GDPR
Personal Data Processing Policy and Personal Data Protection System under the GDPR
Prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data pursuant to Articles 13 and 14 of the Regulation (hereinafter referred to as the “GDPR”) and Act No. 18/2018 Coll. on Personal Data Protection (hereinafter referred to as the “Personal Data Protection Act”).
Controller:
Schweisser Team s.r.o.
Sad SNP 8/668
010 01 Žilina
Company ID: 50 248 898
Jozef Bebčák
Phone: 0902 726 909
E-mail: cabadajova.simona@schweisserteam.sk
(hereinafter referred to as the “Controller”)
What is personal data?
Personal data means any information relating to an identified or identifiable natural person who can be identified directly or indirectly, in particular by reference to a generally applicable identifier, another identifier such as name, surname, identification number, location data, or online identifier, or by reference to one or more factors specific to the physical identity, physiological identity, genetic identity, mental identity, economic identity, cultural identity or social identity of that person.
What is the processing of personal data?
Processing of personal data means a processing operation or a set of processing operations performed on personal data or sets of personal data, in particular collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise, alignment or combination, restriction, erasure, regardless of whether it is carried out by automated or non-automated means.
The Controller is not obliged to appoint/designate a Data Protection Officer.
Sources and categories of personal data:
The Controller processes personal data (directly from you) which you have provided to it, or personal data which it has obtained based on the fulfilment of your order.
Your identification and contact data and data necessary for the performance of the contract.
Legal basis and purpose of processing:
The legal basis for processing is:
Your consent to the processing of personal data for the purposes of direct marketing pursuant to Article 6(1)(a) GDPR.
Performance of a contract between you and the Controller pursuant to Article 6(1)(b) GDPR.
Processing is necessary for compliance with a legal obligation of the Controller pursuant to Article 6(1)(c) GDPR.
The purpose of processing personal data is:
Processing your order and exercising the rights and obligations arising from the contractual relationship between you and the Controller. When ordering services, personal data necessary for the successful performance of the contract pursuant to Article 6(1)(b) GDPR are required (this also includes subsequent payment processing, delivery of goods or services, handling of complaints, etc.); the processing of the customer’s personal data takes place without the customer’s consent, as the legal basis for processing personal data for the purpose of contract performance is the specific contract between the customer and the Controller. Providing personal data is a necessary requirement for concluding and performing the contract; without providing personal data, it is not possible to conclude the contract or for the Controller to fulfil its obligations.
When operating profiles on social networks (Facebook, Instagram, LinkedIn), our interest is to increase awareness of the Controller in the online environment and to communicate with customers.
Personal data that you publish on our social network pages, such as comments, likes, videos, images, etc., are published via the social network platform. We do not further process such personal data for any other purpose.
The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her. You may send objections by e-mail to the Controller’s contact address: cabadajova.simona@schweisserteam.sk
Operators of social networks have their own adopted rules, service infrastructure and their own provisions regarding personal data protection. We have no influence over the transfer of data and the use of your data by social network operators. We recommend that you familiarize yourself with the privacy policies of the social network platform providers:
Facebook
https://www.facebook.com/policy.php
Instagram
https://help.instagram.com/519522125107875
LinkedIn
https://www.linkedin.com/legal/privacy-policy
In certain processing operations, we act as joint controllers with social network operators within the meaning of Article 26(4) GDPR.
Measurement of website traffic and improvement of services – through cookies, we obtain data on the traffic of our website, viewed information and other activities. We collect these data based on your consent granted through your browser settings. More information: “Cookie Policy”.
In order to maintain full transparency, we inform you that we will verify the accuracy of the personal data provided (where circumstances allow). If incorrect personal data or information stored in our information system is identified, we will promptly correct, restrict or delete such data. If such data have been provided, we will inform all parties involved.
The Controller does not carry out automated individual decision-making within the meaning of Article 22 GDPR.
Retention period:
The Controller retains personal data:
For the period necessary to exercise rights and obligations arising from the contractual relationship between you and the Controller and to assert claims arising from such contractual relationships.
After the expiry of the retention period arising from Act No. 395/2002 Coll. on Archives and Registries, the Controller deletes the personal data.
Recipients of personal data
Who is a recipient?
A recipient is any person to whom personal data are disclosed, regardless of whether they are a third party. A public authority that processes personal data on the basis of a specific legal regulation is not considered a recipient.
These include persons involved in the delivery of goods, services and payment execution under a contract.
The Controller does not provide, disclose or transfer personal data to third countries.
Conditions for ensuring personal data protection
The Controller declares that it has adopted appropriate personnel, technical and organisational measures to ensure the protection of personal data.
The Controller has adopted technical measures to secure data storage and personal data storage in documentary form.
The Controller declares that only authorised persons have access to personal data.
Your rights:
Under the conditions set out in the GDPR, you have:
- The right of access to your personal data pursuant to Article 15 GDPR
- The right to rectification pursuant to Article 16 GDPR
- The right to restriction of processing
- The right to erasure pursuant to Article 17 GDPR
- The right to object pursuant to Article 21 GDPR
- The right to data portability pursuant to Article 21 GDPR
- The right to withdraw consent (electronically or by post)
- The right to lodge a complaint with a supervisory authority if you believe your rights have been violated
How can you exercise your rights?
You may contact us:
By email: cabadajova.simona@schweisserteam.sk
or by post: Schweisser Team s.r.o., Sad SNP 8/668, 010 01 Žilina
Supervisory authority
Office for Personal Data Protection
Hraničná 12
820 07 Bratislava 27
Slovak Republic
Company ID: 36064220
Tax ID: 2021685985
Phone: +421 /2 3231 3214
Email: statny.dozor@pdp.gov.sk
These personal data protection policies are valid from 25 May 2018 and replace the previous data protection policy.
