GDPR

Information provided in the form of this document in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons in the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (hereinafter "GDPR") and Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (hereinafter referred to as the "Act on the Protection of Personal Data") serve to ensure the provision of information for the natural persons concerned in accordance with Art. 13 and 14 GDPR as well as instructing these persons about their legal rights and about the manner and extent of handling their personal data.

Operator: SLOVAKIA RING AGENCY, p. r. about.; Address: 800 Orechová Potôň 930 02, ID: 44 407 793 (hereinafter referred to as "AGENCY").

Subject: any natural person to whom the personal data relate. For the purposes of this document, in particular, visitors, orderers, participants, receivers, competitors and other persons moving in the AGENCY premises, e.g. natural persons acting on behalf of contractual partners and their employees (hereinafter referred to as the "person concerned"). In the event that data on the affected person is provided to the AGENCY by another person, the provider of the affected person's personal data is only authorized to do so if it has a legitimate legal basis for the provision according to the relevant provisions of the GDPR or the Personal Data Protection Act and is obliged to do so on the basis of a request AGENCY within 3 working days to be able to demonstrate.

Disclaimer: This information relates exclusively to the processing of personal data carried out by the AGENCY. AGENCY is not responsible for the processing of personal data carried out by AGENCY's contractual partners (mostly organizers of various events, sports and cultural and social events, etc.), who rent AGENCY premises and premises.

For what PURPOSES does the AGENCY process personal data?

As part of the operation of the Automodrome area and the Safe Driving Center, the AGENCY processes the Personal Data of the Data Subject in particular for the purposes of:

• introduction and fulfillment of pre-contractual and contractual relationships,
• solutions to claims, suggestions and complaints,
• dealing with correspondence,
• ensuring the application of the rights of the person concerned,
• checks for compliance with the rules of operating regulations,
• monitoring of publicly accessible spaces,
• monitoring of areas not accessible to the public,
• necessary storage or archiving of created documentation and records,
• settlement of damages and insurance claims,
• recovery of incurred receivables and asserting legal claims,
• business-marketing communication and AGENCY promotion, organization of contests and raffles,
• preparation of internal analyzes and statistics,
• accreditation of journalists,
• accreditation of event participants,
• fulfillment of other obligations arising from the AGENCY's contractual obligations and special legal regulations.

Processing of personal data necessary for the performance of the contract:

As part of pre-contractual and contractual relationships, personal data is processed primarily for the purposes of:

• establishment of pre-contractual relations with the persons concerned (processing of orders, reservations, negotiations on the contractual relationship, issuing of invoices and recording of payments for the goods and services provided, etc.),
• fulfillment of contractual relations, while the person concerned is a contractual party, or the contract was concluded by another third party for the benefit of the person concerned (fulfilment of the subject of the contract, provision of goods or services and performance of related services, e.g. education and training of participants in events, binding declarations of participants in events, maintaining a user account on the website www.slovakiaring.sk etc.),
• resolution of claims, suggestions and complaints of affected persons related to the delivered goods or service within the framework of a legitimate purpose even after the end of the contractual relationship.

As part of pre-contractual and contractual relations, personal data is processed to the extent necessary for the conclusion and performance of the contract, in particular: name, surname, date of birth, place of residence, ID and driver's license number, contact details, payment details, details of the subject of the contract and other personal data processed to an appropriate extent in connection with a specific contractual relationship (e.g. data on insurance, data on breath tests performed, fines issued, etc.).

Disclosure of personal data is a contractual requirement, only to the extent necessary for the performance of the contract in question or a requirement that is necessary for the conclusion of the contract. If the required personal data is not provided, it may result in not concluding the contractual relationship or it may have an impact on the fulfillment of the subject of the contract.

Personal data are kept for the period necessary to assert legal claims after the end of the contractual relationship, at least 5 years, and in the scope of accounting documents, they are kept for 10 years. In case of cancellation of the user account on the website www.slovakiaring.sk, the processing of the personal data of the person concerned for the purpose of maintaining the account is terminated immediately.

Personal data are primarily provided to the following recipients: Slovak Trade Inspection, courts and law enforcement agencies in the performance of their activities, payment service providers, postal companies, lawyers and other third parties to whom the AGENCY is obliged to provide data on the basis of a special legal regulation or contractual obligations and authorized intermediaries.

Processing of personal data necessary to fulfill the legal obligation of the AGENCY:

As part of the legal obligation, personal data is processed primarily for the purposes of:

• monitoring of selected parts of the Automotodrome area within the organization of events where, based on the provisions of Act no. 1/2014 Coll. the AGENCY has a legal obligation to monitor the organization of public sports events. The recorded records are mainly used to resolve sports disputes. Recordings of the camera system are kept for 7 days.

Personal data are primarily provided to the following recipients: courts and law enforcement agencies, the Slovak Police Force to the extent of the required cooperation, and authorized intermediaries.

• ensuring the application of the rights of the affected persons and keeping the relevant records, which the AGENCY is obliged to keep in accordance with the provisions of the GDPR. The person concerned is obliged to provide his personal data, primarily to the extent of data necessary for his accurate identification in the AGENCY systems and contact data for the purpose of informing him about the completion of his application (if he requests a statement). Personal data is stored for at least 5 years.

Personal data are primarily provided to the following recipients: the Personal Data Protection Office of the Slovak Republic, a lawyer, a postal company, courts and law enforcement authorities to the extent of the required cooperation, and authorized intermediaries.

Processing of personal data based on the consent of the person concerned:

Based on the consent granted, personal data are processed primarily for the purposes of:

• business-marketing communication (so-called newsletters) and targeted AGENCY promotion,
• organization of contests and raffles, while the contest organizer is the AGENCY,
• and for other purposes defined by specific consent.

The targeting of business-marketing communication is carried out to a minimum extent, usually only on the basis of initial information about the interest of the person concerned (e.g. interest in "AUTO" products or services or "MOTO" services, etc.).

Providing personal data is voluntary, i.e. the person is not obliged to provide data to the AGENCY. If the person does not provide personal data, it will not be possible to communicate with them for the above purpose.

Personal data is processed on the basis of consent during the validity of the respective consent. After the expiration of the consent, the AGENCY will not process personal data for the purpose defined by the consent of the person concerned.

Personal data is primarily provided to the following recipients: third parties defined by consent, if the person concerned has given consent to the provision of their personal data to a third party, and authorized intermediaries.

Processing of personal data based on the legitimate interests of the AGENCY or a third party:

AGENCY processes personal data within its legitimate interest or that of a third party primarily for the purposes of:

• handling of the correspondence with data subjects, which does not relate to the aforementioned processing purposes. Personal data are stored for the period necessary for processing them and for the protection of the legally protected interests of the AGENCY (usually 2 years).

Personal data are primarily provided to the following recipients: Postal companies, couriers, other third parties in connection with the purpose of correspondence and authorized intermediaries.

• monitoring of publicly accessible spaces with camera systems for the purpose of ensuring public order, protection of persons and property, and safety. Outputs from the camera system are continuously evaluated by SBS employees, and records from this camera system are not made or stored.

Personal data is provided primarily to the following recipients: attorney, courts and law enforcement authorities to the extent of the required cooperation, and authorized intermediaries.

• monitoring of areas not accessible to the public (grounds of buildings, runways and other areas not accessible to the public) by camera systems for the purposes of security, protection of persons and property and safety. The records made are kept for 7 days.

Personal data is provided primarily to the following recipients: attorney, courts and law enforcement authorities to the extent of the required cooperation, and authorized intermediaries.

• necessary storage or archiving of the created documentation and records, while the AGENCY sets deadlines primarily in terms of the deadlines determined by special legal regulations or the retention periods are necessary for the exercise of legal claims and legally protected interests of the AGENCY.

Personal data is primarily provided to recipients in connection with the use of a stored document or record (e.g. control and supervisory authorities, courts and law enforcement authorities, etc.) and authorized intermediaries.

• settlement of damages and insurance claims. Personal data is stored for the period until the settlement of the insurance claim. Documents related to the AGENCY's accounting agenda are then kept for 10 years.

Personal data are primarily provided to the following recipients: attorney, courts and law enforcement authorities to the extent of the required cooperation, insurance companies and authorized intermediaries.

• accreditation of journalists and event participants, while the legitimate interest is the AGENCY's interest in allowing entry to the AGENCY's premises, the performance of permitted activities and the registration of accredited persons. Personal data is stored for 5 years.

Personal data is provided primarily to the following recipients: attorney, courts and law enforcement authorities to the extent of the required cooperation, and authorized intermediaries.

• business-marketing communication if the AGENCY can demonstrate a relationship with the person concerned. Personal data are processed for this purpose, unless the person concerned objects.
• promotion of the AGENCY in the form of publication of photos, video recordings and promotional materials, while it is not the intention of the AGENCY to create and publish portraits of specific persons concerned, but to promote its business activities by documenting the course of events. The affected person has the right to object to the publication of the image or recording in question at the AGENCY. AGENCY undertakes not to interfere with the rights of the affected persons without authorization within the scope of this purpose of processing.
• preparation of AGENCY's internal analyzes and statistics, which generally consist of anonymized data that are not personal data of the person concerned.

What are the rights of the CONCERNED person when processing his personal data?

The person concerned has the right to:

• for information about the processing of her personal data;
• gain access to personal data processed and stored about her;
• request correction of your incorrect, inaccurate or incomplete personal data;
• request the deletion of your personal data when they are no longer needed or if the processing is unlawful;
• to object to the processing of your personal data for marketing purposes or on a basis related to a specific situation;
• request the restriction of the processing of your personal data in special cases;
• receive your personal data in a machine-readable format and/or request their transfer to another operator;
• revoke your consent at any time without this affecting the legality of processing based on consent granted before its revocation, if such consent was granted by the person concerned;
• request that decisions based on automated processing that concern or significantly affect her, based on her personal data, are carried out by natural persons and not by automated technical means, if personal data are processed in this way by AGENCY. The affected person has the right to express his opinion and object to the decision of the AGENCY;
• file a complaint with a supervisory authority, especially in the Member State of their usual residence, place of work or place of alleged violation and the right to an effective judicial remedy if they believe that the processing of their personal data is contrary to legal regulations. The supervisory authority in the territory of the Slovak Republic is the Personal Data Protection Office of the Slovak Republic, Hraničná 12 Bratislava;
• submit a request or complaint to the AGENCY in connection with the protection and processing of its personal data. Any affected person who wants to file a request or complaint and exercise their rights can do so:
• in writing at the address: SLOVAKIA RING AGENCY, p. r. about.; seat address: 800 Orechová Potôň 930 02
• in electronic form at the address: gdpr@slovakiaring.sk

Detailed information on the rights of data subjects:

Transparency of notification and procedures for exercising the rights of the person concerned

• The AGENCY will provide the affected person with all information and all notices related to the processing of their personal data, in a concise, transparent, understandable and easily accessible form, formulated clearly and simply, especially in the case of information intended specifically for a child. The AGENCY can provide information in writing or by other means, or by electronic means. If the person concerned so requests, the information may be provided to the AGENCY orally, provided that the identity of the person concerned has been proven in a relevant manner.
• AGENCY will facilitate the exercise of the rights of the person concerned. In the event that the purposes for which the AGENCY processes personal data do not or have ceased to require the AGENCY to identify the data subject and the AGENCY no longer stores, obtains and processes additional information to establish the identity of the data subject, the AGENCY shall not refuse to act on the basis of the data subject's request when exercising her right, unless it is proven that the person concerned cannot be identified.
• The AGENCY will provide the affected person with information on the measures taken based on his request within one month of receiving his request. In necessary cases, the AGENCY may extend the stated deadline by another two months, taking into account the complexity and number of applications. The AGENCY informs the affected person of any such extension within one month of the receipt of the request, along with the reasons for missing the deadline. If the person concerned submitted the request by electronic means, the AGENCY will provide the information, if possible, by electronic means, unless the person concerned requests another method.
• If the AGENCY does not take measures based on the request of the person concerned, it shall inform the person concerned of the reasons for not acting without delay and no later than one month after receiving the request, and of the possibility of filing a complaint with the supervisory authority and applying for a judicial remedy. The supervisory authority on the territory of the Slovak Republic is the Personal Data Protection Office of the Slovak Republic, Hraničná 12 Bratislava.
• The AGENCY provides information, notices and notices on the adoption of measures at the request of the affected person free of charge. If the data subject's requests are clearly unfounded or disproportionate, especially due to their repeated nature,
• the AGENCY may: require a reasonable fee taking into account administrative costs for providing information or for notification or for carrying out the requested action,
• or refuse to act on such a request.

The AGENCY bears the burden of proving the groundlessness or inadequacy of the request.

• If the AGENCY has legitimate doubts in connection with the identity of the natural person submitting the application within the scope of the above-mentioned points, the AGENCY may request the provision of additional information necessary to confirm the identity of the person concerned.
• The information that AGENCY provides to data subjects may be presented in combination with machine-readable standardized icons in order to provide a visible, clear and comprehensible overview of the intended processing.

Information that is provided when obtaining personal data from the person concerned

• In the event that personal data is obtained from the person concerned, the AGENCY provides the following information to the person concerned when obtaining personal data:
• identity and contact details of the AGENCY,
• contact details of the responsible person, if designated,
• the processing purposes for which the personal data are intended, as well as the legal basis of the processing,
• if the processing is based on the legitimate interests of the AGENCY or a third party, state these legitimate interests pursued by the AGENCY or the third party,
• recipients or categories of recipients of personal data, if any, where relevant, information that the AGENCY intends to transfer personal data to a third country or international organization and information on the existence or non-existence of a Commission decision on adequacy or,
• in the case of relevant transfers, a reference to adequate or suitable guarantees and means of obtaining a copy thereof, or where were provided.
• In addition to the information specified in paragraph 1, the AGENCY provides the data subject with information necessary to ensure fair and transparent processing when collecting personal data:
• the period of storage of personal data or, if this is not possible, the criteria for its determination,
• the existence of the right to request from the AGENCY access to personal data concerning the person concerned and the right to their correction or deletion or restriction of processing, or the right to object to processing, as well as the right to portability of personal data, if the processing is based on the consent of the person concerned, the existence of the right to revoke the consent at any time without this affecting the legality of the processing based on the consent granted before its revocation,
• the right to file a complaint with the supervisory authority,
• information on whether the provision of personal data is a legal or contractual requirement, or a requirement that is necessary to conclude a contract, whether the person concerned is obliged to provide personal data, as well as the possible consequences of not providing such personal data,
• the existence of automated decision-making, including profiling and information about the procedure used, as well as the meaning and expected consequences of such processing for the person concerned.
• If the AGENCY intends to further process personal data for a purpose other than that for which it was obtained, it shall provide the data subject with information about this other purpose and other relevant information specified in paragraph 2 before such further processing.
• Paragraphs 1, 2 and 3 do not apply to the extent that the data subject already has the given information.

Information to be provided if the personal data has not been obtained from the data subject

• If personal data were not obtained from the person concerned, the AGENCY will provide the person concerned with the following information:
• identity and contact details of the AGENCY,
• contact details of the responsible person, if designated,
• the processing purposes for which the personal data are intended, as well as the legal basis of the processing,
• categories of affected personal data,
• recipients or categories of recipients of personal data, if any,
• where relevant, information that the AGENCY intends to transfer personal data to a third country or international organization and information on the existence or non-existence of a Commission decision on adequacy or, in the case of relevant transfers, a reference to adequate or suitable guarantees and means of obtaining a copy thereof, or where were provided. In addition to the information specified in paragraph 1, the AGENCY will provide the data subject with the information necessary to ensure fair and transparent processing with regard to the data subject:
• the period of storage of personal data or, if this is not possible, the criteria for its determination,
• if the processing is based on the legitimate interests of the AGENCY or a third party, state these legitimate interests pursued by the AGENCY or the third party,
• the existence of the right to request from the AGENCY access to personal data concerning the person concerned and the right to their correction or deletion or restriction of processing, or the right to object to processing, as well as the right to portability of personal data,
• if the processing is based on the consent of the person concerned, the existence of the right to revoke the consent at any time without this affecting the legality of the processing based on the consent granted before its revocation,
• the right to file a complaint with the supervisory authority,
• from which source the personal data come, or information about whether the personal data comes from publicly accessible sources,
• the existence of automated decision-making, including profiling and information about the procedure used, as well as the meaning and expected consequences of such processing for the person concerned.
• AGENCY will provide the information specified in paragraphs 1 and 2:
• within a reasonable period of time after obtaining personal data, but within one month at the latest, while it is necessary to take into account the specific circumstances under which personal data are processed,
• if personal data are to be used for communication with the data subject, at the latest at the time of the first communication with the data subject,
• or if personal data is expected to be provided to another recipient, at the latest when the personal data is provided for the first time. If the AGENCY intends to further process personal data for a purpose other than that for which it was obtained, the AGENCY shall provide the data subject with information about this other purpose and any other relevant information referred to in paragraph 2 before such further processing.
• Paragraphs 1 to 4 do not apply to the extent that:
• the person concerned already has the given information,
• disclosure of such information proves impossible or would require disproportionate effort, in particular in the case of processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes covered by the conditions and guarantees, or if it is likely that the obligation referred to in paragraph 1 will make it impossible or seriously difficult to achieve the goals of such processing. In such cases, the AGENCY will take appropriate measures to protect the rights and freedoms and legitimate interests of the person concerned, including making the given information available to the public,
• the acquisition or provision is expressly provided for in the law of the EU or the Slovak Republic and in which adequate measures are laid down to protect the legitimate interests of the person concerned, or
• in the case when personal data must remain confidential based on the obligation to maintain professional secrecy regulated by EU or SR law, including the obligation to maintain confidentiality resulting from the statute.

The data subject's right to access personal data

• If the data subject requests it, he has the right to obtain from the AGENCY a confirmation as to whether it processes personal data concerning him, and if so, he has the right to obtain access to this personal data and the following information:
• processing purposes,
• categories of affected personal data,
• recipients or categories of recipients to whom personal data have been or will be provided, in particular recipients in third countries or international organizations,
• if possible, the expected period of storage of personal data or, if this is not possible, the criteria for its determination,
• the existence of the right to request from the AGENCY the correction of personal data concerning the person concerned or their deletion or restriction of processing, or the right to object to such processing,
• the right to file a complaint with the supervisory authority,
• if the personal data was not obtained from the data subject, any available information as to its source,
• the existence of automated decision-making, including profiling and, in these cases, information about the procedure used, as well as the meaning and expected consequences of such processing for the person concerned.
• If personal data is transferred to a third country or an international organization, the person concerned has the right to be informed by the AGENCY about adequate guarantees regarding the transfer.
• AGENCY will provide the affected person with a copy of the personal data being processed. For any additional copies requested by the data subject, the AGENCY may charge a reasonable fee corresponding to administrative costs. If the person concerned submitted the request by electronic means, the AGENCY will provide the information in a commonly used electronic form, unless the person concerned has requested another method. The right to obtain a copy must not have adverse consequences on the rights and freedoms of other persons.

Right to rectification

• If the person concerned requests it, he has the right to have incorrect personal data concerning him corrected by the AGENCY without undue delay. With regard to the purposes of processing, the data subject has the right to supplement incomplete personal data, including by providing a supplementary statement.

Right to erasure (right to be “forgotten”)

• If the affected person requests it from AGENCY, he has the right to ensure the deletion of personal data concerning him without undue delay, and AGENCY will delete personal data without undue delay if any of the following reasons are met:
• personal data are no longer necessary for the purposes for which they were obtained or otherwise processed,
• the person concerned revokes the consent on the basis of which the processing is carried out and if there is no other legal basis for their processing,
• the person concerned objects to the processing that concerns him, which is carried out to fulfill a task carried out in the public interest or in the exercise of public authority entrusted to the AGENCY or for the purposes of legitimate interests pursued by the AGENCY or a third party, including objection to profiling, and no legitimate reasons prevail for processing,
• the person concerned objects to processing for direct marketing purposes,
• personal data were processed illegally,
• personal data must be deleted in order to fulfill a legal obligation under EU or Slovak law to which AGENCY is subject, or
• personal data were obtained in connection with the information company's offer of services addressed directly to the child. If the company AGENCY publishes personal data and is obliged to delete them according to paragraph 1, it is obliged, taking into account the available technology and costs, to take reasonable measures, including technical measures, to inform other operators who carry out the processing of personal data that the data subject requests them to delete all references to this personal data, its copy and replicas.
• Paragraphs 1 and 2 do not apply if the processing is necessary:
• to exercise the right to freedom of expression and the right to information,
• to fulfill a legal obligation that requires processing according to EU law or SR law to which the AGENCY is subject, or to fulfill a task carried out in the public interest or in the exercise of public authority entrusted to the AGENCY,
• for reasons of public interest in the field of public health in accordance with the GDPR,
• for the purposes of archiving in the public interest, for the purposes of scientific or historical research or for statistical purposes, if it is likely that the right referred to in paragraph 1 will make it impossible or seriously difficult to achieve the goals of such processing, or
• to demonstrate, exercise or defend legal claims.

Right to restriction of processing

• If the data subject requests it, he/she has the right to have the AGENCY company limit the processing in relation to one of the following cases:
• the person concerned contests the correctness of personal data during the period allowing the AGENCY to verify their correctness, the processing is illegal and the data subject objects to the erasure of personal data and requests a restriction of their use instead,
• AGENCY no longer needs personal data for processing purposes, but the data subject needs them to prove, exercise or defend legal claims,
• the person concerned has objected to the processing that concerns him, which is carried out to fulfill a task carried out in the public interest or in the exercise of public authority entrusted to the AGENCY or for the purposes of legitimate interests pursued by the AGENCY or a third party, including objection to profiling, and no legitimate reasons prevail for processing, until it is verified whether the legitimate reasons on the AGENCY's side prevail over the legitimate reasons of the person concerned.
• If the processing has been limited according to paragraph 1, such personal data, with the exception of storage, are processed only with the consent of the person concerned or to prove, exercise or defend legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the EU or the Slovak Republic .
• The AGENCY will inform the affected person who has reached the restriction of processing according to paragraph 1 before the restriction of processing is cancelled.

Notification obligation in connection with correction or deletion of personal data or restriction of their processing

• The AGENCY will notify each recipient to whom personal data has been provided of any correction or deletion of personal data or restriction of processing, if possible or if this does not require disproportionate effort. The AGENCY informs the affected person about these recipients, if the affected person requests it.

The right to portability of personal data

• Upon request, the affected person has the right to obtain from AGENCY personal data relating to him and provided by AGENCY in a structured, commonly used and machine-readable format and has the right to request AGENCY to transfer this personal data to another operator without AGENCY prevented from doing so if:
• the processing is based on consent, or if the processing is carried out within the framework of a contractual relationship with the person concerned, and
• if the processing is carried out by automated means.
• When exercising his right to the portability of personal data according to paragraph 1, the affected person has the right to transfer personal data directly from the AGENCY to another operator, as long as it is technically possible. Exercising the right referred to in paragraph 1 does not affect the right to delete the personal data of the person concerned. The said right does not apply to processing necessary to fulfill a task carried out in the public interest or in the exercise of public authority entrusted to the AGENCY.
• The right referred to in paragraph 1 must not have adverse consequences on the rights and freedoms of other persons.

The right to object

• If the affected person requests it from the AGENCY, he has the right to object, for reasons related to his specific situation, to the processing of personal data concerning him, which is carried out to fulfill a task carried out in the public interest or in the exercise of public authority entrusted to the AGENCY or for the purposes of legitimate interests. tracked by AGENCY or a third party, including objecting to profiling. The AGENCY will not further process personal data, unless it demonstrates necessary legitimate reasons for processing that outweigh the interests, rights and freedoms of the person concerned, or reasons for proving, exercising or defending legal claims.
• If the AGENCY processes personal data for the purposes of direct marketing, the data subject has the right to object at any time to the processing of personal data concerning him for the purposes of such marketing, including profiling to the extent that it is related to such direct marketing.
• If the data subject objects to processing for direct marketing purposes, personal data will no longer be processed for such purposes.
• The AGENCY expressly informs the person concerned of the right mentioned in paragraphs 1 and 2 at the latest during the first communication with him, while it is necessary that this right be presented clearly and separately from other information.
• In connection with the use of information society services, the data subject may exercise his right to object by automated means using technical specifications.
• If personal data is processed for the purposes of scientific or historical research or for statistical purposes, the data subject has the right to object, for reasons related to his specific situation, to the processing of personal data concerning him, with the exception of cases where the processing is necessary for the performance of a task from reasons of public interest.

Automated individual decision-making, including profiling

• If the data subject requests it, he/she has the right not to be subject to the decision of the AGENCY, which is based exclusively on automated processing, including profiling, and which has legal effects that concern him/her or similarly significantly affect him/her.
• Paragraph 1 does not apply if the decision is:
• necessary for the conclusion or performance of the contract between the person concerned and the AGENCY,
• permitted by EU law or SR law, to which the AGENCY is subject and which also stipulate measures guaranteeing the protection of the rights and freedoms and legitimate interests of the person concerned, or
• based on the express consent of the person concerned.
• In cases where the decision is necessary for the conclusion or performance of a contract between the person concerned and the AGENCY or is based on the express consent of the person concerned, the AGENCY will take measures to protect the rights and freedoms and legitimate interests of the person concerned, at least the right to human intervention by the AGENCY , the right to express your opinion and the right to challenge the decision.
• The decisions referred to in paragraph 2 are not based on special categories of personal data, unless exceptions to the prohibition of their processing apply, i.e.:
• the person concerned has expressed explicit consent to the processing of this personal data for one or more specified purposes, with the exception of cases where the law of the EU or the Slovak Republic stipulates that the person concerned cannot cancel the ban and
• processing is necessary for reasons of significant public interest on the basis of EU law or SR law, which are adequate in view of the objective pursued, respect the essence of the right to the protection of personal data and establish specific measures to ensure the fundamental rights and interests of the person concerned and appropriate measures are not in place to guarantee the rights and freedoms and legitimate interests of the person concerned.

Restrictions

• In the law of the EU or the law of the Slovak Republic, to which the AGENCY or the intermediary is subject, the scope of obligations and rights of the affected persons may be limited by means of a legislative measure, as long as its provisions correspond to the rights and obligations established in the GDPR, if such limitation respects the essence of fundamental rights and freedoms and is necessary and appropriate measures to ensure:
• national security, defense and public safety, prevention of criminal offences, their investigation, detection or prosecution or execution of criminal sanctions, including protection against threats to public security and its prevention,
• other important objectives of the general public interest of the EU or the Slovak Republic, in particular the subject of important economic or financial interest of the EU or a member state, including monetary, budgetary and tax matters, public health and social security,
• protection of the independence of the judiciary and judicial proceedings,
• prevention of violations of ethics for regulated professions, their investigation, detection and prosecution,
• monitoring, control or regulatory function associated, even occasionally, with the exercise of public authority,
• protection of the person concerned or the rights and freedoms of other persons,
• enforcement of civil claims.
• Specifically, each legislative measure referred to in paragraph 1 must contain special provisions that, in relevant cases, regulate at least:
• purposes of processing or categories of processing and categories of personal data, retention periods of personal data and applicable guarantees, taking into account the nature, extent and purposes of processing or categories of processing,
• the scope of established restrictions and guarantees preventing misuse of personal data or illegal access or transfer,
• determination of the operator or categories of operators,
• risks to the rights and freedoms of data subjects and the rights of data subjects to be informed about the restriction, unless the purpose of the restriction is jeopardized.

The right to file a complaint with a supervisory authority

• Without prejudice to any other administrative or judicial remedy, any affected person has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his habitual residence, place of work or place of alleged infringement, if he believes that the processing of personal data, which concerns her, is contrary to the applicable legal regulations.

The right to an effective judicial remedy against the AGENCY or the intermediary

• Without prejudice to any available administrative or extrajudicial remedy, including the right to file a complaint with a supervisory authority, each data subject has the right to an effective judicial remedy if he or she believes that the processing of his or her personal data in violation of applicable law has to the violation of her rights.

Representation of affected persons

• The person concerned has the right to entrust a non-profit entity, organization or association that has been duly established in accordance with the law of an EU member state, whose goals according to the statutes are in the public interest and which operate in the area of ​​protection of the rights and freedoms of the persons concerned, as regards the protection of their personal data, to file a complaint on her behalf, to exercise rights on her behalf under Articles 77, 78 and 79 GDPR and to exercise her right to compensation under Article 82 GDPR on her behalf, if permitted by the law of a Member State.

Right to damages and liability

• Any person (not only the affected person) who has suffered pecuniary or non-pecuniary damage as a result of a violation of the GDPR has the right to compensation from the AGENCY or an intermediary.
• The AGENCY that participated in the processing is responsible for the damage caused by the processing that was in violation of the GDPR. The intermediary is responsible for the damage caused by the processing, only if the obligations expressly imposed by the GDPR on the intermediary were not met, or if he acted beyond the scope or contrary to the instructions of the AGENCY, which were in accordance with the GDPR, the Personal Data Protection Act and special legal regulations of the Slovak Republic.
• AGENCY or an intermediary are exempted from liability according to paragraph 2 if it is proven that it bears no responsibility for the event that caused the damage.
• If more than one operator or intermediary participated in the same processing, or both the AGENCY and the intermediary together, and they are responsible for the damage caused by the processing according to paragraphs 2 and 3, each of them is responsible for the entire damage in order to ensure effective compensation for the affected person.

In Orechová Poton, May 25, 2018