Personal Data Processing Statement

Statement on the processing of personal data

The company K-Kart spol. sro (hereinafter referred to as the “Controller”) collects, processes and uses personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of personal data and does everything necessary to ensure compliance with these legal regulations.

The operator will process personal data only for the purpose for which they were obtained. The operator declares that it will process personal data only in accordance with good morals and will act in a manner that does not contradict the Personal Data Protection Act or other generally binding legal regulations, nor will it circumvent these regulations. After fulfilling the purpose of processing personal data, the operator will ensure the destruction of personal data without undue delay, unless a special law requires otherwise.

The operator ensures an adequate level of personal data protection, also protects the processed personal data against damage, destruction, loss, alteration, unauthorized access and disclosure, provision or publication, as well as against any other unauthorized methods of processing and for this purpose has adopted and is adopting adequate security measures corresponding to the method of processing personal data.

The controller will process personal data in accordance with the rights of the data subject. The data subject has the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed. Where the controller processes such personal data, the data subject has the right to access those personal data and information about:

1. the purpose of processing personal data,
2. the category of personal data being processed,
3. the identification of the recipient or category of recipient to whom they have been or are to be provided, in particular a recipient in a third country or an international organisation, where possible.
4. the period of storage of personal data, if this is not possible, information on the criteria for determining it,
5. the right to request from the controller the correction of personal data concerning the data subject, their erasure or restriction of their processing, or the right to object to the processing of personal data,
6. just file a motion to initiate proceedings under,
7. the source of the personal data, if the personal data were not obtained from the data subject,
8. the existence of automated individual decision-making, including profiling.

The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning him or her. Taking into account the purpose of the processing of personal data, the data subject has the right to have incomplete personal data completed.

The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay if:

1. the personal data are no longer necessary for the purpose for which they were collected or otherwise processed,
2. the data subject withdraws the consent on the basis of which the processing of personal data is carried out, and there is no other legal basis for the processing of personal data,
3. the data subject objects to the processing of personal data and there are no overriding legitimate reasons for the processing of personal data,
4. personal data is being processed unlawfully.

The data subject has the right to obtain from the controller restriction of the processing of personal data where:

1. the data subject objects to the accuracy of the personal data, within a period allowing the controller to verify the accuracy of the personal data,
2. the processing of personal data is unlawful and the data subject objects to the erasure of the personal data and requests the restriction of their use instead,
3. the controller no longer needs the personal data for the purpose of processing the personal data, but the data subject needs them for the exercise of a legal claim, or
4. the data subject objects to the processing of personal data.

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and shall have the right to transmit those personal data to another controller, where technically feasible. The right to portability shall not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to object to processing of personal data concerning him or her, on grounds relating to his or her particular situation, carried out on the basis of the legitimate interest of the controller, including profiling based on these provisions. The controller shall not further process the personal data unless it can demonstrate compelling legitimate interests for the processing of the personal data which override the rights or interests of the data subject or the exercise of legal claims.

The data subject shall have the right to object to processing of personal data concerning him or her for direct marketing purposes, including profiling to the extent that it is related to direct marketing. If the data subject objects to the processing of personal data for direct marketing purposes, the controller shall not further process the personal data for direct marketing purposes.

The data subject has the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning him or her or significantly affects him or her personally, unless it concerns personal data necessary for entering into or the performance of a contract between the data subject and the controller.

The data subject has the right to file a complaint for investigation pursuant to Section 100 of Act No. 18/2018 Coll. on the Protection of Personal Data if he or she suspects that his or her personal data is being processed unlawfully or if the processing of his or her personal data or the breach of security of processing has resulted in a violation of his or her rights.

The controller or processor may, under the conditions established by a special regulation or an international treaty by which the Slovak Republic is bound, limit the scope of obligations and rights if such a limitation is established in order to ensure:

1. security of the Slovak Republic,
2. defense of the Slovak Republic,
3. public order,
4. performance of tasks for the purposes of criminal proceedings,
5. other important objectives of general public interest of the European Union or the Slovak Republic, in particular a matter of important economic interest or important financial interest of the European Union or the Slovak Republic, including monetary, budgetary and tax matters, public health or social security,
6. protecting the independence of the judiciary and judicial proceedings,
7. preventing ethical violations in regulated professions or regulated professional activities,
8. a monitoring function, a control function or a regulatory function connected with the exercise of public authority,
9. protection of the rights of the data subject or other persons,
10. exercising a legal claim,
11. economic mobilization.

The data subject has the right to defend his or her rights through the responsible person or by submitting a request for investigation, a complaint, to the supervisory authority, in Slovakia the Office for Personal Data Protection pursuant to Section 100 of Act No. 18/2018 Coll.

Contact details for the responsible person: kkart@kkart.sk