Povinné informovanie

The Regulation of the European Parliament and of the Council (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/ES (General Data Protection Regulation) (hereinafter referred to as “Regulation GDPR) and Act No. 18/2018 Coll. on the personal data protection and on amendments and supplements to certain acts as amended (hereinafter referred to as “Act”) guarantee you as a Data subject the following rights:

1. right of a Data subject to access personal data, the content of which is:

• the right to obtain a confirmation from the Controller if the personal data relating to the Data subject is being processed;
• if the personal data of the Data subject is being processed, the right to acquire the access to the processed personal data and the right to obtain such information:
• the information about the purposes of processing;
• the information about the categories of personal data concerned;
• the information about the recipients or categories of recipients whom the personal data has been or will be provided to, particularly in case of third- country recipients or international organisations;
• if possible, the information about the assumed retention period of personal data, or if not possible the information about the criteria for its determination;
• the information about the existence of the right to request from the Controller the alternation of personal data relating the Data subject, its erasure or restriction of processing and the existence of the right to object against such processing;
• the information about the right to file a complaint to a supervisory authority;
• if personal data has not been obtained from the Data subject, any available information as regards its source;
• the information about the existence of automated decision-making including profiling stated in Art. 22 (1) and (4) of Regulation and in such cases at least the meaningful information about the procedure used as well as the meaning and assumed consequences of such personal data processing for the Data subject;
• the right to be informed about reasonable warranties under Art. 46 of Regulation relating to the portability of personal data, if the personal data is transferred to a third country or international organisation;
• the right to provide the copy of personal data that is being processed, however, only under the condition that the right to provide the copy of processed personal data may not have adverse consequences to rights and freedoms of the others is fulfilled;

 

Right of the Data subject to access personal data in its principle means that the Data subject has the right to obtain a confirmation from us whether the personal data concerning Them is being processed and if so, the Data subject has the right to obtain the access to this data. We will provide the copy of personal data that is being processed at the request of the Data subject. We may charge a reasonable fee corresponding to the administrative costs for any other copy that will be requested by the Data subject. If the Data subject has filed an application electronically, information shall be provided in a commonly used electronic form unless the Data subject has requested another method. Information must be provided immediately no later than within the period of 1 month. We have the right to prolong the processing period of the request for another 2 months if the request is demanding or frequent. However, the Data subject must be informed within 1 month about the reason of the prolongation in the processing period. In the event of an unreasoned or too frequent request, we have the right to charge a fee proportionate to the costs or to refuse the request. We must explain the reason of the refusal and the right of the Data subject to turn with the request to a supervisory authority.    

1. right of a Data subject to rectification of personal data, the content of which is:

• the right to rectify inaccurate personal data related to the Data subject by the Controller without undue delay;
• the right to supplement the incomplete data of the Data subject also through the provision of a supplementary statement of the Data subject;

 

Right of the Data subject to rectification of personal data means that you may request us to rectify or supplement your personal data if it is inaccurate or incomplete. The Data subject has the right to supplement incomplete personal data also through the provision of a supplementary statement 

1. right of the Data subject to erasure of personal data (so-called “right to be forgotten”), the content of which is:

• the right to achieve the erasure of personal data related to the Data subject without undue delay if any of the following reasons is fulfilled:
• the personal data is no longer needed for the purposes it has been collected or otherwise processed;
• the Data subject shall withdraw the consent on the basis of which the processing is being carried out and under the condition that there is no legal basis for the processing of personal data;
• the Data subject objects to the processing of personal data under Art. 21 (1) of Regulation and no legitimate grounds prevail for the processing of personal data or the Data subject objects to the processing of personal data under Art. 21(2) of Regulation;
• personal data has been processes unlawfully;
• personal data must be erased in order to comply with a legal obligation under the European Union or other Member State law to which the Controller is subject;
• personal data has been collected in connection to the offer of the information society services pursuant to Art. 8 (1) of Regulation;
• the right that the Controller who has made the personal data of a Data subject public, taking into account the available technology and the costs of implementation, shall take reasonable steps including technical measures to inform Controllers, who are processing personal data, that the Data subject has requested Them to erase any links to such personal data, their copy or replications;

yet it applies that the right to erasure of personal data containing rights pursuant to Art. 17 (1) and (2) of Regulation [i.e. with the content of rights pursuant to (i) and (ii) of this c) pt. J. herein] shall not be established as long as the processing of personal data is necessary:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by the European Union or Member State law to which the Controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
3. for reasons of public interest in the area of public health in accordance with Art. 9 (2) (h) and (i) of the Regulation as well as Art. 9 (3) of the Regulation;
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 (1) of the Regulation in so far as the right referred to in Art. 17 (1) is likely to render impossible or seriously obstruct the achievement of the objectives of such processing; or
5. for the establishment, exercise or defence of legal claims;

 

Right of the Data subject to erasure of personal data means that we must erase your personal data if (i) it is not necessary for the purposes for which it has been collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no prevailing reasons for the processing, or (iv) it is imposed on us by a legal obligation.

1. Right of a Data subject to restriction of personal data processing, the content of which is:

• the right of a Data subject that the Controller restricts the processing of personal data where one of the following applies:
• the accuracy of the personal data is contested by the Data subject, for a period enabling the Controller to verify the accuracy of the personal data;
• the processing is unlawful and the Data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data subject for the establishment, exercise or defence of legal claims;
• the Data subject has objected to processing pursuant to Art 21 (1) pending the verification whether the legitimate grounds of the Controller override those of the Data subject
• the right that the processing of personal data be restricted pursuant to sub-point (i) of this (d) of pt. J. herein, such restricted processed personal data have been processed with the exception of storing solely with the consent of the Data subject or for establishing, exercising or defending legal claims, or for the protection of rights of other natural or legal person, or for reasons of an important public interest of the European Union or a Member State;
• the right to be informed in advance about the cancellation of the restriction of the personal data processing;

 

1. right of the Data subject to comply with the notification obligation against recipients, the content of which is:

• the right so that the Controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17 (1) and Article 18 of Regulation to each recipient to whom the personal data has been provided, unless this proves impossible or involves disproportionate effort;
• the right so that the Controller informs the Data subject about those recipients if the Data subject requests it;

 

Right of the Data subject to comply with the notification obligation against recipients means the obligation of the Controller to inform every recipient who was provided with the personal data of the Data subject about every rectification or erasure of the personal data or the restriction of its processing. The Controller shall not have this obligation only if such notification from objective reasons proves impossible or involves disproportionate effort.

 

1. right of the Data subject to portability, the content of which is:

• the right to receive the personal data which They have provided to the Controller in a structured, commonly used and machine-readable format and have the right to transfer this data to another Controller without hindrance from the Controller to which the personal data have been provided, where:
• the processing is based on the Data subject´s consent pursuant to Art. 6 (1) (a) of Regulation or Art. 9 (2) (a) of Regulation or based on a contract pursuant to Art. 6 (1) (f) of Regulation and simultaneously
• the processing is carried out by automated means, and simultaneously
• the right to receive the personal data in a structured, commonly used and machine-readable format and the right to transfer this data to another Controller without hindrance from the Controller to which the personal data have been provided, it will not have adverse consequences on the rights and freedoms of the others;
• the right to transfer personal data directly from one Controller to the second Controller, if technically possible;

 

Right to data portability means the right to receive the personal data that has been provided to us in a structured, commonly used and machine-readable format and the Data subject shall have the right to request to have the personal data transferred directly from one Controller to another provided lawful conditions are complied with; your right to erasure shall not be affected by applying this right. The right to portability only concerns this personal data we have obtained from you based on a contract to which you are a contractual party

 

1. right of the Data subject to object, the content of which is:

• the right to object, on grounds relating to his or her particular situation of the Data subject to processing of personal data concerning the Data subject that is carried out based on Art. 6 (1) (e) or (f) of Regulation including objecting to profiling based on these provisions of Regulation;
• [to object at any time from the reasons relating to a specific situation of the Data subject to the personal data processing that concerns Them that is carried out based on Art. 6 (1) (e) or (f) of Regulation including objection to profiling based on these Regulation provisions in the case of executing the right] the right so that the Controller shall not further process personal data of the Data subject unless it establishes necessary legitimate reasons for the processing that outweigh the interests, rights and freedoms of the Data subject, or reasons for proving, applying or defending legal claims;
• the right to object to the processing of personal data concerning the Data subject at any time, for the purposes of direct marketing including profiling in the scope it relates to direct marketing; while it applies that if the Data subject objects to the processing of personal data for the purposes of direct marketing, personal data must not be processed for such purposes;
• (in connection to using services of information society) the right to apply the right to object to the processing of personal data through automated means using technical specifications;
• the right to object to the processing of personal data from the reasons relating to a specific situation of the Data subject, if the personal data is being processed for scientific or historical research purposes or for statistical purposes under Art. 89 (1) of Regulation, however, with the exception of cases where the processing is necessary for the tasks fulfilment because of a public interest;

 

Right of the Data subject to object means that you as the Data subject can object to your personal data processing that we process for the purposes of direct marketing or legitimate grounds. When processing personal data for the purposes of direct marketing or legitimate grounds, we will cease immediately upon the receipt of the objection.    

1. right of the Data subject relating to individual automated decision-making, the content of which is:

• the right not to be subject to a decision based solely on automated processing, including profiling which produces legal effects that concern the Data subject or similarly significantly affect the Data subject with the exception of cases pursuant to Art. 22 (2) of Regulation [i.e. with the exception of cases if a decision is: (a) necessary for entering into, or performance of, a contract between the Data subject and the Controller, (b) authorised by the European Union or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard the Data subject's rights and freedoms and legitimate interests; or (c) based on the Data subject's explicit consent].

 

Right of the Data subject in connection to individual automated decision-making means that the Data subject has the right not to be subject to a decision that is based solely on automated processing, including profiling which produces legal effects that concern you or similarly significantly affect you. In cases where such processing is necessary for entering into or performance of a contract or based on an explicit consent of the Data subject, the Controller shall implement suitable measures to safeguard the Data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the Controller, to express Their point of view and to contest the decision.

 

1. right of the Data subject to file a proposal to initiate a proceeding pursuant to the provision Sec. 100 of the personal data protection act, the content of which is:
   1. the right of the Data subject who assumes that Their personal data has been unlawfully processed or misused to file a proposal to initiate a proceeding on personal data protection to the Office for Personal Data Protection of the Slovak Republic (hereinafter referred to as “Office”).
   2. a proposal to initiate a proceeding may be filed in writing, personally in oral form into the minutes, electronically while the Data subject must be signed by a secured electronic signature, by telegraph or telefax which must be filed in writing or orally into the minutes within 3 days.
   3. Pursuant to the provision Sec. 100 (3) of the Personal Data Protection Act, the proposal concerned must contain:
      1. name, surname, permanent residence and applicant´s signature,
      2. an indication of the person against whom the proposal is directed; name (of a company) or name and surname, registered office or permanent residence, or legal form and identification number,
      3. the subject of the proposal with an indication of which rights have been breached during processing according to the applicant,
      4. evidence to support statements in the proposal,
      5. the copy of the document proving the exercise of the right pursuant to Sec. 28, if such right might have been applied or the statement of reasons worth of special consideration.
      6. Office subsequently decides about the applicant´s proposal within 60 days as of the date of the initiating of the proceeding. Office may reasonably prolong this period in justified cases, but not more than 6 months. The parties to the proceeding shall be informed by Office about the prolonging of the proceeding.

•  

A sample of the proposal to initiate the proceeding on personal data protection can be found on Office´s website (https://www.dataprotection.gov.sk/uoou/sites/default/files/kcfinder/files/WEB-vzor_navrhu.pdf).