Privacy
NOTICE ON THE PROCESSING OF PERSONAL DATA BY THE REGIONAL TOURISM ORGANIZATION GEMER
Notification of the processing of personal data by the Regional Tourism Organization Gemer pursuant to Art. 13 and Art. 14 ff. Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons in the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC and pursuant to § 19 and § 20 of Act No. 18/2018 Coll. on the protection of personal data and the amendment of some laws
- Operator:
Regional tourism organization Gemer, with registered office Muránska 1331/4, 050 01 Revúca, ID: 51837099 (hereinafter referred to as the "Operator").
- Contact details of the Operator and the responsible person of the Operator
In matters related to the processing and protection of personal data, you can contact the responsible person of the Operator by e-mail at the e-mail address info@regiongemer.sk
- General information
The operator processes personal data in accordance with Regulation 2016/679 of the European Parliament and the Council of the European Union on the protection of natural persons in the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (General Data Protection Regulation) ( hereinafter as " Regulation ") and with Act no. 18/2018 Coll. on the protection of personal data (hereinafter referred to as the " Act ").
The operator obtains personal data directly from you as the data subject (hereinafter referred to as the " Data Subject ") or from another person who provides us with your personal data. A situation may arise if the Operator obtains personal data from a person other than directly from you, therefore this document provides information to all Affected Persons as per Art. 13 of the Regulations, as well as in accordance with Art. 14 Regulations/§ 19 and § 20 of the Act.
- Purposes of personal data processing
The Operator processes your personal data exclusively in accordance with the principle of legality, namely for the purposes of processing personal data listed in the Record of Processing Activities, if at least one of the following conditions is met by the Operator:
Fulfillment of contractual obligations – The Operator processes personal data during the fulfillment of the contract with the Affected Person, to the extent necessary for the fulfillment of contractual obligations. The processing of personal data in the fulfillment of contractual obligations takes place, for example when concluding a purchase contract, substitution contract, contract related to social services, etc., which is concluded between the Operator and the Affected Person.
Fulfillment of legal obligations – The operator processes your personal data also when fulfilling legal obligations. These legal obligations are e.g. obligations arising from tax regulations, regulations related to audits, accounting, etc.
Protection of vital interests – your personal data may be processed even if the Operator protects the vital interests of the Affected Person.
Completion of a task performed in the public interest or in the exercise of public authority – the Operator as a higher territorial unit performs tasks performed in the public interest, as well as tasks in the exercise of public authority, within the scope of the Operator resulting from special legal regulations, therefore it is obliged to process personal data. The processing of personal data includes e.g. in cases where the Operator is an administrative authority.
Legitimate interest of the Operator - The Operator processes personal data also on the basis of a legitimate interest, exclusively in cases where the processing is necessary to monitor the legitimate interests of the Operator or a third party, if these interests are not overridden by the interests or fundamental rights and freedoms of the Person concerned. Legitimate interest The operator applies e.g. when monitoring premises at the Operator's address for the purpose of property protection, during certain activities connected with the Operator's presentation, etc.
Consent to the processing of personal data – The Operator also processes personal data based on the consent of the Affected Person. The Operator requests consent from the Data Subject whenever it is necessary to process personal data. Processing of personal data on the basis of consent takes place, for example, when sending information about the Operator via e-mail, participating in a contest by the Affected Person, etc.
The operator processes personal data on the basis of the aforementioned legal bases, while determining whether it is a legal or contractual requirement for the processing of personal data, as well as a legitimate interest, or public interest of the Operator are listed in the Record of Processing Activities of the Operator.
In the event that personal data were not provided to the Operator, in some cases it would not be possible to fulfill the Operator's obligations imposed by legal regulations and/or laws, it would not be possible to fulfill the task performed by the Operator in the public interest/in the exercise of public authority by the Operator or it would not be possible conclude a contract and/or other contractual relationship between the Operator and the Data Subject.
You can find all the purposes of personal data processing by clicking on the Record of processing activities of the Operator.
- Categories of personal data
The Operator processes personal data that is necessary for processing personal data always in accordance with the principle of minimization so that the Operator fulfills contractual and legal requirements, protects vital interests, if necessary, performs tasks in the public interest and in the exercise of public authority, or to be able to process personal data for which the Data Subject has given consent or to process personal data for which he has a legitimate interest.
The operator mainly processes identification data of natural persons, representatives of legal entities and their contact data - name, surname, address (permanent, temporary residence / place of business), date of birth, ID number, signature, e-mail address, telephone number, or other data needed.
Personal data also includes special categories of personal data that the Operator is authorized and at the same time obliged to process. Special categories of personal data that the Operator processes are e.g. data on health status, social situation, financial situation, etc.
Personal data, or categories of processed personal data are listed in the Record of processing activities.
In terms of the legal basis for processing personal data, where the Operator fulfills contractual obligations, legal obligations and tasks in the public interest and in the exercise of public authority, the personal data processed by the Operator are mainly specified in legal regulations. When processing personal data, where the legal basis is consent or legitimate interest, the Operator determines the categories of processed personal data.
- Period of storage of personal data
The operator stores personal data depending on the purpose of personal data processing. During the retention period, the Operator takes into account the principle of minimizing the retention of personal data, i.e. it stores personal data exclusively during the period during which the retention of personal data is necessary.
The operator stores personal data in accordance with the requirements of the current Slovak legislation, in particular Act no. 395/2002 on archives and registries , in which the retention periods of individual groups of personal data are determined in accordance with applicable legal regulations. Where the storage periods are not specified in the Operator's Registration Plan, the Operator determines the storage period for personal data, which is specified in the Record of Processing Activities.
In the case of your request, we will provide you with information on the retention period of personal data specified in the Registration Plan.
- Rights of Affected Persons
The protection of your personal data as a Data Subject is governed by the provisions of the Regulation, and in certain cases by the provisions of the Act.
As a Data Subject, you can exercise your rights with the Operator through a request, which are:
- Right of access
You have the right to receive a copy of the personal data we hold about you, as well as information about how we use your personal data. In most cases, your personal data will be provided to you via electronic means of communication, unless otherwise requested by you.
- Right to rectification
We take reasonable measures to ensure the accuracy, completeness and timeliness of the information we have about you. If the personal data we have is inaccurate, incomplete or out of date, we will modify, update or supplement this personal data based on your request.
- Right to erasure
In certain circumstances, you have the right to ask us to delete your personal data, for example, if the personal data we have obtained about you is no longer necessary to fulfill the original purpose of processing or if you withdraw your consent to the processing of personal data. However, your right must be assessed in light of all the relevant circumstances. For example, we may have certain arising from applicable legislation, which means that we will not be able to comply with your request.
- Right to restriction of processing
You also have the right to ask us not to process your personal data any further. In the event that you believe that your personal data that we process is incorrect, the processing is illegal and you request a restriction of processing, we do not need your personal data, but you need it as a Data Subject when exercising legal claims or when you think that the Operator has no legitimate reason to further process your personal data.
- The right to data portability
Under certain circumstances, you have the right to transfer personal data to another entity, according to your choice. However, the right to portability only applies to personal data that we process on the basis of a contract to which you are a party, on the basis of the consent you have given us or if we process personal data by automated means.
- The right to object
You have the right to object to the processing of personal data, for example, if we process your personal data in the performance of a task carried out in the public interest, in the exercise of public authority entrusted to us, in the case of processing based on a legitimate interest or in the case of processing that results in profiling. If you file an objection to such processing of personal data, we will not process your personal data further, unless we demonstrate the necessary legitimate reasons for such processing.
- Rights related to profiling or automated decision-making
In the event that we process personal data through profiling or automated decision-making, you have the right to refuse automated individual decision-making, including profiling, which results in legal or similar significant consequences for you. However, the operator does not use automated individual decision-making or profiling when processing personal data.
- The right to withdraw consent
If we process your personal data based on your consent, you have the right to withdraw your consent to the further processing of your personal data. You can withdraw your consent in writing, by e-mail or orally (in person).
- The right to file a complaint or initiative
You can file a complaint with the supervisory authority, which is the Office for the Protection of Personal Data of the Slovak Republic, with headquarters at Hraničná 12, 820 07 Bratislava 27; website: dataprotection.gov.sk, tel. number: 02 3231 3214; E-mail: statny.dozor@pdp.gov.sk.
- Exercising the rights of affected persons
You can exercise your rights listed in the previous point 7. of this Information Obligation of the Operator:
- in writing, by sending a request to the address: Regional Tourism Organization Gemer, with registered office Muránska 1331/4, 050 01 Revúca
- electronically, via the e-mail address info@regiongemer.sk
- verbally, at the address of our headquarters Regional Tourism Organization Gemer, with headquarters Muránska 1331/4 , 050 01 Revúca, about which a written record will be made, a copy of which will be presented to you.
We provide an answer to the exercise of your rights free of charge. Under certain circumstances, in the case of a repeated, unjustified or unreasonable request to exercise your rights, we are entitled to charge a reasonable fee for the provision of information.
We will provide you with an answer within one month from the day you exercised your rights. In certain cases, we are entitled to extend the deadline for providing an answer in the case of a high number and complexity of requests from Affected Persons, but by a maximum of two months. We will always inform you about the extension of the deadline.
- Profiling
The operator does not process your personal data through profiling or any form of automated individual decision-making. When personal data is processed by the Operator, there is no profiling or processing of personal data through automated individual decision-making to evaluate your personal aspects.
- Transfer to third countries and international organizations
The transfer of personal data to third parties and international organizations is not carried out.
- Beneficiaries
Your personal data may be provided to recipients - mainly intermediaries, but also to third parties,
Intermediaries mainly include companies with which we cooperate - companies providing IT services, tax and accounting services, etc.
The operator exclusively uses intermediaries who have adopted adequate technical and security measures, through which the requirements of the Regulation, the Act and other regulations relating to the security and protection of personal data are met, to ensure the safe processing of your personal data.
Other recipients are mainly public bodies that are authorized to process personal data obtained by the Operator. These bodies can include courts, law enforcement agencies, etc.