Personal data protection policy

Information on the processing of personal data

Personal data of affected persons (customers, possibly also other cooperating persons) are processed in accordance with legal regulations regarding the protection of personal data. It is primarily a regulation of the European Parliament and the Council (EU) no. 2016/679 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (general regulation on data protection), as amended (hereinafter referred to as “GDPR” or “Regulation”) and further Act No. 18/2018 Coll. on the protection of personal data and on the amendment of certain laws as amended (hereinafter referred to as “the law”).

This information does not apply to the data of legal entities, including the name, legal form and contact data of the legal entity.

The following text contains information on the method, scope, purpose, legal basis, processing time, recipients of your personal data and your related rights and their protection according to Art. 13 to 22 of the Regulations.

I. Basic provisions

1. The operator of personal data according to § 5 letter o) Act no. 18/2018 Coll. on the protection of personal data as amended (hereinafter referred to as the “Act”) is SZČO Ing. Ján Haško, PhD. – JH engineering, with registered office at Kollárova 756/7, 962 63 Pliešovce, Slovak Republic, ID: 40 242 862, Tax ID: 1026028652 (hereinafter: “operator”).
2. The contact details of the operator for any requests, complaints, comments and questions are:

– address:  Ing. Ján Haško, PhD. – JH engineering, Kollárova 756/7, 962 63 Pliešovce

– e-mail: jan.hasko@jhengineering.sk

3. Personal data means all information about an identified or identifiable natural person. An identifiable natural person is a natural person who can be directly or indirectly identified, in particular by reference to a certain identifier, for example name, identification number, location data, network identifier or by reference to one or more special elements of physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person. The use of personal data should be adequate, relevant and limited to the extent that is necessary in view of the purposes for which they are processed.
4. The operator has not appointed a responsible person for the protection of personal data.

II. Sources and categories of processed personal data

The personal data that the operator processes about you comes from the following sources:

1. you yourself provided the data to the operator primarily in connection with the conclusion of the contract or as part of consent to the processing of personal data;
2. the data comes from public sources, lists and records.

III. Legal basis and purpose of personal data processing

1. The legal basis for processing personal data is one or more of the following facts:

• performance of the contract between you and the operator or implementation of measures by the operator before the conclusion of the contract in accordance with Art. 6 par. 1 letter b) Regulations (according to § 13 paragraph 1 letter b) of the Act);
• fulfillment of legal obligations that apply to the operator according to Art. 6 par. 1 letter c) Instructions, specifically:
  • settlement of complaints according to Act no. 40/1964 Coll. of the Civil Code and Act No. 250/2007 Coll. on consumer protection;
  • fulfillment of other obligations imposed on the operator by other generally binding legal regulations.
• legitimate interest of the operator according to Art. 6 par. 1 letter f) Regulations (according to § 13 paragraph 1 letter f) of the Act) consisting of:
  • in dealing with questions, complaints or requests of customers – affected persons;
  • in the development and support of the operator’s own business activity e.g. in the form of sending electronic marketing announcements, etc.
• your consent to processing according to Art. 6 par. 1 letter a) Regulations (according to § 13 paragraph 1 letter a) of the Act):
  • consent to the processing of personal data for the purpose of offering engineering services and professional training, including sending information about organized events and other activities of the operator, as well as sending other business notifications of the operator. In the case of minors under the age of 16, it is necessary to the consent to the processing of personal data, also attach the approval of the granting of consent by the minor’s legal representative.

2. The purpose of personal data processing is:
   • Primary fulfillment of the contract concluded between you and the operator i.e. exercise of rights and obligations arising from the contract between you and the operator, including registration of the customer in the operator’s system, delivery of the product, service (collectively hereinafter also “operator’s products”), including possible subsequent resolution of rights from defective performance or responsibility for defects, issuance of a certificate of completion of professional training, further implementation of measures by the operator before the conclusion of such a contract as well as the fulfillment of related obligations by the operator. You are not obliged to provide personal data. The provision of your personal data is, however, a necessary requirement for the conclusion of the contract with the operator and for its fulfillment i.e. without their provision it is not possible to conclude the contract or fulfill it on the part of the operator.
   • For the purposes of implementing the contract, the operator processes personal data to a maximum of the following extent: title, first and last name, job position, name and address of employer, date and place of birth, gender, permanent residence, temporary residence, service delivery address (for services delivered at the customer’s premises), billing address, bank connection (bank account number, credit card number and designation), e-mail and telephone number. Without providing contact data, it is not possible to conclude a contract or fulfill it on the part of the operator. In this context, the operator may further process data on the customer’s business activity for the purpose of its legitimate interest.
   • For the purpose of dealing with customer requests, complaints or questions (depending on their form and content), the operator processes the customer’s contact data (e-mail, phone number), additional identification data (name, surname, residence address) and the content of mutual communication.
   • For the purpose of sending electronic notifications, the operator processes the customer’s contact data (e-mail, phone number).
   • The operator processes personal data automatically in information systems as well as manually. The operator does not use the above-mentioned data to make decisions exclusively on the basis of automated processing, including profiling in accordance with Art. 22 par. 2 Regulations.

IV. Provision of your personal data outside the European Union

Personal data are not transferred to a third country or international organization.

V. Use of your personal data for automated individual decision-making

Personal data will not be used for automated individual decision-making, including profiling.

VI. Recipients of personal data (subcontractors of the operator)

1. Recipients of personal data in justified cases and only to the extent necessary may be persons:
   • persons participating in the delivery of the operator’s products on the basis of the contract (subcontractors);
   • other entities in cases where the provision of such data to the operator is imposed by generally binding legal regulations or if it is necessary to protect the legitimate interests of the operator (for example by the court, the Slovak Police, etc.).
2. The operator does not intend to transfer personal data to a third country (a country outside the EU) or an international organization.

VII. Period of storage of personal data

1. The operator stores personal data:
   • For the period necessary to exercise the rights and obligations arising from the contractual relationship between the customer and the operator and the application of claims from these contractual relationships. After this period, the operator will dispose of your personal data, unless it is authorized/obliged to process this data on the basis of another legal title. Your personal data will be processed by the operator in the same way for the duration of possible court cases.
   • For the period before the consent to the processing of personal data for the purpose of sending electronic or paper marketing notifications is revoked, i.e. the longest within 3 years from the provision of consent, if the data are processed on the basis of consent.
2. Documents containing your personal data will be archived by the operator in cases where it is required by a generally binding regulation for the prescribed period.
3. After the personal data storage period has expired, the operator will dispose your personal data, unless it is authorized/obliged to process this data on the basis of another legal title.

VIII. Terms of security of personal data

1. The operator declares that he has taken all appropriate technical and organizational measures to secure personal data. Your personal data will be stored securely and only for the time necessary to fulfill the purpose of processing.
2. The operator has taken technical measures to secure data storage, in particular by securing access to computers with a password, using an antivirus program and regular maintenance of computers, as technical measures to secure the object/s in which your personal data are stored.
3. The operator ensures data backup in accordance with the security requirements of Act no. 18/2018 Coll. on the protection of personal data and on the amendment of certain laws and Regulation of the European Parliament and of the Council (EU) 2016/679. Your personal data will be completely deleted from the backup storage as soon as it is possible in accordance with the backup rules. Personal data stored on backup storages serves to prevent security incidents, in particular disruption of data availability as a result of a security incident.
4. The operator declares that only persons authorized by the operator to process personal data, who process them on the basis of the operator’s instructions, and possibly other persons from the operator’s supplier group, have access to personal data.

IX. The rights of the person concerned:

1. Withdraw consent – in cases where your personal data are processed on the basis of your consent, you have the right to withdraw this consent at any time. You can withdraw your consent electronically, at the address of the operator, in writing, with a notice of withdrawal of consent or in person at the operator. Withdrawal of consent does not affect the legality of the processing of personal data that was processed about you on its basis.
2. Right of access – you have the right to provide a copy of the personal data that the operator has about you, as well as information about how your personal data are used. In most cases, your personal data will be provided to you in written document form, unless you request another way of providing them. If you have requested the provision of this information by electronic means, it will be provided to you electronically if it is technically possible.
3. Right to rectification – appropriate measures are taken to ensure the accuracy, completeness and timeliness of the information available to the operator about you. If you believe that the data held by the operator are inaccurate, incomplete or out of date, please do not hesitate to submit a request to modify, update or supplement this information.
4. The right to deletion (to be forgotten) – you have the right to ask the operator to delete your personal data if any of the following situations occur:
   • personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
   • you have revoked the consent on the basis of which your personal data were processed and there is no other legal reason for their processing;
   • you have objected to being the subject of a decision based on the automated processing of your personal data and there are no overriding legitimate reasons for such processing or you have objected to the processing of your personal data for the purpose of sending electronic or paper marketing notifications i.e. offering business and services, including sending information about organized actions, products and other activities of the operator, as well as sending other business announcements of the operator;
   • your personal data was processed illegally;
   • your personal data must be deleted in order to fulfill a legal obligation established by the law of the European Union or a member state that applies to the operator;
   • your personal data was collected in connection with and offering the services of the information company.
5. The right to limit processing – under certain circumstances, you are entitled to ask the operator to terminate the use of your personal data. These are cases where any of the following situations occur:
   • you denied the accuracy of your personal data, for the time necessary for the operator to verify the accuracy of the personal data;
   • the processing of your personal data is illegal, but you refuse the deletion of this data and instead request the restriction of its use;
   • the operator no longer needs the personal data for processing purposes, but you require them for the determination, exercise or defense of legal claims;
   • you have objected to the processing of your personal data according to Article 21 paragraph 1 of the Regulation, until it is verified whether the legitimate reasons of the operator prevail over your legitimate reasons.
6. The right to data portability – under certain circumstances, you have the right to ask the operator to transfer the personal data you have provided to another third party of your choice. However, the right to portability only applies to personal data that the operator has obtained from you on the basis of consent or on the basis of a contract to which you are one of the contracting parties.
7. The right to object – you have the right to object to data processing based on the legitimate interests of the operator. In the event that the operator does not have a convincing legitimate reason for processing and you file an objection, the operator will not process your personal data further.
8. The right to be informed – you have the right to be informed by the operator in the event that there has been a breach of the security of your personal data, when it is likely that this case will result in a high risk for the rights and freedoms of natural persons, including you.
9. Right in relation to automated processing – you have the right not to be the subject of a decision based solely on automated processing, including profiling, which has legal effects for you or significantly affects you in a similar way.
10. The right to submit a proposal to initiate proceedings on the protection of personal data – if you believe that the operator processes your personal data unfairly or illegally, you can file a complaint with the supervisory authority, which is the Office for the Protection of Personal Data of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; tel. number: +421 /2/ 3231 3214; e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk. In the case of submission of the proposal in electronic form, it is necessary that it fulfills the requirements according to § 19 par. 1 of Act no. 71/1967 Coll. on administrative procedure (administrative order).

X. Final provisions:

1. By concluding a contract with the operator or by performing actions that lead to the conclusion of a contract with the operator, you confirm that you are familiar with the terms of personal data protection and that you accept them in their entirety.
2. You agree to these conditions by ticking the consent to the processing of personal data through an internet form. By ticking the consent box, you confirm that you accept the terms of personal data protection in their entirety.
3. The operator is entitled to change these conditions. The new version of the terms of personal data protection will be published on the website of the operator and at the same time the operator will inform you about the new version of these terms by sending a notification to your e-mail address that you provided.

These conditions entered into force on 10/24/2023.