GDPR

data subject

any natural person whose personal data is processed;

controller

anyone who, alone or jointly with others, determines the purposes and means of processing personal data and processes personal data in their own name; the controller, or specific requirements for its determination, may be laid down in a specific regulation or an international treaty binding on the Slovak Republic, if such regulation or treaty determines the purpose and means of processing;

processor

anyone who processes personal data on behalf of the controller;

processing of personal data

an operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure;

consent of the data subject

any freely given, specific, informed and unambiguous indication of the data subject's wishes, given either by a statement or by a clear affirmative action, by which the data subject signifies agreement to the processing of personal data relating to them;

filing system

any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

biometric data

personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;

restriction of processing

the marking of stored personal data with the aim of limiting its processing in the future;

profiling

any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

pseudonymisation

the processing of personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person;

encryption

the transformation of personal data in a way that re-processing is possible only after a chosen parameter, such as a key or password, has been entered;

online identifier

an identifier provided by an application, tool or protocol, in particular an IP address, cookies, login credentials for online services, or radio frequency identification, which may leave traces that, especially in combination with unique identifiers or other information, can be used to create a profile of the data subject and to identify them;

personal data breach

a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

recipient

anyone to whom personal data is disclosed, whether a third party or not; a public authority which processes personal data under a specific regulation or an international treaty binding on the Slovak Republic, in accordance with the data protection rules applicable to the purpose of processing, is not regarded as a recipient;

third party

anyone other than the data subject, the controller, the processor, or another natural person who, under the direct authority of the controller or processor, processes personal data.

In this step, our company decided to define which personal data it processes so that it can analyse the processing of personal data and ensure compliance with the GDPR. We define individual categories of personal data as separate filing systems (IS).

Our company will comply with the following principles of personal data processing:

Personal data will be processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency').

Our company has undertaken to process data only in a lawful manner so as not to infringe the fundamental rights of the data subject. Processing of personal data by our company will be lawful by ensuring it is based on at least one of the following legal grounds:

1. the data subject has given consent to the processing of their personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing of personal data is necessary under a specific regulation or an international treaty binding on the Slovak Republic (§ 13(1)(c) of the Data Protection Act);
4. processing is necessary to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

The legal basis for the individual filing systems (IS) is as follows:

Our company will collect personal data only for specified, explicit and legitimate purposes, and will not process it further in a manner incompatible with those purposes. Our company informs the data subject of the purpose of processing personal data before processing begins. In the section Mapping of personal data, we have set out the purposes of processing for each IS, and we will process personal data only for the purposes stated there.

Our company will process personal data in a manner that is adequate, relevant and limited to what is necessary for the purposes for which it is processed. To ensure data minimisation, our company has decided to analyse whether the data processed is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

Our company will process personal data so that it is accurate and, where necessary, kept up to date, and will take reasonable and effective steps to ensure that personal data which is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay. To ensure the principle of accuracy, our company's written consent to the processing of personal data includes the following wording: „The data subject is obliged to provide true and up-to-date personal data. In the event of a change in personal data, the data subject is obliged to notify the controller of the change without delay."

Our company will keep personal data in a form which permits identification of the data subject for no longer than is necessary for the purpose for which the personal data is processed.

Personal data at our company will be processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, erasure or damage, using appropriate technical or organisational measures.

Personal data stored in electronic documents: Our company uses Microsoft Defender antivirus software and a Microsoft firewall. Internet connection: Orange Slovensko.

Personal data stored in paper (printed) form: Physical documents are kept in folders and binders, which protects them from damage. Binders with physical documents are stored in a cabinet and in a locked office, ensuring that only authorised persons can access these documents. Physical documents are destroyed using a shredder.

Our company is responsible for compliance with the basic principles of personal data processing and for the conformity of processing with those principles, and is obliged to demonstrate this compliance at the request of the Office. Our company has reviewed its written consents to the processing of personal data to ensure they meet GDPR requirements.

The company will ensure the following conditions are met when a data subject gives consent:

1. consent to the processing of personal data must be given freely, specifically, in an informed manner and by a clear affirmative act;
2. the request for consent must be presented in a manner clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language;
3. the data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The data subject must be informed of this before giving consent. Withdrawing consent must be as easy as giving it.

Our company has reviewed its written consents to the processing of personal data to ensure they meet GDPR requirements.

Under the GDPR, it is prohibited to process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and to process genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation. This prohibition does not apply where one of the conditions set out in Article 9(2)(a)–(j) GDPR applies.

Our company processes data concerning health on the basis of Article 9(2)(b) GDPR – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

The rights of the data subject are set out in Chapter 3 GDPR, and our company undertakes to comply with them. These include, in particular, the following rights:

When processing personal data, our company will provide the data subject with the following information:

1. details of our company;
2. contact details of any data protection officer, where applicable;
3. the purposes of processing;
4. the legal basis for processing;
5. where processing is based on Article 6(1)(f) GDPR, the legitimate interests pursued by the controller or a third party;
6. the recipients or categories of recipients of personal data, if any;
7. where relevant, information that our company intends to transfer personal data to a third country or international organisation;
8. the period for which personal data will be stored, or, if not possible, the criteria used to determine that period;
9. the existence of the right to request access to, and rectification or erasure of, personal data, or restriction of processing, the right to object to processing, and the right to data portability;
10. where processing is based on consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
11. the right to lodge a complaint with the supervisory authority;
12. information as to whether the provision of personal data is a statutory or contractual requirement, whether the data subject is obliged to provide the data, and the possible consequences of failure to provide it;
13. the existence of automated decision-making, including profiling, and meaningful information about the logic involved, its significance and the envisaged consequences for the data subject.

If personal data has not been obtained from the data subject, our company will provide the data subject with all the information set out in point 6.1 of this directive, as well as the source from which the personal data originates and, where applicable, information as to whether it comes from publicly accessible sources, within a reasonable period, and no later than within one month. Our company will not provide the data subject with this information in the cases set out in Article 14(5) GDPR, in particular where:

1. the data subject already has the information;
2. providing such information proves impossible or would involve a disproportionate effort;
3. obtaining or disclosure is expressly laid down by Union or Member State law which provides appropriate measures to protect the data subject's legitimate interests.

The data subject has the right to obtain from the controller confirmation as to whether personal data concerning them is being processed and, if so, the right to access that personal data.

The data subject has the right to have the controller rectify inaccurate personal data concerning them without undue delay, and to have incomplete personal data completed, including by means of providing a supplementary statement.

The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, and the controller is obliged to erase such data without undue delay where one of the following grounds applies:

1. the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
2. the data subject withdraws the consent on which the processing is based, and there is no other legal ground for processing;
3. the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
4. the personal data has been unlawfully processed;
5. the personal data must be erased for compliance with a legal obligation under Union or Member State law;
6. the personal data was collected in relation to the offer of information society services referred to in Article 8(1).

The data subject has the right to obtain restriction of processing from the controller in any of the following cases:

1. the data subject contests the accuracy of the personal data, for a period enabling the controller to verify its accuracy;
2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
3. the controller no longer needs the personal data for the purposes of processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;
4. the data subject has objected to processing pending verification whether the legitimate grounds of the controller override those of the data subject.

Under Article 19 GDPR, the controller will communicate any rectification, erasure or restriction of processing to each recipient to whom the personal data was disclosed, unless this proves impossible or involves disproportionate effort; the controller will inform the data subject about those recipients if requested.

The data subject has the right to receive the personal data concerning them, which they provided to the controller, in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller, where processing is based on consent or on a contract and is carried out by automated means. Where technically feasible, the data subject has the right to have the data transmitted directly from one controller to another.

The data subject has the right to object, at any time, on grounds relating to their particular situation, to the processing of personal data carried out on the basis of legitimate or public interest, including profiling based on those provisions.

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

As controller, our company undertakes to comply with the following general obligations:

1. taking into account the nature, scope and purpose of processing personal data and the risks to the rights of natural persons, to adopt appropriate technical and organisational measures to ensure and demonstrate compliance of processing with the GDPR;
2. to update these measures where necessary;
3. to regularly review whether the purpose of processing personal data still applies and, once fulfilled, to ensure the data is erased without undue delay;
4. to maintain confidentiality of the personal data it processes, even after processing has ended.

Our company undertakes to implement, prior to processing and throughout the processing of personal data, data protection by design, consisting of the adoption of appropriate technical and organisational measures, such as pseudonymisation, to effectively implement appropriate safeguards for the protection of personal data and to comply with the GDPR. In doing so, it takes into account the state of the art, the cost of implementation, the nature, scope, context and purpose of processing, and the risks that processing poses to the rights of the data subject.

Our company undertakes to implement data protection by default, consisting of appropriate measures to ensure that only personal data necessary for the specific purpose is processed, limiting the amount of data collected, the extent of its processing, its storage period and accessibility. It will ensure that personal data is not, by default, made accessible without the individual's intervention to an indefinite number of natural persons.

A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. Our company, as controller, does not currently use any processors.

Our company, as controller, maintains records of processing activities and will make them available to the supervisory authority upon request. These records contain:

1. the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;
2. the purposes of processing;
3. a description of the categories of data subjects and of the categories of personal data;
4. the categories of recipients to whom the personal data has been or will be disclosed, including recipients in third countries or international organisations;
5. where applicable, transfers of personal data to a third country or an international organisation, including documentation of appropriate safeguards;
6. where possible, the envisaged time limits for erasure of the different categories of data;
7. where possible, a general description of the technical and organisational security measures referred to in Article 32(1) GDPR.

Our company, as processor, maintains records of processing activities and will make them available to the supervisory authority upon request. These records contain:

1. the name and contact details of the processor or processors and of each controller on whose behalf the processor is acting, and, where applicable, of the controller's or processor's representative and the data protection officer;
2. the categories of processing carried out on behalf of each controller;
3. where applicable, transfers of personal data to a third country or an international organisation, including documentation of appropriate safeguards;
4. where possible, a general description of the technical and organisational security measures referred to in Article 32(1) GDPR.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, our company will implement appropriate technical and organisational measures to ensure a level of security appropriate to that risk.

Authorisation to process personal data (Article 32(4) GDPR): Our company will take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data processes that data only on our instructions, unless required to do so by Union or Member State law.

In the event of a personal data breach, our company will, without undue delay and, where feasible, no later than 72 hours after becoming aware of it, notify the breach to the supervisory authority. Where notification is not made within 72 hours, it will be accompanied by reasons for the delay. The notification will contain at least:

1. a description of the nature of the breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
2. the contact details of the data protection officer at our company, where more information can be obtained;
3. a description of the likely consequences of the breach;
4. a description of the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

Our company will document every personal data breach, including the facts relating to it, its effects and the remedial action taken. Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, our company will also notify the data subject without undue delay.

Where a type of processing, in particular using new technologies and taking into account the nature, scope, context and purposes of processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller will, prior to processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. This is required in particular in cases of:

1. a systematic and extensive evaluation of personal aspects relating to natural persons based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the natural person;
2. large-scale processing of special categories of data or of personal data relating to criminal convictions and offences;
3. systematic monitoring of publicly accessible areas on a large scale.

Our company's processing activities do not include the cases set out above; therefore, a data protection impact assessment is not required.

The controller is obliged to appoint a data protection officer where:

1. the processing of personal data is carried out by a public authority or body, except for courts acting in their judicial capacity;
2. the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale;
3. the core activities of the controller or the processor consist of large-scale processing of special categories of personal data or personal data relating to criminal convictions and offences.

As our company does not meet any of the above conditions, it does not appoint a data protection officer.

The transfer of personal data which is processed or intended for processing after transfer to a third country or international organisation may only take place if the controller and processor comply with the applicable conditions, including conditions for onward transfer from that third country or international organisation to another third country or international organisation. The Office for Personal Data Protection publishes on its website a list of third countries, territories, specified sectors within a third country, and international organisations for which an adequate level of protection is ensured, available at dataprotection.gov.sk. Our company will regularly monitor this list and, when transferring personal data to countries outside this list, will proceed in accordance with Chapter 4 GDPR.

Our company is obliged to maintain confidentiality regarding the personal data it processes. This duty of confidentiality continues even after the processing of personal data has ended. Our company is also obliged to bind, by a duty of confidentiality, natural persons who come into contact with personal data at the controller or processor. This duty of confidentiality must continue even after the termination of the employment, civil service, service, or similar working relationship of that natural person.