Information obligation:
Principles of personal data processing
according to the GDPR regulation and the new Act 18/2018 Coll. as amended
Definition:
Data subject: website visitor
Controller:
Branislav Prievozník – BAJO
M. R. Štefánika 2618/18
022 01 Čadca
IČO: 56 287 925
Pursuant to Section 44 of Act No. 18/2018 Coll. on the Protection of Personal Data, the Controller is not obliged, given the scope and subject of its activities, to appoint a responsible person/trustee. You can contact the Controller at 0910 772 750, or at the email address info@sommbajo.sk, or in person at the company’s registered office/operation.
Information on the processing of personal data
We process the personal data you provide to us responsibly, transparently and in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council and Act No. 18/2018 Coll. on the Protection of Personal Data.
Securing your personal data
No unauthorized person has access to your personal data and we do not transfer them to other entities for further processing without your consent, unless required by law. Personal data is also not transferred to intermediaries or other recipients in third countries or international organizations.
The data subject has the right to request, based on a written request to the address of the controller, information about their personal data that are the subject of processing or the destruction or correction of their personal data by the controller. The data subject is obliged to provide true and up-to-date personal data.
Rights of data subjects:
Right to rectification
Right to access to personal data
Right to erasure (to be forgotten)
Right to restriction of processing
Right to data portability
Right to object
Right to object to automated individual decision-making and profiling
Right to request access to personal data concerning the data subject from the controller
The data subject has the right to request information from the controller about whether and what personal data the controller is processing about the data subject (including the right to request a copy of this information). If the controller is processing personal data about the data subject, the data subject also has the right to information about the purpose, categories and duration of the personal data being processed, to which recipients the data have been or will be provided, or information about their source if they were obtained from someone other than the data subject.
Right to rectification
The data subject has the right to have incomplete personal data processed by the controller completed or rectified. The data subject has the right to request that the controller inform the data subject of the recipients to whom the correction of his or her personal data has been communicated.
Right to erasure
The data subject has, under the conditions set out in the GDPR, the right to obtain the erasure of personal data processed by the controller without undue delay. The data subject may exercise this right in particular where
the personal data have been processed unlawfully,
the personal data are no longer necessary for the purposes for which they were processed,
the data subject withdraws his or her consent to the processing of personal data,
the data subject objects to the processing of personal data,
the personal data were obtained in connection with the offer of information society services.
The right of the data subject to erasure shall not apply where the processing of the data subject’s personal data is necessary:
a) to exercise the right to freedom of expression and information;
b) to comply with a legal obligation;
c) for reasons of public interest in the field of public health;
d) for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, or
e) for the establishment, exercise or defence of legal claims. The data subject shall have the right to obtain from the controller the information of the recipients to whom the erasure of his or her personal data has been communicated.
Right to restriction of processing
The data subject shall have the right to obtain from the controller restriction of processing of his or her personal data where the accuracy of the personal data is contested or where the processing is unlawful and where the controller no longer needs the personal data for the purposes for which they were originally collected. If the processing of personal data has been restricted based on the exercise of the data subject’s right, such personal data may only be processed under the conditions and in the manner specified in the GDPR. The data subject has the right to request that the controller inform him/her of the recipients to whom he/she has notified the restriction of the processing of his/her personal data.
Notification obligation in connection with the rectification, erasure or restriction of the processing of personal data
The controller is obliged to notify the recipient (anyone to whom your personal data have been provided) of the rectification of your personal data, the erasure of your personal data or the restriction of the processing of personal data, unless this proves impossible or does not require disproportionate effort. If you request it, the controller will inform you of these recipients.
Right to data portability
The controller shall provide the personal data concerning the data subject, upon request, in a structured, commonly used and machine-readable format. The data subject shall also have the right to transmit those data to another controller without the original controller objecting to such transfer, where the processing is based on the consent of the data subject or on a contractual relationship between the controller and the data subject. The right to data portability to another controller shall be exercised by the controller directly, in accordance with the GDPR, where technically feasible.
Right to object to processing
Where the data subject objects to the processing of his or her personal data by the controller, which processes the data on the basis of Article 6(1)(e) (performance of a task carried out in the public interest) or (f) (legitimate interests), the controller shall not further process the personal data unless it demonstrates compelling legitimate grounds for the processing. Such legitimate reasons must objectively outweigh the interests, rights and freedoms of the data subject. The data subject may also object to the processing of his or her personal data where such data are processed for direct marketing purposes, in which case the controller may not further process such data. The data subject may also object to the processing of his or her personal data where such data are processed for scientific or historical research purposes or for statistical purposes, on grounds relating to his or her particular situation.
Right to lodge a complaint with a supervisory authority
The data subject has the right to lodge a complaint with the Personal Data Protection Authority pursuant to Section 100 of Act No. 18/2018 Coll. on the Protection of Personal Data (hereinafter referred to as the “PDP”) with the Personal Data Protection Authority of the Slovak Republic within three years of the occurrence of the event in which, according to the data subject, his or her rights have been infringed in the processing of personal data or the PDP has been infringed. The proposal to initiate proceedings must contain:
a) name, surname, correspondence address and signature of the data subject,
b) SLOVGRAM’s designation,
c) subject of the proposal with designation of the rights that were allegedly violated during the processing of personal data,
d) evidence to support the claims stated in the proposal,
e) a copy of the document or other evidence proving the exercise of the data subject’s rights under the GDPR Regulation, if the data subject has exercised such a right, or a statement of reasons worthy of special consideration for the non-exercise of the right in question, if the proposal was submitted by the data subject.
The operator hereby informs you, as the data subject, about the protection of your personal data and instructs you about your rights in relation to the protection of personal data within the scope of this written information obligation.
Automated individual decision-making, including profiling
The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
Exercise of the rights of data subjects
The controller cannot enable the exercise of the rights of the data subject automatically to anyone who requests it, but must verify the identity of the applicant for each request and determine whether it is indeed the data subject. In the case of personal contact, identity can be verified by presenting an identity document, in electronic communication via a guaranteed electronic signature.
The data subject may exercise his or her rights by submitting a request to the above-mentioned e-mail address of the responsible person or by delivering it to the address of the controller. The controller shall provide the data subject with information about the measures taken on the basis of the request without undue delay and within one month of receipt of the request. This period may be extended by a further 2 months, if necessary, taking into account the complexity of the request and the number of requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the missed deadline.
If the data subject has submitted the request by electronic means, the information shall be provided by electronic means.
The information shall be provided free of charge, except where the request is manifestly unfounded or disproportionate, in particular because of its repetitive nature. In such a case, the controller may refuse to act on the request of the data subject or may charge a reasonable fee taking into account the administrative costs incurred in handling the request.
Where the controller fails to act on the request of the data subject, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not acting and of the possibility of lodging a complaint with a supervisory authority and of seeking a judicial remedy in accordance with the Regulation, or to file a motion to initiate proceedings on the protection of personal data pursuant to the Act.
Processing based on the consent of the data subject
Where the controller processes personal data based on the consent of the data subject, the data subject shall have the right to withdraw his or her consent at any time. Withdrawal of consent shall not affect the lawfulness of the processing of personal data based on consent before its withdrawal. The data subject may withdraw consent in the same manner as he or she gave consent.
Notification of a personal data breach
In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.
The notification to the data subject shall contain a clear and plain language description of the nature of the personal data breach and at least the following information and measures:
name and contact details of the person responsible or another point of contact where further information can be obtained;
a description of the likely consequences of the personal data breach;
a description of the measures taken or proposed by the controller to remedy the personal data breach, including, where necessary, measures to mitigate its potential adverse consequences.
This notification is not required if any of the following conditions are met:
the controller has implemented appropriate technical and organisational security measures and applied them to the personal data concerned by the personal data breach,
has implemented subsequent measures to ensure that the high risk to the rights and freedoms of data subjects is no longer likely to result in consequences
it would require disproportionate effort. (In such a case, the controller shall inform the public or take other measures to ensure that the data subject is informed in an equally effective manner).
If you believe that we are not processing your personal data in accordance with applicable Slovak and Union legislation, you have the right to object and we will subsequently verify the legitimacy of your request. At the time of the objection, the processing of your personal data will be restricted until it is verified whether the objection is justified. We inform you that you also have the right to object to the processing of your personal data by us to the competent supervisory authority for the Protection of Personal Data at the following address:
Personal Data Protection Authority
Hraničná 12
820 07 Bratislava 27
Slovak Republic
Cookies
See here
How can you contact us?
With your questions about personal data protection, you can also contact us by e-mail info@sommbajo.sk or by phone at 0910 772 750:
Branislav Prievozník – BAJO
M. R. Štefánika 2618/18
022 01 Čadca
Slovak Republic