Privacy policy

Information obligation of the company developed
in accordance with the Personal Data Protection Act

Identification data of the operator:

The company LIMOSS.SK s.r.o., IČO:36711373, Romanova 33, 85102 Bratislava (hereinafter referred to as the “company”) acts as an operator of information systems (hereinafter referred to as the operator of information systems) when processing the personal data of its employees, clients, customers or business partners (hereinafter referred to as the “data subject just “IS”).

Legal basis for processing personal data of the persons concerned:

When processing personal data, the company proceeds in accordance with Act No. 18/2018 Coll. on the protection of personal data and on amendments and additions to certain regulations (hereinafter referred to as the “Act on the Protection of Personal Data”). The legal basis for personal data processing is the Personal Data Protection Act, special legal regulations and consent to personal data processing, depending on the purpose of personal data processing.

In the event that the purpose of processing personal data, the scope of the affected persons and the list of personal data is established by a directly enforceable act of the European Union, an international treaty to which the Slovak Republic is bound, the Personal Data Protection Act or a special law, the company is entitled under the Personal Data Protection Act process personal data without the consent of the person concerned.

The company processes personal data without the consent of the person concerned, if the purpose of processing personal data, the range of persons concerned and the list of personal data or their scope is established by a directly enforceable legally binding act of the European Union, an international treaty to which the Slovak Republic is bound, or this law. If the list or scope of personal data is not established, the company may process personal data only to the extent and in a manner that is necessary to achieve the established purpose of processing while complying with basic obligations under the Personal Data Protection Act.

The company further processes personal data without the consent of the person concerned, if the purpose of processing personal data, the range of persons concerned and the list of personal data is established by a special law and only to the extent and in the manner established by a special law. Processed personal data can be provided, made available or published from the information system only if a special law establishes the purpose of providing, making available or publishing, a list of personal data that can be provided, made available or published, as well as third parties to whom personal data is provided, or range of recipients to whom personal data is made available, unless otherwise stipulated by the Personal Data Protection Act.

The company processes personal data without the consent of the person concerned even if:

a) the processing of personal data is necessary for the performance of a contract in which the person concerned acts as one of the contracting parties, or in pre-contractual relations with the person concerned or during negotiations to change the contract, which are carried out at the request of the person concerned,

b) the processing of personal data is necessary to protect the life, health or property of the person concerned,

c) the subject of processing is exclusively the title, name, surname and address of the person concerned without the possibility of assigning to them other personal data, and their use is intended exclusively for the needs of the operator in postal relations with the person concerned and the records of this data,

d) personal data are processed that have already been published in accordance with the law and the operator has duly marked them as published; the person who claims to process published personal data shall, upon request, prove to the office that the processed personal data has already been legally published,

e) the processing of personal data is necessary to protect the rights and legally protected interests of the operator or a third party, while this does not apply if the basic rights and freedoms of the person concerned prevail in such processing of personal data, which are subject to protection according to this law.

If, due to the purpose of personal data processing established in a directly enforceable legally binding act of the European Union, an international treaty to which the Slovak Republic is bound, in the Personal Data Protection Act and a special law, it is not possible to specifically determine in advance the individual personal data to be processed, the list of personal data can be replaced by the range of personal data.

The company is obliged to process such personal data in accordance with the Personal Data Protection Act, except for those operators who process personal data for the purposes of and in connection with legal proceedings.

In the event that the Personal Data Protection Act does not apply to the processing of personal data, the company as an operator is authorized to process personal data only with the consent of the person concerned.

The company obtains the consent of the person concerned without coercion or coercion, as well as without conditioning by the threat of rejection of the contractual relationship, the services provided or obligations arising for the operator from legally binding acts of the European Union, international agreements to which the Slovak Republic is bound or the law.

In case of refusal to provide personal data to the company for purposes necessary for the provision of services or fulfillment of legal obligations, the company is entitled to notify the affected person of the possible consequences of not providing personal data.

The affected persons agree that the company, when processing personal data, entrusts such processing to an intermediary who processes personal data on behalf of the company. After the end of the purpose of personal data processing, the company disposes of these legally obtained personal data of the persons concerned within the period established by applicable legal regulations and in accordance with the company’s internal regulations.

The purpose of processing the personal data of the persons concerned:

The company respects your privacy and considers the provided personal data confidential.

For the quality provision of its services, the company needs to know some personal data of the affected persons and needs to provide them to other recipients in order to fulfill legal obligations and ensure the highest quality services.

The company processes the provided personal data for several purposes.

On the one hand, it concerns the personal data of job applicants and the personal data of their employees for the purposes of the personnel and payroll agenda, and related legal obligations resulting from special legal regulations.

The company also processes the personal data of its clients, customers and business partners in order to ensure its business activity, taking into account the interests of its clients, customers and business partners.

The company does not process personal data for any other purpose, which means that the company collects, stores and processes only the personal data of the affected persons that it needs in order to fulfill its provided services. The provided personal data are strictly protected against misuse by unauthorized third parties, by the means documented in the adopted security project and the security directive in accordance with the Personal Data Protection Act.

When processing the personal data of the affected persons, the company complies with the basic obligations of the operator resulting from the Personal Data Protection Act, which include the following obligations.

The company always uses the provided personal data for a predetermined purpose of processing, which is clear, clearly defined and specific, and is in accordance with the Constitution of the Slovak Republic, constitutional laws, laws and international treaties to which the Slovak Republic is bound.

The company always defines the terms of personal data processing in such a way that the rights of the data subject established by law are not restricted.

The company only acquires such personal data of the persons concerned, whose scope and content correspond to the purpose of the processing and are necessary to achieve it.

The company ensures that the personal data of the affected persons is processed exclusively in a manner that corresponds to the purpose for which it was collected in advance.

The company as an operator is obliged to process only correct, complete and as necessary updated personal data in relation to the purpose of processing. The operator is obliged to block incorrect and incomplete personal data and correct or supplement them without undue delay, if they cannot be corrected or supplemented in such a way that they are correct, the company will clearly mark this personal data and dispose of it without undue delay.

The company ensures that the personal data of the affected persons are processed in a form that enables the identification of individual affected persons for a period of time no longer than is necessary to achieve the purpose of the processing.

The company disposes of personal data for which the purpose of processing has ended in the prescribed manner. After the end of the defined purpose, the company is authorized to process personal data to the extent necessary for research or statistical purposes in their anonymized form. Personal data processed in this way cannot be used by the operator to support measures or decisions taken against the person concerned to limit his fundamental rights and freedoms.

Intermediaries:

The company does not provide your personal data to third parties in violation of the Personal Data Protection Act and for the purpose of their collection, contrary to your interests or instructions, and they are provided to a third party only within the scope of the aforementioned purpose.

In its business activities, the company cooperates with several intermediaries whose goal is to provide high-quality services, while these entities process the personal data of the affected persons in the performance of their contractual activities for the company.

The company honestly declares that, when selecting individual intermediaries, it paid attention to their professional, technical, organizational and personnel competence and their ability to guarantee the security of processed personal data through security measures adopted in accordance with the Personal Data Protection Act.

At the same time, when choosing a suitable intermediary, the company proceeded in such a way as not to endanger the rights and legally protected interests of the persons concerned.

As an operator, the company has entered into written contracts with intermediaries in accordance with the Personal Data Protection Act on ensuring the protection of personal data processed by intermediaries, which it has entrusted with processing the personal data of the affected persons only to the extent, under the conditions and for the purpose agreed in the contract and in the manner according to the Personal Data Protection Act .

Scope and list of processed personal data:

The company processes in its information systems the personal data of the affected persons to the extent necessary to achieve the specified purpose. This is the scope of personal data established by special legal regulations or to the extent of the consent of the person concerned for the processing of his personal data.

The company only processes personal data that was provided to it voluntarily and to the extent necessary by the person concerned. The provision of personal data to the company beyond the scope of special laws is voluntary.

Conditions and method of processing personal data of the persons concerned:

The company processes the personal data of the affected persons in its information systems by automated and non-automated means of processing.

The company does not publish processed personal data, except in cases where it is required by a special legal regulation or a decision of a court or other state authority.

The company will not process your personal data without your express consent or other lawful legal basis for another purpose, even to a greater extent than is stated in this information and the registration sheets of the individual information systems of the operator.

The rights of the person concerned in connection with the processing of his personal data:

Based on a written request, the person concerned has the right to demand from the company:

a) confirmation of whether or not personal data about her are processed,

b) in a generally comprehensible form, information about the processing of personal data in the information system to the extent according to the Personal Data Protection Act; when issuing a decision according to the Personal Data Protection Act, the person concerned is entitled to become familiar with the procedure for processing and evaluating operations,

c) in a generally comprehensible form, precise information about the source from which he obtained her personal data for processing,

d) in a generally comprehensible form, a list of her personal data that is the subject of processing,

e) correction or liquidation of your incorrect, incomplete or out-of-date personal data, which are the subject of processing,

f) liquidation of her personal data, the purpose of which has ended; if the subject of processing is official documents containing personal data, he can request their return,

g) liquidation of her personal data, which are the subject of processing, if there has been a violation of the law,

h) blocking of her personal data due to withdrawal of consent before the expiration of its validity period, if the company processes personal data based on the consent of the person concerned.

The above-mentioned rights of the person concerned according to letter e) and f) can be restricted only if such restriction results from a special law or its application would violate the protection of the person concerned, or the rights and freedoms of other persons would be violated.

According to the Personal Data Protection Act, the data subject has the right to object to:

a) processing her personal data, which she assumes are or will be processed for direct marketing purposes without her consent, and to request their liquidation,

b) the use of personal data specified in the Personal Data Protection Act for the purposes of direct marketing by mail, or

c) provision of personal data specified in the Personal Data Protection Act for direct marketing purposes.

According to the Personal Data Protection Act, the person concerned has the right, based on a written request addressed to the company or in person, if the matter cannot be delayed, to object to the processing of personal data at any time in cases according to the Personal Data Protection Act by stating legitimate reasons or presenting evidence of unauthorized interference with his rights and interests protected by law, which are or may be damaged in a specific case by such processing of personal data; if this is not prevented by legal reasons and it is proven that the objection of the person concerned is justified, the company is obliged to block and dispose of the personal data, the processing of which the person concerned has objected, without undue delay and dispose of them immediately, as circumstances allow.

According to the Personal Data Protection Act, the person concerned has, based on a written request addressed to the company or in person, if the matter cannot be delayed, the right to object at any time and not to submit to the company’s decision, which would have legal effects or a significant impact for him, if such a decision is issued exclusively on based on automated processing of her personal data. The affected person further has the right to ask the company to review the issued decision by a method different from the automated form of processing, while the company is obliged to comply with the affected person’s request, in such a way that the authorized person will have a decisive role in reviewing the decision; the operator informs the affected person about the method of examination and the result of the finding within the deadline according to the Personal Data Protection Act. The person concerned does not have this right only if it is established by a special law in which measures to ensure the legitimate interests of the person concerned are regulated, or if, within the framework of pre-contractual relations or during the existence of contractual relations, the operator issued a decision by which he complied with the request of the person concerned, or if based on the contract, the operator has taken other appropriate measures to ensure the legitimate interests of the person concerned.

If the data subject exercises his right:

a) in writing, and it follows from the content of her application that she is exercising her right, the application is considered to have been submitted in accordance with the Personal Data Protection Act; the request submitted by e-mail or fax shall be delivered by the person concerned in writing no later than three days from the date of its sending,

b) in person orally in the minutes, from which it must be clear who exercised the right, what is claimed and when and who made the minutes, his signature and the signature of the person concerned; the company is obliged to hand over a copy of the minutes to the person concerned,

c) in the case of an intermediary according to letter a) or letter b), he is obliged to hand over this application or minutes to the company without unnecessary delay.

If the person concerned suspects that his/her personal data is being processed without authorization, he/she can submit a proposal for the initiation of personal data protection proceedings to the Office for the Protection of Personal Data of the Slovak Republic, with registered office at Hraničná 12, 820 07 Bratislava 27, Slovak Republic, or contact the office via its website headquarters http://www.dataprotection.gov.sk.

If the person concerned does not have full legal capacity, his rights can be exercised by a legal representative.

If the person concerned is not alive, the rights that he had under this law can be exercised by a close person.

The company will handle the request of the person concerned in accordance with the Personal Data Protection Act free of charge.

Žiadosť dotknutej osoby podľa zákona o ochrane osobných údajov vybaví spoločnosť bezplatne, okrem úhrady vo výške, ktorá nemôže prekročiť výšku účelne vynaložených vecných nákladov spojených so zhotovením kópií, so zadovážením technických nosičov a s odoslaním informácie dotknutej osobe, ak osobitný zákon neustanovuje inak.

Spoločnosť je povinná písomne vybaviť žiadosť dotknutej osoby podľa zákona o ochrane osobných údajov najneskôr do 30 dní odo dňa doručenia žiadosti.

Obmedzenie práv dotknutej osoby podľa zákona o ochrane osobných údajov spoločnosť bez zbytočného odkladu písomne oznámi dotknutej osobe a Úradu na ochranu osobných údajov Slovenskej republiky.

Spoločnosť Vás, ako dotknutú osobu týmto informovala o ochrane Vašich osobných údajov a poučila Vás o Vašich právach vo vzťahu k ochrane osobných údajov v rozsahu tejto písomnej informačnej povinnosti.

V Bratislave, dňa 24.01.2020