Personal data processing and protection policy

5. USE OF WEB TRACKING AND USE OF COOKIES

We use tracking software to determine how many users visit our website and how often. We do not use this software to collect personal data or individual IP addresses. This data are only used in anonymous and aggregated form for statistical purposes and for the development of the website.

Use of cookies:

Cookies are small text files that may be sent to your browser when you visit a website and stored on your device (computer or other internet-enabled device, such as a smartphone or tablet). Cookies are stored in a folder in your browser. Cookies usually contain the name of the website from which they originate, their validity and value. The next time you visit the website, your web browser will reload the cookies and send this information back to the website that created the original cookies.

The company uses the following types of cookies:

Basic Cookies

They are necessary for the most important functions of the website, enabling the website to function properly. These cookies do not collect any information about you that could be used for marketing purposes.

Complianz: Complianz BV, CoC 717814475, Kalmarweg 14-5, 9723 JG, Groningen (NL)

Analytical Cookies

These cookies are used to obtain data about traffic to our website, information about searches made on our website and also to detect how you move around our website so that we can make it as user-friendly for you as possible.

• Google Analytics: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Google Tag Manager: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States.
  
  

Marketing Cookies

We use these cookies to enable us to show you content on our website that you have previously found interesting, based on your preferences, and also for the purpose of displaying ads based on your interests. We only store cookies of this type with your consent. We use the following third-party solutions for these cookies:

• Google AdWords: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Instructions on how to change cookies can be found in the help menu of each browser. If you use different devices to access the website (e.g. computer, smartphone, tablet), we recommend adjusting each browser on each device to your cookie preferences.

We will respect if you change your default cookie settings. However, disabling some cookies may have an impact on your use of some features of our website.

6. RECIPIENTS

To provide certain services, the company needs to know some personal data of data subjects and needs to provide the personal data to other recipients to meet the company’s legal obligations and provide top-quality services.

In its business activities, the company cooperates with a number of data processors who are committed to providing top-quality services.  In the performance of their contractual activities for the company, personal data of data subjects are processed by the following entities:

Packeta Slovakia s. r. o.
Address: Kopčianska 3338/82A, 851 01 Bratislava
ID No. (IČO): 48136999
VAT ID (DIČ): 2120099014
Purpose: Transportation of goods

FREE Company s.r.o.
Address: Ďialničná cesta 6, 903 01 Senec
ID No. (IČO): 47976292
VAT ID (DIČ): 2024162976
VAT ID (IČ DPH): SK2024162976
Purpose: Storage of goods

Webglobe – Yegon, s.r.o.
Address: Stará Prievozská 2, 821 09 Bratislava
ID No. (IČO): 36306444
VAT ID (DIČ): 2020114987
VAT ID (IČ DPH): SK2020114987
Purpose: Emails, domains
State authorities

State authorities – in case of enforcement of our rights, your personal data may be transferred to a third party (e.g. a lawyer). If we are required by law or a public authority (e.g. the Police of the Slovak Republic) to provide them with your personal data, we must do so.

The company declares that its selection of individual data processors took into account their professional, technical, organisational and personnel competence and their ability to guarantee the security of the processed personal data by the security measures taken in accordance with the Personal Data Protection Act.

When selecting a suitable data processor, the company proceeded so as to avoid jeopardising the rights and legitimate interests of data subjects.

The company concluded written contracts with data processors in accordance with Article 28 (3) of the Regulation on the protection of personal data processed by the data processors entrusted with the processing of personal data of data subjects to the extent, under the conditions and for the purpose agreed in the contract and in the manner laid down in the Personal Data Protection Act.

The company may also provide information to third parties (health insurance companies, Social Insurance Agency, tax authorities, Office for Labour, Social Affairs and Family, supplementary pension companies, supplementary asset management companies, banks, commercial insurance companies, enforcement officers, etc.)

7. CONDITIONS AND METHOD OF PROCESSING OF PERSONAL DATA OF DATA SUBJECTS

The company does not disclose processed personal data. An exception may only be made if required by a special legal regulation, by a court ruling or a decision of a public authority. The company will not process your personal data without your consent or any other lawful legal basis for any purpose other than stated above.

8. RETENTION PERIOD FOR PERSONAL DATA OF DATA SUBJECTS

It is determined according to the specific purpose of personal data processing and according to the requirements of special regulations.

Specific retention periods are prescribed by the company’s internal Registry Plan, prepared in accordance with the Act on Archives and Registries. In the event of processing of personal data for which consent was given, your data will be processed for five (5) years (for marketing purposes) and for ten (10) years (photographs and videos of winners and models), or until your consent is withdrawn.

The company will securely destroy all personal data whose processing purpose and retention period has expired. After the expiry of the defined purpose, the company is authorised to process personal data to the extent necessary for research or statistical purposes in anonymised form.

The company shall ensure that the personal data of data subjects are processed in a form that allows identification of individual data subjects for no longer than is necessary to achieve the purpose of the processing.

9. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

We process your personal data (marketing data, communication tools) using online applications that have servers located in the USA. Based on a decision of the European Commission, the servers in the USA guarantee adequate protection of personal data and the data controllers have provided adequate guarantees for the security of your data and have guaranteed that personal data are processed in accordance with the GDPR.

10. RIGHTS OF THE DATA SUBJECT IN RELATION TO THE PROCESSING OF THEIR PERSONAL DATA

Based on a written request, the data subject may exercise the following rights (legal obligation, consent of the data subject, legitimate interest, contractual relations) in respect of all forms of personal data processing:

• Request access to personal data relating to the data subject from the data controller;
• Rectify the processed personal data;
• Erase the processing of personal data (only if we are not required by law to store the personal data, e.g. invoices, tax documents, etc.);
• Object to personal data processing;
• File a complaint or motion to initiate proceedings with a supervisory authority;
• Access your own personal data;
• Obtain a list of their own personal data subject to processing;
• Destruct their personal data subject to processing if there has been a breach of legislation;
• Prevent the processing of their personal data which they believe are or will be processed for marketing purposes without their consent;
• File a motion to initiate proceedings under Article 100 if the data subject suspects that their personal data are processed unlawfully.

Based on a written request, the data subject has the right to (with respect to consent to personal data processing and contractual relationships):

• Withdraw consent to personal data processing at any time;
• Portability of personal data from the data controller to another data controller, if technically feasible.

Based on a written request, the data subject has the right to (with respect to legitimate interest):

• Restrict their personal data processing – if the data subject suspects that we process their personal data unlawfully, they may object. In the event of an objection, the data subject has the right to restrict our processing of their personal data.

If the data subject does not have legal capacity, their rights may be represented by a legal representative.

The company shall process the data subject’s request under the Personal Data Protection Act free of charge, except for the payment of an amount that may not exceed the amount of the reasonable expenses incurred in making copies, in procuring technical media and in sending the information to the data subject, unless otherwise laid down by a special act.

The company shall process the data subject’s request within 30 days from the date of its receipt or shall inform the data subject about the reasons why the review has not been carried out and about the possibility of exercising the data subject’s right to file a motion to initiate proceedings under Article 100 and to other legal protection under a special regulation.

The company shall notify the data subject without undue delay of a personal data breach, which is likely to result in a high risk to the data subject’s rights.

The company has informed you as the data subject about the protection of your personal data. You have been advised of your rights in relation to personal data protection.

 Updated on 1 December 2023