DATA CONTROLLER’S STATEMENT ON THE PROCESSING OF PERSONAL DATA
In this section, we provide information on the processing and protection of personal data within the meaning of
Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard
to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data
Protection Regulation) and Act of the Slovak Republic No. 18/2018 Coll. on the Protection of Personal Data and on
Amendments to Certain Acts (hereinafter: the “Personal Data Protection Act”).
The Controller ES-RD 5 s.r.o., with its registered office at Špitálska 55, Company ID No.: 50264109 (hereinafter referred
to as the “Controller”), has taken appropriate technical and organizational measures to ensure the protection of the rights
of data subjects, which declare the lawful processing of personal data. Furthermore, the Operator has implemented a
transparent system for recording security incidents and any questions from the data subject as well as other persons.
If necessary, the data subject can also obtain individual information by phone at: +421 911 907 127 or by e-mail:
1. Controller
ES-RD 5 s.r.o.
Špitálska 55
811 08 Bratislava – Old Town District
Company ID: 50264109
We process your data for our own purposes as the Controller. This means that we determine the purpose for which we
collect your personal data, determine the means of processing and are responsible for their proper implementation.
2. Intermediaries
In certain cases, the Controller may also process the personal data of data subjects through processors who are entrusted
with the processing of personal data in accordance with Article 28 of the GDPR.
The processors process the personal data of data subjects on behalf of the Controller. The processing of personal data by
the processor does not adversely affect the exercise and exercise of the rights of the data subject. The Controller uses
only processors providing appropriate technical, organizational and other measures so that the processing meets the
requirements of the GDPR and that the protection of the rights of the data subject is fully ensured.
The Controller uses the following categories of processors when processing personal data of data subjects:
• supplier ensuring the supply of technical solutions, web hosting services, maintenance and support of IT systems
used by the Operator
• a supplier providing services in the field of accounting and tax obligations of the Operator
Categories of recipients of personal data: persons acting on the basis of a mandate from the controller, legal
representative, auditor, state administration and public authorities to perform control and supervision.
3. Purpose of personal data processing
As a controller, we exclusively process personal data that we can substantiate on a legitimate legal basis and a defined
purpose:
• Response to an inquiry, suggestion or question submitted physically, by telephone or electronically: In order
to provide feedback and comply with the requests of the data subject, we apply the legal basis for processingpursuant to Article 6(1)(f) of the GDPR – legitimate interest of the controller. As a data subject, you have the
right to object to such processing at any time.
• Expression of interest in our services or products, planned cooperation: The legal basis for data processing is
Article 6 (1) (b) of the GDPR – data processing is necessary for the implementation of measures prior to the
conclusion of the contract, i.e. during the pre-contractual relationship.
• Conclusion and performance of the contractual relationship: After the conclusion of the contract between the
controller and the data subject, the processing of data is necessary for its performance in accordance with Article
6(1)(b) of the GDPR.
• Recruitment of new employees: If you are looking for a job and are interested in working for our company, you
can provide us with your CV and cover letter based on your consent to the processing of personal data pursuant
to Article 6(1)(a) of the GDPR. We will include the data obtained in this way in the register of job seekers. You
can withdraw your consent at any time.
4. Period of processing and storage of your personal data
Your personal data that we have processed or are processing pursuant to Article 6(1)(b) of the GDPR – as part of the
fulfilment of the controller’s obligations, we also process for the purpose of fulfilling our legal obligations regarding taxes
and accounting. These obligations arise from generally binding legal regulations, such as Act No. 431/2002 Coll. on
Accounting, as amended, or Act No. 595/2003 Coll. on Income Tax and Act No. 563/2009 Coll. on Tax Administration. We
must retain the data for the period stipulated by this legislation. We follow the principle of minimizing the storage of
personal data according to Article 5 (1) (e) of the GDPR, and therefore your personal data, which is not subject to archiving
according to special legal regulations, will be deleted or anonymized.
We process personal data processed on the basis of the consent granted pursuant to Article 6(1)(a) of the GDPR, for
example for the inclusion of the data subject in the register of job applicants or for the purpose of sending current
marketing news, for a period of 3 years or until the consent is withdrawn. In the event that the end of the data processing
period is approaching, we will contact the data subject with the possibility of renewing and extending the consent for the
next processing period. If the data subject does not give consent or does not respond to contact, we will stop processing
personal data – we will automatically remove it from the records, we will technically delete the electronic data from the
systems and shred the physical documents.
Personal data processed on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR, which were obtained
in response to a submitted inquiry, suggestion or question for the purpose of providing feedback to the data subject, are
deleted immediately after processing, unless they have subsequently been forwarded to a pre-contractual or contractual
relationship.
As the Controller, we will ensure the deletion of personal data without undue delay after: all contractual relations
between you and us as the controller have been terminated; and/or
– all your obligations to the Controller have ceased to exist; and/or
– all your complaints and requests have been handled; and/or
– all other rights and obligations between you and us as the controller have been settled; and/or
– all the purposes of processing set out by law or the purposes of processing for which you have given us your consent
have been fulfilled, if the processing was based on the consent of the data subject; and/or
– the period for which consent was granted has expired or the data subject has withdrawn his/her consent; and/or
– the data subject’s request for the erasure of personal data has been granted and one of the reasons justifying the
granting of this request has been met; and/or- the decisive legal fact for the termination of the purpose of processing has occurred and at the same time the protective
retention period defined with regard to the principle of minimizing the retention period of personal data has expired;
– and at the same time the legitimate interest of the controller does not exist, all obligations stipulated by generally
binding legal regulations that require the storage of personal data of the data subject (in particular for the purposes of
archiving, tax audit, etc.) have ceased to exist, or which could not be fulfilled without their storage.
In any case, we do not systematically process any accidentally obtained personal data for any purpose defined by us.
Where possible, we will inform the data subject to whom the accidentally collected personal data belongs about their
accidental collection and, depending on the nature of the case, we will provide them with the necessary cooperation
leading to the restoration of control over their personal data. Immediately after these necessary actions aimed at
resolving the situation, we will immediately dispose of all accidentally obtained personal data in a secure manner.
If you are interested in further information about the specific retention period of your personal data, please contact us
using the contact details provided.
5. Disclosure of data
Our company does not arbitrarily disclose the personal data obtained in any way.
6. Cross-border transfer and profiling of personal data
Cross-border transfers outside the EU and profiling of personal data is not carried out and is not intended for the future.
7. Rights and obligations of the data subject
• The data subject is obliged to provide only complete and truthful data.
• In the event of a change, the data subject undertakes to update his/her data at the latest before the first
order following the change occurs.
• The data subject undertakes that if he provides personal data of a third party (name, surname, telephone
number), he does so only with the consent of the third party and the data subject is familiar with the
procedures, rights and obligations set out on this page.
• As a data subject, you have the right to decide on the handling of your personal data to the specified extent.
You can exercise these rights in person at the Controller’s registered office or by phone – in writing (by post /
e-mail).
We will try to respond to you as soon as possible, but we will always respond to you no later than 30 days after
receiving your request. The applicable legal regulations and the GDPR Regulation, or the Act, provide you in particular:
Right of access – You have the right to request confirmation from us as to whether your personal data is being processed,
and if so, to obtain a copy of this data and additional information resulting from Article 15 of the Regulation or Section
21 of the Act. In the event that we collect a large amount of data about you, we may require you to specify your request
for a range of specific data that we process about you.
Right to rectification – In order for us to constantly process only up-to-date personal data about you, we need you to
notify us of their change as soon as it occurs. In the event that we process incorrect data about you, you have the right
to request their correction.
Right to erasure – If the conditions of Article 14 of the Regulation or Section 23 of the Act are met, you can request the
deletion of your personal data. Therefore, you can request erasure, for example, if you have withdrawn your consent tothe processing of personal data and there is no other legal basis for processing, or if we process your personal data
unlawfully, or the purpose for which we processed your personal data has ceased to exist and we do not process them
for another compatible purpose. However, we will not delete your data if it is necessary to establish, exercise or defend
legal claims.
Right to restriction of processing – If the conditions of Article 18 of the Regulation or Section 24 of the Act are met, you
can request us to restrict the processing of your personal data. Therefore, you can request restriction, for example, when
you object to the accuracy of the processed data or if the processing is unlawful and you do not want us to delete the
data, but you need their processing to be restricted while you exercise your rights. We continue to process your data if
there are grounds for establishing, exercising or defending legal claims.
Right to portability – If the processing is based on your consent or carried out for the purpose of performing a contract
concluded with you and at the same time carried out by automated means, you have the right to receive from us your
personal data that we have collected from you in a commonly used machine-readable format. If you are interested in it
and it is technically possible, we will transfer your personal data directly to another controller. This right will not be
applicable to processing carried out for the performance of a task carried out in the public interest or in the exercise of
official authority.
Right to object to processing – If we process your personal data for the performance of a task carried out in the public
interest or in the exercise of official authority vested in us, or if the processing is carried out on the basis of our legitimate
interests or those of a third party, you have the right to object to such processing. On the basis of your objection, we will
restrict the processing of personal data and unless we prove compelling legitimate reasons for the processing that
outweigh your interests, rights and freedoms or the reasons for proving, exercising or defending legal claims, we will no
longer process the personal data and we will delete your personal data. You have the right to object at any time to the
processing of personal data for direct marketing purposes, including profiling to the extent that it is related to such direct
marketing. Once you have objected, we will no longer process your personal data for this purpose.
Right to lodge a complaint – If you believe that the processing of your personal data is contrary to the Regulation or the
Law, you have the right to lodge a complaint with one of the competent supervisory authorities, in particular in the
Member State of your habitual residence, place of work or the place of the alleged infringement. For the territory of the
Slovak Republic, the supervisory authority is the Office for Personal Data Protection, with its registered office: Hraničná
4826/12, 820 07 Bratislava, Slovak Republic, web: www.dataprotection.gov.sk, tel.: +421 /2/ 3231 3220.
Right to withdraw consent – If the processing of your personal data is based on consent, you have the right to withdraw
this consent at any time. The withdrawal of consent does not affect the processing already carried out. If at any time later
you decide that you are interested in receiving commercial and marketing offers from us about our products and services
again, you can re-give your revocation of your consent (or objection) at any time by any of the above-mentioned forms
of contact.
8 . Contact details of the Office for Personal Data Protection
Office for Personal Data Protection of the Slovak Republic
Address:
Park one building
Námestie 1.mája 18
811 06 Bratislava
Slovak RepublicCompany ID: 36 064 220
Registry:
Monday – Thursday: 8:00 – 15:00
Friday: 8:00 – 14:00
Telephone consultations in the field of personal data protection:
Tuesday and Thursday from 8:00 to 12:00 +421 2 323 132 20
Secretariat of the President of the Office +421 2 323 132 11
Office Secretariat +421 2 323 132 14
Fax: +421 2 323 132 34
Spokesman:
Mobile: 0910 985 794
E-mail: [email protected]
Email:
a) in general: [email protected]
b) for the provision of information pursuant to Act No. 211/2000 Coll.: [email protected]
c) Website: [email protected]
d) to submit requests for the provision of information pursuant to Act No. 211/2000 Coll. on Free Access to Information,
use the online form.
e) an e-mail address through which the Office will provide you with advice in the field of personal data protection. It is
intended for children, youth, students, teachers, parents who suspect that their personal data has been misused:
A template for initiating a personal data protection procedure can be found on the Office’s website
(https://dataprotection.gov.sk/uoou/sk/content/konanie-o-ochrane-osobnych-udajov).
