Privacy protection

1. INTRODUCTORY PROVISIONS

1.1 Company: Business name: GARAGE SPORT s.r.o. Registered office: Rázusova 15, 977 01 Brezno Company ID (IČO): 47 357 380 Registered in the Commercial Register of the District Court Banská Bystrica, section: Sro, insert no.: 24752/S Phone: 0902 469 636 Email: info@blackhilloutdoor.sk

(hereinafter referred to as the "Operator" or the "Company") hereby provides information on the manner and scope of processing of your personal data, including rights related to such personal data processing ("Policy").

1.2 We fully respect every person's right to privacy and personal data protection. Maximum security and protection during the processing of your personal data is a matter of course for our Company, upon which you can rely. To guarantee the protection of each of your personal data that comes into our contact during our work, we have adopted technical, organizational, and personnel measures in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as "GDPR") as well as Act No. 18/2018 Coll. on Personal Data Protection and on amendments to certain acts ("Personal Data Protection Act").

1.3 The Operator is the operator of the website www.blackhilloutdoor.sk (hereinafter referred to as the "E-shop"), through which it offers its products and services, in particular outdoor clothing and accessories.

1.4 The Operator of the Site acquires, stores, and uses (and otherwise processes) personal data of in particular the following data subjects:

• (a) persons who create an order on the Operator's website,
• (b) site visitors.

(hereinafter referred to as "You" or "Data Subjects").

1.5 The individual purposes for which specific personal data are processed are defined in more detail in Article 3 of this Policy.

2. METHOD OF ACQUISITION AND SCOPE OF PERSONAL DATA

2.1 If you are a customer of our E-shop, we most frequently obtain your personal data directly from you. In such cases, the acquisition of your personal data is voluntary. Depending on the specific case, failure to provide personal data may affect our ability to conclude a valid contract with you or provide the services ordered by you, or in exceptional cases, our obligation to refuse the conclusion of a contract or the provision of a service.

2.2 During your visit to our website, we may process the following personal data: first name, last name, email address, telephone number, address (street, house number, postal code, city, country), password to your account on the site, preferred site language, your preferences regarding marketing information, information about registration on the site, and communication with you in connection with handling your telephone or email requests.

2.3 For the purpose of accessing the Site, Data Subjects can enter without the need to provide personal data (such as name, address, or email address). However, even in this case, minimal acquisition, collection, and storage of personal data occur, without which efficient access to the Site could not be ensured. In addition, the Operator uses certain analytical procedures on the Site, detailed further in this Policy, which are necessary for the proper functioning of the Site.

2.4 Cookies: In order to adapt our Site to be as comfortable as possible for you to use, the Operator may collect personal data through cookies, similarly to other well-known companies. Cookies are small text files stored in your browser that help us understand visitor preferences. More information on how we use cookies can be found in our Cookie Policy.

3. PURPOSES OF PERSONAL DATA PROCESSING

3.1 The Operator is authorized to process personal data in particular for the following purposes:

• (a) processing of a goods or service order – we collect primarily data that is necessary to the required extent for processing your order and concluding a contract, i.e., first name, last name, email address, delivery address, and the subject matter of the order itself.
• (b) creation and operation of an account on the Site – processing data for the purpose of creating an account on the Site and subsequent logging in, utilizing provided options and functionalities, and subsequent removal;
• (c) fulfillment of legal obligations – fulfillment of obligations imposed on the Operator by generally binding legal regulations; fulfillment of legal obligations also includes providing data and information to law enforcement authorities or other public authorities in accordance with relevant legal regulations; e.g., pursuant to Act No. 452/2021 Coll. on Electronic Communications, the Operator is obliged to store the provided consent to receive marketing communication for a set period in order to prove the granting of consent;
• (d) legitimate interests of the Operator – improving the functionality of the Site, adapting, setting, improving, and developing business strategies, and more;
• (e) direct marketing – the Operator will process data about you for direct marketing purposes based on the consent granted, naturally in accordance with your preferences specified on the Operator's website;
• (f) handling requests and complaints – if you contact us by phone or electronically via email at info@blackhilloutdoor.sk or in any other way, we will process the data provided by you for the purpose of handling your requests and complaints;
• (g) other purposes.

3.2 The legal bases for processing personal data for the individual processing purposes specified in Article 3.1 are:

• (a) Your consent – Section 13(1)(a) of the Act; or Article 6(1)(a) of the GDPR (Articles 3.1(e) and 3.1(f) of this Policy)

• (b) Fulfillment of contractual obligations – Section 13(1)(b) of the Act; or Article 6(1)(b) of the GDPR (Articles 3.1(a) and 3.1(b) of this Policy);
• (c) Fulfillment of legal obligations – Section 13(1)(c) of the Act; or Article 6(1)(c) of the GDPR (Article 3.1(c) of this Policy);
• (d) Legitimate interests of the Operator or other entities – Section 13(1)(f) of the Act; or Article 6(1)(f) of the GDPR (Articles 3.1(d) and 3.1(e) of this Policy);
• (e) one of the legal bases pursuant to Section 13(1) of the Act; or Article 6(1) of the GDPR.

4. PROCESSED PERSONAL DATA

4.1 The Operator is authorized to process primarily the following personal data according to the purpose of processing:

• – Processing of goods or service order: First name, last name, email address, telephone number, address (street, house number, postal code, city, country)
• – Creation and operation of an account on the Site: First name, last name, email address, telephone number, address (street, house number, postal code, city, country), password
• – Fulfillment of legal obligations: Data pursuant to legal regulations
• – Legitimate interests of the Operator: Technical data
• – Direct marketing: First name, last name, email address, telephone number, address (street, house number, postal code, city, country)
• – Handling requests and complaints: First name, last name, email address, telephone number, communication content

5. METHOD OF PROCESSING PERSONAL DATA

5.1 The Operator will securely store the personal data of Data Subjects primarily in electronic form, but storage in paper form may also occur. The Operator will process personal data primarily in an automated manner, but manual processing may also occur.

6. RECIPIENTS OF PERSONAL DATA

6.1 Personal data are made accessible only to authorized employees and collaborators of the Operator.

6.2 Your Personal Data are disclosed only to the necessary extent and always while maintaining the data recipient's confidentiality duty, e.g., to our employees, persons commissioned by us to perform individual legal service tasks, economic services, our accounting advisors, our professional advisors (e.g., auditor, lawyer, PR and marketing advisor), state administration authorities and public authority bodies (especially in the case of fulfilling legal obligations or for the purpose of detecting misdemeanors and criminal activity), and software, web domain, and IT support providers for the E-shop operation (including employees of these entities), while in this context we use IT support and cloud services from a partner entity within the EU and web hosting services from a Slovak entity (with recording equipment located in the territory of the Slovak Republic).

7. PROCESSING OF PERSONAL DATA OUTSIDE THE EU/EEA

7.1 The processing of your personal data takes place fundamentally within the EU or the European Economic Area.

7.2 In connection with the involvement of web analytics service providers, however, information may be sent to recipients in so-called third countries. Third countries are countries outside the European Union or countries not participating in the Agreement on the European Economic Area in which a level of personal data protection comparable to that within the European Union cannot be assumed.

7.3 If information sent to third countries also contains personal data, the Operator will ensure prior to such transfer that the required adequate protection of personal data is guaranteed in the relevant third country or with the recipient in the third country. This may result in particular from a so-called Adequacy Decision of the European Commission, by means of which an adequate level of personal data protection is generally established for a certain third country. Alternatively, when providing personal data, it is also possible to rely on so-called EU Standard Contractual Clauses agreed with the recipient in the third country.

8. RETENTION PERIOD OF PERSONAL DATA

8.1 We retain your personal data for no longer than is necessary for the purposes for which the personal data are processed. In general, the retention period follows legal regulations. If the retention period for your personal data does not follow from legal regulations, we determine it always in relation to specific purposes through our internal policies. If we process your personal data based on consent, we are obliged to cease processing the personal data for that purpose after its withdrawal. However, this does not preclude us from continuing to process your personal data on another legal basis, especially when it concerns the fulfillment of legal obligations.

9. RIGHTS OF DATA SUBJECTS

9.1 As a Data Subject, you have rights related to the processing of personal data that derive from legal regulations and which you can exercise with the Operator at any time. These include the right (a) of access to personal data, (b) to rectification of inaccurate and completion of incomplete personal data, (c) to erasure of personal data if they are no longer necessary for the purposes for which they were collected or otherwise processed, or if it is found that they were processed unlawfully, (d) to restriction of personal data processing, (e) to data portability, (f) to object, upon recognition of which the processing of personal data will be terminated unless it is proven that there are compelling legitimate grounds for processing that override the interests or rights and freedoms of the Data Subject, especially if the reason is the potential enforcement of legal claims, and (g) the right to lodge a complaint with a supervisory authority, which in the Slovak Republic is the Office for Personal Data Protection (https://dataprotection.gov.sk/sk/).

• (a) Right of access to personal data: you have the right to know whether the Operator processes your personal data, you have the right to obtain information on whether your personal data are being processed, and if so, you also have the right to obtain access to your personal data. In cases of unfounded, disproportionate, or repeated requests, the Operator shall be entitled to charge a reasonable fee for a copy of the provided personal data or refuse the request (the above applies mutatis mutandis to the exercise of the rights listed below).
• (b) Right to rectification of inaccurate and completion of incomplete personal data: if you believe that the Operator is processing inaccurate or incomplete personal data about you, you have the right to request their correction and completion. The Operator shall carry out the correction or completion without undue delay, always taking technical possibilities into account.
• (c) Right to erasure: if you request the erasure of personal data, the Operator shall erase your personal data if (i) they are no longer necessary for the purposes for which they were collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for processing your personal data, or (iv) a legal obligation is imposed on the Operator to do so.
• (d) Right to restriction of personal data processing: if you request a restriction of processing, the Operator will make the personal data inaccessible, temporarily remove or store them, or perform other processing operations necessary for the proper exercise of the exercised right.
• (e) Right to data portability: if you want the Operator to transfer your personal data, which it processes based on your consent or based on the Contract, to you or a third entity, you can exercise your right to data portability. If the exercise of this right could adversely affect the rights and freedoms of third parties, the Operator will not be able to comply with your request.
• (f) Right to object: the right to object to the processing of personal data processed for the purposes of safeguarding the legitimate interests of the Operator. If the Operator does not demonstrate a compelling legitimate interest for processing that overrides the interests or rights and freedoms of the Data Subjects, it shall terminate processing based on the objection without undue delay.
• (g) Right to withdraw consent: if your personal data were processed based on your consent, you are entitled to withdraw your consent at any time by unsubscribing, sending information about the withdrawal to the relevant email address info@blackhilloutdoor.sk as well as by sending a registered letter to the Operator's address, always in accordance with the text of the granted consent.

9.2 In the case of repeated or manifestly unfounded requests to exercise the aforementioned rights, the Operator shall be entitled to charge a reasonable fee for the realization of the given right, or to refuse its realization. You will be informed of such procedure.

9.3 The contact point in connection with the processing of personal data is the registered office of the Operator. Information in connection with the processing of personal data will also be provided to you at the email address info@blackhilloutdoor.sk. You can use the same contact details to exercise your rights. The Operator reserves the right to verify in a reasonable manner the identity of the data subject exercising the aforementioned rights.

9.4 The Operator is entitled to unilaterally amend or supplement this Policy at any time. In the event of changes to this Policy, the Operator shall notify Data Subjects of these changes well in advance and in an appropriate manner so that Data Subjects have an objective opportunity to acquaint themselves with them.

10. EFFECTIVENESS

10.1 This personal data processing policy is effective from September 1, 2025.