Operator´s declaration on the protection of personal data and their handling
according articles 13 and 14 of Regulation (EU) 2016/679 of the European parliament and of the Council (EU) of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
1. Contact data of operator
The owner and operator, that processes personal data is company doem, s.r.o., Komenského 31, 010 01 Žilina, IČO: 36 395 480, registered in the Commercial Register of the District Court of Žilina, section.: Sro, insert no.12577/L, (hereinafter referred to as "the operator“).
The persons concerned may address their comments and requests concerning the processing of personal data to the company doem, s.r.o.; in writing or in person at: Komenského 52/A, 010 01 Žilina
- in time from 8:00 to 16:00 during the working week,
- tel. contact 041/500 15 08; e-mail: email@example.com
Your personal data is processed legally, correctly, transparently and kept safe for the time necessary to fulfill the purpose of the processing. Only persons authorized by the operator to process personal data have access to your personal data. The personal data processed is not sensitive. The transfer of your personal data to third countries or international organizations does not take place. Automated decision-making, including profiling, is not performed.
2. Purpose and legal basis of the processing of personal data
The operator processes your personal data for these purposes:
a) Management of accounting and business agenda of the businessman
Personal data from the field of accounting and business agenda. Personal data are stored for the period required by Act no. 431/2002 Coll. on accounting as amended, Act no. 222/2004 Coll. on value added tax, Act No. 595/2003 Coll. on income tax, as amended, and the like (10 years). The legal basis for the processing of personal data is the fulfillment of the legal obligation in the sense of Art. 6 par. 1 letter c) Regulations. The recipients of personal data are public authorities.
b) Preparation and conclusion of an employment contract or agreement on work outside the employment relationship and the obligations of the employer arising therefrom
Personal data from the field of personnel and payroll agenda and from the field of occupational health and safety. Personal data from the area of personnel and payroll agenda are stored for the period of reaching the age of 70 of the employee (including the former). Personal data from the area of occurpational health and safety are stored for the period of 2 years from termination of employment. The legal basis for processing is the fulfillment of the legal obligation in the sense of Art. 6 par. 1 letter c) Regulations and an employment contract or agreement within the meaning of Art. 6 par. 1 letter b) Regulations concluded with the person concerned pursuant to the Labor Code. The data subject is required to provide complete and true personal data to the extent necessary; in the failure to provide personal data, it is not possible to conclude an employment or similar contract.
Recipients of the employee's personal data will be: health insurance companies, Social Insurance Agency, educational agencies and trainers, entity providing HSE, occupational health assessment, medical fitness assessment, external company providing OSH, labor inspectorate, postal service providers, telecommunications service providers, customers and employer suppliers, entities providing development, administration support of information technologies, the company on whose servers personal data is stored, public authorities in special cases also courts, law enforcement authorities and executors.
c) Demonstration of the professional competence of the operator's employees when entering another employer's construction site
Personal data of employees are processed for this purpose in accordance with Art. 6 par. 1 letter c) Regulations, resulting primarily from Act No. 124/2006 Coll. on safety and health protection at work and on amendments to certain laws as amended. Personal data is stored for the period of termination of the employee's employment. The recipients of personal data are the customers which ordering the performance of work performed by the employees of the operator, and the recipients may also be state administration bodies, in the case of an inspection.
d) Concluding and fulfilling the subject of the contract and contractual relations
Personal data from the area of contracts concluded between the operator and the buyer. Personal data such as the name of the company (title, name and surname), registered office of the company (address, delivery address), ID number, VAT number, VAT number of the natural person of the entrepreneur are processed and stored for the period required by Act no. 431/2002 Coll. on accounting as amended. Especially according to Act no. 222/2004 Coll. on value added tax (10 years). The processing of personal data such as email and telephone contact is also necessary for the performance of a distance contract. Due to archiving, their storage period is also 10 years after the buyer has placed the order. The legal basis for the processing of personal data is the legitimate interest of the operator - the right to conduct business within the scope of subject its activity with art. 6 par. 1 letter b) Regulations. When concluding a distance contract of purchase, the recipients of personal data by the customer are the chosen transport companies: Direct Parcel Distribution SK, s.r.o. with head office Rožňavská 1, 83104 Bratislava, IČO: 35834498 and Slovenský doručovací systém, s.r.o. with head office Družby 22, 97401 Banská Bystrica, IČO: 45497885 (Intermediary). In special cases, the recipients of personal data may also be courts and law enforcement agencies.
e) Preparation and implementation of business activities of the operator
Personal data from the field of business communication. Doba uchovania takýchto osobných údajov je 5 rokov po zaniknutí obchodnoprávneho vzťahu. The legal basis for the processing of personal data is a legitimate interest watched by the operator in accordance with art. 6 par. 1 letter f) Regulations and thus the right to conduct business within the scope of subject its activity. The recipients of personal data in the field of business communication are information technology management and support companies, telecommunications service providers, data storage providers and, in special cases, courts and law enforcement agencies.
f) Insurance and documentation of a damage event in the exercise of a profession
Personal data from the area of insurance and the formation of an insured event. Personal data is stored for as long as stipulated by special regulations. The legal basis for the processing of personal data is a legitimate interest watched by the operator in accordance with art. 6 par. 1 letter f. Regulation. The recipients of personal data are: commercial insurance companies, courts and law enforcement agencies.
g) Protection of the operator's property and the health of natural persons moving in the monitoring area, as well as the acquisition of evidence in the event of formation of security incidents.
Personal data obtained from the monitoring of the operator's outdoor and indoor areas by a camera system. The retention period for such personal data in the form of videos is 15 days. The legal basis for the processing of personal data is the legitimate interest of the operator or a third party - the right to protection of property, the right to protection of health of natural persons and the right to require respect for public policy with art. 6 par. 1 letter f) Regulations. The purpose of processing personal data obtained in this way is: to prevent access of unauthorized persons to the premises of the operator, to prevent the occurrence of crime, security breaches and crime detection. From the point of view of the security of personal data processing, video recordings are stored in a protected area and in a storage that is not connected to the Internet. Only authorized persons of the operator have access to the video recordings. Only the necessary space is monitored, which does not restrict the rights of persons to their privacy and is properly marked. The monitoring by the camera system is indicated by pictograms, which are located at the entrances to the recorded area and contain a camera symbol with a warning to monitor the area, the identification of the operator processing personal data with a link to more detailed information about their processing. Surrounding subjects thus have the opportunity to decide whether to enter the monitored area. The operator's employees are informed of the presence of cameras in internal regulation. When criminal activity arises, the recipients of personal data are courts and bodies active in criminal proceedings.
h) Requests of data subjects
Personal data of natural persons apllying the rights of the persons concerned shall be processed for the purpose of fulfilling the legal obligations of the operator pursuant to art. 6 par. 1 letter c) Regulations, necessary to fulfill the legal obligation of the operator arising from the regulation and from act no. 18/2018 coll. The retention period of such personal data is 5 years. The recipients are the authorized state authorities if the provision of data takes place on the basis of a legal obligation, the Office for Personal Data Protection of the Slovak Republic and entities to which the provision of personal data are operator given by law.
i) Realization of selection procedure/ recording of job seekers
Common personal data of the job seeker. Personal data is processed only with the consent of the data subject. Uchovávané sú po dobu ukončenia výberového konania, avšak v prípade rozhodnutia dotknutej osoby ukončiť proces výberového konania je možné kedykoľvek ho odvolať prostredníctvom e-mailu zaslaného na adresu: firstname.lastname@example.org.
j) Marketing sending of newsletters via e-shop
Personal data: e-mail. Personal data is processed only with the consent of the data subject. Consent to the processing of personal data is provided for an indefinite period, but it can be revoked at any time via e-mail sent to: email@example.com
k) Contacting the operator via the web form
Personal data: name and e-mail are mandatory, tel. no. is optional. Personal data is processed for the purpose of recording and processing suggestions, questions, complaints, claims and other messages addressed to us. Personal data is processed with the consent of the data subject, who will give it by ticking the box. It is not possible to send the message without the consent. Consent to the processing of personal data is provided for the duration of the specified purpose, but it can be revoked at any time via e-mail sent to the address: firstname.lastname@example.org.
3. The Rights of the data subject
The data subject has the right to access to his or her personal data. Based on request of data subject, operator shall issue a confirmation, as to whether the personal data of the data subject concerning him or her are being processed. If the operator processes this data, he shall issue a copy of these personal data of data subject, upon request. Issuance the first copy is for free according to par.7. For any additional copies which the person will request, the operator shall charge a fee corresponding to the administrative costs incurred to issue the copy. If a person requests information by electronic means, it will be provided in a commonly used electronic form, by e-mail, unless he requests otherwise.
The data subject has the right to repair her or his personal data, if operator reords incorrect personal data about her or his. At the same time, the data subject has the right to complete an incomplete personal data. The operator shall correct or supplement personal data without undue delay after the person concerned has requested his.
The data subject has the right to deletion of his or her personal data, concerning him or her, provided that:
a) personal data are no longer needed for the purposes for which they were obtained or otherwise processed,
b) the data subjekt withdraws the consent on the basis of which the processing is carried out,
c) the data subject objects to the processing of personal data pursuant to para. 17,
d) personal data has been processed illegally,
e) the reason for the deletion is the fulfillment of the obligation of a law, special regulation or international agreement by which the Slovak Republic is bound, or
f) personal data was obtained in connection with the offer of information society services to a person under 16 years of age.
The data subject will not have the right to delete personal data provided that their processing is necessary:
g) for application the right to freedom of expression and information,
h) to fulfill an obligation under the law, a special regulation or an international agreement by which the Slovak Republic is bound, or to fulfill a task carried out in the public interest or in the exercise of public power entrusted to the operator,
i) for reasons of public interest in the field of public health,
j) for the purposes of archiving in the public interest, for the purposes of scientific or historical research or for statistical purposes, in so far as the right of erasure is likely to make it impossible or seriously difficult to achieve the objectives of such processing, or
k) to proving, asserting or defending legal claims.
The operator shall delete the personal data of the data subjects based on request, without undue delay, after assessing that the data subject's request is justified.
The data subject has the right to restrict the processing of personal data, if:
l) challenges the accuracy of personal data by an objection pursuant to para. 17, during a period allowing the operator to verify the accuracy of the personal data,
m) the processing is illegal and the data subject requests a restriction on their use instead of deleting personal data,
n) the controller no longer needs personal data for processing purposes, but the data subject needs them to proving, asserting or defending legal claims,
o) the data subject objected to the processing of personal data on the basis of the operator's legitimate interest, until it is verified that the legitimate reasons on the part of the controller outweigh the legitimate grounds of the data subject.
If the data subject requests a restriction on the processing of his personal data, the operator shall not carry out any processing operations on the data concerned, other than storage, without the consent of the data subject.
The data subject will be informed by the operator if the restriction on the processing of such data is lifted.
The data subject has the right to the portability of data, which means obtaining personal data which he has provided to the controller, while having the right to transfer such data to another operator in a normally usable and machine-readable format, provided that the personal data have been obtained with the consent of the person concerned or under contract and their processing takes place in the form of automated means.
The data subject has the right to object at any time to the processing of his or her personal data on grounds relating to his or her specific situation. The data subject may object to the processing of his or her personal data on the basis of:
p) the legal title for the fulfillment of tasks implemented in the public interest or in the exercise of public power, or the legal title of the legitimate interest of the operator,
q) processing of personal data for direct marketing purposes,
r) processing for purporses of scientific or historical research or for statistical purposes. If the data subject objects to the processing of personal data for the purposes of direct marketing pursuant to para. 17 letter b), his or her personal data may not be further processed by the operator.
The operator shall assess the objection received in a reasonable time. The controller may not further process personal data unless it demonstrates the necessary legitimate interests for the processing of personal data which prevail over the rights or interests of the data subject or the reasons for asserting a legal claim.
The data subject has the right to withdraw his consent to the processing of personal data at any time, provided that the processing of personal data was based on this legal title.
The person concerned shall revoke his consent by contacting the operator with his request in any chosen manner. However, the lawfulness of the processing of personal data on the basis of the granted consent is not affected by its revocation.
The data subject has the right to file a motion to initiate proceedings with the Office for Personal Data Protection of the Slovak Republic if he or she considers that his or her rights in the field of personal data protection have been violated.