Data Processing Notice
Our company is responsible for compliance with generally binding regulations on the protection of personal data, in particular, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “GDPR”) and Act No. 18/2018 Coll. on the protection of personal data and amending and supplementing certain Acts.
The Company reserves the right to change or modify the information in this notice, in particular for the purpose of harmonization in the event of changes in the relevant legislation or to incorporate changes in the purposes, legal bases or means of processing personal data. Any changes related to the processing of your personal data will be ensured in the form of an update of this document, which you can find in electronic form on our website www.rdsartgroup.sk or in a printed version, which is available at the Company's headquarters.
The Controller is RDS ART Group s. r. o., with its registered office: Laurinská 213/14, 811 01 Bratislava - Staré Mesto district, Slovak Republic, Company ID: 45 315 621, a company registered in the Commercial Register of the District Court Bratislava I, Section: Sro, insert no.: 62644/B (hereinafter referred to as the “Company”).
3. Personal data and scope of their processing
Personal data is any information relating to you from which you can be directly or indirectly identified. This includes in particular first and last name, residential or other address, your e-mail address, telephone contact, date of birth, national ID number, passport or other ID number, title, nationality, citizenship, but also data with reference to an identifier such as an identification number or elements specific to your physical, physiological or genetic identity.
The Company always processes your personal data for the purposes listed below, to the extent of the data you have provided when granting consent to the processing of personal data, or to achieve the Company's legitimate interests or to fulfil its legal and contractual obligations of the specific purpose of processing.
These are the following categories of personal data:
• Identification data (e.g.: first name, last name, ID number, etc.)
• Contact information (e.g.: address of permanent residence or temporary residence, telephone number, e-mail address)
• Video recordings (camera recordings of the premises of the Company headquarters and their surroundings)
• Data related to the use of the Company's website (e.g. cookies, Google Analytics, MailChimp and others).
4. Purpose and legal basis of the processing of personal data
The Company never processes your personal data without a reason. On the basis of a specific legal basis, data is only processed for individual purposes. This data is kept by the company for a period necessary in relation to the purposes for which the data is processed and after this period your data will be deleted.
The stated purpose includes in particular:
• Customer identification,
• Proper performance of the services provided by the company to customers,
• Receiving and processing customer suggestions and complaints,
• Legal protection and enforcement of the Company's rights against customers,
• Fulfilment of the Company's tasks and obligations resulting from the applicable legal regulations,
• Conclusion of contractual relationships with customers, including pre-contractual relationships,
• Management of contractual relationships, including making changes and their termination,
• Activities related to the fulfilment of archiving obligations.
If the scope of personal data specified by the above legal provisions is not sufficient to achieve the specified purpose of processing, the Company may also process your personal data in the following cases:
• If you have consented to the processing of your personal data;
• If the processing of personal data is necessary to fulfil contractual obligations;
• If the processing of personal data is necessary to protect the legitimate interests of the Company;
• If the processing is necessary to prove, exercise or defend the Company's legal claims.
The Company has a legitimate interest in looking after its customers and establishing business relationships and thus informing them about its products, innovations, services and, where appropriate, various special offers. In this context, the Company may also contact you without your prior consent. Of course, this does not apply if you do not agree to such addressing or object to it.
5. Retention period for personal data
The period of storage of personal data varies depending on the purpose for which the personal data is processed. In general, the Company stores personal data for the following period:
• If the Company processes personal data in order to comply with a legal obligation – for the period required by law;
• If the Company processes personal data for the purpose of performance of a contract – for the duration of the performance of the contract (including pre-contractual negotiations) and after the end of the contract during the period for asserting claims under the contract;
• If the Company processes personal data on the basis of legitimate interests of the Company or third parties - for the time necessary to achieve the purpose for which the personal data was collected and for the duration of the exercise of legal claims;
• If the Company processes personal data on the basis of consent – for the period specified in the consent or for the duration of the consent until its withdrawal and for the period for enforcing legal claims.
After the expiry of said periods, the Company is entitled to further process personal data for compatible purposes or for special purposes (e.g. archiving, statistics).
6. Recipients of personal data
In some cases, the Company may share your personal data with third parties in order to properly fulfil the Company's obligations. Following groups of entities may be involved:
• courts, state and local authorities, public law institutions, law enforcement authorities, financial authorities, customs authorities and financial management authorities, notary's offices, executors, etc.;
• intermediaries who process personal data for the Company;
• companies for which the Company processes personal data as an intermediary;
• contractual partners of the Company, insofar as the provision of personal data is necessary for the fulfilment of the contract by the contractual partner or the company or the assertion or enforcement of rights and obligations under the contract.
7. Contractual requirement
The provision of your personal data is a contractual requirement necessary for entering into a contractual relationship between you and the Company and without providing it the Company could not provide the services for which you signed up during registration.
8. Your rights in connection with the processing of personal data
The right to withdraw consent to the data processing
If your personal data is processed on the basis of your consent, you have the right to withdraw this consent at any time. Withdrawal of consent will not affect the lawfulness of processing of your personal data prior to the withdrawal of your consent.
Right to access data
You have the right to request information about your data processed by the Company at any time, including information about its origin, data recipient and the purpose of the processing. You also have the right to request information about the expected storage period of your data.
Right to rectification of data
You have the right to request the Company to correct your inaccurate personal data and/or to complete the personal data without undue delay.
The right to the erasure of data and restriction of data processing
You have the right to request that the Company erase your personal data without undue delay if one of the following reasons applies: a) the data are no longer necessary for the purposes for which they were collected or otherwise processed, b) the consent given to the processing of the personal data has been revoked and there is no other legal basis for the processing, c) you exercise your right to object to the processing of the personal data and there is no legitimate interest in the processing, d) the data was processed unlawfully, e ) the data must be erased to fulfil a legal obligation, f) the data are obtained in connection with information society services aimed directly at the child.
You also have the right to request the restriction of the processing of your data if: a) you dispute the accuracy of the data, b) the data processing would be unlawful, or c) the Company no longer needs the personal data for the purposes of the processing, however, you need it to prove, assert or defend legal claims, d) you have lodged an objection to the processing of personal data.
The right to object to processing
You have the right, for reasons arising from a particular situation, to object at any time to the processing of your personal data, which is in the public interest or based on the legitimate interests of the Company. At the same time, you have the right to object to profiling, which is based on Article 6 (1)(e) or (f) GDPR. You also have the right to object to the processing of personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.
Right to data portability
You have the right to receive from the Company your personal data that you have provided to them in a structured, commonly used and machine-readable format. You have the right to transfer personal data obtained in this way to another controller without the Company preventing you from doing so. Such data portability is possible if your personal data has been processed on the basis of given consent or on the basis of a contract and the processing is automated. If technically possible, you have the right to a direct transfer from one controller (the Company) to another controller.
Automated individual decision-making and profiling
If you have not expressly consented to the use of automated individual decision-making and profiling through automated processing carried out on the basis of the personal data you have provided, you have the right not to be subject to the Company's decision that is based solely on automated processing, including profiling.
The right to lodge a complaint with a supervisory authority
You have[AN1] the right to lodge a complaint with the supervisory authority responsible for supervising the processing of personal data. On the territory of the Slovak Republic, such authority is the Office for Personal Data Protection of the Slovak Republic with its registered office at Hraničná 4826/12, 820 07 Bratislava.
The right to report a personal data breach
You have the right for the Company to notify you immediately of a personal data breach that is likely to result in a high risk to your rights and freedoms.
Exercising your rights
If you decide to exercise any of your above rights related to the processing of your personal data, you can do so in writing at the Company's address or electronically at firstname.lastname@example.org.
9. Transfer of personal data to third countries
As part of the processing of personal data, these are transmitted to third countries outside the territory of the European Economic Area, namely the United States of America, for technical security purposes and marketing purposes via the international marketing platforms MailChimp and Google Analytics.
The subject of the cross-border transmission is only ordinary personal data in the scope of the first name, last name, address, telephone number and e-mail address. We never perform cross-border transfers of special categories of personal data or camera footage.
10. Existence of automated decision-making including profiling
The Company does not use decision-making based on automated processing of personal data, including profiling.
11. Data sources
The Company receives personal data mainly from the data subjects (directly or through intermediaries who process personal data on behalf and on the basis of the Company's instructions for the purposes determined by the Company). The Company may also obtain your personal data from other sources, such as publicly available sources and registers, mainly in connection with the conclusion or performance of a contract or in connection with the exercise of its rights, powers or obligations arising from the relevant legal regulations, court decisions or contractual relationships.