Obligation of the company developed in accordance with the Personal Data Protection Act

Identification data of the operator:

The company digitalpanda s.r.o., ID: 52 579 212, Orechová 2922/66, Dunajská Lužná 900 42, Slovakia (hereinafter referred to as the “company”) acts in the processing of personal data of its employees, clients, customers or business partners (hereinafter referred to as the “data subject“) as an information operator system (hereinafter referred to as “IS”).

Legal basis of processing personal data of the persons concerned:

When processing personal data, the company proceeds in accordance with Act no. 18/2018 Coll. on the protection of personal data and on amendments and additions to certain regulations (hereinafter referred to as the ” Act on Personal Data Protection“). The legal basis for processing personal data is the Personal Data Protection Act, special legal regulations and consent to the processing of personal data, depending on the purpose of processing personal data.

In the case that the purpose of processing personal data, range of affected persons and list of personal data is established by a directly enforceable act of the European Union, an international treaty to which the Slovak Republic is bound, from laws on the protection of personal data or a special law is a company within the meaning of the Personal Data Protection Act authorized to process personal data without the consent of the person concerned.

The company processes personal data without the consent of the person concerned, if the purpose of processing personal data, range of affected persons and list of personal data or their scope is established by a directly enforceable legally binding act of the European Union, an international treaty to which the Slovak Republic is bound, or this law. If the list or range of personal data is not established, the company may process personal data only to the extent and in a manner that is necessary to achieve the established purpose of processing while complying with the basic obligations according to the Act on the Protection of Personal Data.

The company further processes personal data without the consent of the person concerned, if the purpose of processing personal data, range of affected persons and list of personal data is established by a special law and only to the extent and in the manner established by a special law. Processed personal data can be provided, made available or published from the information system only if a special law establishes the purpose of providing, making available or publishing, a list of personal of data that can be provided, made available or published, as well as third parties to whom personal data are provided, or the range of recipients to whom personal data is made available, if the Personal Data Protection Act does not stipulate otherwise.

The company processes personal data without the consent of the person concerned even if:

1. a) processing personal data is necessary for the performance of a contract in which the person concerned acts as one of the parties to the contract, or in pre-contractual relations with the person concerned or during negotiations to change the contract, which are carried out at the request of the person concerned,
2. b) processing personal data is necessary to protect the life, health or property of the person concerned,
3. c) the subject of processing is exclusively the title, name, surname, and address of the person concerned without the possibility of assigning to them other personal data, and their use is intended exclusively for the needs of the operator in postal relations with the person concerned and the records of this data,
4. d) personal data are processed that have already been published in accordance with the law and the operator has duly marked them as published; the person who claims to process published personal data shall, upon request, prove to the office that the processed personal data has already been legally published,
5. e) processing personal data is necessary to protect the rights and legally protected interests of the operator or a third party, while this does not apply if during such processing of personal data, the basic rights and freedoms of the person concerned prevail, which are subject to protection according to this law.

If, due to the purpose of processing, personal data established in a directly enforceable legally binding act of the European Union, an international treaty to which the Slovak Republic is bound, in the Act on the Protection of Personal data and a special law cannot specifically determine in advance the individual personal data that are to be the subject of processing, the list of personal data can be replaced by the scope of personal data.

The company is obliged to process personal data to proceed according to the Act on the Protection of Personal Data except for those operators who process personal data for the purposes of legal proceedings and in connection with them.

In case that personal data is not applied by the Personal Data Protection Act, the company as an operator is entitled to process personal data only with the consent of the person concerned.

The company obtains the consent of the person concerned without coercion or coercion, as well as without conditioning with the threat of rejection of the contractual relationship, services provided or obligations arising for the operator from legally binding acts of the European Union, international agreements to which the Slovak Republic is bound or the law.

In case of refusal to provide personal data of the company’s data for purposes necessary for the provision of services or the fulfillment of legal obligations, the company is entitled to notify the affected person of the possible consequences of not providing personal data.

The affected persons agree that the company, when processing personal data entrusted such data processing to an intermediary who processes personal data on behalf of the company. After the end of the processing purpose, personal data, the company disposes of these legally obtained personal data of the persons concerned within the period established by applicable legal regulations and in accordance with the company’s internal regulations.

Purpose of processing personal data of the persons concerned:

The company respects your privacy and considers the provided personal data confidential.

For the high- quality provision of its services, the company needs to know some personal data of the affected persons and needs to provide them to other recipients to fulfill legal obligations and ensure the highest quality services.

The company processes the provided personal data for several purposes.

On the one hand, it concerns the personal data of job applicants and the personal data of their employees for the purposes of the personnel and payroll agenda, and related legal obligations resulting from special legal regulations.

The company also processes the personal data of its clients, customers, and business partners for the purpose of ensuring its business activity, taking into account the interests of its clients, customers and business partners.

For processing personal data there is no data for any other purpose in the company, which means that the company collects, stores and processes only the personal data of the persons concerned, which it needs in order to fulfill its provided services. The provided personal data are strictly protected against misuse by unauthorized third parties, by the means documented in the adopted security project and the security directive in accordance with the Act on the Protection of Personal data.

When processing personal data of the persons concerned, the company complies with the basic obligations of the operator resulting from the Personal Data Protection Act, which includes the following obligations.

The company always uses the provided personal data for a predetermined processing purpose, which is clear, defined clearly and concretely, and is in accordance with the Constitution of the Slovak Republic, constitutional laws , laws and international treaties to which the Slovak Republic is bound.

The company always defines the conditions for processing personal data in such a way as not to limit the rights of the person concerned established by law.

The company only acquires such personal data of the persons concerned, whose scope and content correspond to the purpose of the processing and are necessary to achieve it.

The company ensures that the personal data of the affected persons are processed exclusively in a manner that corresponds to the purpose for which they were collected in advance.

only obliged to process correct, complete and, as necessary, updated personal data in relation to the purpose of processing. The operator is obliged to block incorrect and incomplete personal data and correct or supplement them without undue delay, if they cannot be corrected or supplemented so that they are correct, the company will clearly mark this personal data and dispose of it without undue delay.

The company ensures that the personal data of the affected persons are processed in a form that enables the identification of individual affected persons for a period of time no longer than is necessary to achieve the purpose of the processing.

The company disposes of the personal data in the prescribed manner, which the purpose of the processing has ended. After the end of the defined purpose, the company is entitled to process personal data to the extent necessary for research or other purposes statistics in their anonymized form. The operator cannot use the personal data processed in this way to support measures or decisions taken against the person concerned to limit his basic rights and freedoms.

Intermediaries:

Protection Act data and for the purpose of their collection, contrary to your interests or instructions, and to a third party are provided only within the scope of the aforementioned purpose.

In its business activities, the company cooperates with several intermediaries whose goal is to provide quality services, while these entities process the personal data of the affected persons in the performance of their contractual activities for the company.

individual intermediaries, it paid attention to their professional, technical, organizational and personnel competence and their ability to guarantee the security of processed personal data. data adopted by security measures in accordance with the Personal Data Protection Act.

At the same time, when choosing a suitable intermediary, the company proceeded in such a way that the rights and legally protected interests of the affected persons would not be jeopardized.

Protection Act data written contract on ensuring the protection of personal data processed by intermediaries , whom the personal data of the persons concerned only to the extent, under the conditions and for the purpose agreed in the contract and in the manner according to the Act on the Protection of Personal Data.

Scope and list of processed personal data:

The company only processes personal data in its information systems to the extent necessary to achieve the specified purpose. This is the scope of personal data established by special legal regulations or to the extent of the consent of the person concerned for the processing of his personal data.

The company only processes personal data that was provided to it voluntarily and to the extent necessary by the person concerned. Provision of personal data to the company beyond the scope of special laws is voluntary.

Conditions and method of processing personal data of the persons concerned:

The company only processes personal data of the affected persons in its information systems by automated and non-automated means of processing.

The company does not publish processed personal data, except in cases where it is required by a special legal regulation or a decision of a court or other state authority.

The company will not process your personal data without your express consent or other legal legal basis for another purpose, even to a greater extent than is stated in this information and the registration sheets of individual informational system of the operator.

The rights of the affected person connected with the processing of his personal data:

Based on a written request, the person concerned has the right to demand from the company:

1. a) confirmation of whether or not personal data about her are processed,
2. b) in a generally comprehensible form, information about the processing of personal data in the information system to the extent according to the Personal Data Protection Act; when issuing a decision according to the Act on the Protection of Personal Data, the person concerned is entitled to become familiar with the procedure for processing and evaluating operations,
3. c) in a generally comprehensible form, precise information about the source from which her personal data for processing was obtained,
4. d) in a generally comprehensible form, a list of her persona data that are the subject of processing,
5. e) correction or liquidation of your incorrect, incomplete or out-of-date personal data that are the subject of processing,
6. f) the liquidation of her personal data, which the purpose of the processing has ended; if the subject of processing is official documents containing personal data, he can request their return,
7. g) liquidation of her personal data that are the subject of processing, if the law has been violated,
8. h) blocking her personal data due to withdrawal of consent before the expiration of its validity period, if the company processes personal data based on the consent of the person concerned.

The above – mentioned rights of the affected person according to letters e) and f) can be restricted only if such a restriction results from a special law or its application would violate the protection of the affected person, or the rights and freedoms of other persons would be violated.

According to the Act on the Protection of Personal Data based on a written request addressed to the company, the data subject has the right to object to:

1. a) processing her personal data that it assumes are or will be processed for direct marketing purposes without its consent, and request their disposal,
2. b) using personal data specified in the Personal Data Protection Act for the purposes of direct marketing in postal communication, or
3. c) provision of personal data specified in the Personal Data Protection Act for direct marketing purposes.

According to the Act on the Protection of Personal Data, the data subject has the right to object to the processing of personal data at any time, based on a written request addressed to the company or personally, if the matter cannot be delayed data in cases according to the Personal Data Protection Act by stating legitimate reasons or presenting evidence of unauthorized interference with its rights and interests protected by law, which are or may be in a specific case by such processing of personal damaged data; if it is not prevented by legal reasons and it is proven that the objection of the person concerned is justified, the company is obliged to block and dispose of the personal data, the processing of which the person concerned has objected, without undue delay , as soon as the circumstances allow.

According to the Act on the Protection of Personal Data, the data subject has, based on a written request addressed to the company or in person, if the matter cannot be delayed, the right to object at any time and not to comply with the company’s decision, which would have legal effects or a significant impact for him, if such a decision is issued solely on the basis of automated actions é him processing her personal data. The person concerned should further request the company to review the issued decision by a method different from the automated form of processing, while the company is obliged to comply with the request of the person concerned, in such a way that the authorized person will have the decisive role in reviewing the decision ; the operator informs the affected person about the method of examination and the result of the finding within the deadline according to the Act on the Protection of Personal Data. The person concerned does not have this right only if it is established by a special law, which regulates measures to ensure the legitimate interests of the person concerned, or if, within the framework of pre-contractual relations or during the existence of contractual relations, the operator issued a decision by which he complied with the request of the person concerned , or if, on the basis of the contract, the operator has taken other appropriate measures to ensure the legitimate interests of the person concerned.

If the person concerned exercises his right:

1. a) in writing and it follows from the content of her application that she is exercising her right, the application is considered to have been filed in accordance with the Act on the Protection of Personal data; the request submitted by e-mail or fax shall be delivered in writing by the person concerned no later than three days from the day of its sending,
2. b) in person orally in the minutes, from which it must be clear who exercised the right, what is claimed and when and who made the minutes, his signature and the signature of the person concerned; the company is obliged to hand over a copy of the minutes to the person concerned,
3. c) in the case of an intermediary according to letter a) or letter b), he is obliged to hand over the same request or minutes to the company without unnecessary delay.

If the person concerned suspects that his/her personal data is being processed without authorization, he/she may submit a proposal to initiate proceedings for the protection of personal data to the Personal Protection Office ch of data of the Slovak Republic, with registered office Hraničná 12, 820 07 Bratislava 27, Slovak Republic or contact the office through its website http://www.dataprotection.gov.sk .

If the person concerned does not have full legal capacity, his rights can be exercised by a legal representative.

If the person concerned is not alive, his rights, which he had under this law, can be exercised by a close person.

The request of the person concerned according to the Personal Data Protection Act will be provided by the company free of charge.

The request of the person concerned according to the Personal Data Protection Act the company will provide the data free of charge, except for a payment in an amount that cannot exceed the amount of material costs incurred for the purpose of making copies, importing technical media and sending information to the person concerned, unless a special law provides otherwise.

The company is obliged to process the request of the affected person in writing according to the Personal Data Protection Act no later than 30 days from the date of delivery of the request.

Limitation of the rights of the affected person according to the Personal Data Protection Act, the company will notify the data subject and the Office for Personal Data Protection in writing without undue delay data of the Slovak Republic.

The company hereby informs you, as the affected person, about the protection of your personal data and informed you about your rights in relation to the protection of personal data within the scope of this written information obligation.