Privacy policy

PERSONAL DATA PROTECTION

Information Notice of the Company Prepared Pursuant to the Personal Data Protection Act

Identification Details of the Data Controller

The company krasnybyt.com s.r.o., Company ID No. (IČO): 54 308 810, registered office at Priekopy 73, 821 08 Bratislava, (hereinafter referred to as the “Company”) acts, in relation to the processing of personal data of its employees, clients, customers, or business partners (hereinafter referred to as the “Data Subject”), as the data controller of its information systems (hereinafter referred to as the “Information Systems”).

Legal Basis for the Processing of Personal Data of Data Subjects

When processing personal data, the Company acts in accordance with Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (hereinafter referred to as the “Personal Data Protection Act”). The legal basis for the processing of personal data is the Personal Data Protection Act, specific legal regulations, and the consent of the Data Subject to the processing of personal data, depending on the purpose for which the personal data are processed.

Where the purpose of the processing of personal data, the categories of Data Subjects, and the list of personal data are laid down in a directly applicable legal act of the European Union, an international treaty binding upon the Slovak Republic, the Personal Data Protection Act, or a specific legal regulation, the Company is, pursuant to the Personal Data Protection Act, entitled to process personal data without the consent of the Data Subject.

The Company processes personal data without the consent of the Data Subject where the purpose of the processing, the categories of Data Subjects, and the list or scope of personal data are established by a directly applicable legally binding act of the European Union, an international treaty binding upon the Slovak Republic, or by the Personal Data Protection Act. Where the list or scope of personal data is not specified, the Company may process personal data only to the extent and in the manner necessary to achieve the specified purpose of processing, while complying with the fundamental obligations set out in the Personal Data Protection Act.

The Company also processes personal data without the consent of the Data Subject where the purpose of the processing, the categories of Data Subjects, and the list of personal data are laid down by a specific legal regulation, and only to the extent and in the manner prescribed by such regulation. Personal data processed within an Information System may be provided, disclosed, or published only where a specific legal regulation establishes the purpose of such provision, disclosure, or publication, specifies the list of personal data that may be provided, disclosed, or published, and identifies the third parties or categories of recipients to whom the personal data may be provided or disclosed, unless otherwise provided by the Personal Data Protection Act.

The Company also processes personal data without the consent of the Data Subject where:

  • the processing of personal data is necessary for the performance of a contract to which the Data Subject is a party, or for taking steps at the request of the Data Subject prior to entering into a contract, or during negotiations concerning amendments to such contract;
  • the processing of personal data is necessary to protect the life, health, or property of the Data Subject;
  • the subject matter of the processing consists exclusively of the title, first name, surname, and address of the Data Subject, without the possibility of associating these data with any additional personal data, and such processing is carried out solely for the purposes of the Company’s postal correspondence with the Data Subject and the maintenance of records relating thereto;
  • the personal data being processed have already been lawfully disclosed, and the Company has duly designated them as publicly disclosed. Any person claiming to process publicly disclosed personal data shall, upon request of the supervisory authority, demonstrate that the personal data concerned were lawfully disclosed;
  • the processing of personal data is necessary for the purposes of the legitimate interests pursued by the Company or by a third party, provided that such interests are not overridden by the fundamental rights and freedoms of the Data Subject protected under the Personal Data Protection Act.

Where, having regard to the purpose of processing established by a directly applicable legally binding act of the European Union, an international treaty binding upon the Slovak Republic, the Personal Data Protection Act, or a specific legal regulation, it is not possible to determine in advance the individual categories of personal data to be processed, the list of personal data may be replaced by a description of the scope of personal data.

The Company is obliged, when processing personal data under such circumstances, to comply with the Personal Data Protection Act, except in the case of controllers processing personal data for the purposes of judicial proceedings and in connection therewith.

Where the Personal Data Protection Act does not apply to the processing of personal data, the Company, as the data controller, is entitled to process personal data only with the consent of the Data Subject.

The Company obtains the data subject’s consent freely, without coercion or undue pressure, and without making the establishment of a contractual relationship, the provision of services, or the fulfilment of obligations arising from legally binding acts of the European Union, international treaties binding upon the Slovak Republic, or statutory provisions conditional upon such consent.

Where a data subject refuses to provide personal data necessary for the provision of services or for the fulfilment of the Company’s statutory obligations, the Company is entitled to inform the data subject of the possible consequences of such refusal.

The data subject acknowledges and agrees that the Company may appoint a processor to process personal data on its behalf. Upon expiry of the purpose for which the personal data were processed, the Company shall securely erase or otherwise dispose of all lawfully obtained personal data within the time limits prescribed by applicable legal regulations and in compliance with the Personal Data Protection Act.

PURPOSE OF THE PROCESSING OF PERSONAL DATA OF DATA SUBJECTS

The Company respects your privacy and considers the personal data provided by you to be confidential.

In order to provide its services at a high-quality standard, the Company needs to process certain personal data of data subjects and, where necessary, provide such data to other recipients for the purpose of fulfilling its legal obligations and ensuring the provision of services of the highest quality.

The Company processes the personal data provided for several purposes.

This includes the processing of personal data of job applicants and employees for the purposes of personnel and payroll administration, as well as for the fulfilment of related statutory obligations arising from specific legal regulations.

The Company also processes personal data of its clients, customers, and business partners for the purpose of carrying out its business activities while taking into account the interests of its clients, customers, and business partners.

The Company does not process personal data for any other purposes, which means that it collects, stores, and processes only such personal data of data subjects as are necessary for the provision of its services. The personal data provided are strictly protected against misuse by unauthorised third parties through measures documented in the Company’s adopted Security Project and Security Policy in accordance with the Personal Data Protection Act.

When processing personal data of data subjects, the Company complies with the fundamental obligations of a data controller arising from the Personal Data Protection Act, including, in particular, the following obligations:

The Company uses the personal data provided exclusively for a predetermined purpose of processing, which is clear, specifically defined, unambiguous, and concrete, and which is in accordance with the Constitution of the Slovak Republic, constitutional laws, applicable legislation, and international treaties binding upon the Slovak Republic.

The Company always defines the conditions for the processing of personal data in such a way that the rights of the data subject established by law are not restricted.

The Company obtains only such personal data of data subjects that correspond in their scope and content to the purpose of processing and are necessary to achieve that purpose.

The Company ensures that personal data of data subjects are processed exclusively in a manner corresponding to the purpose for which they were originally collected.

As the data controller, the Company is obliged to process only accurate, complete, and, where necessary, updated personal data in relation to the purpose of processing. Incorrect or incomplete personal data shall be restricted and corrected or supplemented without undue delay. If such data cannot be corrected or supplemented so that they are accurate, the Company shall clearly mark such personal data and erase them without undue delay.

The Company ensures that personal data of data subjects are processed in a form allowing the identification of individual data subjects for no longer than is necessary to achieve the purpose of processing.

The Company shall erase personal data in accordance with the prescribed procedures once the purpose of processing has ceased to exist. After the defined purpose has ended, the Company may process personal data only to the extent necessary for research or statistical purposes in an anonymised form. Personal data processed in this manner may not be used by the data controller to support measures or decisions taken against the data subject or to restrict his or her fundamental rights and freedoms.

PROCESSORS

The Company does not provide your personal data to third parties in violation of the Personal Data Protection Act, nor for the purpose of their collection contrary to your interests or instructions. Personal data are provided to third parties only within the purposes specified above.

In carrying out its business activities, the Company cooperates with several processors whose purpose is to provide high-quality services. These entities process personal data of data subjects on behalf of the Company when performing their contractual activities for the Company.

The Company declares that, when selecting individual processors, it carefully considered their professional, technical, organisational, and personnel capabilities, as well as their ability to guarantee the security of processed personal data through security measures adopted in accordance with the Personal Data Protection Act.

At the same time, when selecting suitable processors, the Company acted in such a way as to prevent any risk to the rights and legally protected interests of data subjects.

As the data controller, the Company has entered into written agreements with processors in accordance with the Personal Data Protection Act to ensure the protection of personal data processed by such processors. The processors have been authorised to process personal data of data subjects only within the scope, under the conditions, and for the purpose agreed in the relevant agreement and in accordance with the Personal Data Protection Act.

Tieto dve časti teraz presne zapadajú medzi tvoje existujúce časti a dokument bude kompletný.

SCOPE AND CATEGORIES OF PERSONAL DATA PROCESSED

The Company processes personal data relating to data subjects within its Information Systems only to the extent necessary to achieve the specified purposes of processing. The scope of personal data processed is determined either by applicable legal regulations or by the consent granted by the data subject for the processing of his or her personal data.

The Company processes only those personal data that have been voluntarily provided by the data subject and only to the extent necessary for the fulfilment of the specified purpose. The provision of personal data beyond the scope required by applicable legislation is voluntary.

CONDITIONS AND METHODS OF PROCESSING PERSONAL DATA

The Company processes personal data contained in its Information Systems by both automated and non-automated means.

The Company does not publish personal data processed by it, except where such publication is required by a specific legal regulation or by a decision of a court or another competent public authority.

The Company shall not process your personal data for purposes other than those expressly stated, nor to a greater extent than specified in this Information Notice and in the records relating to the individual Information Systems maintained by the Company, unless it has obtained your explicit consent or another lawful basis for such processing.

RIGHTS OF THE DATA SUBJECT IN RELATION TO THE PROCESSING OF PERSONAL DATA

Upon submitting a written request, the data subject has the right to obtain from the Company:

  • confirmation as to whether or not personal data concerning him or her are being processed;
  • information, in an intelligible form, regarding the processing of personal data within the Information System to the extent provided by the Personal Data Protection Act; where a decision has been adopted pursuant to the Personal Data Protection Act, the data subject is entitled to be informed of the processing procedure and the evaluation of the processing operations;
  • accurate information, in an intelligible form, concerning the source from which the Company obtained his or her personal data for processing;
  • a list, in an intelligible form, of his or her personal data that are being processed;
  • the rectification or erasure of inaccurate, incomplete, or outdated personal data being processed;
  • the erasure of personal data where the purpose of processing has ceased to exist; where official documents containing personal data are being processed, the data subject may request their return;
  • the erasure of personal data processed in violation of the Personal Data Protection Act;
  • the restriction (blocking) of personal data processed on the basis of consent, where the data subject has withdrawn such consent before the expiry of its validity.

The rights referred to above concerning the rectification or erasure of personal data may be restricted only where such restriction arises from a specific legal regulation or where the exercise of those rights would infringe the rights and freedoms of another person or otherwise undermine the protection of the data subject.

Pursuant to the Personal Data Protection Act, the data subject has the right, upon submitting a written request to the Company, to object to:

  • the processing of his or her personal data where he or she believes that such data are being, or will be, processed for direct marketing purposes without his or her consent, and to request their erasure;
  • the use of personal data specified by the Personal Data Protection Act for direct marketing purposes by means of postal communication; or
  • the disclosure of personal data specified by the Personal Data Protection Act for direct marketing purposes.

Pursuant to the Personal Data Protection Act, the data subject has the right, by submitting a written request to the Company or, where the matter cannot be delayed, by making the request in person, to object at any time to the processing of personal data carried out on the legal grounds provided for by the Personal Data Protection Act by stating legitimate reasons or presenting evidence of unlawful interference with his or her rights and legally protected interests that have been or may be adversely affected by such processing. Unless prevented by statutory grounds and provided that the objection is found to be justified, the Company shall, without undue delay, restrict the processing of the personal data concerned and erase such personal data as soon as the circumstances permit.

Pursuant to the Personal Data Protection Act, the data subject also has the right, by submitting a written request to the Company or, where the matter cannot be delayed, by making the request in person, to object at any time to, and not to be subject to, a decision of the Company that produces legal effects concerning him or her or similarly significantly affects him or her, where such decision is based solely on automated processing of personal data. The data subject further has the right to request that the Company review such decision by means other than automated processing. The Company shall comply with such request by ensuring that the review is carried out by an authorised person. The Company shall inform the data subject of the method of review and its outcome within the time limit prescribed by the Personal Data Protection Act. The data subject shall not have this right where otherwise provided by a specific legal regulation containing appropriate safeguards for the legitimate interests of the data subject, or where, in the context of pre-contractual or contractual relations, the Company has adopted a decision granting the request of the data subject, or where the Company has implemented other appropriate measures based on the contract to safeguard the legitimate interests of the data subject.

Where the data subject exercises his or her rights:

  • written and apparent from the content of the request that he or she is exercising rights under the Personal Data Protection Act, the request shall be deemed to have been submitted pursuant to the Personal Data Protection Act. A request submitted by electronic mail or facsimile shall be delivered in writing no later than three days after it has been sent;
  • in person, the request shall be recorded in written minutes specifying the identity of the person exercising the right, the right invoked, the date, and the identity of the person who prepared the minutes. The minutes shall be signed by both the authorised representative of the Company and the data subject, and a copy thereof shall be provided to the data subject;
  • through a processor, the processor shall, without undue delay, forward the request or the written minutes to the Company.

Where the data subject suspects that his or her personal data are being processed unlawfully, he or she may file a motion to initiate proceedings on personal data protection with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovak Republic, or contact the Office via its official website at www.dataprotection.gov.sk.

Where the data subject does not have full legal capacity, his or her rights may be exercised by a legal representative.

Where the data subject is deceased, the rights conferred by the Personal Data Protection Act may be exercised by a close relative.

The Company shall process requests submitted by data subjects pursuant to the Personal Data Protection Act free of charge.

The Company shall process such requests free of charge, except for reimbursement of objectively incurred costs associated with making copies, providing technical data carriers, and sending the requested information to the data subject, unless otherwise provided by a specific legal regulation.

The Company shall respond to a request submitted by a data subject pursuant to the Personal Data Protection Act in writing no later than 30 days from the date of receipt of the request.

Any restriction of the rights of a data subject pursuant to the Personal Data Protection Act shall be communicated by the Company in writing, without undue delay, both to the data subject and to the Office for Personal Data Protection of the Slovak Republic.

The Company hereby informs you, as the data subject, about the protection of your personal data and advises you of your rights relating to the protection of personal data to the extent set out in this Information Notice.

In Bratislava, on 22 July 2026                                                                                             krasnybyt.com s.r.o.