GDPR - data protection
GDPR
Procedure for processing personal data
This document describes the method and purpose of processing personal data of the operator Zeter, p. r. o., Kalištná 21, 841 07 Bratislava, ID: 46909028 (hereinafter referred to as the "Operator") and also provides any other information required by law, including information about the rights of the data subject and how to exercise them. Law no. 18/2018 Coll. The Act on the Protection of Personal Data and on Amendments to Certain Acts as well as Regulation (EU) 2016/679 on the Protection of Personal Data (hereinafter referred to as the "Regulation") constitutes a legal regulation on the protection of natural persons in the processing of personal data and on the free movement of such data and protects basic rights and freedoms of natural persons, especially in relation to the right to the protection of personal data. According to Article 4 (1) of the Regulation, the term "personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"). "Processing" is an operation or set of operations on personal data or sets of personal data, whether carried out by aed or non-aed means, such as obtaining, recording, organizing, structuring, storing, processing or changing, searching, viewing, using, providing by transmission, dissemination or otherwise providing, rearranging or combining, limiting, erasing or disposal (Article 4(2) of the Regulation). According to Article 12 et seq. Regulations, the person concerned must also be provided with relevant information about the processing activities of the operator and about the rights of the person concerned. "Validity" due to the fact that the information on the processing of personal data contained in this Policy may be required to be updated in the future, the Operator is entitled to update this Policy at any time. This version of the statement was issued on March 1, 2022. 1. ON WHAT BASIS CAN WE PROCESS YOUR PERSONAL DATA? Processing is lawful only if and only to the extent that at least one of the following conditions is met: The person concerned has expressed his consent to the processing of his personal data for one or more specific purposes. Processing is necessary for the performance of a contract to which the data subject is a party, or to take measures prior to the conclusion of the contract based on the data subject's request. Processing is necessary to fulfill a legal obligation. Processing is necessary for the purposes of legitimate interests pursued by the operator or a third party, with the exception of cases where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, especially if the data subject is a child.
2. WHAT IF PERSONAL DATA IS NOT PROVIDED? The operator, who determines the conditions and method of processing personal data, will not request any personal data from the person concerned that (after careful consideration and assessment of the legal basis) is not absolutely necessary. Therefore, in the event that the personal data of the persons concerned are processed: • on the basis of a legal obligation (Article 6, paragraph 1, letter c) of the GDPR Regulation), the person concerned is obliged to provide personal data to the operator. If, despite this, the affected person does not provide his personal data, the operator will not be able to fulfill his obligations arising from special legal regulations and the affected person will (may) commit a violation of the provisions of the relevant legal regulation, which may cause a refusal to provide a service or sell goods. • based on the contract with the data subject (Article 6, paragraph 1, letter b) of the GDPR Regulation), the provision of personal data is a contractual requirement. If the person concerned does not provide his personal data, the operator will not be able to enter into a contractual relationship with him or, based on his request, will not be able to take measures before concluding the contract. • on the basis of consent to the processing of personal data granted by the person concerned (Article 6, paragraph 1, letter a) of the GDPR Regulation), the provision of personal data is voluntary and is an expression of the free will of the person concerned. If the person concerned does not provide his personal data, the operator will not be authorized to process the data for the purposes defined in the specific consent, which may prevent him from providing the person concerned with the activities or activities described in the consent. (The person concerned is entitled to withdraw the granted consent at any time.) • based on the legitimate interests of the operator or the legitimate interests of a third party (Article 6, paragraph 1, letter f) of the GDPR Regulation), the personal data of the affected persons are processed even without their prior consent. Affected persons must be informed in advance about the legitimate interests of the operator. Affected persons have the right to object to processing. (The affected person has the right to object at any time to the processing of personal data concerning him, which is carried out on the basis of the legitimate interests of the Operator. The operator to whom the objection of the affected person was addressed will not further process personal data, unless he proves the necessary legitimate reasons for the processing that prevail over the interests, rights and freedoms of the person concerned, or reasons for proving, exercising or defending legal claims.)
3. PERSONAL DATA PROCESSING PRINCIPLES Compliance with the principles of processing personal data of customers according to Art. 5 Regulations. • Legality of processing – every processing must be legal, so we have an adequate legal basis. • Minimization of OU processing (necessity) – we only process your personal data to the extent necessary in relation to the purpose. We will always consider the scope of personal data processing. • Minimizing the storage of personal data (disposal) - we store it in a form that allows identification of the DO as long as it is necessary for the purposes. Your personal data is carefully disposed of after the purpose of processing has been fulfilled. • Integrity and confidentiality (security) – the operator has taken technical, organizational and personnel measures against loss, destruction, damage to OU.
4. WE OBTAIN YOUR PERSONAL DATA You will most often provide us with your personal data: • We receive primarily directly from you, for example from communication with you via the contact form on our website. • If you are in the position of our client, or Those interested in signing up for a driving course.
5. WHAT IS THE PURPOSE OF PERSONAL DATA PROCESSING, THE LEGAL BASIS OF THE PROCESSING ACTIVITY, FOR HOW LONG DO WE STORE YOUR PERSONAL DATA? Your personal data will be processed on the basis of special legal regulations and purposes set by the operator. These are listed individually in the INFORMATION ON PURPOSES OF PROCESSING: Name of processing operation Purpose of processing personal data Category of personal data Legal title of processing Data storage period Other recipients Application for a driving course • • taking a driver's license course and the applicant must meet the age limit, the applicant can register for the course no earlier than 2 months before reaching the age limit ordinary personal data, other data necessary to verify the initiative fulfillment of pre-contractual relations 10 years after the end of the course state administration, public authority and public administration bodies according to relevant legal regulations. JISCD, Application for the granting of a driver's license • completion of a driver's license course and the applicant must meet the age restriction, the applicant can register for the course at least 2 months before reaching the age limit general personal data, other data necessary to verify the initiative, legal representative fulfillment of pre-contractual relationships until termination course max 2 years state administration bodies, public authority and public administration according to relevant legal regulations. JISCD, Confirmation of the result of the medical examination the purpose of processing personal data is whether the applicant is fit to drive a motor vehicle ordinary personal data, fit without restrictions, not fit, fit with conditions legal obligation of the operator until the end of the course max 2 years bodies of state administration, public authority and public administration according to the relevant legal regulations Refresher courses courses that are ordered to the holder of a driving license by the traffic inspectorate in the event that in the last 12 months as a driver of a motor vehicle he has seriously violated the rules of the road three times general personal data, contractual relationship - performance of the contract until the end of the course max 2 years state authorities administration, public power and public administration according to relevant legal regulations. Individual course the individual course is primarily intended for people who are busy with time and cannot afford to participate in classes at a standard pace with a group, common personal data, other data necessary to verify the initiative, contractual relationship - performance of the contract until the end of the course, max. 2 years, the data is no further provided Fitness driving practical training in driving a motor vehicle for those who already hold a driver's license. - haven't driven at all for a long time, don't drive regularly and want to maintain their driving skills, want to improve their driving skills common personal data, other data necessary to verify the initiative contractual relationship - fulfillment of the contract until the end of the course max 2 years state administration, public authority and public authorities reports according to the relevant legal regulations. Dealing with customer questions, providing information to clients, title, name, surname, e-mail, telephone, fulfilling pre-contractual relationships until the end of the course, max. 2 years, data is not provided further Payroll and personnel agenda complete information about employees required by law as well as information about salary, vacation, health. state name, surname, title, place of residence, document number identities, attendance, information for salary calculation, information on birth. members, the legal obligation of the operator max. 50 years in case of inspection of the Social Insurance Company, FR SR, health insurance companies Registry administration is the provision of registration, creation, and storage protection of registry records, access to them and ensuring their disposal ordinary personal data legal obligation of the operator 10 years after the end of registration Ministry of the Interior of the Slovak Republic, other authorized entity Records of the rights of the affected persons handling requests of natural persons aimed at exercising their rights title, name, surname, address and other personal data to which the applied right of the affected person applies legal obligation of the operator 5 years from the date of processing the request bodies of state administration, public authority and public reports according to the relevant legal regulations Dealing with the complaint of the persons affected by the processing is a submission by a natural or legal person seeking protection of their rights or interests protected by law which they believe have been violated ordinary personal data, other data necessary to verify the initiative legal obligation of the operator 5 years after termination or termination obligations of state administration bodies, public authorities and public administration according to relevant legal regulations Records of business partners information about the company's business partners name, surname, e-mail, telephone the legitimate interest of the operator to store the person in a form that allows identification of the DO as long as it is necessary for the purposes of the business transaction contractual parties, partners in the implementation of project activities, state administration authorities , public power Issuance of invoices and their archiving legal records name, surname, title, delivery address, billing address, e-mail, telephone legal obligation of the operator 10 years tax office, municipal and municipal authorities, Slovak Post, other authorized entity Digital driving school-GX driving school identification devices in the vehicle, in the classroom and on the simulator ensure the collection of data and communication with the unified information system in road transport - JISCD ordinary personal data, other data necessary to verify the initiative legal obligation of the operator we will process your personal data for this purpose for 10 years JISCD, GX Solutions a.s. If we process your personal data on the legal basis of fulfilling our legal obligation, the following legal regulations may apply: Act no. 311/2001 Coll. Labour Code Act no. 580/2004 Coll. Health Insurance Act on Amendments to Act No. 95/2002 Coll. on the insurance industry and on the amendment of certain laws Act no. 461/2003 Coll. Social Insurance Act Act No. 431/2001 Coll. Accounting Law Act No. 161/2011 Coll. Act on consumer protection in the provision of certain tourism services and on amendments to certain laws Act no. 387/2015 Coll. Act on a unified information system in road transport and on amendments to certain laws Act no. 8/2009 Coll. Act on Road Traffic and Amendments to Certain Acts Decree no. 9/2009 Coll. Decree of the Ministry of the Interior of the Slovak Republic implementing the Act on Road Traffic and Amendments to Certain Acts Act No. 40/1964 Coll. Civil Code Provisions of § 8 of Act no. 725/2004 Coll. on the conditions for the operation of vehicles in traffic on land roads. Pursuant to the amendment to decree no. 45 MDVa RR SR valid from 1.1.2016.
6. WHO ARE THE RECIPIENTS OF YOUR PERSONAL DATA? Category of recipients: state and public administration bodies, local governments, auditor, lawyer, District Directorate of Transport, Regional Office of Transport, intermediaries (accounting agenda), companies managing and supporting information technologies, information service providers in justified cases, courts and law enforcement authorities . JISCD / Unified Information System in Road Transport - which ensures effective management, registration and control of the performance of the state administration in the field of transport, specifically in the area of driving school administration, list of personal data - title, first name, last name, social security number, date and place of birth, residence, e-mail, phone number, number of instructor's card, TOKEN of the student, TOKEN of the instructor. Digital driving school-GX driving school - identification devices in the vehicle, in the classroom and on the simulator ensure data collection and communication with the unified information system in road transport - JISCD.
7. DISCLOSURE OF PERSONAL DATA Personal data will not be published.
8. AUTOMATED INDIVIDUAL DECISION-MAKING Personal data will not be used for aed individual decision-making, including profiling.
9. TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION Personal data is not transferred to a third country or international organization.
10. CONFIDENTIALITY We would like to assure you that our employees and collaborators who will process your personal data are obliged to keep personal data confidential. This confidentiality also lasts after the end of the contractual relationship with us.
11. DO WE PROCESS PERSONAL DATA OF CHILDREN? We consider the protection of your children's privacy to be particularly important. For you for this purpose, we do not knowingly collect any personal data of persons under the age of 16. If you are under 16 years of age, please do not send us any of your personal information, including your name, residential address, telephone number or email address. No person under the age of 16 is authorized to provide their personal data on the website. If we find that any personal data that we process relates to a person whose age has not reached 16 years, and at the same time we have not been granted the consent of such a person's legal representative, we will delete such personal data without delay. If you suspect that we may be processing information from or about persons under the age of 16, please contact us.
12. DRIVING LICENSE AGE The minimum age for obtaining a driving license is: 15 years for an applicant for a group AM driver's license, 16 years for an applicant for the granting of a driving license of groups A1 and B1, 17 years for an applicant for a group B and T driver's license, 18 years for an applicant for the granting of a driving license of groups A2, BE, C1 and C1E, 21 years for an applicant for the granting of a driving license of groups C, CE, D1 and D1E, 24 years for an applicant for the granting of a driving license of groups A, D and DE.
13. SECURITY OF PERSONAL DATA Your personal data is safe with us. In order to prevent unauthorized access and misuse of your personal data, we have implemented adequate technical and organizational measures. The protection of your personal data is very important to us. That's why we not only regularly check their security, but also continuously improve their protection. We try to use such security measures that, taking into account the current state of technology, provide sufficient security. The security measures taken are then regularly updated.
14. WHO IS THE PERSON CONCERNED They are mainly employees, clients, any natural person whose personal data is processed. 15. RIGHTS OF THE PERSON CONCERNED Withdraw consent - in cases where we process your personal data based on your consent, you have the right to withdraw this consent at any time. You can withdraw your consent electronically to the given email address, in writing, or in person at the operator's headquarters. Withdrawal of consent does not affect the legality of the processing of personal data that we processed about you on the basis of it. Regardless, you have the right to object to the processing of personal data at any time. Right of access - you have the right to be provided with a copy of the personal data we hold about you, as well as information about how we use your personal data. In most cases, your personal data will be provided to you in written document form, unless you request another way of providing them. If you have requested the provision of this information by electronic means, it will be provided to you electronically if it is technically possible. Right to rectification - we take reasonable measures to ensure the accuracy, completeness and timeliness of the information we have about you. If you believe that the data we hold is inaccurate, incomplete or out of date, please do not hesitate to ask us to correct, update or supplement this information. Right to deletion (to be forgotten) - you have the right to ask us to delete your personal data, for example, if the personal data we have obtained about you is no longer necessary to fulfill the original purpose of processing. However, your right must be assessed in light of all the relevant circumstances. For example, we may have certain legal and regulatory obligations which mean that we will not be able to comply with your request. Right to restriction of processing - under certain circumstances, you are entitled to ask us to stop using your personal data. These are, for example, cases when you think that the personal data we have about you may be inaccurate or when you think that we no longer need to use your personal data. The right to data portability - under certain circumstances, you have the right to ask us to transfer the personal data you have provided to us to another third party of your choice. However, the right to portability only applies to personal data that we have obtained from you on the basis of consent or on the basis of a contract to which you are a party. Right to object - you have the right to object to data processing based on our legitimate legitimate interests. In the event that we do not have a compelling legitimate reason for processing and you file an objection, we will not process your personal data further. The right to submit a proposal to initiate proceedings on the protection of personal data - if you believe that your personal data is being processed unfairly or illegally, you can file a complaint with the supervisory authority, which is the Office for the Protection of Personal Data of the Slovak Republic, hraničná 12, 820 07 Bratislava 27; tel. Number: +421 /2/ 3231 3214; mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk. In the case of submission of the proposal in electronic form, it is necessary that it fulfills the requirements according to § 19 paragraph 1 of Act No. 7181967 Coll. on administrative proceedings (administrative fee).
16. HOW TO PROCEED WHEN YOUR RIGHTS ARE EXERCISED You always exercise your rights with the person who processes your personal data, i.e. j. with a specific operator. If the operator has a responsible person, you can also address your request to this person. The request can be oral, written, electronic or submitted by other means (the general regulation on data protection does not prescribe a specific form). We recommend using mainly written or electronic form. Prepare identification data such as contract number, your ID with the operator, username or password, etc. that is, an identifier on the basis of which the operator will be able to identify you in his environment and thus provide you with data that concern you. The operator is obliged to process your request without delay, no later than 1 month after its delivery. In case of complexity or a large number of requests, we are entitled to extend this period by another 60 days. In the event of a repeated request, we are entitled to charge a reasonable administrative fee to cover the costs associated with providing this service. The right of the affected person to object to aed decision-making cannot be exercised, because the described processing activity does not include aed decision-making. The right of the data subject to request information from the operator about the source of the personal data is irrelevant because the operator processes personal data obtained from the data subject.
17. WHO IS YOUR RESPONSIBLE PERSON? Our company does not have a designated responsible person, as it is not a legal necessity in the case of our company. However, you can direct your questions regarding personal data directly to our company.
18. INFORMATION AND EXERCISE OF THE RIGHTS OF THE PERSON CONCERNED In order to exercise your rights, you can contact the operator at any time as follows: Address: Zeter, s. r. o., Kalištná 21, 841 07 Bratislava E-mail: info@autoskolazeman.sk
19. CONCLUSION If you have questions about the protection of personal data, you can contact us at any time by e-mail or by post at the operator's headquarters. In the event that you exercise some of the rights of the data subject with us according to the legislation governing the protection of personal data and it is not possible to verify the identity of the applicant from your application or in the event that we have legitimate doubts regarding the identity of the person submitting the application, we reserve the right ask this person to provide additional information necessary to confirm the identity of the person making this request.