1. Purpose of processing personal data:
Personal data are processed for the purpose of sending commercial offers, the purpose of which is (for example) informing the customer about the controller’s new goods and services with the aim of supporting their sales. Commercial offers are sent to data subjects who have given their consent to the controller.
2. Lawfulness of processing personal data:
Personal data are processed on the basis of Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
3. Statutory obligation to process personal data:
When processing personal data for the above-mentioned purpose, the provisions of Act No. 452/2021 Coll. on Electronic Communications are taken into account.
4. List of personal data:
Personal data are processed in the following scope: email address.
5. Data subjects:
Data subjects are persons who have given the controller their consent to the sending of commercial (marketing) offers.
6. Personal data retention periods:
Personal data are processed until consent is withdrawn, but for a maximum period of 5 years from when it was given. After consent is withdrawn, the consent is archived for 4 years from its withdrawal.
7. Legitimate interest of the controller:
Processing of personal data for the purposes of the legitimate interests of the controller is not carried out.
8. Transfer of personal data to third countries:
Personal data are not provided to third countries.
9. Technical and organisational security measures:
Organisational and technical measures for the protection of personal data are set out in the controller’s internal regulations. Security measures are carried out in the areas of physical and premises security, information security, cryptographic protection of information, personnel and administrative security, and protection of sensitive information, with precisely defined powers and duties set out in the security policy.
10. Category of personal data.
Ordinary personal data.
11. Publication of personal data:
Personal data are not published.
12. Automated individual decision-making and profiling:
Not carried out.
13. Processor:
| Marketing platform (focused on mailing) | on the basis of Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) |
14. Other authorised entity:
| Other authorised entity | Legal basis | Scope of personal data transferred to a third party |
|---|---|---|
| Public authorities | Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not, however, be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing. | Personal data to the extent requested by the authorised entity (e.g. the Police in the course of investigating offences or criminal offences) |
15. Rights of the data subject
The data subject has the right to request from the controller access to the personal data processed about them, the right to rectification of personal data, the right to erasure or restriction of processing of personal data, the right to object to the processing of personal data, the right not to be subject to automated individual decision-making, including profiling, the right to data portability, as well as the right to submit a petition to initiate proceedings to the supervisory authority. Where the controller processes personal data on the basis of the data subject’s consent, the data subject has the right to withdraw their consent to the processing of personal data at any time. The withdrawal of consent does not affect the lawfulness of processing of personal data based on consent before its withdrawal. The data subject may exercise their rights by sending an email to the controller’s address, or in writing to the controller’s address. The handling of data subjects’ rights is ensured individually through the responsible person (the person designated by the controller).
This document is a translation of the Slovak original. The Slovak version is the primary version and prevails in case of any discrepancies.
