Privacy Policy

Privacy Policy

INFORMATION TO THE DATA SUBJECT IN RELATION TO THE COLLECTION AND PROCESSING OF PERSONAL DATA

provided by the controller to the data subject in obtaining personal data from the data subject

The operator hereby, in accordance with Article 13, 1. and 2. of the Regulation of The European Parliament and Council, No. 2016/679, 27 October 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (General Data Protection Regulation) (hereinafter referred to as the “Regulation”) provides the Data Subject from whom the Operator obtains personal data concerning him with the following information:

Identity and contact details of the Operator:

The operator is Mgr. Tomáš Balla, with the place of business Heďbeneéte 422, 929 01 Kútniky, Registration Number: 52 899 241, registered in the business register of the District Office Dunajská Streda, business register number: 210-39121 , e-mail address: info@vistawood.eu, telephone number: +421 915 654 710

Contact details of the responsible person:

The responsible person is not established.

Personal data processed:

The operator processes the following personal data: first name, surname, residence, email address, telephone number, IP address, cookies.

Purposes of the processing of personal data of the Data Subject:

The purposes of the processing of the personal data of the Data Subject shall be:

processing of accounting documents
performance and registration of contracts;
the records of clients and contractors for the purpose of concluding and performance of contracts
archiving documents in accordance with legislation
marketing activities of the operator
correspondence and communication

Legal basis for the processing of personal data of the Data Subject:

The legal basis for the processing of the personal data of the Data Subject shall, depending on the specific personal data and the purpose of their processing, be the consent of the Data Subject to the processing of personal data, the fulfilment of the legal obligation of the operator or, where appropriate, the fulfilment of the contract to which the data subject is party.

Specification of legitimate interests pursued by the Operator or third party: Not applicable.

Recipients or categories of recipients of personal data:

The recipient of personal data of the Data Subject will be at least may be persons cooperating with the Controller in the performance of the tasks of the Controller, his business partners, suppliers and contractors, in particular: the accounting company, the company providing legal services to the controller, the company providing services related to the creation and maintenance of the software, the company providing the transport of the ordered products.

The recipients of personal data will also be tax authorities, health insurance companies, social insurance companies and other state authorities, in legally established cases.

Information on the intended transfer of personal data to a third country: Not taking place.

Retention periods of personal data:

Personal data shall be legally stored for the necessary time for the performance of the contract and their subsequent archiving.

Instruction on the existence of the relevant rights of the data subject:

The data subject shall have, among other, the following rights:

(a) the data subject's right of access to data pursuant to Article 15 of the Regulation, the content of which is:

(i) the right to obtain from the Controller confirmation of whether personal data relating to the Data Subject are being processed;

(ii) where the personal data of the Data Subject are processed, the right to obtain access to the personal data processed and the right to obtain the following information:

information on the purposes of the processing;
information on the categories of personal data concerned;
information on the recipients or categories of recipients to whom personal data have been or will be provided, in particular in the case of recipients in third countries or international organisations;
where possible, information on the estimated retention period of personal data or, where this is not possible, information on the criteria for its designation;
information on the existence of the right to request from the Controller the rectification of personal data relating to the Data Subject or their erasure or restriction of processing and the existence of the right to object to such processing;
information on the right to file a complaint with the supervisory authority;
where personal data have not been obtained from the Data Subject, any available information as to their source;
information on the existence of automated decision-making, including profiling referred to in Article 22(1) and (4) of the Regulation and, in these cases, at least meaningful information on the procedure used, as well as the significance and foreseeable consequences of such processing of personal data for the Data Subject;

(iii) the right to be informed of adequate safeguards under Article 46 of the Regulation concerning the transfer of personal data where personal data are transferred to a third country or international organisation;

(iv) the right to provide a copy of the personal data that is processed, provided, however, to the condition that the right to provide a copy of the personal data processed must not adversely affect the rights and freedoms of others;

(b) the right of the data subject to rectification under Article 16 of the Regulation, the content of which is:

(i) the right for the Controller to correct, without undue delay, incorrect personal data relating to the Data Subject;

(ii) the right to supplement the incomplete personal data of the Data Subject, including by providing a supplementary statement of the Data Subject;

Regulations containing:

(i) the right to obtain with the Controller the erasure of personal data relating to the Data Subject without undue delay if any of the following reasons is fulfilled:

personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
The data subject withdraws the consent on the basis of which the processing is carried out, subject to the condition that there is no other legal basis for the processing of personal data;
The data subject objects to the processing of personal data pursuant to Article 21(1) of the Regulation and no legitimate reasons prevail for the processing of personal data, or the Data Subject objects to the processing of personal data pursuant to Article 21(2) of the Regulation;
personal data have been processed unlawfully;
personal data must be deleted in order to comply with a legal obligation under European Union law or the law of the Member State to which the Controller is subject;
the personal data were collected in connection with the offering of information society services pursuant to Article 8(1) of the Regulation;

(ii) the right, so the Controller who disclosed the personal data of the Data Subject, with regard to the available technology and the costs of implementing the measures, to take appropriate measures, including technical measures, to inform other controllers carrying out the processing of personal data that the Data Subject is requesting them to delete all references to such personal data, a copy thereof or a replica thereof;

while the right to the erasure of personal data with the content of rights pursuant to Article 17(1) and (2) of the Regulation (i.e. the content of rights according to (i) and (ii) of section (c) of this document) shall not arise if the processing of personal data is necessary:

to exercise the right to freedom of expression and information;
to fulfil a legal obligation requiring processing under the law of the European Union or the law of the Member State to which the Controller is subject, or to perform a task carried out in the public interest or in the exercise of public authority conferred on the Controller;
for reasons of public interest in the field of public health, in accordance with Article 9, Paragraph 2, section h) and i) of the Regulation, as well as Article 9, Paragraph 3 of the Regulation;
for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes pursuant to Article 89, Paragraph 1 of the Regulation where it is likely that the right referred to in Article 17, Paragraph 1 of the Regulation shall make it impossible or seriously difficult to achieve the objectives of such processing of personal data; Or
for the demonstration, exercise or defence of legal claims;

(d) the data subject's right to restrict the processing of personal data pursuant to Article 18 of the Regulation

containing:

(i) the right to have the Controller to restrict the processing of personal data in respect of one of the following cases:

The data subject shall challenge the accuracy of the personal data during a period enabling the Controller to verify the accuracy of the personal data;
the processing of personal data is unlawful and the Data Subject objects to the erasure of personal data and calls instead for a restriction on their use;
The controller no longer needs personal data for processing purposes, but the Data Subject needs them to prove, exercise or defend legal claims;
The data subject has objected to the processing pursuant to Article 21, Paragraph 1 of the Regulation, until the verification that the legitimate reasons on the part of the Controller oubalance the legitimate reasons of the Data Subject;

(ii) the right, where the processing of personal data is restricted under (i) of section (d), such restricted personal data, with the exception of storage, have been processed only with the consent of the Data Subject or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State;

(iii) the right to be informed in advance of the lifting of the restriction on the processing of personal data;

(e) the right of the data subject to comply with the notification obligation towards the beneficiaries pursuant to Article 19 of the Regulation, the content of which is:

(i) the right so the Controller shall notify any recipient to whom personal data have been provided any rectification or erasure of personal data or restriction of processing made pursuant to Article 16, Article 17 Paragraph 1 and Article 18 of the Regulation unless this proves impossible or does not require disproportionate effort;

(ii) the right so the Controller shall inform the Data Subject of such recipients if the Data Subject so requests;

(f) the data subject's right to data portability pursuant to Article 20 of the Regulation, the content of which is:

(i) the right to obtain personal data relating to the Data Subject which it has provided to the Controller in a structured, commonly used and machine-readable format and the right to transfer such data to another controller without the Controller preventing from doing so if:

the processing is based on the consent of the Data Subject pursuant to Article 6 Paragraph 1, a) of the Regulation or on the contract pursuant to Article 6 Paragraph 1, b) of the Regulation and at the same time
the processing is carried out by automated means, and at the same time
the right to obtain personal data in a structured, commonly used and machine-readable format and the right to transfer such data to another controller, without the Controller objecting it, will not adversely affect the rights and freedoms of others;

(ii) the right to transfer personal data directly from one controller to another controller, as far as technically possible;

(g) the right of the data subject to object pursuant to Article 21 of the Regulation, the content of which is:

(i) the right to object at any time on grounds relating to the particular situation of the Data Subject against the processing of personal data concerning him or her, which is carried out pursuant to Article 6 Paragraph 1 section e) or f) of the Regulation, including objecting to profiling based on these provisions of the Regulation;

(ii) [in the event of the exercise of the right to object at any time on grounds relating to the particular situation of the Data Subject, against the processing of personal data concerning him or her, which is carried out pursuant to Article 6 Paragraph 1 section e) or f) of the Regulation, including objecting to profiling based on these provisions of the Regulation] the right that the Controller should not further process the personal data of the Data Subject unless he demonstrates the necessary legitimate grounds for processing which premise the interests, rights and freedoms of the Data Subject, or the reasons for proving, exercising or defending legal claims

(iii) the right to object at any time to the processing of personal data relating to the Data Subject for the purposes of direct marketing, including profiling to the extent that it relates to direct marketing; while it stands, that if the Data Subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes;

(iv) (in connection with the use of information society services) the right to exercise the right to object to the processing of personal data by automated means using technical specifications;

(v) the right to object, on grounds relating to the particular situation of the Data Subject, against the processing of personal data concerning the Data Subject where the personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89 Paragraph 1 of the Regulation, but except where processing is necessary for the performance of a task for reasons of public interest;

(h) the right of the data subject related to automated individual decision-making pursuant to Article 22 of the Regulation, the content of which is:

(i)the right not to be subject to a decision which is based solely on the automated processing of personal data, including profiling, and which has legal effects which concern or similarly significantly affect him, except in cases pursuant to Article 22 Paragraph 2 of the Regulation (i.e. except where a decision: (a) is necessary for the conclusion or performance of a contract between the Data Subject and the Controller, (b) authorised by European Union law or the law of a Member State to which the Controller is subject, and which also provides for appropriate measures guaranteeing the protection of the rights and freedoms and legitimate interests of the data subject or (c) based on the express consent of the Data Subject).

Instruction on the data subject's right to withdraw consent to the processing of personal data:

The data subject shall at any time be entitled to withdraw his consent to the processing of personal data, without having impact on the lawfulness of the processing of personal data based on consent given prior to his revocation.

The data subject is entitled at any time to withdraw his consent to the processing of personal data – in whole or in part. The partial withdrawal of consent to the processing of personal data may concern a certain type of processing operation/processing operation, while the lawfulness of the processing of personal data to the extent of the remaining processing operations remains unaffected. The partial withdrawal of consent to the processing of personal data may relate to a particular purpose of the processing of personal data / certain specific purposes for the processing of personal data, while the lawfulness of the processing of personal data for other purposes remains unaffected.

The right to withdraw consent to the processing of personal data may be exercised by the Data Subject in paper form at the address of the Controller registered as his registered office in the commercial register at the time of withdrawal of consent to the processing of personal data or in electronic form by electronic means (by sending an e-mail to the Operator's e-mail address specified when the Operator is identified in this document or by completing an electronic form published on the Operator's website).

Instruction on the data subject's right to make a complaint with the supervisory authority:

The data subject shall have the right to make a complaint with the supervisory authority, in particular in the Member State of his habitual residence, place of work or at the place of the alleged infringement, if he considers that the processing of personal data relating to him is contrary to the Regulation, all without having impact on any other administrative or judicial remedy. The supervisory authority in the Slovak Republic is the Office for the Protection of Personal Data of the Slovak Republic, established by Hraničná 12, 820 07 Bratislava, IČO: 36 064 220, email: statny.dozor@pdp.gov.sk , telephone: 02/3231 3214.

Information on the existence / absence of an obligation on the data subject to provide personal data:

The Controller shall inform the Data Subject that the provision of personal data of the Data Subject is necessary for the conclusion of the contract and for its performance. The Controller shall inform the Data Subject that the Data Subject is not obliged to provide personal data or be obliged to consent to their processing. As a result of the failure to provide personal data and/or the consequence of not agreeing to the processing of personal data, the Controller will not be able to conclude and fulfil the contract.

Information related to automatic decision-making, including profiling: Not applicable