November 17, 2018

Personal data protection

Information that the controller shall be obliged to provide a data subject with

under Article 13 et seq. of Regulation (EU) 2016/679 of the European Parliament and the Council on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of Such Data

(hereinafter referred to as “the Regulation “)

intended for customers of the controller as well as for other data subjects.

 

1. The controller and their contact details:

Business Name:                                                                   ETC s.r.o.

(i.e. limited liability company)

Registered Place of Business:                                          Rosinská cesta 8, 010 08 Žilina

Company Identification (Registration) Number:      31641393                 

 

2. Purpose of processing personal data, legal basis of processing and categories of personal data concerned:

 

The controller shall process personal data of their customers in the extent required for conclusion of contractual relation in selling merchandise and services of the controller. The controller shall process those personal data without consent of the customers for the purpose of performance of their obligations resulting from a purchase contract and for the purpose of other communication with the customer concerned. Should no personal data be provided to the controller, the controller cannot properly perform a contract as concluded with the purchaser and therefore it will not be possible to conclude such contract with the purchaser. The personal data shall also be processed for the purpose of accountancy and business office work. At the same time processing of the same on the part of the controller results in fulfilment of their legal obligation following from special legal regulations, such as the Act on Accountancy, Act on Value Added Tax etc., and processing of the same is therefore necessary. The controller shall for those purposes process regular categories of personal data, in particular academic degree, name and surname, signature, permanent address, address for service, account number, telephone number, e-mail address and other necessary personal data.

           

The controller shall also process personal data of their customers for marketing purposes to support sales of their products, for example in the form of a newsletter, information e-mail messages and offers sent etc. in the extent as follows: name, surname and e-mail address. Legal basis to send such offers shall be legitimate interest of the controller which shall be provision of relevant information that may benefit the customers. Should a customer decide that they do not want to receive such marketing offers anymore, they may cancel them by clicking a cancellation link, a direct part of e-mail communication. The controller may also process personal data of data subjects other than their customers obtained for example from web forms etc. in the extent as follows: user name and e-mail address. The controller shall for marketing purposes and for the purposes of sending e-mail offers only process those personal data with consent of the data subject concerned. The data subject concerned may cancel their consent to receiving e-mail offers by clicking a cancellation link, a direct part of e-mail communication.

 

3. The recipients of personal data:

 

The controller shall provide personal data to processors that shall be mandated on the part of the controller in writing to process personal data, for example for the purpose of delivery, repairs, warranty and post warranty serviceof products, to providers of information systems and cloud platforms etc. The controller may for the purpose of exercise of their legal claim also provide personal data to public authorities, companies recovering claims and to other parties. At the same time the controller declare that they do not provide any personal data to subjects in third countries where personal data are not protected on appropriate level.

 

4. Storage period of personal data:

 

The controller shall not process personal data of data subjects longer than necessary for the performance of obligations resulting from the contractual relation and after the purpose that the same is processed for is achieved. The controller shall also process personal data of data subjects within the meaning of relevant provisions of the Act on Archiving (Act no. 395/2002 Coll. on Archives and Registries as amended – accounting documents for 10 years, while orders for 3 years), the same shall then be disposed of. Personal data shall for marketing purposes be processed for five years from obtaining the same or from obtaining consent to processing the same. After achieving the purpose of processing and expiration of storage period of personal data the controller shall immediately arrange disposal of personal data of the data subject, this shall not apply, should the personal data form a part of a record of registry.

 

5. Rights of data subjects:

 

A data subject shall in connection with processing their personal data have the following rights towards the controller:

 a) The right to obtain confirmation as to whether or not personal data concerning him or her are  being processed, and, where that is the case, access to the personal data and the information hereunder;

 b) The right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her and the right to have incomplete personal data completed;

 c) The right to erasure (right to be forgotten) of his or her personal data if the same are not necessary for the purposes that it was collected or otherwise processed for and period of storage thereof already expired;

 d)The right to obtain from the controller restriction of processing where one of the following applies:

 

-    the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

 

-       the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

-        the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;


e) The right to receive the personal data concerning him or her, which he or she has provided to a controller, as well as the right to transmit those data to another controller if the processing is carried out by automated means on the basis of a contract or consent and is technically possible;

 f) The right to object processing of personal data concerning him or her on the part of the controller processed on the grounds of legitimate interests of the controller. Should the controller fail to prove existence of a serious legitimate interest to process personal data that overrides rights and freedoms of the data subject, the controller shall terminate processing such personal data without undue delay;

 g) The right to lodge a complaint with the Personal Data Protection Office if he or she believes that processing of personal data concerning him or her on the part of the controller is in conflict with legal regulations on protection of personal data;

 h) The right to object to and not to submit himself or herself to a decision of the Office that would result in legal effects affecting him or her or in significant impact on him or her if such decision is issued solely on the basis of automated processing of personal data. The controller declares that they do not perform automated decision-making affecting in legal terms the data subjects without human judgment;

 i) If personal data were not collected from the data subject, such data subject shall be entitled to be informed of the source that his or her personal data were collected from, or as the case may be, be informed as to whether the personal data are from open sources.