal data, the right to object to the processing of personal data, the right not to be subject to automated individual decision-making, including profiling, the right to data portability, and the right to lodge a complaint (initiate proceedings) with a supervisory authority. The data subject may exercise these rights by telephone via the customer service number, by sending an email to gdpr.sk@lyreco.com, or by writing to the controller’s address.
Obligation to provide personal data The data subject provides personal data voluntarily via a recorded telephone call, to the extent necessary to handle the request (e.g. conclusion, amendment, or termination of a contract). The data subject is obliged to provide the requested personal data. If such data are not provided, the controller will not guarantee the handling of the request by telephone or the subsequent provision of the service. If the data subject does not wish to be recorded during a telephone call, he or she may handle the request by an alternative method (in writing to the controller’s address or by email).
Personal data are processed for the purpose of handling accounting documents of data subjects in connection with the establishment and performance of pre-contractual and contractual relationships.
Personal data are processed on the basis of Section 13(1)(b) of the Act, Article 6(1)(b) of the Regulation, the Civil Code, the Commercial Code, Act No 222/2004 on value added tax, as amended (Section 74), and Act No 431/2002 on accounting, as amended.
Legitimate interests of the controller or a third party Personal data are not processed on the basis of the legitimate interests of the controller or a third party.
Personal data processed in respect of data subjects Data subjects: clients and contractual partners of the controller.
Scope of personal data processed: first name and surname, or business name, of the taxable person, the address of their registered office, place of business, establishment, residence, or the address of the place where they habitually reside, their tax identification number under which the goods or services were supplied, or the first name and surname, or business name, of the recipient of the goods or services, the address of their registered office, place of business, establishment, residence, or the address of the place where they habitually reside, their tax identification number under which the goods or services were supplied, company registration number, VAT number (if liable to account for VAT), bank account number, and signature.
The controller may provide personal data to authorised entities, such as institutions and organisations where processing is permitted by specific legislation, or to contractual partners (in particular processors) who are contractually bound to adopt appropriate safeguards, as follows:
· tax authority and other authorised entity pursuant to Article 6(1)(c) of the Regulation;
· contractual partner on the basis of a contract pursuant to Article 28 of the Regulation.
With the consent of the data subject, or on his or her instruction, personal data may be provided to other recipients.
Transfer of personal data to a third country or international organisation Personal data are not transferred to third countries or international organisations.
Source of personal data Personal data are obtained directly from the data subject (in person, by email, by telephone, or via the controller’s website).
Retention period The controller processes personal data for the period necessary to fulfil the purpose, but for a maximum of 10 years.
Profiling The controller does not process personal data by means of profiling or in a similar manner based on automated individual decision-making.
Obligation to provide personal data The provision of personal data is a legal/contractual requirement, or a requirement necessary for the conclusion of a contract. The data subject is obliged to provide personal data. If such data are not provided, the controller will not guarantee the processing of accounting documents.
Personal data are processed for the purpose of maintaining records of data subjects who are business partners or clients of the controller.
Personal data are processed on the basis of Section 13(1)(f) of the Act and Article 6(1)(f) of the Regulation where the data subject is an employee of a business partner or client of the controller.
Personal data are processed on the basis of Section 13(1)(b) of the Act and Article 6(1)(b) of the Regulation where the data subject is a governing body or a person acting on behalf of a business partner or client of the controller.
Legitimate interests of the controller or a third party Personal data are processed on the basis of the legitimate interests of the controller or a third party.
Personal data processed in respect of data subjects Data subjects: employees of business partners or clients of the controller, or governing bodies or persons acting on behalf of business partners or clients of the controller.
Scope of personal data processed: Title, first name, surname, job position, service position, post, employee personal number or employee number, department, place of work, telephone number, fax number, work email address, and identifying data of the employer.
The controller may provide personal data to authorised entities, such as institutions and organisations where processing is permitted by specific legislation, or to contractual partners (in particular processors) who are contractually bound to adopt appropriate safeguards, as follows:
· other authorised entities pursuant to Article 6(1)(c) of the Regulation.
· contractual partner on the basis of a contract pursuant to Article 28 of the Regulation.
With the consent of the data subject, or on his or her instruction, personal data may be provided to other recipients.
Transfer of personal data to a third country or international organisation Personal data are not transferred to third countries or international organisations.
Source of personal data Personal data are obtained directly from the data subject or from the employer of the data subject.
Retention period The controller processes personal data for the period necessary to fulfil the purpose, but for a maximum of one year upon completion of the purpose.
Profiling The controller does not process personal data by means of profiling or in a similar manner based on automated individual decision-making.
Obligation to provide personal data The provision of personal data is a contractual requirement; processing of personal data is necessary. If personal data are not provided, a contractual relationship will not be concluded with the data subject or with the company which he or she represents and on whose behalf he or she acts. The data subject is obliged to provide accurate personal data. If such data are not provided, he or she is in breach of the Act and the Regulation.
Personal data are processed for the purpose of marketing (informing about news, discounts, and other marketing offers).
Personal data are processed on the basis of the data subject’s voluntary consent pursuant to Section 13(1)(a) of the Act and Article 6(1)(a) of the Regulation.
Legitimate interests of the controller or a third party Personal data are not processed on the basis of the legitimate interests of the controller or a third party.
Personal data processed in respect of data subjects Data subjects: clients, customers, potential customers and clients.
Scope of personal data processed: standard personal contact details such as title, first name and surname, email address, telephone number, and any other personal data specified in the consent.
The controller may provide personal data to authorised entities, such as institutions and organisations where processing is permitted by specific legislation, or to contractual partners (in particular processors) who are contractually bound to adopt appropriate safeguards, as follows:
· other authorised entities pursuant to Article 6(1)(c) of the Regulation;
· a contractual partner on the basis of a contract pursuant to Article 28 of the Regulation.
With the consent of the data subject, or on his or her instruction, personal data may be provided to other recipients.
Transfer of personal data to a third country or international organisation Personal data are not transferred to third countries or international organisations.
Source of personal data Personal data are obtained directly from the data subject.
Retention period The controller processes personal data for the period necessary to fulfil the purpose.
Profiling The controller does not process personal data by means of profiling or in a similar manner based on automated individual decision-making.
Obligation to provide personal data The data subject provides personal data voluntarily on the basis of consent (the provision is not a legal or contractual requirement). If such data are not provided, the data subject will not be informed about news, discounts, or other marketing offers.
Personal data are processed for the purpose of marketing (informing about news, discounts, and other marketing offers) related to goods or services purchased or procured by the data subject.
Personal data are processed on the basis of the legitimate interests of the controller pursuant to Section 13(1)(f) of the Act and Article 6(1)(f) of the Regulation.
Legitimate interests of the controller or a third party Personal data are processed on the basis of the legitimate interests – marketing activities – of the controller or a third party.
Personal data processed in respect of data subjects Data subjects: clients/customers.
Scope of personal data processed: standard personal contact details such as title, first name and surname, email address, and telephone number.
The controller may provide personal data to authorised entities, such as institutions and organisations where processing is permitted by specific legislation, or to contractual partners (in particular processors) who are contractually bound to adopt appropriate safeguards, as follows:
· other authorised entities pursuant to Article 6(1)(c) of the Regulation;
· a contractual partner on the basis of a contract pursuant to Article 28 of the Regulation.
With the consent of the data subject, or on his or her instruction, personal data may be provided to other recipients.
Transfer of personal data to a third country or international organisation Personal data are not transferred to third countries or international organisations.
Source of personal data Personal data are obtained directly from the data subject (in person, by email, by telephone, or via the controller’s website).
Retention period The controller processes personal data for the period necessary to fulfil the purpose (but for a maximum of five years from the data subject’s last enquiry).
Profiling The controller does not process personal data by means of profiling or in a similar manner based on automated individual decision-making.
Obligation to provide personal data The data subject provides personal data voluntarily, in the expectation that, in the future, he or she will be informed about marketing activities (informing about news, discounts, and other marketing offers) related to goods or services purchased or procured by the data subject. If such data are not provided, the data subject will not be informed about news, discounts, or other marketing offers, and the service or goods requested by the data subject will not be provided.
Personal data are processed for the purpose of ensuring the participation of the data subject in a competition on the basis of the data subject’s voluntary consent. Where separate consent is granted, the controller may also publish the personal data of the data subject as a winner, to the extent and under the conditions set out in the Competition Rules.
Personal data are processed on the basis of the data subject’s voluntary consent pursuant to Section 13(1)(a) of the Act and Article 6(1)(a) of the Regulation.
Legitimate interests of the controller or a third party Personal data are not processed on the basis of the legitimate interests of the controller or a third party.
Personal data processed in respect of data subjects Data subjects: competition participants.
Scope of personal data processed: standard personal contact details (identifying and contact data).
The controller may provide personal data to authorised entities, such as institutions and organisations where processing is permitted by specific legislation, or to contractual partners (in particular processors) who are contractually bound to adopt appropriate safeguards, as follows:
· other authorised entities pursuant to Article 6(1)(c) of the Regulation;
· a contractual partner on the basis of a contract pursuant to Article 28 of the Regulation.
With the consent of the data subject, or on his or her instruction, personal data may be provided to other recipients.
Transfer of personal data to a third country or international organisation Personal data are not transferred to third countries or international organisations.
Source of personal data Personal data are obtained directly from the data subject or his or her legal representative.
Retention period The controller processes personal data for the period necessary to fulfil the purpose – until the end of the competition. Where separate consent is granted, the controller may also publish the personal data of the data subject for the period specified in the consent.
Profiling The controller does not process personal data by means of profiling or in a similar manner based on automated individual decision-making.
Obligation to provide personal data The data subject (or his or her legal representative) provides personal data voluntarily on the basis of consent (such provision is not a legal or contractual requirement). If personal data are not provided, the data subject will not be included in the competition. If the data subject (or his or her legal representative) provides personal data but does not grant consent to the publication of personal data in the event of winning, the data subject will be included in the competition but will not be published as a winner.
Personal data are processed for the purpose of improving the quality of services for clients in connection with the use of new and innovative methods in software, or in the approach to and care of customers.
Personal data are processed on the basis of Section 13(1)(f) of the Act and Article 6(1)(f) of the Regulation (legitimate interests), or, in specific cases, on the basis of Section 13(1)(a) of the Act and Article 6(1)(a) of the Regulation (consent of the data subject).
Legitimate interests of the controller or a third party Personal data are processed on the basis of the legitimate interests of the controller.
Personal data processed in respect of data subjects Data subjects: clients and business partners of the controller.
Scope of personal data processed: personal contact details (first name, surname, email address, landline or mobile number, other contact details where appropriate), photographs, audio, video, and audiovisual recordings.
The controller may provide personal data to authorised entities, such as institutions and organisations where processing is permitted by specific legislation, or to contractual partners (in particular processors) who are contractually bound to adopt appropriate safeguards, as follows:
· other authorised entities pursuant to Article 6(1)(c) of the Regulation;
· a contractual partner on the basis of a contract pursuant to Article 28 of the Regulation;
· other recipients.
With the consent of the data subject, or on his or her instruction, personal data may be provided to other recipients.
Transfer of personal data to a third country or international organisation Personal data are not transferred to third countries or international organisations.
Source of personal data Personal data are obtained directly from the data subject.
Retention period The controller processes personal data for the period necessary to fulfil the purpose, up to a maximum of three years.
Profiling The controller does not process personal data by means of profiling or in a similar manner based on automated individual decision-making.
Obligation to provide personal data The data subject provides personal data voluntarily, in the expectation that, in the future, the data will be used to improve service quality (completion of forms or satisfaction surveys).
Based on the template you provided for the e-shop, the information obligation for cookie management purposes has been prepared. The text has been drafted formally and in compliance with applicable requirements (the GDPR and the Electronic Communications Act), while preserving the structure of your template.
Purpose and legal basis of personal data processing Personal data are processed for the purpose of ensuring the proper functioning of the website (necessary cookies), measuring website traffic, analysing user behaviour, and displaying personalised advertising. Personal data are processed on the basis of:
Legitimate interests of the controller or a third party Personal data are processed on the basis of legitimate interests exclusively in connection with necessary technical cookies to ensure the basic functionality, stability, and security of the website.
Personal data processed in respect of data subjects Data subjects: visitors to the e-shop website.
Scope of personal data processed: online identifiers (IP address, cookie identifier), browser, device, and interaction with the website.
Identification and categories of recipients The controller may provide personal data to authorised entities and contractual partners, in particular providers of analytical and advertising services (processors), on the basis of a contract pursuant to Article 28 of the Regulation:
Transfer of personal data to a third country or international organisation In connection with the use of analytical and marketing tools, personal data may be transferred to third countries (e.g. the USA), in which case the controller applies appropriate safeguards pursuant to Article 44 et seq. of the Regulation (e.g. standard contractual clauses or adequacy decisions).
Source of personal data Personal data are obtained directly from the data subject through the settings of the web browser or interaction with the cookie banner.
Retention period The controller processes personal data for the duration of the consent given or depending on the type of cookies; session cookies are deleted after the browser is closed, persistent cookies are retained for the period defined by their purpose, but for no longer than two years.
Profiling Where consent is given, personal data may be processed for profiling (analysis of purchasing behavior and preferences). However, this processing does not result in automated individual decision-making producing legal effects for the data subject.
Obligation to provide personal data The provision of personal data for necessary cookies is required for the technical functioning of the website. The provision of data for analytical and marketing purposes is voluntary; if such data are not provided (consent is not given), personalised functions and advertising will not be available to the data subject.
If you have any further questions, please contact the controller at gdpr.sk@lyreco.com or the controller’s data protection officer directly at dpo5@proenergy.sk
Last updated: 07. 05. 2026
Slovakia
