Privacy policy (GDPR)

PROCEDURE FOR THE PROCESSING OF PERSONAL DATA

This document describes the manner and purpose of the processing of personal data by GALÉRIA MARTIN, s.r.o., registered office Námestie SNP 2497, 960 01 Zvolen, Company ID (IČO): 48 115 711, as the controller (hereinafter referred to as “GALÉRIA MARTIN” or the “controller”), and also provides any other information required by law, including information on the rights of the data subject and how to exercise them.

Regulation (EU) 2016/679 on the protection of personal data (hereinafter referred to as the “Regulation”) is the legal act on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and it protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data.

Pursuant to Article 4(1) of the Regulation, the term “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”).

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated or non-automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Article 4(2) of the Regulation).

Pursuant to Article 12 et seq. of the Regulation, the data subject must also be provided with the relevant information about the controller’s processing activities and about the rights of the data subject.

1. ON WHAT BASIS MAY WE PROCESS YOUR PERSONAL DATA?

Processing is lawful only if and to the extent that at least one of the following conditions is met:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes,
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract,
• processing is necessary for compliance with a legal obligation,
• processing is necessary in order to protect the vital interests of the data subject or of another natural person,
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child,

2. WHAT IS THE PURPOSE OF THE PROCESSING OF PERSONAL DATA, WHAT PERSONAL DATA DO WE PROCESS, AND FOR HOW LONG DO WE STORE YOUR PERSONAL DATA?

The Company, as the controller, processes your personal data in the following manner / for the following purposes:

• Accounting and business administration
• The purpose is the fulfilment of the controller’s legal obligations arising from specific legislation (e.g. the Accounting Act, the Value Added Tax Act, the Income Tax Act).
• Legal basis (including disclosure to third parties): legal obligation
• Retention period: 10 years.
• Business communication
• The purpose of the processing is the preparation and implementation of the controller’s business activities.
• Legal basis: The legitimate interest pursued by the controller, consisting in the right to conduct business within the scope of the business activities entered in the extract from the relevant register.
• Retention period: depends on the preparation and duration of the commercial relationship, as well as on the expiry of the limitation period.
• Personnel and payroll administration
• The purpose of the processing is the preparation and conclusion of an employment contract or an agreement on work performed outside an employment relationship, keeping records of documents on fitness for work, payment of wages, levies and contributions, fulfilment of obligations towards state administration authorities, attendance records, training records, records of issued authorisations and powers of attorney, records of assets or equipment, conclusion of agreements on material liability, records of cash disbursements, provision of employee benefits, records of damage caused by employees at the workplace or to the property of the controller (employer), provision of meals, copying of documents necessary for the purposes of an employment or similar relationship, as well as the fulfilment of other legal and contractual obligations.
• Legal basis: fulfilment of a legal obligation, performance of a contract, consent given or, where applicable, legitimate interest
• Retention period: for the duration of the employment relationship or other similar relationship until the employee (including a former employee) reaches the age of seventy.
• Records management
• The purpose of the processing is the fulfilment of legal obligations, in particular those arising from Act No. 395/2002 Coll. on Archives and Registries and on the amendment of certain acts, as amended, and from Act No. 305/2013 Coll. on the electronic form of the exercise of powers of public authorities and on the amendment and supplementation of certain acts (the e-Government Act).
• Legal basis: fulfilment of a legal obligation.
• Retention period: is laid down by specific legislation.
• Camera system – monitoring of premises
• The purpose of the monitoring is the protection of property in the monitored area and the protection of natural persons present in this area, as well as the ongoing gathering of evidence on the causes, course and consequences of security incidents.
• Legal basis: the legitimate interest pursued by the controller or a third party, consisting in the right to protection of property, protection of the health of natural persons and the right to demand compliance with public order Retention period: 72 hours.
• Records of data subjects’ rights
• The purpose of the processing, as well as its legal basis, is the fulfilment of the Company’s legal obligation.
• Retention period: 2 years from the date on which the data subject’s request was dealt with
• Legal disputes
• The purpose of the processing, as well as the legitimate interest, is the establishment, exercise and defence of the Company’s legal claims.
• Legal basis: the legitimate interest of the controller in pursuing legal claims
• Retention period: until the matter is finally concluded

3. TO WHOM DOES THE COMPANY DISCLOSE YOUR PERSONAL DATA?

The Company discloses your personal data to the following persons: the Company’s accountant (including external accountants), state and public administration authorities, local government authorities, the administrator of the Company’s website, the auditor, the lawyer, companies providing management and support of information technologies, providers of information services, providers of data storage, in justified cases courts and law enforcement authorities, the health insurance company, supplementary pension savings companies, training agencies, the entity providing occupational health services, occupational health assessments and assessment of medical fitness, and the entity providing postal services.

4. “COOKIES” ON OUR WEBSITE

The controller uses cookies on its website www.galeriamartin.sk only with the consent of the data subject. Cookies are small text files consisting of a sequence of numbers and letters which are stored on your computer’s hard drive via your web browser and are able to uniquely identify your IP address. We use cookies for the purpose of enabling electronic communication by e-mail and identifying users of the website.

5. Publication of personal data

Personal data will not be published.

6. AUTOMATED INDIVIDUAL DECISION-MAKING

Personal data will not be used for automated individual decision-making, including profiling.

7. Transfer of personal data outside the EUROPEAN UNION

No transfer of personal data to a third country or an international organisation takes place.

8. rights of the data subject

Withdrawal of consent – where we process your personal data on the basis of your consent, you have the right to withdraw this consent at any time. You may withdraw your consent electronically, at the address of the responsible person, in writing by means of a notice of withdrawal of consent, or in person at the office. Withdrawal of consent does not affect the lawfulness of the processing of personal data that we carried out about you on the basis of that consent.

Right of access – you have the right to obtain a copy of the personal data we hold about you, as well as information on how we use your personal data. In most cases, your personal data will be provided to you in written paper form, unless you request another method of provision. If you have requested this information by electronic means, it will be provided to you electronically where technically possible.

Right to rectification – we take reasonable measures to ensure that the information we hold about you is accurate, complete and up to date. If you believe that the data we hold is inaccurate, incomplete or out of date, please do not hesitate to ask us to correct, update or supplement this information.

Right to erasure (right to be forgotten) – you have the right to ask us to erase your personal data, for example where the personal data we have obtained about you are no longer necessary for the original purpose of the processing. However, your right needs to be assessed in the light of all relevant circumstances. For example, we may have certain legal and regulatory obligations which mean that we will not be able to comply with your request.

Right to restriction of processing – in certain circumstances you are entitled to ask us to stop using your personal data. This applies, for example, where you believe that the personal data we hold about you may be inaccurate or where you believe that we no longer need to use your personal data.

Right to data portability – in certain circumstances you have the right to ask us to transfer the personal data you have provided to us to another third party of your choice. However, the right to portability applies only to personal data that we have obtained from you on the basis of consent or on the basis of a contract to which you are a party.

Right to object – you have the right to object to the processing of data that is based on our legitimate interests. If we do not have a compelling legitimate ground for the processing and you lodge an objection, we will no longer process your personal data.

Right to lodge a petition to initiate proceedings on the protection of personal data – if you believe that your personal data are being processed unfairly or unlawfully, you may lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic (úrad na ochranu osobných údajov slovenskej republiky), hraničná 12, 820 07 Bratislava 27; tel. no.: +421 /2/ 3231 3214; e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk. If the petition is submitted electronically, it must meet the requirements under Section 19(1) of Act No. 7181967 Coll. on Administrative Proceedings (administrative fee).

9. INFORMATION AND EXERCISE OF THE DATA SUBJECT’S RIGHTS

In order to exercise your rights, you may contact the controller at any time as follows:

• Address: GALÉRIA MARTIN, s.r.o, Námestie SNP 2497, 960 01 Zvolen
• Telephone: 0918 181 923
• E-mail: gdpr@galeriamartin.sk

We will respond to your request free of charge within 30 days. In the case of complexity or a large number of requests, we are entitled to extend this period by a further 60 days. Should this occur, we will inform you of this and of the reasons for it.

In the case of a repeated request, we are entitled to charge a reasonable administrative fee to cover the costs associated with providing this service.