The Company’s Information Obligation Prepared in Accordance with the Personal Data Protection Act
Operator identification data:
PRATON s.r.o., Business ID No.: 47059133, Charkovská 689/20, 040 22 Košice-Dargovských hrdinov, registered in the Commercial Register of the District Court Košice I, Section: sro, File No. 31840/V (hereinafter referred to as the “Company”) acts in the personal data processing of its employees, clients, customers or business partners (hereinafter referred to as “the data subject”) as an information system operator (hereinafter referred to as “IS“).
Legal basis for processing personal data of data subjects:
When processing personal data, the Company proceeds in accordance with Act No. 18/2018 Coll. on the Protection of Personal Data and on the Amendment and Supplementation of Certain Regulations (hereinafter referred to as the “Personal Data Protection Act”). The legal basis for personal data processing is the Personal Data Protection Act, special legal regulations and consent to personal data processing, depending on the purpose of personal data processing.
In the event that the purpose of the personal data processing, the group of persons concerned and the list of personal data are determined by a directly enforceable European Union act, the international treaty by which the Slovak Republic is bound, the Personal Data Protection act or a special Act, the Company is entitled under the Personal Data Protection Act to process personal data without the data subject’s consent.
The Company processes personal data without the consent of the person concerned, if the purpose of personal data processing, the group of persons concerned and the list of personal data or their scope is determined directly by a legally binding European Union act, an international treaty by which the Slovak Republic is bound or this Act. If a list or scope of personal data is not established, the Company may only process personal data to the extent and in the manner necessary to achieve the stated purpose of processing, while complying with the basic obligations under the Personal Data Protection Act.
The Company further processes personal data without the consent of the person concerned, if the purpose of personal data processing, the group of persons concerned and the list of personal data is stipulated by a special act only in the scope and manner stipulated by a special act. The processed personal data may only be provided, made available or published from the information system if a separate law states the purpose of providing, making available or publishing, a list of personal data that can be provided, made available or published, as well as third parties to whom personal data are provided, or the range of recipients to whom personal data is made available, unless otherwise provided by the Personal Data Protection Act.
The Company also processes personal data without the consent of the data subject, even if:
a) personal data processing is necessary for the performance of an agreement involving the person concerned as one of the parties, or in a pre-contractual relationship with the person concerned or when negotiating a change to the agreement which is carried out at the request of the person concerned,
b) personal data processing is necessary to protect the life, health or property of the person concerned,
c) the subject of the processing is exclusively the title, name, surname and address of the person concerned without the possibility of assigning other personal data to them and their use is intended solely for the needs of the operator in postal communication with the person concerned and registration of these data,
d) personal data processing that has already been published in accordance with the law and has been duly designated by the operator as disclosed; the person who claims to process the personal data disclosed will prove to the Office upon request that the processed personal data have already been lawfully published,
e) processed processing is necessary for the protection of the rights and the legitimate interests of the operator or a third party, except where the fundamental rights and freedoms of the data subject to protection prevail under this Act in processed processing.
If, due to processed processing, it is stipulated in the European Union’s legal act, the international treaty by which the Slovak Republic is bound, it is not possible to specify the individual personal data to be processed in the Personal Data Protection Act and the Special Act; the personal data list may be replaced by a range of personal data.
The Company is obliged to proceed with such processed processing in accordance with the Personal Data Protection Act, except for those operators who process personal data for the purposes of legal proceedings and in connection therewith.
If the Personal Data Protection Act does not apply to processed processing, the Company is only authorised to process personal data with the data subject’s consent.
The Company obtains the data subject consent without coercion and enforcement, as well as without the threat of rejecting a contractual relationship, services provided or obligations for the operator from legally binding European Union acts, an international treaty by which the Slovak Republic is bound.
In the event refusing to provide the Company with personal data for purposes necessary for the provision of services or for fulfilling legal obligations, the Company is entitled to notify the person concerned of the possible consequences of not providing personal data.
The persons concerned agrees to authorise processed processing by an intermediary who processes personal data on the Company’s behalf. Upon termination of the personal data processing, the Company shall dispose of these legally acquired personal data of the persons concerned within the period stipulated by applicable legal regulations and in accordance with the Company’s internal regulations.
Purpose of personal data processing:
The Company respects your privacy and considers the provided personal data to be confidential.
The Company needs to know some of the data subject’s personal data for the quality of their services and needs to provide it to other recipients in order to fulfil their legal obligations and provide the highest quality services.
The Company processes the personal data provided for several purposes.
First, the personal data of job seekers and their employees’ personal data for the purposes of personnel and payroll, and related legal obligations arising from special legal regulations.
The Company also processes their clients, customers and business partners personal data in order to ensure their business activities, taking their clients, customers and business partners interests into account.
Personal data processing for other purposes within the Company does not take place, which means that the Company only collects, stores and processes the data subject’s personal data if required in order to fulfil their services. The provided personal data is strictly protected against third party misuse by means documented in the adopted security project and security directive under the Personal Data Protection Act.
When processing personal data of the persons concerned, the Company complies with the operator’s basic obligations resulting from the Personal Data Protection Act, which include the following obligations.
The Company always uses the provided personal data for a predetermined processing purpose, which is clear, clearly defined and specific, while complying with the Constitution of the Slovak Republic, constitutional laws, laws and international treaties by which the Slovak Republic is bound.
The Company always defines the conditions for personal data processing in a way that does not restrict the data subject’s rights specified by law.
The Company only acquires the personal data of the persons concerned who, by their size and content, correspond to the purpose of the processing and are necessary to achieve it.
The Company ensures that the personal data of the persons concerned are processed exclusively in a manner consistent with the purpose for which they were collected in advance.
As the operator, the Company is only required to process the correct, complete and, where necessary, updated personal data in relation to processing purposes. Incorrect and incomplete personal data shall be blocked by the operator and then corrected or supplement without undue delay if it cannot be corrected or supplemented so that it is correct, the Company clearly identifies the personal data and disposes of it without undue delay.
The Company makes sure that a data subject’s personal data is processed in a form that allows the individual data subjects to be identified for no longer than is necessary to achieve the processing purpose.
The Company will dispose of the personal data whose processing purpose is terminated in the prescribed manner. At the end of the defined purpose, the Company is entitled to process personal data to the extent necessary for research or statistics in their anonymised form. The personal data processed in this way cannot be used by the operator to support measures or decisions taken against the data subject to limit his fundamental rights and freedoms.
Mediators:
The Company does not disclose your personal information to third parties in violation of the Data Protection Act and for the purpose of collecting it, in violation of your interests or instructions, and it is provided to a third party only for the aforementioned purpose.
In their business activities, the Company co-operates with a number of intermediaries aiming to provide quality services, while in carrying out their contractual activities, the entities process the data subject’s personal data.
The company honestly declares that when selecting individual intermediaries, they took care of their professional, technical, organisational and personnel capabilities and their ability to guarantee the security of the processed personal data by the adopted security measures pursuant to the Personal Data Protection Act.
At the same time, when selecting the appropriate intermediary, the Company proceeded in a way that the rights and interests of the persons concerned were not jeopardised.
As an operator, the Company has concluded agreements with intermediaries pursuant to the Personal Data Protection Act to ensure personal data protection processed by intermediaries, which they entrusted with personal data processing of the persons concerned only to the extent, under the terms and conditions agreed in the agreement and in accordance with the Personal Data Protection Act.
The scope and list of personal data being processed:
The Company processes a data subject’s personal data in their information systems to the extent necessary to achieve the intended purpose. It concerns the scope of personal data stipulated by special legal regulations or in the scope of consent of the person concerned to their personal data processing.
The Company only processes personal data provided to it voluntarily and to the extent necessary by the person concerned. The provision of personal data to the Company beyond the scope of special laws is voluntary.
Terms and conditions for the data subject’s personal data processing:
In its information systems, the Company processes the personal data of the persons concerned by automated and non-automated means of processing.
The Company does not disclose the processed personal data, except when required by a special legal regulation or decision of a court or other state body.
The Company will not process your personal data without your explicit consent or any other legal basis for any other purpose or to a greater extent than set forth in this information and registration sheets of each operator’s information system.
The data subject’s rights associated to their personal data processing:
The person concerned has the right to request the following from the Company in writing:
a) confirmation of whether or not personal information is processed,
b) in a generally understandable form, information on personal data processing in the information system to the extent provided by the Personal Data Protection Act; when issuing a decision under the Personal Data Protection Act, the person concerned is entitled to acquaint themselves with the process of processing and evaluating the operations,
(c) in a generally comprehensible form, accurate information on the source from which it obtained the personal data for processing,
(d) a list of their personal data which is subject to processing in a generally comprehensible form,
(e) the correction or liquidation of their incorrect, incomplete or outdated personal data that is subject to processing;
f) the destruction of their personal data whose processing purpose has ceased; if they are subject to processing official documents containing personal data, they may request their return,
g) the destruction of their personal data that is being processed if there is a law violation,
h) blocking personal data by reason of withdrawing consent before their period of validity expires, if the company processes personal data with the data subject’s consent.
The data subject’s abovementioned rights under e) and f) may only be limited only if such a restriction results from a special law or its application would violate the protection of the data subject or would infringe the rights and freedoms of others.
Under the Personal Data Protection Act, the person concerned has the right to object to:
a) their personal data, which they assume has been or will be processed for direct marketing purposes without their consent, and request their disposal,
b) the use of personal data referred to in the Data Protection Act for direct marketing purposes in postal communication, or
c) the provision of personal data referred to in the Data Protection Act for direct marketing purposes.
According to the Personal Data Protection Act, the person concerned has the right, with a written request to the Company or in person, if the matter is not deferred, to object to personal data processing in cases under the Personal Data Protection Act by justifying evidence of unlawful interference and interests protected by law which are or may be harmed by such personal data processing in a particular case; if this is not precluded by legitimate reasons and it is shown that the data subject’s objection is justified, the Company is obliged to block and destroy personal data which the person concerned has objected to without delay as soon as circumstances permit.
Pursuant to the Personal Data Protection Act, the person concerned has the right, with a written request to the Company or in person, if the matter cannot be deferred, to oppose and declare a Company decision at any time that has legal effects or significant impact if the decision is solely based on automated personal data processing. Furthermore, the data subject has the right to request that the Company reviews the issued decision by a method different from the automated form of processing, whereby the company is obliged to comply with the request of the person concerned, so that the decisive role in the decision’s review will be played by the person entitled; the manner of the examination and the result of the finding shall be notified by the operator to the data subject in accordance with the Personal Data Protection Act. The person concerned does not have this right only if it is provided for by a special law providing for measures to protect the data subject’s legitimate interests, or if in the context of a contractual relationship, the operator has issued a decision to comply with the data subject’s request or if under the agreement, the operator has taken other appropriate measures to ensure the data subject’s legitimate interests.
If the person concerned exercises their right:
a) it is apparent in writing and from the content of their application that they exercise their right, the application is deemed to have been filed under the Personal Data Protection Act; the request submitted by electronic mail or by fax shall be delivered by the person concerned in writing no later than three days from the dispatch date,
b) in person, orally in the minutes, from which it must be clear who has exercised the right, what they are seeking and when and by whom the minutes have been drawn-up, their signature and the signature of the person concerned; the company is obliged to handover a copy of the minutes to the person concerned,
(c) in the case of an intermediary pursuant to a) or b), they shall be required to handover that request or minutes to the company without undue delay.
If the person concerned suspects that their personal data is being processed unlawfully, they may file a request to initiate proceedings on Personal Data Protection with the Slovak Republic Personal Data Protection Office, located at Hraničná 12, 820 07 Bratislava 27, Slovakia or contact the registered office via http://www.dataprotection.gov.sk.
If the person concerned does not have full legal capacity, their rights may be exercised by a legal guardian.
If the person concerned is no longer living, a close person may exercise their rights under this law.
The request of the person concerned under the Personal Data Protection Act is provided by the Company free of charge.
Except as otherwise provided with a separate law, the Company shall process the data subject’s application free of charge under the Personal Data Protection Act, in addition to payment of an amount that cannot exceed the amount for purposefully incurred material costs associated with the making copies, the acquisition of technical media and sending information.
The Company is obliged to hand the request of the person concerned in writing according to the Personal Data Protection Act no later than 30 days from the request’s delivery date.
The limitation of the data subject’s rights under the Personal Data Protection Act shall be notified to the data subject in writing and the Slovak Republic Personal Data Protection Office without undue delay.
The Company informed you, as the person concerned, regarding your personal data protection and instructed you of your rights in relation to personal data protection within the scope of this written information duty.
