In accordance with Articles 13 and 14 of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“Regulation” or “GDPR”), this document is intended to provide you, as the data subject whose personal data is being processed by MDF ŽERIAVY, s.r.o., with its registered office at Plavnica 130, 065 45 Plavnica, Company Registration Number (IČO): 47318716, registered in the Commercial Register of the District Court Prešov, Section: Sro, Insert No.: 28272/P, with information in accordance with the Regulation, in particular:

• data about MDF ŽERIAVY, s.r.o., as the data controller,
• information on the scope of data we process about you,
• the range of recipients and processors to whom your personal data may be provided,
• the range of purposes for which we may use your personal data,
• the legal basis for processing,
• information about your rights and how you can exercise them.

1. CONTACT DETAILS OF THE DATA CONTROLLER

MDF ŽERIAVY, s.r.o. (hereinafter also referred to as “MDF ŽERIAVY, s.r.o.” or the “controller”),

Registered office: Plavnica 130, 065 45 Plavnica,

Company ID (IČO): 47318716,

Registration: Commercial Register of the District Court Prešov, Section: Sro, Insert No.: 28272/P,

Tel.: +421 918 407 055,

E-mail: info@mdf.sk .

MDF ŽERIAVY, s.r.o., does not have an appointed Data Protection Officer as our company is not obliged to have an appointed Data Protection Officer under the Regulation.

2. CATEGORIES OF PERSONAL DATA, PURPOSE, AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

2.1. Legal basis and purpose of personal data processing

MDF ŽERIAVY, s.r.o., provides its services on a contractual basis, and its activities are regulated by legal regulations that require the collection and processing of personal data. In some situations, the processing of personal data is a legitimate interest of MDF ŽERIAVY, s.r.o., or we request your consent for its processing. The purpose of processing is primarily:

• carrying out the subject of activity the company is authorized to perform and fulfilling related obligations,
• marketing communication,
• protection of the legitimate interests of MDF ŽERIAVY, s.r.o., and the exercising of legal claims.

The legal basis for processing your personal data is therefore generally:

a) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

MDF ŽERIAVY, s.r.o., concludes written contracts with its clients in most cases, an essential requirement of which is the identification of the contracting parties and the determination of the contract content. This requires obtaining the personal data of the client or their representative, even without their consent. During the performance of the contract, new personal data are also created that are related to the exercise of rights and fulfillment of obligations under the contract (e.g., payment data, etc.).

In the event of a breach of rights and obligations from the contract between the client and MDF ŽERIAVY, s.r.o., the data may be used to assert the claims of MDF ŽERIAVY, s.r.o., and provided to third parties and recipients to the necessary extent.

Processing of personal data for the performance of a contract generally involves several activities, e.g.:

• preparation of a contractual relationship at the request of a client and contractual partner of MDF ŽERIAVY, s.r.o., and concluding and executing transactions between MDF ŽERIAVY, s.r.o., and its clients, and the actual execution of transactions or services;
• administration and control of the obligation relationship between the client, the contractual partner, and MDF ŽERIAVY, s.r.o.;
• postal, telephone, e-mail, and personal communication with the client regarding a specific contractual relationship;
• handling complaints and grievances;
• providing customer or technical support.

If you are an employee of a client or contractual partner and your personal data is listed on the contract as a contact, or you are a person authorized to act on behalf of a client or contractual partner, MDF ŽERIAVY, s.r.o., may process your personal data in connection with such a contract, both in paper form and by electronic means.

b) compliance with a legal obligation to which the controller is subject;

In cases where data is processed for the purpose of fulfilling the legal obligations of MDF ŽERIAVY, s.r.o., the consent of the data subjects is not required. The data subject in this case may be not only a client but also their representative, a person interested in concluding a transaction, or another person.

MDF ŽERIAVY, s.r.o., is authorized in such cases to collect and further process your personal data to the extent and for the purposes stipulated by legal regulations related to the purpose of providing services and other activities of MDF ŽERIAVY, s.r.o., and fulfilling related obligations. In many cases, the legal regulation also determines the minimum period for which MDF ŽERIAVY, s.r.o., is obliged to process the data and the related purposes for which the data needs to be processed, or directly lists the processing activities that need to be performed.

Depending on the specific transaction we conclude with you, special regulations include, in particular:

• Act No. 513/1991 Coll., Commercial Code, as amended,
• Act No. 40/1964 Coll., Civil Code, as amended,
• Act No. 431/2002 Coll. on Accounting, as amended, or
• Act No. 595/2003 Coll. on Income Tax, as amended.

The above regulations set out related purposes and activities for which data are processed, in particular:

• concluding and executing transactions with clients and business partners,
• protection and enforcement of the rights of MDF ŽERIAVY, s.r.o., against its clients and business partners,
• documenting the activities of MDF ŽERIAVY, s.r.o.,
• fulfilling tasks and obligations according to legal regulations.

c) processing for the purposes of the legitimate interests pursued by MDF ŽERIAVY, s.r.o., or by a third party;

A special situation where personal data is processed for the purpose of legitimate interests is the processing of personal data, including profiling, for the purpose of direct marketing in the event that we have obtained your personal data while providing products and services. In such a case, MDF ŽERIAVY, s.r.o., also processes data on the use of services in the form of profiling and, based on this, can prepare a tailor-made offer for you.

When processing personal data for the purpose of legitimate interests, MDF ŽERIAVY, s.r.o., or a third party must assess in the manner set out in the Regulation whether the legitimate reasons on the part of the controller override the legitimate reasons of the data subject.

You have the right to object to the processing of personal data for the purpose of the legitimate interest of the controller or a third party.

d) processing for the establishment, exercise, or defense of legal claims;

This legal basis may include cases where data is processed based on consent which is later withdrawn, and the data is necessary for the establishment, exercise, or defense of legal claims.

e) consent of the data subject;

In cases where your consent is the legal basis, MDF ŽERIAVY, s.r.o., will not condition the provision of its services on its granting. Consent must therefore be freely given and revocable. The withdrawal of consent, however, does not affect the lawfulness of processing based on consent before its withdrawal.

2.2. Scope of personal data processing

MDF ŽERIAVY, s.r.o., usually processes your data to the following extent:

• Identification data (name, surname, permanent residence address, birth number if assigned, date of birth, nationality, type and number of identity document and, in the case of a natural person who is an entrepreneur, also the address of the place of business, subject of business, designation of the official register or other official record in which they are registered and the registration number in this register or record),
• Contact details (contact telephone number, fax number, e-mail address, temporary residence address, correspondence address, or social media account ID).

MDF ŽERIAVY, s.r.o., obtains the above data directly from you, from other persons (e.g., from a client if you are their representative) or from special registers (Commercial Register, Trade Register, Cadastre of Real Estate).

If you are an employee of a contractual partner of MDF ŽERIAVY, s.r.o., the company MDF ŽERIAVY, s.r.o., standardly processes the following data about you: title, name, surname, job title, service position, functional position, personal employee number or employee number, professional department, place of work, telephone number, fax number, workplace e-mail address, and identification data of the employer.

3. PROVISION OF YOUR PERSONAL DATA TO OTHER PERSONS

3.1. Recipients

MDF ŽERIAVY, s.r.o., processes your personal data primarily through its employees or persons in a similar relationship, who are bound by confidentiality and may process your personal data only to the extent and in a manner necessary for the performance of their work duties.

To achieve the processing purposes mentioned above, however, it may be necessary for MDF ŽERIAVY, s.r.o., to provide your personal data to other recipients. Under the Regulation, a recipient is a natural or legal person, public authority, agency, or another body to which personal data are disclosed, whether a third party or not.

The legal basis for providing your personal data to recipients may be a legal obligation, your consent, written instruction, necessity for the purposes of performing a contract, or the legitimate interest of MDF ŽERIAVY, s.r.o., or a third party.

The recipients of your personal data may, depending on the circumstances of your relationship with MDF ŽERIAVY, s.r.o., be third parties (companies, consultants, etc.) who process your personal data as controllers, in particular:

• Companies to which we have assigned receivables;
• Law firms and audit companies;
• Court experts;
• Entities that provide services to MDF ŽERIAVY, s.r.o., such as Slovenská pošta, a.s.;
• State authorities, public authorities, and other entities provided by law, e.g.:
  • Office for Personal Data Protection of the Slovak Republic,
  • Police Force, law enforcement authorities, and courts,
  • Administrator or preliminary administrator in bankruptcy or restructuring proceedings,
  • Tax authority, customs authority, or tax administrator,
  • Court executor,
  • other entities in accordance with the relevant legislation.

3.2. Processors

MDF ŽERIAVY, s.r.o., uses third parties to provide services, which may include processing personal data on behalf of MDF ŽERIAVY, s.r.o., and for the purpose and in the manner determined by MDF ŽERIAVY, s.r.o. Your consent is not required to provide personal data to processors; however, MDF ŽERIAVY, s.r.o., is responsible for selecting the processor and for protecting the rights of the data subjects, primarily by ensuring that technical and organizational measures are taken into account when selecting the processor. Processors are other entities that MDF ŽERIAVY, s.r.o., has entrusted as processors because they provide services to MDF ŽERIAVY, s.r.o., on a supplier basis, which may include the processing of personal data.

4. TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY OR INTERNATIONAL ORGANIZATION OUTSIDE THE EU

Your personal data is processed by MDF ŽERIAVY, s.r.o., within the EU, and when selecting suppliers, MDF ŽERIAVY, s.r.o., ensures that they process personal data primarily within the EU. If, for technical or operational reasons, it is necessary to process your personal data outside the EU, MDF ŽERIAVY, s.r.o., will ensure that the conditions of the Regulation for such processing are met.

5. RETENTION PERIOD OF PERSONAL DATA

Your personal data are processed by manual and electronic means in a manner that ensures their security, integrity, and availability.

The period for which personal data are processed and stored depends on the purpose of processing and is determined by MDF ŽERIAVY, s.r.o., as the controller or by legal regulations. Legal regulations set minimum periods for which MDF ŽERIAVY, s.r.o., is obliged to keep data.

In cases where MDF ŽERIAVY, s.r.o., as the controller itself determines the retention period for personal data, this period is determined so as to be proportionate to the purpose for which the data are processed:

Legal basis for processing	Duration
Consent	Regulated in the consent; if the period is not specified there, the standard period is the duration of the contractual relationship with the company and 5 years after its termination.
Legitimate interest of MDF ŽERIAVY, s.r.o.	Considering the specific legitimate interest, MDF ŽERIAVY, s.r.o., will determine a reasonable processing period.

If there are multiple retention periods for the same information or group of information, the longest of them will be used to determine the retention period.

6. RIGHTS OF THE DATA SUBJECT

As a data subject, under the Regulation, you have rights towards MDF ŽERIAVY, s.r.o., as the controller, in relation to the processed personal data.

It is the duty of MDF ŽERIAVY, s.r.o., to ensure that you can exercise these rights simply, but at the same time, MDF ŽERIAVY, s.r.o., has a duty to protect your data from unauthorized access and alteration.

Therefore, MDF ŽERIAVY, s.r.o., must verify your identity so that you and our company, MDF ŽERIAVY, s.r.o., can be certain that the information does not reach an unauthorized person or that your rights are not abused. For this reason, MDF ŽERIAVY, s.r.o., recommends that you exercise your rights by submitting a request directly at the registered office of MDF ŽERIAVY, s.r.o.

In cases where you exercise your rights in another way that does not allow for verification of your identity, e.g., by sending a letter, sending an e-mail, or by phone, MDF ŽERIAVY, s.r.o., may, depending on the circumstances, ask you to verify your identity, e.g., in person at the registered office of MDF ŽERIAVY, s.r.o.

If your identity is not verified, MDF ŽERIAVY, s.r.o., reserves the right not to act on such a request.

If requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the company may either (i) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or (ii) refuse to act on the request.

If you exercise your right to rectification, erasure, or restriction of processing, MDF ŽERIAVY, s.r.o., shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

6.1. Right of access to data

You have the right to obtain from MDF ŽERIAVY, s.r.o., as the controller, confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request from MDF ŽERIAVY, s.r.o., as the controller, rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from you as the data subject, any available information as to their source.

Where personal data are transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Article 46 of the Regulation relating to the transfer.

At your request, we will provide a copy of the personal data undergoing processing. The right to obtain a copy must not adversely affect the rights and freedoms of others.

If we process a large amount of information concerning you, we will ask you to specify the information or processing activities to which the request relates.

For any further copies requested by you, MDF ŽERIAVY, s.r.o., may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by you.

6.2. Right to rectification

The aim of MDF ŽERIAVY, s.r.o., is to process accurate and complete personal data. However, if you are aware that this is not the case, you have the right to obtain from MDF ŽERIAVY, s.r.o., without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

6.3. Right to erasure (“right to be forgotten”)

As a data subject, you also have the right to obtain from MDF ŽERIAVY, s.r.o., the erasure of personal data concerning you without undue delay, and MDF ŽERIAVY, s.r.o., has the obligation to erase personal data without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw consent on which the processing is based and where there is no other legal ground for the processing;
• you object to automated processing and there are no overriding legitimate grounds for the processing, or you object to the processing of your personal data for marketing purposes;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which MDF ŽERIAVY, s.r.o., is subject.

This right may not apply if the conditions set out in Article 17 of the Regulation are met, for example, if the processing is necessary for the establishment, exercise, or defense of legal claims.

6.4. Right to restriction of processing

In cases stipulated by the Regulation in Article 18, you have the right to request that MDF ŽERIAVY, s.r.o., restrict the processing of your personal data in the manner governed by the Regulation.

6.5. Right to data portability

In cases where the processing of your personal data is carried out by automated means and is based on consent or a contract, you have the right to receive the personal data concerning you, which you have provided to MDF ŽERIAVY, s.r.o., in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller, even directly, where technically feasible.

However, this right must not adversely affect the rights and freedoms of others.

If you request that we transfer your data directly to another controller, we will need the contact details of the new controller (e-mail and telephone number). MDF ŽERIAVY, s.r.o., will ensure a secure method of data transfer to the new controller; however, it bears no responsibility for the processing of personal data by the new controller from the moment of assumption.

6.6. Right to object

You have the right to object at any time to the processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. In such cases, MDF ŽERIAVY, s.r.o., will assess whether the legitimate interests override the grounds you have specified in your objection.

Where your personal data are processed for scientific or historical research purposes or statistical purposes, you have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you.

Where personal data are processed for direct marketing purposes, including profiling, based on the legitimate interest of MDF ŽERIAVY, s.r.o., you have the right to object at any time to processing of personal data; if you object, your personal data shall no longer be processed for direct marketing purposes.

6.7. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the Regulation.

The local competent supervisory authority is, in particular:

Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
Hraničná 12
820 07 Bratislava 27
Slovak Republic
https://dataprotection.gov.sk/sk

In Stará Ľubovňa, on 18.10.2024

Jozef Diňa
Managing Director
MDF ŽERIAVY, s.r.o.