Personal Data Processing Procedure

This document describes the manner and purpose of personal data processing by the controller BENOX, s.r.o., Stavebná 23D, 974 01 Banská Bystrica, Company ID: 36049221 (hereinafter referred to as the “Controller”) and also provides any other legally required information, including information about the rights of the data subject and how to exercise them.

Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts, as well as Regulation (EU) 2016/679 on the protection of personal data (hereinafter referred to as the “Regulation”), constitutes legislation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and protects the fundamental rights and freedoms of natural persons, in particular in relation to the right to the protection of personal data.

According to Article 4 (1) of the Regulation, the term “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”).

“Processing” is an operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Article 4(2) of the Regulation).

According to Article 12 et seq. of the Regulation, the data subject must also be provided with relevant information about the Controller’s processing activities and about the rights of the data subject.

“Validity” given that the information on the processing of personal data contained in this Policy may require updating in the future, the Controller is entitled to update this Policy at any time. This version of the statement was issued on 1 June 2021.

1. ON WHAT BASIS MAY WE PROCESS YOUR PERSONAL DATA?

Processing is lawful only if and to the extent that at least one of the following conditions is met:

  • The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Processing is necessary for compliance with a legal obligation.
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

2. WHAT HAPPENS IF PERSONAL DATA IS NOT PROVIDED?

In the case of processing your personal data within the scope of:

  • When providing personal data that is a legal or contractual requirement, the data subject is obliged to provide such personal data. Without the provision of personal data, it is not possible to process an order.
  • Concluding or performing a contract to which you are a party, failure to provide the necessary data means that we cannot conclude the contract in question or fulfill contractual obligations (e.g., concluding a purchase contract through our e-shop).
  • Any personal data you provide to us voluntarily, and you are obliged to consider yourself to what extent you provide such personal data. However, without the provision of certain personal data, we cannot respond to your inquiry or request.

3. WE OBTAIN YOUR PERSONAL DATA

You most often provide us with your personal data:

  • We obtain it primarily directly from you, for example from communication with you through the contact form on our website.
  • In the event that you are our customer or interested in our goods or services.
  • If you are our customer, we most often obtain your personal data directly from you. In such a case, the provision of your personal data is voluntary, with the exception of data necessary for invoicing the goods or services we provide.
  • (accommodation, mandatory reporting to the foreign police).

4. WHAT IS THE PURPOSE OF PERSONAL DATA PROCESSING, WHAT PERSONAL DATA DO WE PROCESS, AND FOR HOW LONG DO WE STORE YOUR PERSONAL DATA?

The Controller processes your personal data in the following manner / for the following purposes:

  • ACCOUNTING AND BUSINESS AGENDA
  • The purpose is to fulfill the Controller’s legal obligations arising from special regulations (e.g., the Accounting Act, the Value Added Tax Act, the Income Tax Act).
  • Legal basis (including their provision to third parties): legal obligation.
  • Retention period: 10 years.
  • BUSINESS COMMUNICATION
  • The purpose of processing is the preparation and implementation of the Controller’s business activities.
  • Legal basis: Legitimate interest pursued by the Controller consisting in the right to conduct business within the scope of activities registered in the extract from the relevant register.
  • Retention period: conditional on the preparation and duration of the commercial relationship, as well as the expiry of the limitation period.
  • CONTACT FORM
  • The main purpose of personal data processing is the preparation of a price quotation at the customer’s request.
  • Legal basis: The processing of personal data is necessary for the performance of a contract (for example, a purchase contract within the meaning of Article 6(1)(b) of the general Regulation of the EP and Council (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data) and you are a contracting party.
  • Retention period: 1 year.
  • E-SHOP
  • The main purpose of personal data processing is the sale of goods to buyers, issuing an invoice, and shipping the goods.
  • Legal basis: The processing of personal data is necessary for the performance of a contract (for example, a purchase contract within the meaning of Article 6(1)(b) of the general Regulation of the EP and Council (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data) and you are a contracting party, or you have asked us to take steps prior to entering into a contract (for example, by registering in the e-shop).
  • Retention period: 10 years.
  • PERSONNEL AND PAYROLL AGENDA
  • The purpose of processing is the preparation and conclusion of an employment contract or an agreement on work performed outside the employment relationship, keeping records of documents on fitness for work, payment of wages, levies, fulfillment of obligations towards state administration bodies, attendance records, training records, records of issued authorizations and powers of attorney, records of property or equipment, conclusion of agreements on material liability, records of the issuance of cash funds, provision of employee benefits, records of damage caused by employees at the workplace or to the property of the Controller (employer), provision of catering, copying of documents necessary for the purposes of the employment or similar relationship, as well as fulfillment of other legal and contractual obligations.
  • Legal basis: fulfillment of a legal obligation, performance of a contract, granted consent, or legitimate interest.
  • Retention period: for the duration of the employment relationship or other similar relationship, up until the employee (including a former employee) reaches seventy years of age.
  • RECORDS MANAGEMENT
  • Records management, handling the agenda of whistleblowers of anti-social activities. The purpose of processing is the fulfillment of legal obligations, in particular those arising from Act No. 395/2002 Coll. on Archives and Registries and on Amendments to Certain Acts, as amended, and from Act No. 305/2013 Coll. on the Electronic Form of the Exercise of Powers of Public Authorities and on Amendments to Certain Acts.
  • Legal basis: fulfillment of a legal obligation.
  • Retention period: determined by special regulations.
  • CAMERA SYSTEM – MONITORING OF PREMISES
  • The purpose of monitoring is the protection of property in the monitored area and the protection of natural persons present in this area, as well as the ongoing collection of evidence on the causes, course, and consequences of security incidents.
  • Legal basis: legitimate interest pursued by the Controller or a third party consisting in the right to protection of property, protection of the health of natural persons, and the right to require the observance of public order.
  • Retention period: 72 hours.
  • SENDING MESSAGES FOR DIRECT MARKETING PURPOSES AND FOLLOW-UP CONTACT
  • The purpose of direct marketing processing is to offer you information about current news and products that may be relevant and interesting to you.
  • The legal basis for the processing of personal data in this case is our legitimate interest.
  • Retention period: we will process your personal data for this purpose until you cancel your participation in the marketing list or unsubscribe from receiving messages for direct marketing purposes (newsletter).
  • RECORDS OF DATA SUBJECTS’ RIGHTS
  • The purpose of processing is handling requests of natural persons aimed at exercising their rights.
  • Legal basis: the basis is the fulfillment of a legal obligation within the meaning of Article 6(1)(c) of the general Regulation.
  • Retention period: 5 years from the date the request is processed.
  • HANDLING COMPLAINTS OF DATA SUBJECTS
  • The purpose of processing is a submission by a natural or legal person seeking protection of their rights or legally protected interests which they believe have been violated.
  • Legal basis: the basis is the fulfillment of a legal obligation within the meaning of Article 6(1)(c) of the general Regulation.
  • Retention period: 5 years from the date the request is processed.

5. WHO ARE THE RECIPIENTS OF YOUR PERSONAL DATA?

Category of recipients: state and public administration bodies, self-government, the administrator of the company’s website, auditor, attorney, companies performing information technology administration and support, providers of information services, and in justified cases courts and law enforcement authorities.

6. DISCLOSURE OF PERSONAL DATA

Personal data will not be disclosed.

7. AUTOMATED INDIVIDUAL DECISION-MAKING

Personal data will not be used for automated individual decision-making, including profiling.

8. TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION

No transfer of personal data to a third country or international organization takes place.

9. CONFIDENTIALITY

We would like to assure you that our employees and collaborators who will process your personal data are obliged to maintain confidentiality regarding personal data. This confidentiality continues even after the termination of contractual relationships with us.

10. SECURITY OF PERSONAL DATA

Your personal data is safe with us. In order to prevent unauthorized access to and misuse of your personal data, we have implemented appropriate measures of both a technical and organizational nature. The protection of your personal data is very important to us. Therefore, we not only regularly check its security, but also continuously improve its protection. We strive to use security measures that, with regard to the current state of technology, provide sufficient security. The adopted security measures are then regularly updated.

11. DATA SUBJECTS

These are mainly employees, clients, and every natural person whose personal data is processed.

12. RIGHTS OF THE DATA SUBJECT

Withdraw consent – in cases where we process your personal data on the basis of your consent, you have the right to withdraw this consent at any time. You may withdraw consent electronically to the e-mail address provided, in writing, or in person at the Controller’s registered office. Withdrawal of consent does not affect the lawfulness of the processing of personal data that we processed about you on its basis. Regardless of this, you have the right to object to the processing of personal data at any time.

Right of access – you have the right to be provided with a copy of the personal data we hold about you, as well as information about how we use your personal data. In most cases, your personal data will be provided to you in written paper form, unless you request another method of provision. If you have requested this information by electronic means, it will be provided to you electronically, if technically possible.

Right to rectification – we take reasonable steps to ensure the accuracy, completeness, and up-to-dateness of the information we hold about you. If you believe that the data we hold is inaccurate, incomplete, or outdated, please do not hesitate to ask us to modify, update, or supplement this information.

Right to erasure (to be forgotten) – you have the right to ask us to erase your personal data, for example if the personal data we have obtained about you is no longer necessary to fulfill the original purpose of processing. However, your right must be assessed in light of all relevant circumstances. For example, we may have certain legal and regulatory obligations, which means that we will not be able to comply with your request.

Right to restriction of processing – under certain circumstances, you are entitled to ask us to stop using your personal data. This applies, for example, to cases where you believe that the personal data we hold about you may be inaccurate, or where you believe that we no longer need to use your personal data.

Right to data portability – under certain circumstances, you have the right to ask us to transfer the personal data you have provided to us to another third party of your choice. However, the right to portability only applies to personal data that we have obtained from you on the basis of consent or on the basis of a contract to which you are a party.

Right to object – you have the right to object to data processing that is based on our legitimate interests. If we do not have a compelling legitimate reason for the processing and you file an objection, we will not further process your personal data.

Right to file a motion to initiate proceedings on the protection of personal data – if you believe that your personal data is being processed unfairly or unlawfully, you may file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; tel. no.: +421 /2/ 3231 3214; e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk. If the motion is submitted electronically, it must meet the requirements pursuant to Section 19(1) of Act No. 71/1967 Coll. on Administrative Proceedings (administrative fee).

13. HOW TO PROCEED WHEN EXERCISING YOUR RIGHTS

You always exercise your rights with the entity that processes your personal data, i.e., with the specific controller.

If the controller has a data protection officer, you may also address your request to this person.

The request may be oral, written, electronic, or submitted by other means (the General Data Protection Regulation does not prescribe a specific form). We recommend using the written or electronic form in particular.

Prepare identification data such as a contract number, your ID with the controller, username or password, etc. — i.e., an identifier on the basis of which the controller will be able to identify you in its environment and thus provide you with the data concerning you.

The controller is obliged to process your request without undue delay, at the latest within 1 month of its receipt. In the case of complexity or a large number of requests, we are entitled to extend this period by an additional 60 days.

In the case of a repeated request, we are entitled to charge a reasonable administrative fee to cover the costs associated with providing this service.

14. INFORMATION AND EXERCISE OF THE DATA SUBJECT’S RIGHTS

In order to exercise your rights, you may contact the Controller at any time as follows:

  • Address: BENOX, s.r.o., Stavebná 23D, Banská Bystrica 974 01.
  • E-mail: hronsky@benox.sk

15. CONCLUSION

If you have any questions regarding the protection of personal data, you may contact us at any time by e-mail or by post at the Controller’s registered office. In the event that you exercise any of the rights of a data subject under the legal regulations governing the protection of personal data and it is not possible to verify the identity of the applicant from your request, or if we have justified doubts regarding the identity of the person submitting the request, we reserve the right to ask this person to provide additional information necessary to confirm the identity of the person exercising this request.