PERSONAL DATA PROTECTION POLICY
for the purpose of observing fairness and transparency towards data subjects
(prepared on the basis of Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and Section 19 of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments and Supplements to Certain Acts, under the title)
HELPLINE: 055/ 20 20 220
Prepared by: EuroTRADING s.r.o. / www.eurotrading.sk
The purpose of the processing of personal data is keeping records of incoming and outgoing mail.
Categories of data subjects: natural persons – addressees.
List of personal data: first name, surname, title, address, name of organisation, job position, e-mail address, subject and content of the mail
Legal basis for the processing of personal data: Act No. 395/2002 Coll. on Archives and Registries and on Supplements to Certain Acts, as amended
Categories of recipients: entities on which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities and processors: Inet.sk, s. r. o., Radvanská 25, 974 05 Banská Bystrica, Company ID (IČO): 45543372
Personal data are not transferred to third countries.
Time limits for the erasure of personal data:
| Routine correspondence | 3 years |
|---|
Automated decision-making, including profiling, is not carried out.
In order to comply with the data minimisation principle, all personal data provided by you are a necessary statutory requirement for fulfilling the purpose of their processing.
ACCOUNTING AND TAX DOCUMENTS
The purpose of the processing of personal data is keeping records of accounting documents and of the administrative matters associated with their processing.
Categories of data subjects: natural persons – clients, employees
List of personal data: first name, surname, title, permanent residence address, temporary residence address, telephone number, e-mail address, date of birth, type and number of identity document, signature, bank account number of the natural person
Legal basis for the processing of personal data: Article 6(1)(c) of the GDPR Regulation – processing is necessary for compliance with the legal obligations of the controller under: Act No. 431/2002 Coll. on Accounting, Act No. 222/2004 Coll. on VAT, Act No. 311/2001 Coll., the Labour Code, Act No. 152/1994 Coll. on the Social Fund, Act No. 40/1964 Coll., the Civil Code, Act No. 311/2001 Coll., the Labour Code, as amended
Categories of recipients: the Social Insurance Agency, health insurance companies, the tax office and entities on which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities and processors: CNC, a.s., Borská 6, Bratislava-Karlova Ves 841 04, Company ID (IČO): 35810408
Personal data are not transferred to third countries.
Time limits for the erasure of personal data:
| Accounting documents | 10 years |
|---|
Automated decision-making, including profiling, is not carried out.
In order to comply with the data minimisation principle, all personal data provided by you are a necessary statutory requirement for fulfilling the purpose of their processing.
JOB APPLICANTS
The purpose of the processing of personal data is keeping records of job applicants, of the CVs submitted and of accompanying documents.
Categories of data subjects: natural persons – job applicants
List of personal data: first name, surname, title, permanent residence, temporary residence, date of birth, telephone number, education, work experience, e-mail address, other data to the extent contained in the CV, cover letter and job application
Legal basis for the processing of personal data: Article 6(1)(a) of the GDPR Regulation
Categories of recipients: entities on which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities
Personal data are not transferred to third countries.
Time limits for the erasure of personal data:
| Records of job applicants | 4 months |
|---|
Automated decision-making, including profiling, is not carried out.
The data subject has the right to withdraw consent to the processing of personal data concerning him or her at any time. The withdrawal of consent does not affect the lawfulness of the processing of personal data based on consent before its withdrawal; the data subject must be informed thereof prior to giving consent. The data subject may withdraw consent in the same manner in which consent was given.
CONTRACTS WITH NATURAL PERSONS
The purpose of the processing of personal data is the preparation, conclusion and performance of contractual relationships with natural persons.
Categories of data subjects: natural persons – contracting parties
List of personal data: first name, surname, title, permanent/temporary residence, account number of the natural person, name of bank, identity card number, data relating to the subject matter of the contract
Legal basis for the processing of personal data: Article 6(1)(b) of the GDPR Regulation
Categories of recipients: entities on which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities and processors: Peter Farkaš, advokátska kancelária spol. s r.o., Puškinova 16, Prešov 080 01, Company ID (IČO): 36855928
Personal data are not transferred to third countries.
Time limits for the erasure of personal data:
| contracts | 10 years |
|---|
Automated decision-making, including profiling, is not carried out.
In order to comply with the data minimisation principle, all personal data provided by you are a necessary contractual requirement for fulfilling the purpose of their processing.
CONTACT FORM
The purpose of the processing of personal data is handling and keeping records of communications sent via the contact form.
Categories of data subjects: natural persons – persons contacting the controller via the contact form
List of personal data: first name, surname, e-mail, place of residence, telephone number
Legal basis for the processing of personal data: Article 6(1)(a) of the GDPR Regulation – consent of the data subject
Categories of recipients: courts, law enforcement authorities, other public authorities in accordance with the law
and processors: Inet.sk, s. r. o., Radvanská 25, 974 05 Banská Bystrica, Company ID (IČO): 45543372
Personal data are not transferred to third countries.
Time limits for the erasure of personal data:
| contact form | a maximum of 6 months (in the case of the fulfilment of the controller’s statutory obligations or the exercise of its legal claims under applicable legislation). |
|---|
Automated decision-making, including profiling, is not carried out.
The data subject has the right to withdraw consent to the processing of personal data concerning him or her at any time. The withdrawal of consent does not affect the lawfulness of the processing of personal data based on consent before its withdrawal; the data subject must be informed thereof prior to giving consent. The data subject may withdraw consent in the same manner in which consent was given.
REQUESTS BY DATA SUBJECTS TO EXERCISE THEIR RIGHTS
The purpose of the processing of personal data is keeping records of and handling requests by data subjects when exercising their rights under the GDPR Regulation.
Categories of data subjects: natural persons – applicants exercising data subject rights under the GDPR
List of personal data: title, first name, surname, permanent residence, e-mail address
Legal basis for the processing of personal data: Article 6(1)(c) of the GDPR Regulation
Categories of recipients: the supervisory authority (e.g. the Office for Personal Data Protection of the Slovak Republic), courts, law enforcement authorities, other public authorities
Personal data are not transferred to third countries.
Time limits for the erasure of personal data:
| request | 5 years |
|---|
Automated decision-making, including profiling, is not carried out.
In order to comply with the data minimisation principle, all personal data provided by you are a necessary statutory requirement for fulfilling the purpose of their processing.
VISITORS’ BOOK
The purpose of the processing of personal data is keeping records of entries by a natural person, and the identification of the person and recording of the person’s movements.
Categories of data subjects: natural persons – visitors
List of personal data: first name, surname, identity card/service card number, time of arrival and departure
Legal basis for the processing of personal data: Article 6(1)(f) of the GDPR Regulation
Categories of recipients: entities on which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities and processors: SYSTEM ALARM, s. r. o., Pri hati 14778/8, Prešov 080 05, Company ID (IČO): 43971113
Personal data are not transferred to third countries.
Time limits for the erasure of personal data:
| Visitors’ book | 5 years |
|---|
Automated decision-making, including profiling, is not carried out.
The main legitimate interest is the protection of the property, financial and other interests of the controller, as well as the protection of the property, life and health of data subjects
CAMERA INFORMATION SYSTEM
The purpose of the processing of personal data is the protection of the controller’s property, and the protection of the property, life and health of data subjects.
Categories of data subjects: persons present in the area monitored by the camera system
List of personal data: camera recording without audio recording
Legal basis for the processing of personal data: Article 6(1)(f) of the GDPR Regulation
Categories of recipients: in justified cases, the recording from the camera system may be provided to courts, law enforcement authorities and other interested entities with a view to fulfilling the purpose of the processing (e.g. an insurance company). Otherwise, the personal data are not provided or disclosed, and no cross-border transfer of such personal data takes place
Personal data are not transferred to third countries.
Time limits for the erasure of personal data:
| video recording | 3 days |
|---|
Automated decision-making, including profiling, is not carried out.
The main legitimate interest is the protection of the property, financial and other interests of the controller, as well as the protection of the property, life and health of data subjects.
REPORTING OF ANTI-SOCIAL ACTIVITY
The purpose of the processing of personal data is the administration necessary to fulfil the controller’s statutory obligation when investigating reports submitted for the investigation of anti-social activity.
Categories of data subjects: natural persons who have made a report
List of personal data: title, first name and surname, residential address of the person who made the report, date of receipt of the report, subject of the report, outcome of the examination of the report, date of completion of the examination of the report
Legal basis for the processing of personal data: Article 6(1)(c) of the GDPR Regulation: Act No. 54/2019 Coll. on the Protection of Whistleblowers of Anti-Social Activity and on Amendments and Supplements to Certain Acts
Categories of recipients: entities on which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities
Personal data are not transferred to third countries.
Time limits for the erasure of personal data:
| Reports | 3 years |
|---|
Automated decision-making, including profiling, is not carried out.
In order to comply with the data minimisation principle, all personal data provided by you are a necessary statutory requirement for fulfilling the purpose of their processing.
Data subjects whose personal data are processed for specifically defined purposes may exercise the following rights:
Right to request access to one’s personal data – Right to rectification of personal data – Right to erasure of personal data – Right to restriction of processing of personal data – Right to object to the processing of personal data – Right to portability of one’s personal data – Right to lodge a complaint with the supervisory authority, i.e. the Office for Personal Data Protection of the Slovak Republic.
The above rights of the data subject are specified in more detail in Articles 15 to 21 of the Regulation. The data subject exercises these rights in accordance with the Regulation and other applicable legislation. The data subject may exercise his or her rights against the controller by means of a written request or by electronic means. Where the data subject requests that information be provided orally, the information may be provided in that manner on condition that the data subject has proven his or her identity.
FROST a.s. Prešov has adopted all appropriate personnel, organisational and technical measures to ensure the maximum protection of your personal data, with the aim of reducing the risk of their misuse to the greatest possible extent. In accordance with our obligation arising from Article 34 of the Regulation, we hereby inform you, as data subjects, that should a situation arise in which we, as the controller, breach the protection of your personal data in a manner that is likely to result in a high risk to the rights and freedoms of natural persons, we will notify you of this fact without undue delay.
Legislation and the related methods of processing your personal data may change. If we decide to update this policy, we will post the changes on our website and inform you of these changes. Where a more substantial change to this policy is to be made, or where the law so requires, we will inform you in advance. We ask you to read this policy carefully and to check it regularly in the course of further communication with us or use of our website.
If you have any question regarding the processing of your personal data, including the exercise of the rights set out above, you may contact our Data Protection Officer, provided by EuroTRADING s.r.o. (www.eurotrading.sk), by e-mail at zo@eurotrading.sk. We will duly examine all your submissions and complaints and send you our response.
If you are not satisfied with our response, or you believe that we are processing your personal data unfairly or unlawfully, you may lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, https://dataprotection.gov.sk, e-mail: statny.dozor@pdp.gov.sk.
Controller: FROST a.s. Prešov, Petrovianska 290/34B, 080 01 Haniska, Company ID (IČO): 36472476