Personal data processing policy and data protection system under the GDPR

This English version is provided for information only. The Slovak version is legally binding.

prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, in particular Articles 13 and 14 (the “GDPR”), and Slovak Act No. 18/2018 Coll. on the protection of personal data (the “Personal Data Protection Act”)

The Controller is not obliged to appoint a data protection officer.

Basic terms

Personal data means any information relating to an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to a generally applicable identifier, another identifier such as a name, surname, identification number, location data or online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Processing of personal data means any operation or set of operations performed on personal data or on sets of personal data, in particular collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure, whether or not by automated means.

Data subject means any natural person whose personal data are processed.

Controller means anyone who alone or jointly with others determines the purposes and means of the processing of personal data and processes personal data in their own name.

Processor means anyone who processes personal data on behalf of the controller.

Recipient means anyone to whom personal data are disclosed, whether a third party or not.

Data protection officer means a person designated by the controller or processor who performs the tasks under this Act.

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Filing system means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Purposes, legal bases and processing activities

The Controller processes personal data for the following purposes within the scope of its business and administration:

Processing for the performance of a contract (Art. 6(1)(b) GDPR)

• Concluding employment contracts and agreements with employees.
• Preparing price quotations and processing received orders.
• Preparing lease agreements, handing over premises in the industrial park and billing utilities directly to natural persons – entrepreneurs.
• Allocating reserved parking spaces to tenants under a contract.
• Ensuring the smooth running of warehouse processes, recording receipt, storage and dispatch of goods for contractual clients.

Processing based on legitimate interest (Art. 6(1)(f) GDPR)

• Operating a CCTV system and controlling access to buildings.
• Processing data of tenants’ (companies’) contact persons for the purposes of preparing contracts, communication and billing.
• Managing vehicle access and checking the authorisation of external vehicles entering the site.
• Identifying drivers and couriers (third parties) to ensure and demonstrate smooth and safe logistics processes.

Processing based on a legal obligation (Art. 6(1)(c) GDPR)

• Calculating wages, processing contributions and keeping mandatory attendance records.
• Processing invoices and tax returns and fulfilling related accounting obligations.
• Keeping statutory records of mandatory training and technical inspections.
• Managing the document archive and controlled disposal (shredding).

Processing based on consent (Art. 6(1)(a) GDPR)

• Use of tracking cookies on the website.

Retention period

We keep personal data only for as long as necessary to fulfil the purpose, in accordance with legislation and our internal records retention plan:

10 years

Accounting documents and invoices (rent, utilities, services).

50 years

Payroll records and pension documentation.

Until the employee reaches 70 years of age

Personnel files and employment contracts.

Duration of the contract + 5 years

Commercial and lease agreements including handover protocols (due to limitation periods).

5 years

Logistics and warehouse records (delivery notes, CMR, warehouse records).

Duration of the relationship (max. 1 year for visitors)

Records of vehicles, parking and access chips.

Duration of employment (accidents 5 to 10 years)

Records of health and safety and fire protection training and occupational accidents.

20 days

CCTV recordings (longer only when investigating a security incident).

Until consent is withdrawn (max. 1 to 2 years)

Marketing data and website cookies on laraservis.sk.

Recipients of personal data

We provide personal data only to the extent necessary to the following categories of recipients:

Public authorities and bodies authorised by law

Processors (external contractual partners):

• External payroll, tax and invoicing services.
• Health and safety, fire protection and technical inspection services.
• IT provider.
• Management of the CCTV system and electronic access control to the site.

Automated decision-making

The Controller does not carry out automated individual decision-making or profiling within the meaning of Article 22 GDPR.

Cross-border transfer

Personal data are not transferred to third countries as part of the main activities. When using selected digital services (e.g. analytics tools, cloud services), data are transferred only where the conditions of the GDPR are met and appropriate safeguards are in place (e.g. standard contractual clauses).

Security of personal data

The Controller declares that it has adopted appropriate personnel, technical and organisational measures to protect personal data.

The Controller has adopted technical measures to secure data storage and storage of personal data in paper form.

The Controller declares that only persons authorised by it have access to personal data.

Your rights

Right of access

You have the right to know whether we process your personal data. If we do, you may ask us for access to them. On request, we will issue a confirmation with information about the processing of your personal data.

Right to rectification

You have the right for the personal data we process to be accurate, complete and up to date. If your personal data are inaccurate or out of date, you may ask us to correct or complete them.

Right to erasure (“right to be forgotten”)

In certain circumstances you have the right for us to erase your personal data. You may ask us to erase your data at any time. We will erase your personal data if:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• the data subject withdraws consent where the processing is based on consent;
• the data subject objects to the processing;
• the personal data have been processed unlawfully;
• the personal data must be erased to comply with a legal obligation;
• you are a child, or the parent of a child, who consented to the processing of personal data online.

Right to restriction of processing

You may ask us to restrict the processing of your personal data. If we grant your request, we will only store your personal data and will not process them further. Processing of your data will be restricted if:

• you inform us that your personal data are inaccurate, until we verify their accuracy;
• we process your personal data unlawfully, but you oppose their erasure and request restriction of processing instead;
• we no longer need your data, but you need them to establish, exercise or defend your legal claims;
• you object to the processing of your personal data, until we verify whether our legitimate interests override your grounds.

Right to data portability

You have the right to ask us to provide your personal data in electronic form (e.g. an XML or CSV file) that allows you to easily transfer them to another company. You may also ask us to transfer your personal data directly to a company of your choice. We will grant your request if you provided the personal data to us directly and consented to their processing.

Right to object

You have the right to object to our processing of your personal data. If we process your personal data in the following cases:

• on the basis of our legitimate interest,
• to create a customer profile,
• you may object to the processing if you have personal reasons for doing so.

Right not to be subject to automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

Your right includes:

• the right to obtain human intervention on the part of the controller
• the right to express your point of view
• the right to contest the decision

Exceptions to this right are possible if the decision is:

• necessary for entering into or performing a contract
• authorised by Union or Member State law
• based on explicit consent

Right to withdraw consent

If the controller processes your personal data on the basis of consent or explicit consent, you have the right to withdraw that consent at any time.

Right to lodge a complaint

If you believe that your right to the protection of personal data has been infringed, you may lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic: https://dataprotection.gov.sk.

How can you exercise these rights?

You can contact us with your request in any of the following ways:

• by e-mail: j.chladecky@laraservis.sk
• by phone: +421903383772
• or by post to: Ľudovíta Čuláka 8, 949 01 Nitra, Slovakia

This Privacy Policy takes effect upon its publication on the Website.