Personal data processing principles and data protection system under the GDPR
Prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data within the meaning of Articles 13 and 14 of the Regulation (hereinafter referred to as "GDPR") and Act No. 18/2018 Coll. on the protection of personal data (hereinafter referred to as the "Personal Data Protection Act")
Operator:
Gashpar s. r. o.
Upper pink 9
969 01 Banská Štiavnica
ID: 51455439
Tel: 0905470050
E-mail: info@gashpar.sk
What is personal data?
Personal data is data relating to an identified natural person or an identifiable natural person, which can be identified directly or indirectly, in particular by a universally applicable identifier, another identifier such as a first name, surname, identification number, location data, or online identifier, or on the basis of one or more characteristics or traits that constitute its physical identity, physiological identity, genetic identity, psychological identity, mental identity, economic identity, cultural identity or social identity.
What is personal data processing?
Processing of personal data means a processing operation or set of processing operations concerning personal data or sets of personal data, in particular the obtaining, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise, alignment or combination, restriction, erasure, whether or not by automated or non-automated means. The Operator (Administrator) is not obliged to appoint/designate a Responsible Person.
Sources and categories of personal data:
The controller processes personal data (directly from you) that you have provided to it or personal data that it has obtained on the basis of the fulfilment of your order. Your identification and contact details and data necessary for the performance of the contract.
Lawful ground and purpose of processing
The lawful reason for the processing is:
- Your consent to the processing of your personal data for the purpose of providing direct marketing pursuant to Article 6(1)(a) of the GDPR
- Performance of the contract between you and the controller pursuant to Article 6(1)(b) GDPR
- The processing is necessary for the fulfilment of the legal obligation of the controller pursuant to Article 6 para. 1(c) GDPR
The purpose of processing personal data is :
Processing your order and exercising the rights and obligations arising from the contractual relationship between you and the operator. When placing an order, the personal data required for the successful completion of the order according to Art. 6 para. 1 lit. (b) of the Regulation (this includes the subsequent payment, delivery of goods, handling of complaints, etc.); the processing of the customer's personal data takes place without the customer's consent, since the legal basis for the processing of their personal data for the purposes of contract performance is a specific order between the customer and the operator. The provision of personal data is a necessary requirement for the conclusion and fulfilment of an order, without the provision of personal data it is not possible to create an order or for the operator to fulfil its terms.
Provision of the agreed service in the field of construction activity
The controller declares that it does not work with the records in any way and does not disclose them to third parties or entities. When operating a profile on social networks (Facebook, Instagram), we are interested in raising awareness of the operator in the online environment and communicating with customers.
Personal data that you post on our social networking sites such as comments, likes, videos, pictures, etc. will be published via the social network platform. We do not subsequently process personal data for any other purpose.
The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her. You can send your objections by e-mail to the contact address of the controller info@gashpar.sk.
Social network operators have their own adopted rules, service infrastructure and their own privacy provisions. We have no influence on the transfer of data and the use of your data by social network operators We recommend that you familiarize yourself with the privacy policy of the social network platform provider:
https://www.facebook.com/policy.php ;
In certain processing operations, we act as joint controllers with social network operators within the meaning of Art. 26 point 4 GDPR. There is no automated individual decision-making on the part of the controller within the meaning of Article 22 of the GDPR.
Retention period:
The controller shall store personal data:
- For as long as necessary to exercise the rights and obligations arising from the contractual relationship between you and the controller and to assert a claim arising from that contractual relationship .
- For as long as consent to the processing of personal data for marketing purposes is withdrawn
- After the expiry of the retention period for personal data resulting from Act no. 395/2002 Coll. Act on archives and registers and on the amendment of certain acts the controller deletes the personal data
Recipients of personal data
Who is the beneficiary?
The recipient is anyone to whom the personal data is disclosed, regardless of whether they are a third party. A public authority which processes personal data on the basis of a special regulation shall not be considered a recipient.
They are persons who are involved in the delivery of goods, services, making payments under a contract
The controller does not provide, disclose or make available personal data to third countries
Terms and conditions for the security of personal data
- The controller declares that it has taken appropriate personal, technical and organisational measures to ensure the protection of personal data.
- The controller has taken technical measures to secure the data storage and storage of personal data in file form.
- The controller declares that the personal data can only be accessed by persons authorised by the controller.
Your rights
Under the conditions set out in the GDPR you have:
- The right of access to your personal data pursuant to Art. 15 GDPR
- Right to rectification of personal data pursuant to Article 16 GDPR
- Right to restriction of processing
- Right to erasure pursuant to Article 17 GDPR
- Right to object under Article 21 GDPR
- The right to the transfer of personal data under Article 21 of the GDPR
- The right to withdraw consent (electronically or to a mailing address)
- The right to lodge a complaint with the Data Protection Authority if you believe that your data protection rights have been violated.
You also have the right to lodge a complaint with the Data Protection Authority if you believe that your data protection rights have been violated
How can you exercise your rights?
Right of access to data
You have the right to know whether we are processing your personal data. If we process them, you can ask us for access to them. Upon your request, we will issue a confirmation with information about the processing of your personal data. The application can be submitted electronically, to the email address info@gashpar.sk, or by post to Gashpar s. r. o., Horná ružová 9, 969 01 Banská Štiavnica
Right to repair
You have the right to have your personal data processed by us to be correct, complete and up-to-date. If your personal data is incorrect or outdated, you can ask us to correct or complete it electronically to the email address info@gashpar.sk or by post to the correspondence address Gashpar s. r. o., Horná ružová 9, 969 01 Banská Štiavnica
Right to erasure
In certain circumstances, you have the right to have your personal data erased by us. You can ask us to delete your data at any time. We will delete your personal data if:
- we no longer need your personal data for the purpose for which you provided it to us,
- you withdraw your consent,
- you object to the processing of your personal data,
- we process your personal data unlawfully,
- personal data must be erased in order to comply with a legal obligation,
- if you are a child, or. the parent of a child who has consented to the processing of personal data over the internet.
Right to restriction of processing
You can ask us to restrict the processing of your personal data. If we grant your request, we will only store your personal data and will not work with it further. Restriction of the processing of your data will occur if:
- notify us that your personal data is incorrect until we have verified its accuracy,
- we are processing your personal data unlawfully, but you do not consent to its erasure and instead request that we only restrict the processing of your personal data,
- We no longer need your data, but you need it to establish, exercise or defend your rights
- you object to the processing of your personal data until we have verified that our legitimate interests outweigh your reasons.
Right to data portability
You have the right to request that we provide you with your personal data in an electronic format (e.g. an XML or CSV file) that allows you to easily transfer your data to another company. You can also ask us to transfer your personal data directly to the selected company. We will comply with your request if you have provided us directly with your personal data and have given your consent to process it.
Right to object
You have the right to object to us processing your personal data. If we process your personal data in the following cases:
- because of our legitimate interest,
- creating a customer profile,
- you can object to their processing if you have personal grounds for doing so.
How can you exercise these rights?
You can contact us with your request in any of the following ways:
by email: info@gashpar.sk or by post to the business address Gashpar s. r. o., Horná ružová 9, 969 01 Banská Štiavnica ,
In the event that you believe that your personal data protection rights have been violated, you have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection at Hraničná 12, 820 07 Bratislava 27, Slovak Republic. Office Secretariat: +421 /2 3231 3214, E-mail: statny.dozor@pdp.gov.sk