The purpose of this section is to provide you with detailed information in the event that we process your personal data, as well as information on how you may exercise your rights in relation to such processing, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “Regulation”) and Sections 19 and 20 of Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (hereinafter referred to as the “Act”).

Data Controller: ŽOS Vrútky a.s., with its registered office at Dielenská Kružná 2, 038 61 Vrútky, Slovak Republic, Company ID No.: 31 615 619, registered in the Commercial Register of the District Court Žilina, Section Sa, File No. 225/L, tel.: +421 43 420 5101, e-mail: zos-vrutky@zos-vrutky.sk

Data Protection Officer (DPO) contact details: Tel.: +421 43 420 5518, +421 43 420 5519, +421 43 420 5182, e-mail: dpo@zos-vrutky.sk

The purposes of processing personal data include, in particular, maintaining records necessary for the fulfilment of the Data Controller’s obligations arising from employment and similar relationships involving its employees, students undertaking practical training at the Data Controller’s premises, as well as other contractual and statutory obligations. Personal data are also processed to ensure occupational safety, protect health and safeguard the property of the Data Controller, data subjects and other natural persons present on the Data Controller’s premises and in its facilities.

The categories of data subjects whose personal data are processed primarily include the Data Controller’s employees, their family members and close relatives, students undertaking practical training at the Data Controller’s premises and their legal and authorised representatives, parties to other legal relationships (including contractual relationships, contentious and non-contentious proceedings and similar matters), visitors and, in specific cases, third parties.

The scope of personal data processed depends on the nature of your relationship with the Data Controller and the category of data subjects to which you belong. In particular, the following categories of personal data may be processed:

1. Identification, contact and status-related data.
2. Data relating to personnel administration, payroll, social security, contributions, taxation and accounting.
3. Operational data.
4. Data relating to access rights.
5. Photographs and CCTV recordings.
6. Other data relating to the performance of work and the maintenance of operational records.
7. Other data relating to contractual relationships with the Data Controller.

This list is illustrative and not exhaustive. Specific and detailed information regarding the processing of your personal data will always be provided before the relevant processing activity begins (upon initial contact and when you first provide your personal data to the Data Controller).

We may process your personal data without your consent:

1. On the basis of specific legislation and international treaties binding on the Slovak Republic.
2. Where processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
3. Where processing is necessary to protect the life, health or property of the data subject or another person.
4. Where processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party.
5. Where processing is necessary for the performance of a task carried out in the public interest.

Where personal data are not processed on any of the above grounds, the Data Controller may, in exceptional and isolated cases, process personal data on the basis of the data subject’s freely given consent, solely for the purposes, within the scope and for the period specified in that consent.

CCTV Recordings

With reference to the legitimate interests of the Data Controller or a third party mentioned above, we would like to inform you about the processing of your personal data for the purposes of ensuring security, protecting life, health, property and other assets when entering, moving within and leaving the Data Controller’s premises and facilities. Such processing also serves to maintain order, protect the life and health of persons in publicly accessible areas, investigate undesirable incidents, and prevent and detect unlawful activities and similar incidents.

The premises, buildings and all points of entry from public areas into the Data Controller’s facilities (including entrances and security gates) are monitored by a CCTV system.

CCTV recordings from individual devices are retained for a maximum period of 15 days, after which they are automatically deleted, meaning they are permanently destroyed.

We collect and process personal data of data subjects only for specifically defined and legitimate purposes, in accordance with the principles of proportionality, lawfulness, fairness and transparency, and only to the extent necessary for the purposes of processing (the principle of data minimisation). The Data Controller has also implemented appropriate technical and organisational measures for the processing of personal data in accordance with the Regulation and the Act.

All processing activities, procedures, security measures and personal data protection arrangements are governed by the Data Controller’s internal regulations.

Identification of Recipients and Categories of Recipients

The Data Controller may disclose personal data to authorised entities, such as institutions and organisations permitted to process such data under specific legislation, or to contractual partners (in particular, data processors) that have contractually undertaken to provide appropriate safeguards for the protection of the personal data processed, as follows:

This list of recipients is general and not exhaustive. Specific and detailed information about the recipients of your personal data will always be provided before the relevant processing activity begins (upon initial contact and when you provide your personal data to the Data Controller).

Personal data may also be disclosed to other recipients with the data subject’s consent, at their request and/or where necessary to protect the life, health or property of the data subject or another natural person.

Retention Period of Personal Data

The Data Controller processes personal data, depending on their category, for the period necessary to fulfil the stated purpose. Such periods are determined by the applicable legislation, internal regulations, records retention schedules or the period expressly specified in the relevant consent to personal data processing.

Transfers of personal data to third countries or international organisations are not envisaged.

The Data Controller does not process personal data through profiling or similar methods based on automated individual decision-making.

Rights of Data Subjects

Upon submitting a written request or making a request in person to the Data Controller, the data subject has the following rights:

1. Right of access: The right to obtain confirmation as to whether personal data concerning them are being processed. Where the Data Controller processes such personal data, the data subject has the right to access those data and obtain information about their processing.
2. Right to rectification: The right to have inaccurate personal data concerning them rectified by the Data Controller without undue delay. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed.
3. Right to erasure: The right to have inaccurate personal data concerning them erased by the Data Controller without undue delay.
4. Right to restriction of processing: The right to obtain restriction of processing from the Data Controller where:

   a. The data subject contests the accuracy of the personal data, for a period enabling the Data Controller to verify their accuracy.

   b. The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.

   c. The Data Controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims.

   d. The data subject has objected to processing pursuant to Section 27(1) of Act No. 18/2018 Coll. and the relevant provisions of the Regulation, pending verification of whether the legitimate grounds of the Data Controller override those of the data subject.

5. Right to data portability: The right to receive personal data in a structured, commonly used and machine-readable format and to have those data transferred, where technically feasible, if the processing is carried out by automated means on the basis of consent or for the performance of a contract.
6. Right to lodge a complaint: The right to submit a proposal to initiate personal data protection proceedings with the Personal Data Protection Office of the Slovak Republic pursuant to Section 100 of Act No. 18/2018 Coll.
7. Right to withdraw consent: Where personal data are processed on the basis of consent, the data subject has the right to withdraw their consent at any time.

Exercising the Rights of Data Subjects

Data subjects may exercise their rights:

1. In writing or electronically, provided that the content of the request clearly indicates that the data subject is exercising a right and specifies the right concerned.
2. In person, orally for the record, whereby the record must clearly identify the person exercising the right, the nature of the request, the date of the record, the person who prepared it, and the signatures of both the person preparing the record and the data subject. The Data Controller is obliged to provide the data subject with a copy of the record.

If you have any questions regarding personal data protection, you may contact the person responsible for supervising personal data protection (the Data Protection Officer, or DPO, within the meaning of the Regulation) at any time. The DPO will answer questions concerning the processing of personal data, obligations arising from applicable personal data protection legislation, or information contained in this document.

You can contact the Data Protection Officer using the address and telephone numbers provided at the beginning of this Privacy Notice. You may also exercise your rights through any data processor.

If you believe that we process your personal data unfairly or unlawfully, you may lodge a complaint with the supervisory authority:

Personal Data Protection Office of the Slovak Republic

Website: https://dataprotection.gov.sk

Address: Hraničná 12, 820 07 Bratislava 27, Slovak Republic

Tel.: +421 2 3231 3214

E-mail: statny.dozor@pdp.gov.sk