Information that the operator is obliged to provide to the data subject
According to Art. 13 et seq. of Regulation EP and R (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation")
intended for the operator's customers and other data subjects.
1. Operator and its contact details:
Business name: Orquesta Asset Donovaly, a.s.
Headquarters: Slávičie udolie 6 811 02 Bratislava - Staré Mesto
Tel.: +421 950 886 862
2. Purpose of processing personal data, legal basis for processing:
The operator processes the personal data of its customers, clients and contractual partners - suppliers of goods and services, as necessary for the conclusion of a contractual relationship in the operator's activities. The operator processes personal data without the consent of customers in order to fulfill its obligations arising from the contract, including pre-contractual relations, provision of warranty and post-warranty repairs and service, debt collection and communication with it. Without their provision, the operator cannot properly perform the contract and therefore it will not be possible to conclude it with the contractual partner. These personal data are also processed for the purpose of fulfilling legal obligations, in particular for the purpose of keeping accounting and business agendas, registry management, by processing them the operator will also fulfill legal obligations arising from special legal regulations, e.g. the Accounting Act, the VAT Act, the Archives and Registry Act, etc., therefore their processing is necessary. For these purposes, the operator processes common categories of personal data, in particular title, first name and surname, signature, permanent address, address, account number, telephone number, email address, work and professional qualifications and other necessary personal data.
3. Recipients:
The operator provides personal data to intermediaries that it has authorized in writing to process personal data, for example for the purpose of delivering goods and services, repairs, warranty and post-warranty service, providers of information systems and cloud platforms, etc. The operator may also provide personal data to public authorities, debt collection companies and other persons for the purpose of exercising its legal rights. The operator also declares that it does not provide personal data to entities in third countries that do not provide an adequate level of personal data protection.
4. Personal data retention period:
The operator processes the personal data of the data subjects for the period necessary to fulfill the obligations arising from the contractual relationship and until the purpose for which they are processed is fulfilled, but for a maximum period of ten years from the fulfillment of the purpose for which they are processed (contract, repairs, complaints, warranty and post-warranty service, debt collection), after which they are destroyed. After the purpose of processing has been fulfilled and the personal data retention period has expired, the operator will ensure the destruction of the data subject's personal data without delay.
5. Rights of the data subjects:
The data subject has the following rights against the controller in relation to the processing of his or her personal data. You can exercise your rights in person, by sending a written request by post to the operator's address or electronically to his email address.
a) The right to obtain confirmation as to whether personal data concerning you are being processed, and if so, you have the right to access these personal data together with the information provided in this document.b) The right to have the operator correct incorrect personal data without undue delay and to have incomplete personal data completed.
c) The right to have your personal data erased (forgotten) if they are no longer necessary for the purposes for which they were collected or otherwise processed and the retention period has expired.
d) The right to have the operator restrict the processing of your personal data if:
- the data subject contests the accuracy of the personal data data, during the period of verification of their accuracy,
- the processing is unlawful and the data subject objects to the erasure of the personal data and requests the restriction of their use instead,
- the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims,
- if the data subject objects to the processing of his or her personal data on grounds relating to his or her particular situation, to the processing of his or her personal data which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, pending verification whether the legitimate grounds of the controller override those of the data subject.
e) The right to obtain the personal data concerning him or her which he or she has provided to the controller, and the right to transmit those data to another controller, where the processing is carried out by automated means, on the basis of a contract or consent and technically possible.
f) The right to object to the processing of his/her personal data by the controller, those that are processed for reasons of the legitimate interests of the controller. If the controller does not demonstrate that there is a compelling legitimate interest for the processing of personal data which outweighs the rights and freedoms of the data subject, the controller shall terminate the processing of such data without undue delay.
g) The right to lodge a complaint with a supervisory authority if he/she considers that the processing of personal data by the controller concerning him/her is in breach of the legal regulations on the protection of personal data. The supervisory authority is the Office for Personal Data Protection, Hraničná 12, 820 07 Bratislava 27, tel. number: +421232313214, e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk.
h) The right to object and not to be subject to a decision that would have legal effects or a significant impact on him/her, if such a decision is issued solely on the basis of automated processing of personal data. The operator declares that it does not carry out automated decision-making with legal effects for the data subjects without the influence of human judgment.
i) If the personal data were not obtained from the data subject, the data subject has the right to obtain information from what source his/her personal data come from, or information about whether the data come from publicly accessible sources.
The operator will respond to a request regarding the processing of personal data without undue delay within one month of its receipt. In special cases, the period may be extended by a further two months; the data subject will be informed of the reasons for the extension of the period within one month of receiving the request. When processing the request of the data subject, the controller is obliged to verify the identity of the applicant in an appropriate manner. The data subject will be informed of the identity verification procedure when responding to their request. The information is provided free of charge. However, if the requests of the data subjects are disproportionate or frequently repeated, the controller may charge a reasonable administrative fee for their processing.
