Information obligation of the Operator when processing personal data
Personal data Operator
The company SLOVAK CUSTOMER COOPERATIVE ROD, cooperative, with headquarters at Hviezdoslavovo námestie 14, 811 02 Bratislava, SR, ID: 53 221 672, (hereinafter referred to as the “Operator”) processes your personal data in accordance with the GDPR and the Personal Data Protection Act. With regard to the nature, scope, context and purposes of processing personal data, as well as risks of varying probability and severity for the rights and freedoms of natural persons, the Operator has adopted adequate and effective technical and organizational measures.
Principles of personal data processing
The operator declares that when processing the personal data of the affected persons, it is governed by the following principles:
- Principle of legality - The operator processes personal data only in a legal manner and in such a way that the fundamental rights of the person concerned are not violated.
- Principle of purpose limitation – The operator obtains personal data only for a specifically determined, explicitly stated and authorized purpose and further processes them in a manner that is not incompatible with this purpose.
- Principle of minimization of personal data - Personal data processed are adequate, relevant and limited to the necessary scope given the purpose for which they are processed.
- Principle of correctness - Personal data processed are correct and updated as necessary.
- Principle of minimization of storage - Personal data is stored in a form that allows the identification of the person concerned no later than as long as it is necessary for the purpose for which the personal data is processed by the Operator.
- Principle of integrity and confidentiality - The operator processes personal data in a way that, through appropriate technical and organizational measures, guarantees adequate security of personal data, including protection against unauthorized processing of personal data, illegal processing of personal data, accidental loss of personal data, deletion personal data or damage to personal data.
Purposes of processing personal data
The operator processes your personal data for the purpose of:
- Keeping a list of members of the Operator's cooperative, when your personal data is processed on a legal basis according to Art. 6 par. 1 letter c) GDPR and §13 par. 1 letter c) of the Personal Data Protection Act for the duration of your membership in the cooperative and for another 5 years from the termination of membership in the cooperative.
- Keeping a list of those interested in becoming a member of the Operator's cooperative, when your personal data is processed on a legal basis according to Art. 6 par. 1 letter b) GDPR and §13 par. 1 letter b) of the Personal Data Protection Act for a period of 1 year from your registration at www.spdr.sk as an applicant for membership in the Operator's cooperative.
- Management of incoming and outgoing mail, when your personal data is processed on a legal basis according to Art. 6 par. 1 letter c) GDPR and §13 par. 1 letter c) of the Personal Data Protection Act for a period of 5 years.
- Management of electronic incoming and outgoing mail, when your personal data is processed on a legal basis according to Art. 6 par. 1 letter c) GDPR and §13 par. 1 letter c) of the Personal Data Protection Act for a period of 5 years.
- Records of concluded contracts with the Operator, when your personal data is processed on a legal basis according to Art. 6 par. 1 letter b) GDPR and §13 par. 1 letter b) for a period of 3 years from the expiry of such contract.
- Records of inquiries through www.spdr.sk, when your personal data is processed on a legal basis according to Art. 6 par. 1 letter a) GDPR and §13 par. 1 letter a) of the Personal Data Protection Act for the period of validity of the granted consent.
Category of processed personal data
Personal data is considered a category of ordinary personal data and is processed in the scope of name, surname, address, date of birth, e-mail address, telephone number and bank account number.
Categories of recipients to whom personal data may be provided
The Operator informs the person concerned that his personal data will be provided to recipients who
- cooperate with the Operator for the purpose of fulfilling his contractual or legal obligations,
- subjects that are bound by the duty of confidentiality on the basis of the law, e.g. lawyer,
- other authorized authorities and institutions of the state, if the provision of data takes place on the basis of a legal obligation.
Disclosure
Personal data will not be published. Disclosure of personal data occurs only on the basis of a law or an international treaty to which the Slovak Republic is bound.
Transfer of personal data to third countries
Personal data will not be transferred to third countries. In the case of the transfer of personal data, this is carried out only in accordance with the provisions and under the conditions specified in the GDPR and/or the Personal Data Protection Act, based on the express consent of the person concerned.
Profiling
Personal data will not be used for automated individual decision-making, including profiling.
Information and access to personal data
In particular, the affected person has the following rights within the meaning of Art. 13 to Art. 22 and Art. 34 of the GDPR and in accordance with § 19 to § 28 and § 41 of the Personal Data Protection Act:
- a) the right to request from the operator access to personal data concerning the person concerned - you have the right to request a copy of the personal data we have about you, as well as information about how we use your personal data. In most cases, your personal data will be provided to you in written document form, unless you request another way of providing them. If you requested the provision of this information by electronic means, it will be provided to you electronically if it is technically possible,
- b) the right to correct personal data – we take reasonable measures to ensure the accuracy, completeness and timeliness of the information we have about you. If you believe that the data we have is inaccurate, incomplete or out of date, please do not hesitate to ask us to modify, update or supplement this information,
- c) the right to delete personal data (to be forgotten). – you have the right to ask us to delete your personal data, for example, if the personal data we have obtained about you is no longer necessary to fulfill the original purpose of processing. However, your right must be assessed in light of all the relevant circumstances. For example, we may have certain legal and regulatory obligations which mean that we will not be able to comply with your request,
- d) the right to restrict the processing of personal data - under certain circumstances, you are entitled to ask us to stop using your personal data. These are, for example, cases when you think that the personal data we have about you may be inaccurate or when you think that we no longer need to use your personal data, the right to object to the processing of personal data - you have the right to object to the processing of data, which is based on our legitimate interests. If we do not have a compelling legitimate legal reason for processing and you file an objection, we will not process your personal data further,
- e) the right to portability of personal data - under certain circumstances, you have the right to ask us to transfer the personal data you have provided to us to another third party of your choice. However, the right to portability only applies to personal data that we have obtained from you on the basis of consent or on the basis of a contract to which you are a party.
- f) the right to withdraw your consent at any time - in cases where we process your personal data based on your consent, you have the right to withdraw this consent at any time. You can revoke your consent electronically at http://www. spdr.sk/osobne_udaje or at the responsible person's e-mail address zodpovednaosoba@spdr.sk, in writing, notice of withdrawal of consent or in person at the operator. Withdrawal of consent does not affect the legality of the processing of personal data that we have processed about you on the basis of it,
- g) the right to file a motion to initiate proceedings pursuant to § 100 of the Personal Data Protection Act and/or the right to file a complaint pursuant to Art. 13 par. 2 letters d) GDPR - if you believe that we process your personal data unfairly or illegally, you can file a complaint with the supervisory authority, which is the Personal Data Protection Office of the Slovak Republic, Hraničná 12, 820 07 Bratislava; in the case of submission of the proposal in electronic form, it is necessary that it fulfills the requirements according to § 19 par. 1 of Act no. 71/1967 Coll. on administrative procedure (correct order).
Contact for the person concerned in connection with the processing of personal data
The operator has an appointed responsible person. The affected person can exercise their rights arising from the GDPR and the Personal Data Protection Act by e-mail: zodpovednaosoba@spdr.sk or in writing or in person at the address of the Operator’s headquarters.