Processing of personal data

Processing of personal data in accordance with the Regulation of the European Parliament and of the Council of the EU

Pursuant to Articles 13 to 22 of Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “General Data Protection Regulation” or “GDPR”) and the provisions of Section 19 et seq. of Act No 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (hereinafter referred to as the “Act on the Protection of Personal Data”). Pursuant to Article 13 of the General Data Protection Regulation or the provisions of Section 19 of the Personal Data Protection Act, the operator of the website: https://www.colormika.sk/ (hereinafter also referred to as the “controller”) is obliged to provide the following information to the data subject in cases where it obtains personal data concerning him or her:

I. Contact details of the operator

Commercial Register of the District Court of Nitra, Section: Sro, Insert No:48039/N

II. Purpose of the processing of personal data of the data subject

The personal data of the data subject shall be processed by the controller for this purpose:

  • for the purpose of further contact to the e-mail address entered via the contact form
  • for the purpose of sending advertising materials

III. Scope of processing of personal data of the data subject

For the above purpose, the controller processes the following personal data from the data subject knowingly:

  • Name
  • Last name
  • E-mail address
  • IP address

Personal data that the controller processes from the data subject unknowingly:

IV. Retention period of the data subject’s personal data

The personal data of the data subject shall be processed, collected, archived and stored securely for the period necessary for the purposes for which the personal data were processed or collected and the lawful reason for their possible archiving has passed or until the consent to the processing of the personal data of the data subject is valid. Upon the data subject’s request for erasure, all personal data will be irretrievably erased and the related orders (if any) will be anonymised.

V. Method of obtaining, recording and securing the personal data of the data subject

We most often obtain personal data directly from the data subject, for example by filling in a contact form. In this case, the collection of personal data is voluntary and does not constitute any contractual or legal obligation. The website operator is obliged to record all requests from users to download, correct and delete the personal data of the data subject. When securing the personal data of the data subject, the website operator has modern technical and security mechanisms in place to ensure the protection of the personal data processed against unauthorised access or transmission, against their loss or destruction, or against any other possible misuse. The controller does not transfer and does not intend to transfer the personal data of the data subject to a third country or an international organisation.

VI. Rights of the data subject regarding the processing of his/her personal data

The General Data Protection Regulation and the Data Protection Act set out the general conditions for the exercise of the individual rights of the data subject. However, this does not automatically imply that the exercise of individual rights will be granted by the controller, as exceptions may also apply in a particular case, or some rights are linked to specific conditions that may not be met in every case. A request concerning a specific right will always be dealt with and examined by the controller in the light of the legislation and the applicable exceptions.

i. With the consent of the data subject, the controller may also process other personal data of the data subject for purposes other than those referred to in point II., or other personal data than those necessary to achieve a specific purpose within the meaning of point III. Where the processing of personal data is subject to the consent of the data subject, the data subject shall have the right to withdraw his or her consent to the processing of personal data at any time. The data subject may or may not give the controller consent to the processing of personal data – failure to give consent shall not have any negative impact on the data subject. The withdrawal of the data subject’s consent to the processing of personal data relating to him or her shall not affect the lawfulness of the processing of personal data based on the consent prior to its withdrawal. The data subject may withdraw consent to the processing of personal data in the same way as he or she gave consent.

ii. The data subject shall have the right to ask the controller whether or not his or her personal data are being processed. The data subject shall have the right to require the controller to access the personal data concerning him or her. On the basis of this request, the controller shall issue the data subject with a confirmation containing information on the processing of his or her personal data. The controller shall be obliged to provide the data subject with the personal data it processes. The controller may charge a reasonable fee corresponding to the administrative costs for the repeated provision of the personal data requested by the data subject. The controller shall provide the personal data to the data subject in the manner requested by the data subject.

iii. The data subject has the right to have his or her personal data processed to be accurate, up-to-date and complete. If the personal data of the data subject are out of date, the data subject shall have the right to request the controller to rectify or supplement them. The data subject shall have the right to have inaccurate personal data concerning him or her rectified by the controller without undue delay. Having regard to the purpose of the processing of personal data, the data subject shall have the right to have incomplete personal data completed.

iv. The data subject shall have the right to object to the processing of his or her personal data as well as the right to request the controller to erase personal data that are processed unlawfully, beyond the purpose for which they were provided or if the data subject withdraws his or her consent.

v. The data subject shall have the right to object to processing of his or her personal data carried out on grounds of public interest or on the basis of the legitimate interests of the controller or of a third party, including profiling. The controller shall not further process the personal data unless it demonstrates compelling legitimate interests for the processing of the personal data which override the rights or interests of the data subject or grounds for exercising a legal claim.

vi. The data subject shall have the right to object to the processing of personal data concerning him or her for the purpose of direct marketing, including profiling to the extent that it is related to direct marketing. If the data subject objects to the processing of personal data for the purpose of direct marketing, the controller may no longer process the personal data for the purpose of direct marketing.

vii. The data subject shall have the right not to be subject to a decision based solely on automated processing of personal data, including profiling, concerning him or her or similarly significantly affecting him or her.

viii. The data subject shall have the right to have personal data concerning him or her erased by the controller without undue delay. The data subject shall have the right to request the controller to restrict the processing of the personal data where the data subject objects to the accuracy of the personal data during a period allowing the controller to verify the accuracy of the personal data, the processing of the personal data is unlawful and the data subject objects to the erasure of the personal data and requests instead that the use of the personal data be restricted, the controller no longer needs the personal data for the purpose of the processing of the personal data but the data subject needs the personal data for the establishment of a legal claim, or the data subject objects to the processing of the personal data on grounds of public interest or on the basis of the legitimate interests of the controller or of a third party, pending verification that the legitimate grounds on the part of the controller override those of the data subject.

ix. Where the processing of personal data has been restricted, except for storage, the controller may only process the personal data with the consent of the data subject or for the purpose of asserting a legal claim, for the protection of persons or for reasons of public interest. The controller shall inform the data subject whose processing of personal data is restricted before the restriction on the processing of personal data is lifted.

x. The data subject shall have the right to request the controller to provide his/her personal data in electronic form, which will enable the personal data of the data subject to be transferred to another company or to a third party. The data subject shall have the right to obtain the personal data concerning him or her which he or she has provided to the controller in a structured, commonly used and machine-readable format and shall have the right to transfer those personal data to another controller, if technically feasible and if the personal data are processed by the controller on the basis of the data subject’s consent or on the basis of a contractual relationship.

xi. The data subject shall have the right to file a petition to initiate a personal data protection proceeding, the purpose of which is to determine whether the rights of natural persons have been violated in the processing of their personal data or whether there has been a violation of the Personal Data Protection Act or a special regulation, and in the event of a finding of deficiencies, to impose, if it is reasonable and expedient, corrective measures or a fine for a violation of this Act or a special regulation in the area of personal data protection. Proceedings shall be initiated at the request of the data subject or of a person who claims to be directly affected in respect of his or her rights under this Act. The elements of the petition of the data subject or the person who claims to be directly affected by his/her rights provided for by this Act as well as the personal data protection procedure itself are regulated in the provisions of Section 100 of Act No. 18/2018 Coll. on the protection of personal data.

xii. Information provided by the controller on the basis of the exercised right of the data subject shall be provided free of charge. Where a request by a data subject is manifestly unfounded or disproportionate, in particular because of its repetitive nature, the controller may charge a reasonable fee taking into account the administrative costs of providing the information or refuse to act on the request.

The data subject may submit his or her request to exercise the data subject’s rights concerning the processing of his or her personal data, as described above, in writing by post or by e-mail, whereby the controller will deal with the data subject’s request and inform the data subject of the outcome in the same way as the request was made.

VI. Rights of the data subject regarding the processing of his/her personal data

Office for Personal Data Protection of the Slovak Republic
Hraničná 12
820 07, Bratislava 27
Slovak Republic
ID: 36064220
E-mail: statny.dozor@pdp.gov.sk

Scroll to Top