Personal data protection

Privacy Policy

When processing personal data by the Controller, you are a data subject — a person about whom personal data relating to you or your relationship to the Controller is being processed.

Privacy policy

Your personal data will be stored securely, in accordance with the Controller's security policy and only for the period necessary to fulfil the stated purpose or as required by law.

Your personal data will be backed up in accordance with the Controller's retention rules. Your personal data will be completely deleted from backups as soon as this is possible in accordance with backup rules.

Purposes of processing

The Controller processes personal data for the purposes set out below. For each purpose, the legal basis, categories of data, retention period, and recipients are listed.

01

Staff selection

Legal basis
  • Act No. 311/2001 Coll. The Labour Code as amended
  • Act No. 55/2017 Coll. on Civil Service
  • Act No. 552/2003 Coll. on the Performance of Work in the Public Interest
Data subjects
Jobseekers
Categories of data
  • Personal data provided in CV or cover letter
  • Personal data from criminal record extract
  • Proof of educational attainment
Retention period
10 years
Recipients
  • Office of the Government of the Slovak Republic
  • Employees
  • Intermediary for processing of personnel agenda
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
02

Fulfilment of employer's obligations – employment relationship

Legal basis
  • Act No. 311/2001 Coll. The Labour Code as amended
  • Contractual relationship
  • Article 9(2)(b) of the GDPR (special category data)
Data subjects
  • Jobseekers
  • Employees' spouses and dependent children
  • Parents of dependent children of employees
  • Former employees
Categories of data
  • Common personal data
  • Payroll data
  • Data on previous employment
  • Data on incapacity for work / health data (special category)
  • Data on important personal obstacles at work
Retention period
70 years
Recipients
  • Employees
  • Other authorised state authorities (based on legal obligation)
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
03

Fulfilment of employer's obligations – Social Insurance Agency

Legal basis
  • Act No. 461/2003 Coll. on Social Insurance
  • Act No. 43/2004 Coll. on Old-Age Pension Savings
  • Act No. 650/2004 Coll. on Supplementary Pension Savings
  • Act No. 462/2003 Coll. on Income Compensation
  • Article 9(2)(b) of the GDPR
Data subjects
  • Employees' spouses and dependent children
  • Parents of dependent children of employees, close persons
  • Former employees
Categories of data
  • Common personal data
  • Data on pension awards, employment contract with supplementary pension company
  • Data on maternity and parental leave
  • Data on incapacity for work / health (special category)
Retention period
10 years
Recipients
  • Social Insurance Agency
  • Employees
  • Intermediary for processing of personnel agenda and payroll
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
04

Promotion of the operator

Legal basis
Consent of the data subject pursuant to Article 6(1)(a) of the GDPR
Data subjects
  • Employees of the operator
  • Public
Categories of data
  • Name and surname
  • Job title
  • Photograph (colour or black and white)
  • Video
Retention period
2 years after the purpose of processing has been fulfilled
Recipients
Authorised employees
Third countries
Cross-border processing may take place given the use of social media technology
Security measures
Operator's safety documentation
05

Fulfilment of employer's obligations – Health Insurance Company

Legal basis
Act No. 580/2004 Coll. on Health Insurance as amended
Data subjects
Staff, spouses and dependent children of staff, parents of dependent children, close persons, former staff
Categories of data
Common personal data
Retention period
10 years
Recipients
  • Health insurance companies
  • Employees
  • Intermediary for processing of personnel agenda and payroll
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
06

Occupational Health and Safety (OHS)

Legal basis
  • Act No. 124/2006 Coll. on Occupational Health and Safety
  • Act No. 355/2007 Coll. on the Protection of Public Health
  • Article 9(2)(b) of the GDPR
Data subjects
Employees
Categories of data
  • Common personal data
  • Health data in registration of accidents at work
Retention period
  • 5 years after termination of the obligation
  • Medical opinions on fitness for work: until termination
Recipients
  • Intermediary for OHS agenda, training entities
  • Authorised employees
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
07

Compliance with tax obligations

Legal basis
  • Act No. 595/2003 Coll. on Income Tax
  • Act No. 222/2004 Coll. on Value Added Tax
  • Act No. 563/2009 Coll. on Tax Administration
Data subjects
Employees
Categories of data
  • Common personal data
  • Income data
Retention period
10 years
Recipients
Tax authorities / Tax administrators
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
08

Employer's wage policy

Legal basis
  • Act No. 311/2001 Coll. Labour Code
  • Act No. 461/2003 Coll. on Social Insurance
  • Act No. 580/2004 Coll. on Health Insurance
  • Act No. 595/2003 Coll. on Income Tax
  • Contractual relationship / Collective agreement
  • Article 9(2)(b) of the GDPR
Data subjects
Employees, dependent children of employees, former employees
Categories of data
  • Common personal data
  • Salary and financial requirements for performance
  • Marital status, permanent and temporary residence
Retention period
50 years
Recipients
  • Health insurance companies, Social Insurance Agency, tax office, DDS
  • Intermediary for personnel agenda and payroll
  • Authorised employees
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
09

Employee business card agenda

Legal basis
Legitimate interest of the controller as employer — Article 6(1)(f) of the GDPR
Data subjects
Employees
Categories of data
Title, name, surname, job title, functional classification, personal number, professional email, phone number
Retention period
Termination of employment
Recipients
Authorised employees
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
10

Management of economic and accounting agenda

Legal basis
  • Act No. 431/2002 Coll. on Accounting
  • Act No. 222/2004 Coll. on Value Added Tax
  • Act No. 55/2017 Coll. on Civil Service
Data subjects
Employees; Suppliers, customers and their representatives; Clients
Categories of data
  • Common and contact personal data
  • Accounting and economic personal data
Retention period
10 years after the year to which the documents relate
Recipients
  • Authorised employees
  • Competent state and public administration bodies
  • Bookkeeping intermediary / Auditor
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
11

Management of legal agenda

Legal basis
Legitimate interest of the operator — Article 6(1)(f) of the GDPR (proving and exercising legal claims)
Data subjects
Employees, suppliers, customers, representatives of suppliers and customers
Categories of data
Common, contact and identification personal data
Retention period
During the duration of litigation / out-of-court settlement, until extinction of the claim
Recipients
External debt collection collaborators, lawyer/advocate, authorised staff, judicial bodies
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
12

Provision of services – contractual obligations

Legal basis
Service Agreement
Data subjects
Contracting Parties
Categories of data
Common, contact and identification personal data; personal data contained in the contract
Retention period
3 years from the termination of the contract
Recipients
Debt collection collaborators, lawyer/advocate, authorised employees, judicial bodies
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
13

Management of supplier–customer relationships – self-employed

Legal basis
Contract for the provision of services or similar contractual relationship
Data subjects
Contracting parties – suppliers, customers as self-employed persons
Categories of data
Common, contact and identification personal data; personal data contained in the contract
Retention period
3 years from the termination of the contract
Recipients
Debt collection collaborators, lawyer/advocate, authorised employees, judicial bodies
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
14

Records of representatives of suppliers and customers

Legal basis
Legitimate interest — Article 6(1)(f) of the GDPR (securing contacts within business relationships)
Data subjects
Representatives of suppliers and customers
Categories of data
Contact and identification personal data
Retention period
3 years from the end of the supplier or customer relationship
Recipients
Authorised employees
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
15

Exercise of rights of data subjects

Legal basis
  • GDPR Regulation
  • Act No. 18/2018 on the protection of personal data
Data subjects
All data subjects who have exercised their rights
Categories of data
Contact and identification personal data; content of the exercise of the data subject's right
Retention period
5 years from the handling of the complaint
Recipients
  • Authorised employees
  • Office for Personal Data Protection
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
16

Register of shareholders of a joint-stock company

Legal basis
§ 156 and § 156a of Act No. 513/1991 Coll. Commercial Code as amended
Data subjects
Shareholders of the company
Categories of data
Numerical designation of the share, its type and nominal value; name, place of residence and birth number of natural person shareholders
Retention period
Duration of shareholder status
Recipients
  • Delegated Members/Staff
  • Intermediary for personnel and accounting agenda
  • Central Securities Depository
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
17

Register of members of the Supervisory Board

Legal basis
Act No. 513/1991 Coll., Commercial Code as amended
Data subjects
Members of the Supervisory Board
Categories of data
Personal data of current and former members of the Supervisory Board
Retention period
4 years from the date of termination of the member's participation
Recipients
  • Judicial authorities
  • Bodies of state administration and public authorities
  • Lawyer / Auditor
  • Partners and statutory bodies of the company
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
18

Protection against money laundering and terrorist financing

Legal basis
Act No. 297/2008 Coll. on the Protection against Money Laundering and Terrorist Financing
Data subjects
Client of the obliged entity; ultimate beneficial owner of the client
Categories of data
  • Identification data (name, surname, date of birth, address, ID document)
  • Data for verification of identification
  • Information on the purpose and nature of the transaction
  • Information on politically exposed persons or sanctioned persons
  • Data on the origin of funds or assets
  • Ongoing monitoring data
Retention period
5 years from the termination of the contractual relationship or execution of an occasional transaction
Recipients
  • Delegated Members/Staff
  • Financial Intelligence Unit
  • Intermediary providing AML software solution
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
19

Managing account of a registered website participant

Legal basis
Consent of the data subject
Data subjects
Registered customer
Categories of data
Identification data, contact personal data
Retention period
4 years
Recipients
  • Delegated Members/Staff
  • IT Technician
  • Intermediary for operation and support of the website
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
20

Management of the complaint procedure

Legal basis
  • Act No. 40/1964 Coll., the Civil Code
  • Act No. 513/1991 Coll., the Commercial Code
  • Contract
Data subjects
Data subject claiming defect(s) of goods and/or services from the controller
Categories of data
Identification data, contact personal data
Retention period
4 years
Recipients
  • Delegated Members/Staff
  • IT Technician
Third countries
The transfer to a third country does not take place
Security measures
Operator's safety documentation
21

Awareness of business activities online (social networks and website)

Legal basis
  • Legitimate interest in raising awareness — Article 6(1)(f) of the GDPR
  • Or: Consent of the data subject
Data subjects
  • Client, potential client
  • Suppliers / customers and potential suppliers / customers
Categories of data
Identification data, contact personal data
Retention period
2 years from the last supply of services or from the date of consent
Recipients
Delegated Members/Staff
Third countries
In connection with Facebook, personal data may be transferred to third countries. Meta Platforms Inc. is certified under the EU-U.S. Data Privacy Framework.
Security measures
Operator's safety documentation
22

Promotion via photo/video documentation of events

Legal basis
Legitimate interest — Article 6(1)(f) of the GDPR (promoting activities of the operator)
Data subjects
The public present at the event
Categories of data
Photograph and/or video of the data subject
Retention period
3 years from the date of execution
Recipients
Delegated Members/Staff
Third countries
Cross-border processing may take place given the use of social media technology
Security measures
Operator's safety documentation
23

Telephone, email and online customer support

Legal basis
  • Customer Contract
  • Consent of the data subject
Data subjects
Operator's customers
Categories of data
Identification and contact personal data

Contact information

To exercise your rights as a data subject, or for any questions about the processing of your personal data, please contact us:

Digital Systems a.s.

Údernícka 5, 851 01 Bratislava 5, Slovak Republic

Website: https://www.digitalsystems.eu

Email: gdpr@digitalsystems.eu