Privacy Policy (GDPR)
PERSONAL DATA PROCESSING PRINCIPLES AND PERSONAL DATA PROTECTION SYSTEM ACCORDING TO THE GDPR REGULATION
With effect from 25/05/2018, all personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as the "Regulation").
The purpose of these principles is to demonstrate that the processing of personal data by the operator is carried out in accordance with the currently valid legislation, in particular Act 18/2018 Coll. on the protection of personal data (hereinafter referred to as the "new GDPR Act") and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons in the processing of personal data and on the free movement of such data (hereinafter referred to as the "GDPR Regulation") ). The new legal regulation obliges the operator, taking into account the nature, scope and purpose of the processing of personal data and the risks of varying probability and severity for the rights of a natural person, to take appropriate technical and organizational measures to ensure and demonstrate that the processing of personal data is carried out in accordance with new legislation. The operator is obliged to update the measures taken as necessary.
This document is the result of an assessment of the processing of personal data by the operator for the purposes of legal standards governing the protection of personal data. By introducing standardized personal data protection based on the principles listed here, the risk of personal data protection violations is minimized.
(further on in the policy text only as "Operator")
CONTACT INFORMATION:
● contact person who supervises the processing of personal data and is authorized to process requests and provide information to exercise the rights of the persons concerned. You can find it here.
● contact person for reporting security incidents. You can find it here.
We declare that, as the operator of your personal data, we fulfill all legal obligations required by applicable legislation, in particular the Personal Data Protection Act and the GDPR, and therefore that:
● we will enable and support you in exercising and fulfilling your rights according to the new Act on the Protection of Personal Data and the GDPR regulation.
WE PROCESS YOUR PERSONAL DATA FOR THE FOLLOWING PURPOSES:
1. Information for CUSTOMERS PURCHASING THROUGH THE ELECTRONIC STORE (natural person, non-entrepreneur)
Non-registered customer:
- Customer relationship management
- Non-binding price offer
- Complaint
- Account receivable
- Appeal of claim
- Administration of the file registry
- Purchase of goods through the electronic store
- Customer relationship management
- Non-binding price-offer
- Account receivable
- Appeal of claim
- Administration of the file registry
- Registration in the e-shop
- Proving, exercising or defending legal demands
We protect personal data to the maximum extent possible. We protect them as if they were our own. We have implemented all possible technical and organizational measures that prevent misuse, damage or destruction of your personal data.
Responses to requests and information will be provided in the form in which the request was made (written/electronic/verbal), unless the person concerned has requested otherwise. Verbal provision of information can be conditioned by proving the identity of the person concerned. If the operator has legitimate doubts about the identity of the natural person who submits the application, he may request the provision of additional information necessary to confirm his identity. In order to ensure the security of personal data, the operator reserves the right not to respond electronically to messages without a qualified electronic signature. For this reason, it is more appropriate to handle requests in which personal data are made available in writing in one's own hands, in order to prevent a situation where an anonymous person can request protected data about another person.
Pursuant to § 29 par. 3 of the new ZOOÚ, the deadline for handling the application of the affected persons is one month from the delivery of the application. The deadline can be extended in justified cases, taking into account the complexity and number of requests, by another two months, even repeatedly. The person concerned must be informed of any such extension, along with the reasons for the extension. According to the law, an objective reason for the extension of the deadline can be considered, for example, a situation where the employer asks the person concerned to add some information for the assessment and processing of his application, while the addition of the required information will not be provided in return. Likewise, the occurrence of security incidents that temporarily paralyzed the employer's information systems, etc.
For processing applications and providing information, the operator is entitled to demand related fees from the applicant. The requests of the affected person and information are primarily handled, respectively. they provide free of charge. A reasonable fee, taking into account administrative costs, can be requested for the second and further copies of the documents with which the employer fulfills the request of the person concerned. Likewise, a fee can also be introduced for the administrative costs of processing a request that is clearly unfounded or disproportionate, especially due to its recurring nature. The obvious groundlessness or inadequacy of the request is demonstrated by the operator. The recurring nature of the request is one that concerns the same personal data as well as the same asserted right. Thus, a request submitted, for example, for the right of access to personal data, and then a request submitted for the right to delete those data, the processing of which was determined based on the request for the right of access, does not have a repetitive nature of the request.
Appropriate measures for exercising the rights of the person concerned and measures facilitating the exercise of his rights.
The operator reserves the right to handle requests online if it deems this option to be the most appropriate.
Summary of rights which the new legal regulation in the area of personal data protection grants to the persons concerned:
This summary of rights is applicable, and the affected person can exercise these rights with the operator only if the legal conditions are met, which are further specified in the text.
1. The right of access
The person concerned has the right to obtain confirmation from the operator as to whether personal data relating to him or her is being processed, and if so, he or she has the right to obtain access to this personal data and the information specified in the information obligation.
The operator will provide a copy of the personal data being processed. For any additional copies requested by the data subject, the operator may charge a reasonable fee corresponding to administrative costs. If the person concerned submitted the request by electronic means, the information will be provided in a commonly used electronic form, unless the person concerned has requested another method. The exercised right to obtain a copy of personal data must not have adverse consequences on the rights and freedoms of others.
2. The right for repair
The person concerned has the right to have the operator correct incorrect personal data concerning him without undue delay. With regard to the purposes of processing, the data subject has the right to supplement incomplete personal data, including by providing a supplementary statement.
3. The right to erasure (right to be forgotten)
The operator is obliged to delete personal data without undue delay if the person concerned has exercised the right to deletion, and if:
a) personal data are no longer necessary for the purpose for which they were obtained or otherwise processed,
b) the person concerned revokes the consent according to § 13(1)(a) or § 16(2)(a), on the basis of which the processing of personal data is carried out, and there is no other legal basis for the processing of personal data,
c) the affected person objects to the processing of personal data pursuant to § 27(1) and there are no overriding legitimate reasons for the processing of personal data or the affected person objects to the processing of personal data pursuant to § 27(2)
d) personal data is processed illegally,
e) the reason for erasure is the fulfillment of an obligation under this Act, a special regulation or an international treaty to which the Slovak Republic is bound, or
f) the personal data was obtained in connection with the offer of information society services according to § 15 par. 1.
The operator is not obliged to delete the processed personal data of the affected person if the processing of personal data is necessary:
a) to exercise the right to freedom of expression or the right to information,
b) to fulfill an obligation according to this Act, a special regulation or an international treaty to which the Slovak Republic is bound, or to fulfill a task carried out in the public interest or in the exercise of public authority entrusted to the operator,
c) for reasons of public interest in the field of public health in accordance with § 16 par. 2 letters h) to j),
d) for archiving purposes, for scientific purposes, for historical research purposes or for statistical purposes according to § 78 par. 8, if it is likely that the right according to paragraph 1 will make it impossible or seriously difficult to achieve the goals of such processing,
e) to assert a legal claim.
4. The right to restriction of processing
The data subject has the right to have the controller restrict processing in one of the following cases:
a) the person concerned contests the correctness of personal data, during the period allowing the operator to verify the correctness of personal data;
b) the processing is illegal and the data subject objects to the erasure of personal data and requests a restriction of their use instead;
c) the operator no longer needs the personal data for processing purposes, but the data subject needs them to prove, exercise or defend legal claims;
d) the person concerned has objected to the processing, until it is verified whether the legitimate reasons on the part of the operator prevail over the legitimate reasons of the person concerned.
5. The right to Portability
The person concerned has the right to obtain the personal data concerning him and which he has provided to the operator in a structured, commonly used and machine-readable format and has the right to transfer this data to another operator without being hindered by the operator to whom the personal data was provided.
When exercising his right to data portability according to paragraph 1, the person concerned has the right to transfer personal data directly from one operator to another operator, as long as this is technically possible.
The right referred to in paragraph 1 must not have adverse consequences on the rights and freedoms of others.
6. The right to object to the processing of personal data
The person concerned has the right to object to the processing of his personal data for reasons related to his specific situation against the processing of personal data concerning him, which is carried out on the basis of Article 6, paragraph 1 letter e) or f) including objecting to profiling based on the said provisions. If personal data is processed for the purposes of direct marketing, the data subject has the right to object at any time to the processing of personal data concerning him for the purposes of such marketing, including profiling to the extent that it is related to such direct marketing.
The operator may not continue to process personal data if he does not demonstrate the necessary legitimate interests for processing personal data that outweigh the rights or interests of the person concerned, or grounds for asserting a legal claim.
If the data subject objects to processing for direct marketing purposes, personal data may no longer be processed for such purposes.
7. The right to the ineffectiveness of automated individual decision-making, including profiling
The data subject has the right not to be subject to a decision that is based solely on automated processing, including profiling, and which has legal effects that concern him or similarly significantly affect him.
Paragraph 1 does not apply if the decision is:
a) necessary for the conclusion or performance of the contract between the person concerned and the operator,
b) permitted by the law of the Union or the law of a Member State to which the operator is subject and which also establish appropriate measures guaranteeing the protection of the rights and freedoms and legitimate interests of the person concerned, or
c) based on the express consent of the person concerned.
8. The right to withdraw consent to the processing of personal data
If the operator processes the personal data of the affected person only on the legal basis of consent, it is obliged to provide the affected persons with the right to withdraw their consent at any time, in the same simple form as the consent was given. If the operator processes personal data on a legal basis other than the consent of the person concerned, this person does not have the right to revoke the consent, since it was not even provided.
In case of doubt about the legality of the processing of personal data, the affected person can file a complaint with the supervisory authority, which is the Personal Data Protection Office of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; tel. number: +421 2 3231 3214; e-mail: statny.dozor@pdp.gov.sk , https://dataprotection.gov.sk.
When processing personal data for the purposes defined in these information obligations, however, the data subject may only exercise those rights (Matrix - Rights of affected subjects under the General Data Protection Regulation) that enable the defined purpose and the legal basis on the basis of which the processing of personal data about the data subject takes place. These rights are always decided by the operator.
You can exercise your right with us at any time in writing or by electronically delivering your request to the contact details listed:
Name and surname: Ing. Jozef Opálený
Tel: +421 (0) 944 684 850
Email: office@debongre.com
Delivery address: Dlhá 1312/1, 953 01 Zlaté Moravce
MODELS FOR EXERCISE OF THE RIGHTS OF THE PERSONS CONCERNED
- REQUEST OF THE PERSON CONCERNED TO RESTRICT THE PROCESSING OF PERSONAL DATA
- REQUEST TO CORRECT PERSONAL DATA
- REQUEST FOR THE PORTABILITY OF PERSONAL DATA
- REQUEST FOR ACCESS TO PERSONAL DATA
- REQUEST TO DELETE PERSONAL DATA
- REQUEST TO OBJECT THE PROCESSING OF PERSONAL DATA
- REQUEST NOT TO BE SUBJECT TO AUTOMATED INDIVIDUAL DECISION-MAKING
SILENCE
We would like to assure you that as the operator, as well as our employees, collaborators and intermediaries who will process your personal data, they are obliged to maintain confidentiality about personal data, the provision of which would jeopardize the security of your personal data. This confidentiality continues even after the end of the relationship with us. Without your consent, your personal data will not be provided to a third party.
These personal data processing principles apply from 25.05.2018 and replace the previous Personal Data Protection.
The document was updated on 01.01.2024.