PERSONAL DATA PROCESSING RULES
STATEMENT OF THE OPERATOR ON THE PROCESSING OF PERSONAL DATA
In this section, we provide information on the processing and protection of personal data in accordance with Regulation of the European Parliament and the Council of the EU No. 2016/679 on the protection of natural persons in the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (general regulation on data protection) and Act of the Slovak Republic no. 18/2018 Coll. on Personal Data Protection and Amendments to Certain Acts (hereinafter referred to as the "Personal Data Protection Act").
Operator Arila s.r.o. with its registered office at Vodárenská 11, ID: 55653154 (hereinafter referred to as the "operator"), has taken appropriate technical and organizational measures to ensure the protection of the rights of the affected persons, which declare the legal processing of personal data. The operator has also implemented a transparent system for recording security incidents and any questions from the affected person as well as other persons.
If necessary, the affected person can also obtain individual information by phone at: +421950643063 or by e-mail: info@zosportu.sk
1. Operator
Arila s.r.o. Vodárenská 11911 01 Trenčín ID number: 55653154 We process your data for our own purposes as the Operator. This means that we determine the purpose for which we collect your personal data, determine the means of processing and are responsible for their proper execution.
2. Intermediaries
The Operator may, in certain cases, process the personal data of the affected persons through intermediaries who are authorized to process personal data in accordance with Article 28 of the GDPR Regulation. Intermediaries process the personal data of the affected persons on behalf of the Operator. The processing of personal data through an intermediary does not have a negative impact on the exercise and application of the rights of the person concerned. The operator uses only intermediaries providing adequate technical, organizational and other measures so that the processing meets the requirements of the GDPR and that the rights of the data subject are fully protected. and tax obligations of the Operator•intermediaries providing services connected with organizing and promoting events, technical and software support, and administration of marketing activities of the Operator. Categories of recipients of personal data: persons acting on the authority of the operator, legal representative, auditor, state administration and public authorities for the exercise of control and supervision.
3. The purpose of personal data processing
Arila s.r.o. as an operator: As an operator, we exclusively process personal data on the basis of a legitimate legal basis and for a specific purpose: • When responding to an inquiry, initiative or question submitted physically, by telephone or in the form of electronic/paper mail: For the purpose of a feedback aimed at satisfying the person concerned, we apply legal basis of processing according to Art. 6 par. 1 letter f) GDPR regulations - legitimate interest of the operator. As a data subject, you have the right to object to such processing at any time.
• When expressing interest in our services or products, when establishing cooperation: The legal basis for data processing is Art. 6 par. 1 letter b) GDPR regulations - data processing is necessary for the implementation of the necessary measures before the conclusion of the contract, i.e. during the process of the pre-contractual relationship.
• After the establishment of a contractual relationship between the operator and the data subject, with the necessary cooperative communication: Data processing is necessary for the fulfillment of the contractual relationship according to Art. 6 par. 1 letter b) GDPR regulations.
• Taking and publishing a photo with the likeness of the person concerned for the purpose of promoting the services of the operator: Based on your consent to the processing of personal data in accordance with Art. 6 par. 1 letter a) GDPR regulations, we can process your likeness and publish it for the purposes of promoting our services.
You can withdraw your consent at any time. Arila s.r.o. as an intermediary: The purpose of processing personal data when we act as an intermediary: In cases where Arila s.r.o. acts as an intermediary according to Art. 28 par. 3 GDPR regulations, we process personal data according to the instructions of another operator who is our client. In such cases, the purpose of personal data processing is determined by the operator, not by us.
•Data processing based on instructions from the operator: When Arila s.r.o. acts as an intermediary, processes personal data exclusively on the basis of the instructions of the operator who entrusted us with the processing of this data. This may, for example, involve the processing of personal data of event participants, their registration and other data necessary for the organization and promotion of the event.
• For the purpose of providing services to the operator: Arila s.r.o. may process personal data for the purpose of providing various services, such as the administration of event participants, sending invitations or photos, while all these activities are performed according to the operator's instructions. In the event that Arila s.r.o. acts as an intermediary, the legal basis for the processing of personal data for the intermediary derives from the contract between the operator and the intermediary, which must be in accordance with Art. 28 of the GDPR Regulations. This article regulates the conditions for the processing of personal data by an intermediary based on a written contract between the operator and the intermediary, in which the operator provides instructions that the intermediary must follow when processing personal data. The intermediary does not process personal data on the basis of its legitimate interest, but on the basis of the instructions of the operator and to the extent necessary to fulfill the tasks set out in the contract between them.
In this case, the operator determines the purpose and method of processing personal data and the intermediary is obliged to carry out data processing according to these instructions, while ensures the protection of personal data according to GDPR requirements.
4. Scope of personal data and categories of affected persons
Arila s.r.o. as an operator: As an operator, we process personal data only to the extent necessary to achieve the purpose of processing. The categories of personal data that we process mainly include:
• Contact data (name, surname, e-mail address, telephone number)
• Data on participation in events (participant number, registration data, confirmation of participation)
• Photos, video and audio recordings (capturing the likeness of the participant, which can be used to promote the event)
• Financial data (in the case of payments for services or products we provide )
The categories of data subjects whose data we process include:
•Event participants
•Interests in our services or products
•Employees, team members or persons who communicate with us within the framework of cooperation or a contractual relationship.
This range of data is processed only for the purposes stated above and in accordance with the principles of data minimization, which are in accordance with the GDPR.
Arila s.r.o. as an intermediary: As an intermediary, we process personal data on the basis of the operator's instructions and to the extent specified in the contract between the operator and the intermediary. The scope of processed personal data may include:
• Contact data (name, surname, e-mail address, telephone number of the event participant)
• Data on participation in the event (participant number, registration data)
• Photographs and visual records (containing likenesses of event participants)
• Communication data (emails, telephone records, event-related messages) Categories of data subjects whose data we process as intermediary, depend on the instructions of the operator and may include:
• Event participants (whether they are employees, customers or other persons)
• Those interested in the services of the operator (in the event that the operator collects data as part of its marketing activities)
• Persons participating in activity within the contractual relationship with the operator (if relevant) As an intermediary, we are obliged to process only personal data provided to us by the operator on based on the contract and instructions, while we ensure the protection of this data in accordance with the requirements of the GDPR.
5. The period of processing and storage of your personal data
Arila s.r.o. as an operator:
As an operator of personal data, we process your personal data only for the time necessary to fulfill the purposes for which we obtained them and in accordance with applicable legal regulations. The period of storage of personal data depends on the purpose of their processing:
• When responding to an inquiry, suggestion or question: Personal data will be stored only for the time necessary to respond to your request, usually for a maximum period of 6 months from the conclusion of the communication, if there is no other legal basis for their storage.
• When showing interest in our services or products: Personal data will be stored during the period of the pre-contractual relationship, that is, until the contract is concluded or a decision is made about it will not close. After this period, the data will be deleted or anonymized, unless there is a legal basis for their further storage.
•After the contractual relationship is established: Personal data is stored for the duration of the contractual relationship and subsequently for the time necessary to fulfill our legal obligations, such as archiving documentation according to tax and business regulations (maximum 10 years).
•Publication of a photo with a likeness: Your likeness will processed only during the time necessary to achieve the purpose of promoting our services. If you have given us your consent to process your personal data, you can revoke this consent at any time. After withdrawal of consent, the data will not be further processed, but may remain in historical records.
Arila s.r.o. as an intermediary:
When Arila s.r.o. acts as an intermediary according to Art. 28 par. 3 of the GDPR Regulations, the period of personal data processing is determined by the operator who provided us with instructions. As an intermediary, we are obliged to store personal data only for the time necessary to fulfill the purposes set out in the contract between the operator and the intermediary. After this period, these data are deleted or returned to the operator, unless we agree otherwise.
Pursuant to Art. 28 par. 3 of the GDPR regulations, as an intermediary, we are obliged to:
• Ensure the protection of personal data during the entire period of their processing and deletion or return of data after the end of the provision of services, according to the operator's instructions.
• Ensure that third parties to whom we can provide services will comply with the same terms of personal protection data as set out in our contract with the operator.
• Comply with the instructions of the operator regarding the period of data retention, while we are obliged to ask for instructions if it is necessary to retain data after the provision of services.
If the operator determines a different period of storage or processing of data, we will fully respect these instructions, unless this conflicts with our legal obligations.
As an operator, we will ensure the deletion of personal data without undue delay after:
all contractual relationships between you have been terminated and us as the operator; and/or- all your obligations towards the operator have ceased; and/or- all
your complaints and requests have been processed; and/or- all
other rights and obligations between you and us as the operator have been settled; and/or- all processing purposes established by legal regulations or processing purposes for which you have given us your consent have been fulfilled, if the processing took place based on the consent of the person concerned; and/or- the period for which the consent was granted has expired or the person concerned has withdrawn his consent; and/or- the request of the affected person for erasure of personal data was granted and one of the reasons justifying the granting of this request was fulfilled; and/or- a decisive legal fact for the termination of the purpose of processing has occurred and at the same time the protective retention period defined with regard to the principle of minimizing the period of storage of personal data has elapsed; storage of the personal data of the person concerned (especially for the purposes of archiving, performing tax audits, etc.), or which could not be fulfilled without their storage. Any accidentally obtained personal data in no case do we systematically process the data further for any purpose defined by us.
If possible, we inform the affected person to whom the accidentally obtained personal data belong about their accidental acquisition and, depending on the nature of the case, provide him with the necessary cooperation leading to the restoration of control over his personal data. Immediately after these necessary actions aimed at resolving the situation, we will immediately dispose of all accidentally obtained personal data in a secure manner.
If you are interested in further information about the specific period of storage of your personal data, please contact us using the contact details provided.
6. Disclosure of data
Arila s.r.o. as an operator: Our company does not publish the obtained personal data without the prior consent of the person concerned.
Arila s.r.o. as an intermediary: As an intermediary, we process personal data exclusively according to the instructions of the operator, who determines whether and to what extent the data will be published. We perform all personal data processing activities on the basis of the contract and instructions of the operator, while we guarantee that these data will not be made available to third parties outside the framework determined by the instructions.
7. Cross-border transfer and profiling of personal data
Cross-border transfer of personal data is not currently carried out, and in the future we do not intend to transfer personal data to third countries that do not comply with GDPR requirements, including adequate data protection guarantees. Profiling of personal data is not carried out.
8. Rights and obligations of the affected person
• The affected person is obliged to provide only complete and true data.
• The affected person undertakes to update his data in the event of a change, at the latest before the first order following the occurrence of the change.
• The affected person undertakes that if provides personal data of a third person (name, surname, telephone number), does so only with their consent and the person concerned is familiar with the procedures, rights and obligations, which are listed on this page.
•As a data subject, you have the right to decide on the handling of your personal data within the specified scope. You can exercise the above rights in person at the Operator's headquarters or by phone - in writing (by mail / e-mail).
We will try to answer you as soon as possible, but we will always answer you no later than 30 days after the delivery of your request.
Applicable legal regulations and the GDPR Regulation, or In particular, the law provides you with:
Right of access - You have the right to request confirmation from us as to whether your personal data is being processed and, if so, to obtain a copy of this data and additional information resulting from Art. 15 Regulations, or § 21 of the Act. In the event that we obtain a large amount of data about you, we may require you to specify your request for the range of specific data that we process about you.
Right to rectification - In order for us to continuously process personal data about you, we only need current, to inform us of their change as soon as possible. In the event that we process incorrect data about you, you have the right to request their correction.
Right to erasure – If the conditions of Article 14 of the Regulation are met, or § 23 of the Act, you can request deletion of your personal data. You can therefore request deletion, for example, if you have revoked your consent to the processing of personal data and there is no other legal basis for processing, or if we process your personal data illegally, or the purpose for which we processed your personal data has ceased to exist and we do not process it for another compatible purpose. However, we will not delete your data if they are necessary for proving, exercising or defending legal claims.
The right to limit processing – If the conditions of Article 18 of the Regulation are met, or § 24 of the Act, you can request us to limit the processing of your personal data. You can therefore request a restriction, for example, when you dispute the correctness of the processed data or in the event that the processing is illegal and you do not want us to delete the data, but you need their processing to be limited while you exercise your rights. We continue to process your data if there are reasons to demonstrate, exercise or defend legal claims.
Right to portability - If the processing is based on your consent or is carried out for the purpose of fulfilling a contract concluded with you and at the same time carried out by automated means, you have the right to receive your personal data from us , which we received from you in a commonly used machine-readable format. If you are interested in this and it is technically possible, we will transfer your personal data directly to another operator. This right will not be applicable to processing carried out for the purpose of performing a task carried out in the public interest or in the exercise of public authority.
The right to object to processing – If we process your personal data for the purpose of performing a task carried out in the public interest or in the exercise of public authority entrusted to us, or if processing is carried out on the basis of our legitimate interests or the legitimate interests of a third party, you have the right to object to such processing. Based on your objection, we will limit the processing of personal data and unless we demonstrate serious legitimate reasons for processing that outweigh your interests, rights and freedoms or reasons for proving, exercising or defending legal claims, we will not continue to process personal data and we will delete your personal data. You have the right to object at any time to the processing of personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. After raising an objection, we will no longer process your personal data for this purpose.
The right to file a complaint - If you believe that the processing of your personal data is contrary to the Regulation, or By law, you have the right to file a complaint with one of the relevant supervisory authorities, especially in the Member State of your habitual residence, place of work or in the place of the alleged violation. For the territory of the Slovak Republic, the supervisory authority is the Office for the Protection of Personal Data, with registered office: Hraničná 4826/12, 820 07 Bratislava, Slovak Republic, website: www.dataprotection.gov.sk, phone: 421 /2/ 3231 3220.
Right to revoke consent - If the processing of your personal data is based on consent, you have the right to revoke this consent at any time. Withdrawal of consent does not affect processing already carried out. If at any time later you decide that you are interested in receiving commercial and marketing offers about our products and services from us again, you can re-grant your revoked consent (or objection filed) at any time, by any of the above-mentioned forms of contact.
9. Contact details of the Office for the Protection of Personal Data
Office for the Protection of Personal Data of the Slovak Republic
Address: Hraničná 12
820 07, Bratislava 27
Slovak Republic
IČO: 36 064 220
Registration office: Monday - Thursday: 8:00 - 15:00 Friday: 8:00 - 14:00
Telephone consultations in the field of personal data protection:
Tuesday and Thursday from 8:00 to 12:00 421 2 323 132 20
Secretariat of the President of the Office 421 2 323 132 11
Secretariat of the office 421 2 323 132 14
Fax: 421 2 323 132 34
Spokesman: mobile: 0910 985 794 e-mail: hovorca@pdp.gov.sk
E-mail:
a) in general: statny.dozor@pdp.gov.sk
b) for providing information according to the law no. 211/2000 Coll.: info@pdp.gov.sk
c) website: webmaster@pdp.gov.sk
d) for submitting requests for the provision of information pursuant to Act no. 211/2000 Coll. about free access to information, use the online form. e) email address through which the Office will provide you with advice in the field of personal data protection. It is intended for children, youth, students, teachers, parents who suspect that their personal data has been misused: ochrana@pdp.gov.sk
You can find a sample proposal for initiating proceedings on personal data protection on the website of the Office (https:// dataprotection.gov.sk/uoou/sk/content/konanie-o-ochrane-osobnych-udajov).