Personal Data Processing Policy and Personal Data Protection System under GDPR

According to Article 4 point 7 of Regulation (EU) 2016/679 of the European Parliament and the Council on the protection of natural persons concerning the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”), ŠPED-INPEX s.r.o., Rázusova 790/7, 949 01 Nitra, Company Registration Number: 46 098 607, is the operator (administrator) of personal data.

Contact details of the administrator:

Phone number: +421 903 494 909

What is Personal Data?

Personal data means any information relating to an identified natural person or an identifiable natural person who can be identified directly or indirectly, in particular by reference to a generally applicable identifier or another identifier such as a name, surname, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

What is the processing of personal data?

The processing of personal data refers to a processing operation or set of processing operations concerning personal data or sets of personal data, in particular collecting, recording, organizing, structuring, storing, changing, searching, viewing, using, providing by transmission, dissemination, or otherwise, re-organizing or combining, limiting, deleting, whether by automated or non-automated means.

The Operator (Administrator) has no obligation to appoint/designate a Responsible Person.

Personal data sources and categories:

The operator processes personal data provided directly by you or personal data collected based on the fulfillment of your order.

Your identification and contact data, and data necessary for the fulfillment of the contract.

Legal basis and purpose of processing:

The legal basis for processing is as follows:

Your consent to the processing of personal data to provide direct marketing following Article 6 paragraph 1 letter a) GDPR

Fulfillment of the contract between you and the operator following Article 6 paragraph 1 letter b) GDPR

The processing is necessary for the fulfillment of the legal obligation of the operator following Article 6, paragraph 1 letter c) GDPR

The purpose of personal data processing is as follows:

The fulfillment of your order, and execution of rights and obligations arising from the contractual relationship between you and the operator. When placing an order, the required personal data are necessary for the order fulfillment following Article 6 par. 1 letter b) Regulation (including subsequent payment, delivery of goods or services, handling of complaints, etc.); the processing of the customer’s data takes place without the customer’s consent, as a specific contract between the customer and the operator represents the legal basis for processing his data for the contract fulfillment. Providing personal data is a fundamental requirement to conclude and fulfill the contract. If personal data is not provided, it is not possible to conclude a contract or to fulfill its terms on the part of the operator.

The operator declares not to work with data in any way or not to provide them to third parties or entities.

The retention period for personal data:

The operator keeps personal data as follows:

For the period necessary to exercise the rights and obligations arising from the contractual relationship between you and the operator, and to assert the claim arising from these contractual relationships.

After the expiry of the personal data retention period, following Act no. 395/2002 Coll., on Archives and Registries and on Amending and Supplementing Certain Acts, the operator will delete personal data.

Recipients of personal data

Who is the recipient?

The recipient is any person to whom personal data is provided, whether a third party or not. A public authority that processes personal data based on a special regulation is not considered a recipient.

Persons participating in the delivery of goods, services, and payments based on the contract

The operator shall not provide, publish or make available personal data to third countries

Data privacy terms

The operator declares to have taken appropriate personnel, technical and organizational arrangements to ensure the protection of personal data.

The operator has taken technical arrangements to secure data storage and personal data storage in paper form.

The operator declares that only persons authorized by him have access to personal data.

Your rights:

Under the conditions set out in the GDPR, you have the following rights:

The right of access to personal data following Article 15 GDPR
The right to rectification of personal data following Article 16 GDPR
The right to restrict processing
The right to erasure following Article 17 GDPR
The right to object to the processing of their data following Article 21 GDPR
The right to data portability following Article 21 GDPR
The right to withdraw consent (electronically or by mail to a correspondence address)
The right to file a complaint to the Office for Personal Data Protection if you believe that your data protection rights have been infringed.

Furthermore, you have the right to file a complaint to the Office for Personal Data Protection if you believe that your data protection rights have been infringed.

How can you fulfill your rights?

Right of access to personal data

You have the right to know whether we process your data. If we do process your data, you can ask us to access them. Based on your request, we will issue a confirmation containing information about personal data processing. You can apply electronically, to the email address gdpr@spedinpex.sk, or by mail, to the address of the registered office ŠPED-INPEX s.r.o., Rázusova 790/7, 949 01 Nitra, Company Registration Number: 46 098 607

Right to rectification

You have the right to have your data that we process correct, complete, and up-to-date. If your data is incorrect or out of date, you can ask us to rectify or supplement it electronically, to the email address gdpr@spedinpex.sk, or by mail, to the address of the registered office ŠPED-INPEX s.r.o., Rázusova 790/7, 949 01 Nitra, Company Registration Number: 46 098 607

Right to erasure

Under specific circumstances, you have the right to have your data erased. You can ask us to erase your data at any time. We will delete your data if:

we no longer need your data for the purpose for which you provided them,
you withdraw your consent,
you object to the processing of your data,
we process your data unlawfully,
personal data must be deleted to comply with a legal obligation,
you are a child, or the parent of a child, who has agreed to the processing of personal data via the Internet.

Right to restrict processing

You can ask us to restrict the processing of your data. If we comply with your request, we will only store your data and will not work with them further. The processing of your data will be restricted if:

you notify us that your data is incorrect, until we verify its correctness,
we process your data unlawfully, but you do not agree to delete personal data, and you request us only to restrict the processing of your data instead,
we no longer need your data, but you need it to prove, exercise, or defend your rights,
you object to the processing of your data until we verify whether our legitimate interests outweigh your reasons.

Right to data portability

You have the right to request us to provide you with your data electronically (e.g. XML or CSV file), which allows you to transfer your data to another company easily. You can also ask us to transfer your data directly to the selected company. We will comply with your request if personal data have been provided directly by you, and you have given us consent to data processing.

Right to object

You have the right to object that your data is processing by us. If we process your data in the following cases:

due to our legitimate interest,
due to creating a customer profile,
you can object to the processing of your personal data if you have personal reasons for doing so.

How can you exercise these rights?

You can send your request as follows:

to the email address: gdpr@spedinpex.sk, or by mail, to the address of the registered office ŠPED-INPEX s.r.o., Rázusova 790/7, 949 01 Nitra, Company Registration Number: 46 098 607

If you believe that your data protection rights have been infringed, you have the right to file a complaint to the Office for Personal Data Protection

Budova Park one

Námestie 1.mája 18

811 06 Bratislava

Slovenská republika

Identification details:

Company Registration Number: 36064220

Tax Registration Number: 2021685985

Administrative office:

+421 /2 3231 3214

Email: statny.dozor@pdp.gov.sk

Registry: Monday – Thursday: 8:00 am – 3:00 pm

Friday: 8:00 am – 2:00 pm

Considering the epidemiological situation in the Slovak Republic, the Office recommends making submissions either electronically, or by mail service (www.slovensko.sk). As of November 29, 2021, the submission in person is possible in necessary cases only, no later than 12:00 pm.