Povinné informovanie

The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing the Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as "GDPR Regulation") and Act No. 18/2018 Coll. on the Protection of Personal Data and on amendments to certain laws (hereinafter referred to as the "Act"), provide you, as the Data Subject, with the following rights:

a) the right of the Data Subject to access personal data, the content of which is: 

• the right to obtain from the Operator a confirmation of the processing of personal data relating to the Data Subject;

• if the personal data of the Data Subject is processed, the right to access the processed personal data and the right to obtain the following information:

- information on the purposes of the processing;

- information on the categories of personal data concerned;

- information on recipients or categories of recipients to whom personal data has been or will be made available, in particular to recipients in third countries or international organizations;

- where it is possible, information on the foreseen retention period of personal data or, if that is not possible, information on the criteria for its establishment;

- information on the existence of the right to require the Operator to correct personal data relating to the Data Subject or to erase or restrict their processing and to the right to object to such processing;

- information on the right to lodge a complaint with the supervisory authority;

- if personal data has not been obtained from the Data Subject, any available information regarding their source;
-information on the existence of automated decision-making, including the profiling referred to in the Article 22, par. 1 and 4. The Regulations and, in such cases, at least meaningful information on the procedure followed, as well as the significance and the implications of such processing of personal data for the Data Subject;

• the right to be informed of adequate safeguards pursuant to Article 46 of the Regulation concerning the transfer of personal data when personal data is transferred to a third country or to an international organization;  

• the right to receive copies of the personal data being processed, however, subject to the condition that the right to receive a copy of personal data being processed must not have adverse effects on the rights and freedoms of others;

Right of the person concerned to access personal data in its essence means that the Data Subject has the right to obtain a confirmation from us that personal data concerning him/her is being processed and, if so, the Data Subject has the right to access such personal data. At the request of the Data Subject, we shall provide a copy of the personal data being processed. Any additional copies requested by the Data Subject may be subject to a reasonable fee corresponding to the administrative costs. If the Data Subject has filed an application electronically, the information will be provided in the commonly used electronic form, unless the Data Subject has requested another form. Information must be provided immediately, within 1 month at the latest. We have the right to extend the processing period of the application for another 2 months if the request is complex or frequent. However, we must notify the Data Subject within one month of the reason for the extension of the processing period. If the requests are unjustified or too frequent, we have the right to impose a reasonable charge or reject the application. We have to explain the reason for the refusal and the right of the Data Subject to refer the complaint to the supervisory authority.

b) the right of the Data Subject to correct personal data, the content of which is:

• the right of the Data Subject to require the Operator to correct without undue delay inaccurate personal data relating to the Data Subject;

• the right to supplement an incomplete personal data of the Data Subject, including the provision of a supplementary statement of the Data Subject;

• the right of the Data Subject to correct personal data means that you may ask us at any time to correct or supplement your personal data if it is inaccurate or incomplete. The Data Subject has the right to supplement his/her incomplete personal data, including by the provision of a supplementary statement of the Data Subject;

c) the Data Subject's rights to erase personal data (so-called right "to be forgotten"), the content of which is:

• the Data Subject's right to require the Operator to delete, without undue delay, the personal data relating to the Data Subject, if any of the following reasons prove as true:

- personal data are no longer needed for the purposes for which they were acquired or otherwise processed;

- The Data Subject has withdrawn his/her consent under which the processing is carried out, subject to the condition that there is no other legal basis for the processing of personal data;

- The Data Subject objects the processing of personal data in accordance with Article 21, par. 1. of the Regulation and any legitimate reasons for the processing of personal data do not preclude it, or the Data Subject objects to the processing of personal data under Article 21 par. 2 of the Regulation;

- personal data has been processed unlawfully;

- personal data must be erased in order to comply with a statutory obligation under European Union law or the law of the Member State to which the Operator is subject;

- personal data has been obtained in connection with the offer of information society services pursuant to Article 8, par. 1. of the Regulation;

• the right to ask the Operator who has made public the Personal Data of the Data Subject, taking into account the available technology and the cost of implementing the measures, to take appropriate measures, including technical measures, to inform other operators who process the personal data that the Data Subject requests them to delete all links to such personal data and the copies or replica thereof;

while it is understood that the Data Subject's right to erase personal data with the content of the rights referred to in Article 17, par 1 and 2 of the Regulation [i.e. with the content of the rights according (i) and (ii) of this section c) of the point J of this document] shall not arise, if the processing of personal data is necessary:

1. to exercise the right to freedom of expression and access to information;

2. to meet the legal obligation that requires processing under European Union law or the law of the Member State to which the operator is subject, or the performance of a task carried out in the public interest or in the exercise of public power entrusted to the Operator;

3. for reasons of public interest in the field of public health, in accordance with Article 9, par 2, section h) and i) of the Regulations, as well as Article 9, par. 3 of the Regulation;

4. for the purpose of archiving in the public interest, for the purposes of scientific or historical research or for statistical purposes under Article 89, par. 1 of the Regulation, if it is probable that the right referred to in Article 17, par. 1 of the Regulation, will prevent or significantly limit the achievement of the objectives of such processing of personal data; or

5. for proving, enforcement or defence of legal claims;

Data Subject's right to erase personal data therefore means that we have to erase your personal data if (i) the data is not necessary for the purposes for which it has been collected or otherwise processed, (ii) the processing is unlawful, (iii) you have objected the processing, and there are no overriding legitimate reasons for processing, or (iv) the processing is stemmed from a legal obligation imposed on us.

d) the right of the Data Subject to limit the processing of personal data,  the content of which is:

• the right to require the Operator to limit the processing of personal data in one of the following cases:

The Data Subject has objected the correctness, namely during a period allowing the Operator to verify the correctness of personal data;

- the processing of personal data is illegal and the Data Subject objects to the deletion of personal data and asks for the limitation of their use;

- The Operator no longer needs personal data for processing purposes, but the Data Subject needs them for proving, enforcement or defending of his/her legal claims;

- The Data Subject has objected the processing in accordance with the Article 21, par. 1 of the Regulation, until the verification whether legitimate reasons on the part of the Operator prevail the legitimate reasons of the Data Subject;

• the right of the Data Subject, if the processing of personal data has been limited in accordance with subparagraph (i) of this section d) of point J of this document, to require that such limited processing of personal data, except for its retention, shall be carried out only with the consent of the Data Subject, or carried out for the purpose of proving, enforcement or defending of legal rights, or for the protection of the rights of the other natural or legal person or for reasons of important public interests of the European Union or of a Member State;

• the right to be informed in advance of the lifting of the limitation on the processing of personal data;

The right of the Data Subject to limit the processing of personal data, means that until we resolve any disputes regarding the processing of your personal data, we have to restrict the processing of your personal data so that the personal data of the Data Subject can only be stored and not further processed.

e) the right of Data Subject to require the Operator to fulfil its notification obligation towards the recipients, the content of which is:

• the right of the Data Subject to require the Operator to notify any recipient to whom the personal data have been provided about any correction or deletion of personal data or the limitation of data processing made pursuant to the Article 16, Article 17, par 1., and the Article 18 of the Regulation, unless it proves impossible or involves a disproportionate effort;

• the right of the Data Subject to require the Operator to inform the Data Subject about such recipients, if requested by the Data Subject;

The right  of the Data Subject to require the Operator to fulfil its notification obligation towards the recipients, means the obligation of the Operator to notify each recipient to whom the personal data of the Data Subject has been provided, about any correction and deletion of the personal data or limitation of their processing. The Operator is stripped of such obligation only if such notification is impossible due to objective conditions or it would require unreasonable effort.

f) the right of the Data Subject for a transfer of the personal data, the content of which is:

• the right to obtain personally identifiable data relating to the Data Subject, which has been provided to the Operator, in a structured, commonly used and machine readable format and the right to transfer such data to other Operator without being prevented by the Operator to do so, if:

- the processing is based on the consent of the Data Subject in accordance with the Article 6, par. 1, sect. a)of the Regulation or the Article 9, par. 2 sect. a) the Regulation, or based on the contract referred to in the Article 6, par. 1, sect. b) of the Regulation, and at the same time;

- the processing is carried out by automated means, and at the same time;

-the right to obtain personal data in a structured, commonly used and machine-readable format, and the right to transfer such data to other Operator without being prevented by the Operator to do so, will not adversely affect the rights and freedoms of others;

• the right to transfer personal data directly from one Operator to the other, if it is technically feasible;

The right to data portability means that you have the right to obtain from us your personal data that you have previously provided us in a structured, commonly used and machine readable format and you have the right to require us to transfer your personal data to the other Operator subject to the statutory conditions; by exercising of this right your right for personal data deletion is not affected. However, the right of data portability concerns only the personal data we have obtained from you under a contract to which you are a party.

g) Right of the Data Subject to object, the content of which is:

• the right to object at any time on grounds relating to the specific situation of the Data Subject the processing of personal data, which is carried out under Article 6, par. 1, sect. e) or (f) of the Regulation, including the objection to the profiling based on these provisions of the Regulation; 

• [in the case of exercising of the right to object at any time on grounds relating to the specific situation of the Data Subject the processing of personal data, which is carried out under Article 6, par. 1, sect. e) or (f) of the Regulation, including the objection to the profiling based on these provisions of the Regulation] the right to ask the Operator to stop further processing of the personal data of the Data Subject, until it proves the necessary legitimate reasons for data processing, which prevail the legitimate interests, rights and freedoms of the Data Subject, or the reasons for proving, enforcing or defending its legal claims; 

• the right of the Data Subject to object at any time the processing of personal data relating to the Data Subject for the purposes of direct marketing, including profiling to the extent that it relates to the direct marketing; it should be understood that if the Data Subject has objected to the processing of his/her personal data for the purpose of direct marketing, the personal data may no longer be processed for such purposes; 

• (in connection with the use of the information society services) the right to exercise the right to object the processing of personal data by automated means using the technical specifications; 

• the right to object for reasons relating to the particular situation of the Data Subject against the processing of personal data relating to the Data Subject if the personal data are processed for the purposes of scientific or historical research or for statistical purposes according to the Article 89, par. 1 of the Regulation, however, except for cases where the processing is necessary for the fulfilment of tasks in the public interest;

The right of the Data Subject to object, therefore means that you, as the Data Subject, may object to the processing of your personal data processed by us for the purposes of direct marketing or due to legitimate reasons. We shall cease the processing of your personal data for the purpose of direct marketing immediately upon receipt of the objection.

h) Right of the Data Subject related to the automated individual decisions, the content of which is:

• the right not to apply to the Data Subject a decision based solely on the automated processing of personal data, including profiling, which has legal effects affecting the Data Subject, or has similar significant effect, except for cases referred to in the Article 22, par. 2 of the Regulation [i.e. except for cases where the decision: (a) is necessary for the conclusion or performance of a contract between the Data Subject and the Controller, (b) is authorized by European Union law or the law of the Member State to which the operator is subject and which also provides for the appropriate measures to ensure the protection of rights and freedoms and legitimate interests of the Data Subject or (c) based on the explicit consent of the Data Subject];

The right of the Data Subject related to the automated individual decisions means that you as the Data Subject are entitled to be exempted from a decision that is based solely on automated processing, including profiling, and has legal effects affecting you, or has similar significant effect. In cases where such processing is necessary for the conclusion or performance of a contract or is based on the explicit consent of the Data Subject, the Operator shall take appropriate measures to protect the rights and freedoms and the legitimate interests of the Data Subject, in particular, as a minimum, to take measures, such as the right to human intervention by the Operator, the right of the Data Subject to express his/her opinion and the rights of the Data Subject to challenge such decision.

i) Right of the Data Subject to file a motion to initiate proceedings according to the Article 100 of the Personal Data Protection Act, the content of which is:

• the right of the Data Subject, who believes that his or her personal data are being misused or their processing is unauthorized, submit to the Office for the Protection of Personal Data of the Slovak Republic (hereinafter referred to as "the Office") a motion to initiate the procedure for the protection of personal data; 

• The application may be filed in writing, in person orally in the form of a report, by electronic means, where it must be signed by a guaranteed electronic signature, by telegram or by fax, but it must be completed in writing or verbally in the report within 3 days at the latest; 

• The filing must, in accordance with the provisions of the Article 100, par. 3 of the Personal Data Protection Act, include:

- name, surname, permanent address and signature of the petitioner;

- designation of the person against whom the filing is directed; designation or name, surname, place of residence or permanent address, or legal form and the identification number;

- the subject of the filing, indicating which rights of the petitioner have been violated during the processing of personal data;

- the evidence supporting the claims made in the filing;

- a copy of the document proving the exercise of the right under the Article 28, if such a right may be invoked, or the provision of reasons worthy of special consideration;

• The Office subsequently decides on the petitioner's filing within 60 days of the opening of the proceedings. In justified cases, the Office may extend this period adequately, but not exceeding six months. The Office shall inform in writing the parties to the proceedings about the extension of time; 

• You can find the template of the petition for opening of the procedure for the protection of personal data at the Office's web site (https://dataprotection.gov.sk).