1. Principles of personal data processing
The company Zväz strojárskeho priemyslu Slovenskej Republiky with its registered office at Lamačská cesta 6353/3C, 841 04 Bratislava, Company ID 17 317 380 (hereinafter referred to as the "Operator"), in accordance with Regulation 2016/679 GDPR on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation") and Act No. 18/2018 Coll. on the protection of personal data and on amendments to certain acts (hereinafter referred to as the "Act"), has developed security measures that are regularly updated. These define the scope and manner of the security measures necessary to eliminate and minimise threats and risks affecting the information system in order to ensure:
- the availability, integrity and reliability of management systems using state-of-the-art information technologies,
- the protection of personal data against loss, damage, theft, modification and destruction, and the preservation of their confidentiality,
- the identification and prevention of potential problems and sources of breaches.
Contact for the person responsible for personal data processing: zspsr@zspsr.sk.
2. Personal data protection principles
Your personal data will be stored securely, in accordance with the data retention policy and only for the period necessary to fulfil the purpose of processing. Access to personal data is granted only to persons authorised by the operator to process personal data, who process them on the basis of the operator's instructions. Your personal data will be backed up in accordance with the operator's retention rules. Personal data stored on backup storage serve to prevent security incidents that could arise in particular from a security breach or damage to the integrity of the processed data.
3. Definition of terms
3.1. "personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
3.2. "processing" means an operation or set of operations performed on personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, whether or not by automated or non-automated means;
3.3. "restriction of processing" means the marking of stored personal data with the aim of limiting their processing in the future;
3.4. "profiling" means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, financial situation, health, personal preferences, interests, reliability, behaviour, location or movements;
3.5. "information system" means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
3.6. "operator" means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the operator or the specific criteria for its nomination may be provided for by Union or Member State law;
3.7. "processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the operator;
3.8. "third party" means a natural or legal person, public authority, agency or body other than the data subject, operator, processor and persons who, under the direct authority of the operator or processor, are authorised to process personal data;
3.9. "consent of the data subject" means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
3.10. "personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
4. Purposes of personal data processing
4.1. Performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract
The personal data we process about our customers are processed on the basis of a contract pursuant to Article 6(1)(b) of the Regulation (processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract). The scope of the processed personal data: title, first name, surname, address, signature, telephone and e-mail. They are subsequently stored in accordance with Act No. 395/2002 Coll. on archives and registries.
4.2. Records of requests
The personal data we process through the contact forms listed on our website and through e-mails are processed solely to handle your request. By completing and submitting the request, you consent to the processing of personal data pursuant to Article 6(1)(a) of the Regulation (the data subject has given consent to the processing of his or her personal data for one or more specific purposes). The scope of the processed personal data: first name, surname, address, telephone, e-mail. No transfer of personal data to a third country takes place. The personal data will not be used for automated decision-making, including profiling.
4.3. Processing of accounting documents
Processing is necessary for compliance with the operator's legal obligation pursuant to Article 6(1)(c) of the Regulation. The scope of the processed personal data: title, first name, surname, address, telephone, account number, e-mail and signature. They are subsequently stored in accordance with Act No. 395/2002 Coll. on archives and registries.
4.4. Records of complaints
We process the personal data of data subjects who seek protection of their rights or legally protected interests, or who point out specific deficiencies, in particular violations of legal regulations whose remedy requires the intervention of the relevant authority, pursuant to Article 6(1)(c) of the Regulation (processing is necessary for compliance with the operator's legal obligation). The scope of the processed personal data: first name, surname, address, telephone, e-mail and signature. They are subsequently stored for a period of 5 years.
4.5. Debt recovery
In the case of debt recovery, personal data are processed pursuant to Article 6(1)(c) of the Regulation. The scope of the processed personal data: first name, surname, birth number, address, telephone,
e-mail. They are subsequently stored in accordance with Act No. 395/2002 Coll. on archives and registries.
4.6. Enforcement proceedings
The processing of personal data is necessary for compliance with the operator's legal obligation pursuant to Article 6(1)(c) of the Regulation. The scope of the processed personal data: ordinary personal data and other personal data identified or provided during the proceedings. They are subsequently stored in accordance with Act No. 395/2002 Coll. on archives and registries.
4.7. Records of job applicants
The processing of the personal data of job applicants is carried out on the basis of the "Consent" to the processing of personal data pursuant to Article 6(1)(a) of the Regulation, provided by the applicant. The operator will contact only successful applicants. The personal data are stored for a period of 12 months from the granting of consent.
No transfer of personal data to a third country takes place. The personal data will not be used for automated individual decision-making, including profiling.
You have the right at any time before the expiry of the stated period to withdraw your consent to the processing of personal data by sending a request to the e-mail address zspsr@zspsr.sk or by sending a request to the operator's address with the text "GDPR withdrawal of consent" on the envelope. The operator declares that, in the event of a written request from the data subject to terminate the processing of personal data before the stated deadline, these data will be deleted within 30 days of receipt of the withdrawal of consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4.8. Education and training
The processing of the personal data of those interested in education and training is carried out on the basis of the "Consent" to the processing of personal data pursuant to Article 6(1)(a) of the Regulation. The education and training is carried out for the purpose of supporting the exercise of the competences of trade and professional organisations in vocational education and training through the training of lead instructors. The scope of the processed personal data: title, first name, surname, telephone number, e-mail address, the employer's identification data and other relevant data for achieving the purpose. They are subsequently stored for a period of 2 years after the expiry of the issued certificate. You have the right at any time before the expiry of the stated period to withdraw your consent to the processing of personal data by sending a request to the e-mail address zspsr@zspsr.sk or by sending a request to the operator's address with the text "GDPR withdrawal of consent" on the envelope. The operator declares that, in the event of a written request from the data subject to terminate the processing of personal data before the stated deadline, these data will be deleted within 30 days of receipt of the withdrawal of consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4.9. Records of representatives of suppliers and customers
The processing of the personal data of suppliers and customers is carried out in accordance with the legitimate interests of the operator, pursuant to Article 6(1)(f) of the Regulation. The scope of the processed personal data: title, first name, surname, job position, official position, functional position, employee personal number, professional department, place of work, telephone number, fax number, workplace e-mail address and the employer's identification data. They are subsequently stored for a period of 10 years after the termination of the contract or business relationship.
4.10. Direct marketing
The personal data we process about our customers for marketing purposes are processed on the basis of the operator's legitimate interest pursuant to Article 6(1)(f) of the Regulation. The scope of the processed personal data: first name, surname, telephone and e-mail. They are subsequently stored for the duration of the contractual or business relationship between the client and the operator.
5. Rights of the data subject
5.1. Right to withdraw consent – in cases where we process your personal data on the basis of your consent, you have the right to withdraw this consent at any time. You may withdraw your consent electronically, at the address of the responsible person, in writing, by notice of withdrawal of consent, or in person at the registered office of our company. The withdrawal of consent does not affect the lawfulness of the processing of personal data that we carried out about you on its basis.
5.2. Right of access – you have the right to be provided with a copy of the personal data we hold about you, as well as information about how we use your personal data. In most cases, your personal data will be provided to you in written paper form, unless you request another method of provision. If you have requested this information by electronic means, it will be provided to you electronically, where technically feasible.
5.3. Right to rectification – we take reasonable steps to ensure the accuracy, completeness and currency of the information we hold about you. If you believe that the data we hold are inaccurate, incomplete or out of date, please do not hesitate to ask us to amend, update or supplement this information.
5.4. Right to erasure (right to be forgotten) – you have the right to ask us to erase your personal data, for example where the personal data we have obtained about you are no longer necessary to fulfil the original purpose of processing. However, your right must be assessed in light of all relevant circumstances. For example, we may have certain legal and regulatory obligations, which means that we may not be able to comply with your request.
5.5.Right to restriction of processing – under certain circumstances you are entitled to ask us to stop using your personal data. This includes, for example, cases where you believe that the personal data we hold about you may be inaccurate, or where you believe that we no longer need to use your personal data.
5.6. Right to data portability – under certain circumstances you have the right to ask us to transfer the personal data you have provided to us to another third party of your choice. However, the right to portability applies only to personal data that we obtained from you on the basis of consent or on the basis of a contract to which you are one of the contracting parties.
5.7. Right to object – you have the right to object to the processing of data that is based on our legitimate interests. In the event that we do not have a compelling legitimate ground for processing and you raise an objection, we will no longer process your personal data.
If you believe that any personal data we hold about you are incorrect or incomplete, please contact us.
If you wish to raise an objection to the manner in which we process your personal data, please contact our person responsible for supervising the processing of personal data by e-mail at: zspsr@zspsr.sk or in writing to the operator's address with the text "GDPR objection" on the envelope.
Our responsible person will examine your objection and will work with you to resolve the matter.
If you believe that your personal data are being processed unfairly or unlawfully, you may lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; tel. no.: +421 /2/ 3231 3214;
e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk.
Dated 20 June 2023
