Information obligation of the company prepared in accordance with the Personal Data Protection Act
Operator identification data:
The company Ilona Magdalena Lisá Witkowska, IČO: 51745879, DIČ 2121459571, IČ DPH 2121459571
Vajanského nábrežie 59/17, 81102 Bratislava (hereinafter referred to as the “Company”) acts in the processing of personal data of its employees, clients, customers or business partners (hereinafter referred to as the “affected person”) as an information operator. systems (hereinafter referred to as "IS").
Legal basis for the processing of personal data of the persons concerned:
When processing personal data, the company proceeds in accordance with Act no. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Regulations (hereinafter referred to as the “Personal Data Protection Act”). The legal basis for the processing of personal data is the Personal Data Protection Act, special legal regulations and consent to the processing of personal data, depending on the purpose of the processing of personal data.
If the purpose of personal data processing, the circle of data subjects and the list of personal data is stipulated by a directly enforceable act of the European Union, an international agreement by which the Slovak Republic is bound, the Personal Data Protection Act or a special law is the company entitled under the Personal Data Protection Act. process personal data without the consent of the data subject.
The Company processes personal data without the consent of the data subject, if the purpose of personal data processing, the range of data subjects and the list of personal data or their scope is stipulated by a directly enforceable legally binding act of the European Union, an international agreement by which the Slovak Republic is bound or this Act. If the list or scope of personal data is not established, the company may process personal data only to the extent and in the manner necessary to achieve the established purpose of processing while complying with the basic obligations under the Personal Data Protection Act.
The Company further processes personal data without the consent of the data subject, if the purpose of personal data processing, the circle of data subjects and the list of personal data are stipulated by a special law and only to the extent and in the manner stipulated by a special law. Processed personal data may be provided, made available or disclosed from the information system only if a special law stipulates the purpose of providing, making available or disclosed, a list of personal data that can be provided, made available or disclosed, as well as third parties to whom personal data are provided. the circle of recipients to whom personal data are made available, unless the Personal Data Protection Act provides otherwise.
The company processes personal data without the consent of the data subject, even if:
a) the processing of personal data is necessary for the performance of a contract in which the data subject acts as one of the parties, or in pre-contractual relations with the data subject or in negotiations to amend a contract which are carried out at the request of the data subject;
b) the processing of personal data is necessary for the protection of the life, health or property of the person concerned, the subject of processing are exclusively the title, name, surname and address of the data subject without the possibility to assign other personal data to them and their use is intended exclusively for the needs of the operator in postal communication with the data subject and records of these data,
c) personal data which have already been disclosed in accordance with the law and have been duly marked as disclosed by the controller are processed; the person who claims that he processes the published personal data shall, upon request, prove to the Office that the processed personal data have already been lawfully published,
d) the processing of personal data is necessary for the protection of the rights and legally protected interests of the controller or a third party, and this does not apply if such processing of personal data outweighs the fundamental rights and freedoms of the data subject.
If, with regard to the purpose of personal data processing provided for in a directly enforceable legally binding act of the European Union, an international agreement by which the Slovak Republic is bound, the Personal Data Protection Act and a special law cannot specifically specify in advance the individual personal data to be processed, the list of personal data can be replaced by a range of personal data.
The company is obliged to proceed with such processing of personal data in accordance with the Personal Data Protection Act, except for those operators who process personal data for the purposes of court proceedings and in connection therewith.
If the Personal Data Protection Act does not apply to the processing of personal data, the company, as the operator, is entitled to process personal data only with the consent of the data subject. The company obtains the consent of the person concerned without coercion and enforcement, as well as without conditional on the threat of refusal of a contractual relationship, services provided or obligations arising for the operator from legally binding acts of the European Union, an international agreement by which the Slovak Republic is bound or the law. In the event of a refusal to provide personal data to the company for the purposes necessary for the provision of services or the fulfillment of legal obligations, the company is entitled to notify the person concerned of the possible consequences of not providing personal data.
The data subjects agree that the company, when processing personal data, entrusts such processing to an intermediary who processes personal data on behalf of the company. Upon termination of the purpose of processing personal data, the company shall destroy the legally obtained personal data of the persons concerned within the period specified by the applicable legal regulations and in accordance with the company's internal regulations.
Purpose of processing the personal data of data subjects:
The company respects your privacy and considers the personal data provided to be confidential.
For the quality provision of its services, the company needs to know some personal data of the persons concerned and needs to provide them to other recipients in order to fulfill their legal obligations and provide the highest quality services. The company processes the provided personal data for several purposes. On the one hand, these are the personal data of jobseekers and the personal data of their employees for the purposes of the personnel and payroll agenda, and the related legal obligations arising from special legal regulations.
The company also processes the personal data of its clients, customers and business partners in order to ensure its business activities, taking into account the interests of its clients, customers and business partners.
There is no processing of personal data for any other purpose in the company, which means that the company collects, stores and processes only the personal data of the persons concerned, which it needs in order to fulfill its services. The provided personal data is strictly protected against misuse by third unauthorized entities, by means documented in the adopted security project and security directive in accordance with the Personal Data Protection Act.
When processing the personal data of the persons concerned, the company complies with the basic obligations of the controller arising from the Personal Data Protection Act, which include the following obligations.
The Company always uses the provided personal data for a predetermined purpose of processing, which is clear, clearly and specifically defined, while in accordance with the Constitution of the Slovak Republic, constitutional laws, laws and international treaties by which the Slovak Republic is bound.
The company always defines the conditions of personal data processing so that the rights of the data subject established by law are not restricted.
The company obtains only such personal data of the data subjects which, in their scope and content, correspond to the purpose of processing and are necessary for its achievement.
The company ensures that the personal data of the data subjects are processed exclusively in a way that corresponds to the purpose for which they were collected in advance.
The company, as the operator, is obliged to process only correctly, completely and, if necessary, updated personal data in relation to the purpose of processing. The controller is obliged to block incorrect and incomplete personal data and to correct or supplement them without undue delay, if they cannot be corrected or supplemented in such a way that they are correct, the company shall clearly mark these personal data and destroy them without undue delay.
The company ensures that the personal data of the data subjects are processed in a form that enables the identification of individual data subjects for a period of time no longer than is necessary to achieve the purpose of the processing.
The company disposes of personal data whose purpose of processing has ended in the prescribed manner. After the end of the defined purpose, the company is entitled to process personal data to the necessary extent for research or for statistical purposes in their anonymized form. Personal data processed in this way may not be used by the controller to support measures or decisions taken against the data subject in order to restrict his or her fundamental rights and freedoms.
Brokers:
The Company does not provide your personal data to third parties in violation of the Personal Data Protection Act and for the purpose of their collection, contrary to your interests or instructions, and are provided to a third party only for the above purpose.
In its business activities, the company cooperates with several intermediaries whose goal is to provide quality services, while these entities process the personal data of the persons concerned in the performance of their contractual activities for the company.
The company honestly declares that when selecting individual intermediaries, it paid attention to their professional, technical, organizational and personnel competence and their ability to guarantee the security of processed personal data by security measures taken in accordance with the Personal Data Protection Act. At the same time, the company proceeded in selecting a suitable intermediary in such a way that the rights and legally protected interests of the persons concerned were not endangered.
As an operator, the Company has entered into written agreements with intermediaries in accordance with the Personal Data Protection Act on ensuring the protection of personal data processed by intermediaries, which it has entrusted with processing personal data of data subjects only to the extent, under conditions and for the purpose agreed in the contract and in accordance with the Personal Data Protection Act. .
Scope and list of processed personal data:
The company processes in its information systems the personal data of the persons concerned to the extent necessary to achieve the specified purpose. This is the scope of personal data stipulated by special legal regulations or within the scope of the consent of the data subject to the processing of his / her personal data.
The company only processes personal data that has been provided to it voluntarily and to the extent necessary by the data subject himself. The provision of personal data of the company beyond the scope of special laws is voluntary.
Conditions and method of processing personal data of the persons concerned:
The company processes in its information systems the personal data of the persons concerned by automated and non-automated means of processing.
The company does not disclose processed personal data, unless required by special legislation or a decision of a court or other state body.
The company will not process your personal data without your express consent or other legal legal basis for any other purpose, or to a greater extent than stated in this information and the records of the individual information systems of the operator.
Rights of the data subject related to the processing of his personal data:
The person concerned has the right, upon written request, to request from the company:
a)confirmation of whether or not personal data about him are processed,
b) in a generally comprehensible form, information on the processing of personal data in the information system to the extent provided for in the Personal Data Protection Act; when issuing a decision pursuant to the Personal Data Protection Act, the person concerned is entitled to become acquainted with the procedure of processing and evaluation of operations,
c) in a generally comprehensible form, precise information about the source from which he obtained his personal data for processing,
d) in a generally comprehensible form, a list of her personal data which are the subject of processing,
e) correction or disposal of their incorrect, incomplete or out-of-date personal data which are the subject of processing,
f) the destruction of her personal data, the purpose of the processing of which has ended; if official documents containing personal data are the subject of processing, it may request their return,
g) liquidation of her personal data, which are the subject of processing, if there has been a violation of the law,
h) blocking of his personal data due to the revocation of the consent before the expiry of its validity, if the company processes personal data with the consent of the data subject.
The above-mentioned rights of the data subject pursuant to letters e) and f) may be restricted only if such restriction results from a special law or its application would violate the protection of the data subject or would violate the rights and freedoms of other persons.
Pursuant to the Personal Data Protection Act, the data subject has the right to object to:
a) the processing of its personal data which it expects to be or will be processed for the purposes of direct marketing without its consent, and request their destruction,
b) the use of personal data specified in the Personal Data Protection Act for the purposes of direct marketing in the postal system, or
c) the provision of personal data specified in the Personal Data Protection Act for the purposes of direct marketing.
Under the Personal Data Protection Act, the data subject has the right to object at any time to the processing of personal data in cases under the Personal Data Protection Act by stating legitimate reasons or submitting evidence of unauthorized interference on the basis of a written request addressed to the company or in person. and legally protected interests which are or may be harmed in such a case by such processing of personal data; unless legally justified and it is proven that the objection of the data subject is justified, the company is obliged to block and destroy the personal data whose processing the data subject objected to without undue delay as soon as circumstances allow.
Under the Personal Data Protection Act, the data subject has the right at any time to object and not to submit to a decision of the company which would have legal effects or a significant effect on the written request addressed to the company or in person, if such a decision is issued exclusively on on the basis of automated processing of her personal data. The data subject also has the right to request the company to review the decision issued in a manner different from the automated form of processing, the company being obliged to comply with the data subject's request, with the beneficiary having a decisive role in reviewing the decision; the operator informs the data subject about the method of examination and the result of the finding within the time limit pursuant to the Personal Data Protection Act. data. The person concerned shall not have this right only if provided for by a special law providing for measures to safeguard the legitimate interests of the person concerned, or if, in pre-contractual relations or during the existence of contractual relations, the operator has issued a decision granting the data subject's request, or the operator has taken other appropriate measures under the contract to safeguard the legitimate interests of the person concerned.
If the person concerned exercises his right:
a) in writing and the content of its application shows that it is exercising its right, the application shall be deemed to have been submitted in accordance with the Personal Data Protection Act; the request submitted by e-mail or fax shall be delivered by the person concerned in writing no later than three days from the date of its dispatch,
b) in person orally in the minutes, from which it must be clear who exercised the right, what he is seeking and when and by whom the minutes were drawn up, his signature and the signature of the person concerned; the company is obliged to hand over a copy of the minutes to the person concerned,
c) in the case of an intermediary as referred to in point (a) or point (b), the latter shall be required to forward that request or minutes to the company without undue delay.
If the data subject suspects that his / her personal data are being processed unjustifiably, he / she may submit a motion to initiate proceedings on personal data protection to the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27, Slovak Republic or to contact the Office via its website. headquarters http://www.dataprotection.gov.sk.
If the person concerned does not have full legal capacity, his rights may be exercised by a legal representative. If the person concerned is not alive, his or her rights under this Act may be exercised by a close person.
The request of the data subject according to the Personal Data Protection Act will be processed by the company free of charge.
The application of the data subject pursuant to the Personal Data Protection Act shall be processed free of charge by the company, except for payment in an amount which may not exceed the amount of expediently incurred material costs associated with making copies, supplying technical media and sending information to the data subject, unless a special law provides otherwise.
The company is obliged to process the request of the data subject in writing in accordance with the Personal Data Protection Act no later than 30 days from the date of delivery of the request.
Restrictions on the rights of the data subject pursuant to the Personal Data Protection Act shall be notified in writing by the company to the data subject and the Office for Personal Data Protection of the Slovak Republic without undue delay.
The company hereby informed you, as the data subject, about the protection of your personal data and instructed you about your rights in relation to the protection of personal data within the scope of this written information obligation. In Bratislava, on 25.11.2020 Ilona Magdalena Lisá Witkowska