Personal data controller
Aardwark sro, IČO: 46 451 234, with its registered office at Trnavská cesta 84, 821 01 Bratislava, registered in the Commercial Register of the District Court Bratislava I, section Sro, file no. 77590 / B (hereinafter referred to as the “Operator”).
In case of any questions regarding the processing of personal data, please contact the Operator at osobneudaje@aardwark.com, by phone on tel. +421 903 995 315 or by post at the address of the Operator’s registered office Trnavská cesta 84, 821 01 Bratislava.
Purpose of personal data processing
- fulfilment of legal obligations of the Operator,
- performance of the contract to which the person concerned is a party,
- the legitimate interest of the Operator, in particular, but not exclusively, marketing,
- other purpose of processing with the consent of the data subject.
Legal basis for the processing of personal data
- a generally binding legal regulation which regulates the obligations of the Operator, for the purpose of which the Operator processes the personal data of the data subject,
- a contract to which the person concerned is a party,
- the legitimate interest of the Operator,
- the consent of the data subject to the processing of personal data for one or more specific purposes.
Categories of recipients to whom personal data may be provided
- the Operator’s employees and subcontractors,
- Clients and potential clients of the Operator,
- external accountant,
- external lawyer,
- public authorities,
- other recipients who provide services for the Operator on the basis of a contract on personal data processing.
Transfer to third countries
Personal data is only transferred to countries that guarantee an adequate level of protection and/or to countries where the protection of personal data is guaranteed by a standard personal data protection clause.
Retention period of personal data
The personal data of the data subject shall be processed by the Operator in accordance with the principle of minimising their retention during the purpose for which the personal data of the data subject were obtained, i.e. personal data are stored in a form that allows the identification of data subjects for as long as necessary for purposes for which this personal data is processed.
- personal data necessary to fulfil the legal obligation of the Operator are stored for a period determined by the relevant generally binding legal regulation, which regulates the obligations of the Operator, for the purpose of fulfilling which the Operator processes personal data of the data subject,
- the personal data necessary to fulfil the contractual obligations are kept until the expiry of the limitation period for the exercise of the right arising from the contract,
- personal data processed with the consent of the data subject shall be retained until the data subject’s consent has been revoked; the person concerned has the right to withdraw his consent electronically at any time at osobneudaje@aardwark.com or by sending a letter to the address of the Operator’s registered office at Trnavská cesta 84, 821 01 Bratislava,
- personal data stored on the basis of the legitimate interest of the Operator are stored until the legal basis for their processing ceases to exist.
Security of personal data processing
The operator has implemented and certified the Information Security Management System (ISMS) in accordance with the international standard ISO/IEC 27001.
Rights of the person concerned
- the right of access to personal data pursuant to Art. 15 of the Regulation – the data subject has the right to obtain a confirmation from the Operator as to whether personal data concerning him or her are being processed and, if so, he/she has the right to obtain access to this personal data. The controller shall provide a copy of the personal data being processed. If the person concerned has submitted the request by electronic means, the information shall be provided in a commonly used electronic form, unless the person concerned has requested another method.
- the right to correct personal data according to Art. 16 of the Regulation – the affected person has the right to have the Operator correct incorrect personal data concerning him without undue delay. With regard to the purposes of processing, the data subject has the right to supplement incomplete personal data, including by providing a supplementary declaration.
- the right to erase (right to “forget”) personal data pursuant to Art. 17 of the Regulation – the affected person has the right to obtain the deletion of personal data concerning the Operator without undue delay, and the Operator is obliged to delete personal data without undue delay if any of the reasons under Art. 17 par. 1 of the Regulation. If the Data Controller has disclosed personal data and is obliged to delete personal data, it shall take the appropriate measures, including technical measures, in view of the available technology and the costs of implementing the measures to inform the Data Processing Operators that the data subject requests them to delete all the references to this personal data, a copy or replicas thereof.
- the right to restrict the processing of personal data pursuant to Art. 18 of the Regulation – the data subject has the right to have the Operator limit the processing in respect of any of the cases pursuant to Art. 17 par. 1 of the Regulation. Where processing is restricted, such personal data shall, with the exception of storage, be processed only with the consent of the data subject or for the establishment, assertion or defence of legal claims, or for the protection of the rights of another natural or legal person. The Operator shall inform the affected person who has reached the processing restriction before the processing restriction is lifted.
- the right to the transfer of personal data pursuant to Art. 20 of the Regulation – the data subject has the right to obtain personal data concerning him and which he has provided to the Operator in a structured, commonly used and machine-readable format and has the right to transfer this data to another operator without his Operator to whom this personal data has been provided, he resisted. In exercising his right to data transfer, the data subject has the right to transfer personal data directly from the Operator to another operator, as far as technically possible.
- the right to object to the processing of personal data pursuant to Art. 21 of the Regulation – the data subject has the right to object at any time for reasons related to his/her specific situation against the processing of personal data concerning him/her, which is performed for the purposes of the legitimate interest of the Operator. The controller may not further process personal data unless it demonstrates the necessary legitimate reasons for the processing which outweigh the interests, rights and freedoms of the data subject, or the reasons for proving, asserting or defending legal claims.
- the right to withdraw consent (if consent is the legal basis for processing) pursuant to Art. 7 of the Regulation – the affected person has the right to withdraw his consent electronically at any time at osobneudaje@aardwark.com or by writing a letter to the address of the Operator’s registered office at Trnavská cesta 84, 821 01 Bratislava. Withdrawal of consent shall not affect the lawfulness of the processing resulting from the consent prior to its withdrawal.
- the right to file a petition for personal data protection proceedings – if the data subject considers that his or her personal data is being processed unfairly or illegally, the Data Controller may file a complaint with the supervisory body, which is:
Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; tel.: +421 / 2/3231 3214; e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk. 1 of Act no. 71/1967 Coll. on Administrative Procedure (Administrative Procedure Code).
