Information obligation on personal data protection
The protection of your personal data is important to us. We take a responsible approach to the protection of your personal data and we strive to ensure your right to information as well.
Act No. 18/2018 Coll. on the Protection of Personal Data and on the Amendment of Certain Regulations (hereinafter referred to as the “Personal Data Protection Act”) and REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (hereinafter referred to as the GDPR).
When processing your personal data, we also adhere to the principles of legality, limitation of the purpose of personal data, minimization of the scope and storage, accuracy, integrity, confidentiality and liability.
1.Personal data provider.
RAVAFOL s.r.o. Registered office address: Školská 5, 963 01 Krupina
Production operation: Antolská 31, 969 01 Banská Štiavnica
2. Contact details of the responsible person
Due to the scope and subject of its activity, our company is not obliged to appoint a responsible person. However, if you have any questions regarding your personal data, write us an e-mail at firstname.lastname@example.org, call +421 901 717 563 by phone, or visit us in person at our company.
3. Purpose of personal data processing
For the quality of its services, the company needs to know some personal data of the persons concerned and needs to provide them to other recipients in order to fulfill their legal obligations and provide the highest quality services.
The company processes the provided personal data for several purposes:
- Processing of contractual and pre-contractual obligations
- Processing of personnel and payroll agenda
- Accounting agenda processing
- Security and property protection
- Employee attendance
- Service security
- Marketing purposes
- Measures to detect corruption
4.Legal basis for the processing of personal data of data subjects:
When processing personal data, the company proceeds in accordance with valid and current law no. 18/2018 Coll. on the Protection of Personal Data and on the Amendment of Certain Regulations (hereinafter referred to as the “Personal Data Protection Act”) and REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (hereinafter referred to as the GDPR).
The legal basis for the processing of personal data is:
special legal regulations, in particular: the Act on Social Insurance, the Labor Code, the valid wage and accounting regulations, the Commercial Code, the Civil Code, the Trade Licensing Act, the Act on the Protection of Safety and Health at Work
the consent of the data subject to the processing of personal data, depending on the purpose of the processing of personal data
performance of the contract to which the person concerned is a party
processing of personal data for the protection of the life, health or property of the data subject
legitimate interest of the company
The company processes personal data without the consent of the data subject, even if:
a) the purpose of the processing of personal data, the circle of data subjects and the list of personal data or their scope shall be established by a directly enforceable legally binding act of the European Union, an international agreement by which the Slovak Republic is bound, or this Act. If the list or scope of personal data is not established, the company may process personal data only to the extent and in the manner necessary to achieve the established purpose of processing in compliance with the basic obligations under § 13 para. 3 letter a) to e) i) of the Personal Data Protection Act.
b) The Company further processes personal data without the consent of the data subject, if the purpose of personal data processing, the circle of data subjects and the list of personal data are stipulated by a special law and only to the extent and in the manner stipulated by a special law. Processed personal data may be provided, made available or disclosed only if a special law stipulates the purpose of providing, making available or disclosed, a list of personal data that may be provided, made available or disclosed, as well as third parties to whom personal data are provided, or a circle of recipients, by which personal data are made available, unless the Personal Data Protection Act provides otherwise.
c) the processing of personal data is necessary for the protection of the life, health or property of the person concerned,
(d) personal data which have already been disclosed in accordance with the law and have been duly marked as disclosed by the controller are processed; the person who claims that he processes the published personal data shall, upon request, prove to the Office that the processed personal data have already been lawfully published,
(e) the company processes personal data which are necessary to protect the rights and legally protected interests of the controller or a third party for the following purposes:
– protection of security and company property
– for the purposes of monitoring employees resulting from the Labor Code (GPS, finger biometrics on attendance, camera system)
– securing pre-contractual / contractual relations
The biometric information system, namely the fingerprint, is used exclusively for the purpose of recording employee attendance. This method of registration is used on the basis of the company’s legitimate interest in checking the presence / absence of employees at the workplace. The company considers this mode of attendance to be proportionate to its purpose in view of the benefits it provides. The controller has taken appropriate security measures throughout the biometric data processing process to ensure the security of such data processing. Security measures have been taken to protect the personal data information system itself for biometric purposes, as well as to protect the environment of this information system, including the means of processing biometric data from damage, theft, unauthorized access or unauthorized manipulation. Only the authorized person has access to the processed data.
Our company may provide your personal information to the following recipients:
Intermediaries – who provide support services for our company in the field of payroll and accounting, security and protection of property and security of web hosting services.
Consent of the person concerned
The Company obtains the consent of the person concerned freely, without coercion and enforcement, as well as without the threat of refusing a contractual relationship, services provided or obligations arising for the operator from legally binding acts of the European Union, an international agreement by which the Slovak Republic is bound or the law.
Consent is granted separately for each purpose of personal data processing.
You can revoke your consent at any time as the person concerned.
The company respects privacy and considers the personal data provided to be confidential.
In its business activities, the company cooperates with several intermediaries whose goal is to provide quality services, while these entities process the personal data of the persons concerned in the performance of their contractual activities for the company. These are, for example, support services in the area of processing accounting and payroll services, provision of services in the area of occupational health and safety, PZS and provision of services in the area of web hosting services.
The company honestly declares that when selecting individual intermediaries, it paid attention to their professional, technical, organizational and personnel competence and their ability to guarantee the security of processed personal data by security measures taken in accordance with the Personal Data Protection Act.
At the same time, the company proceeded in selecting a suitable intermediary in such a way that the rights and legally protected interests of the persons concerned were not endangered.
As an operator, the Company has entered into written agreements with intermediaries pursuant to Section 34 of the Personal Data Protection Act on ensuring the protection of personal data processed by intermediaries, which it has entrusted with processing personal data of data subjects to the extent, under conditions and for the purpose agreed in the contract and manner data.
7. Conditions and method of processing personal data of the persons concerned
The company processes in its information systems the personal data of the persons concerned by automated and non-automated means of processing.
The company does not disclose processed personal data, unless required by special legislation or a decision of a court or other state body.
The Company will not process your personal data without your express consent or other legal legal basis for any other purpose, or to a greater extent than stated in this information and the records of the individual information systems of the operator.
8. Retention period of personal data of the persons concerned
The retention period of personal data is determined according to the purpose of personal data processing and according to the requirements of special regulations.
Specific retention periods are prescribed by an internal regulation of the Company’s Registration Plan prepared in accordance with the Act on Archives and Registries.
The company disposes of personal data whose purpose of processing and retention period has expired in the prescribed manner. After the end of the defined purpose, the company is entitled to process personal data to the necessary extent for research or for statistical purposes in their anonymized form.
The company ensures that the personal data of the data subjects are processed in a form that enables the identification of individual data subjects for a period of time no longer than is necessary to achieve the purpose of the processing.
9. Automated individual decisions, including profiling
The company uses the Google AdWords advertising program, which allows it to create online ads and reach people when they are interested in the products and services it provides. AdWords Remarketing or Similar audiences allow us to reach people who have visited your website in the past. Allows your ad to appear on search, YouTube, and email. Dynamic remarketing allows users to show ads on products or services they’ve viewed in the past. Cookies that provide remarketing codes can be disabled by website visitors through appropriate browser settings.
10. The Company does not transfer personal data to third countries and international institutions.
11. The data subject’s rights relating to the processing of his personal data
The person concerned has the right, upon written request, to request from the company:
accurate information in a generally comprehensible form about the source from which he obtained his personal data for processing,
access to her personal data,
a list of her personal data which are the subject of processing in a generally comprehensible form,
correction or destruction of your incorrect, incomplete or outdated personal data which are the subject of processing,
deletion of her personal data whose purpose of processing has ended; if the subject of processing are official documents containing personal data, it may request their return,
liquidation of her personal data, which are the subject of processing, if there has been a violation of the law,
restrictions on the processing of her personal data,
the data subject may, at the written request of the company addressed or in person, if the matter cannot be postponed, the right at any time to object to the processing of personal data by giving legitimate reasons or providing evidence of unjustified interference with his or her rights and legally protected interests. personal data corrupted; if this is not prevented by legal reasons and it is proven that the objection of the data subject is justified, the company is obliged to block and destroy the personal data whose processing the data subject objected to without undue delay as soon as circumstances allow,
to prevent the processing of her personal data which she expects to be or will be processed for direct marketing purposes without her consent and to request their destruction,
the right to transfer her personal data to another operator
whether the provision of personal data is a legal requirement or a contractual requirement or a requirement necessary for the conclusion of the contract and whether the data subject is obliged to provide personal data, as well as the possible consequences of not providing personal data,
the right to file a motion to initiate proceedings pursuant to Section 100.
If the data subject suspects that his / her personal data are being processed unjustifiably, he / she may submit a motion to initiate proceedings on personal data protection to the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27, Slovak Republic or to contact the Office via its website. headquarters http://www.dataprotection.gov.sk.
If the person concerned does not have full legal capacity, his rights may be exercised by a legal representative.
If the person concerned is not alive, his or her rights under this Act may be exercised by a close person.
The application of the data subject pursuant to the Personal Data Protection Act shall be processed free of charge by the company, except for payment in an amount which may not exceed the amount of expediently incurred material costs associated with making copies, supplying technical media and sending information to the data subject, unless a special law provides otherwise.
The company is obliged to process the request of the person concerned in writing no later than 30 days from the date of delivery of the request.
Restrictions on the rights of the data subject pursuant to the Personal Data Protection Act shall be notified in writing by the company to the data subject and the Office for Personal Data Protection of the Slovak Republic without undue delay.
The company hereby informed you, as the data subject, about the protection of your personal data and instructed you about your rights in relation to the protection of personal data within the scope of this written information obligation.
In Krupina on 1.3.2018
Director of company