GDPR and Cookies

Slovensky | English

This English version is a translation provided for information. In case of any discrepancy, the Slovak version prevails.

Mandatory information

GDPR

Name of entity: Správa telovýchovných zariadení (Sports Facilities Administration)
Company ID (IČO): 35514035
Address: Za Hornádom 898/15, 052 01 Spišská Nová Ves

Contents

• Basic information
• Office for Personal Data Protection of the Slovak Republic
• Processing activities of the Controller
• Rights of the data subject
• Processing of cookies
• CCTV system

Basic information

treats your personal data responsibly and therefore, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the “GDPR”) and Act No. 18/2018 Coll. on Personal Data Protection and amending and supplementing certain acts (hereinafter the “Act”), makes available to you as a data subject (a natural person whose personal data are processed) on its website, in addition to its identification and contact details and the contact details of the data protection officer, also other necessary information, which can be found in the tabs on the left.

Pursuant to Article 24 of the GDPR and Section 31 of the Act, the Controller has proceeded to adopt appropriate technical, organisational, personnel and security measures and safeguards which take into account, in particular:

• the principles of processing of personal data, namely lawfulness, fairness and transparency, limitation and compatibility of the purposes of processing of personal data, furthermore minimisation of personal data, their pseudonymisation and encryption, as well as integrity, confidentiality and availability;
• the principles of necessity and proportionality (also applying to the scope and amount of the personal data processed, the storage period and access to the personal data of the data subject) of the processing of personal data with regard to the purpose of the processing operation;
• the nature, scope, context and purpose of the processing operation;
• the resilience and recovery of personal data processing systems;
• the instruction of the controller’s authorised persons;
• the adoption of measures to establish without delay whether a personal data breach has occurred and to promptly inform the supervisory authority and the data protection officer;
• the adoption of measures to ensure the rectification or erasure of inaccurate data, or the exercise of other rights of the data subject;
• the risks of varying likelihood and severity for the rights and freedoms of natural persons (in particular accidental or unlawful destruction of personal data, loss or alteration of personal data, misuse of personal data – unauthorised access or unauthorised disclosure, assessment of risks having regard to the origin, nature, likelihood and severity of the risk in relation to the processing and to the identification of best practices for mitigating the risk).

Office for Personal Data Protection of the Slovak Republic

Address: Galvaniho Business Centrum II, Galvaniho 7/B, 811 06 Bratislava
Slovak Republic
Company ID (IČO): 36 064 220

Filing office:
Monday – Thursday: 8:00 – 15:00
Friday: 8:00 – 14:00

Telephone consultations on personal data protection:
Tuesday and Thursday from 8:00 to 12:00 +421 2 323 132 20

Secretariat of the President of the Office +421 2 323 132 11

Secretariat of the Office +421 2 323 132 14

Fax: +421 2 323 132 34

Spokesperson:
mobile: 0910 985 794
e-mail: hovorca@pdp.gov.sk

E-mail:
– general: statny.dozor@pdp.gov.sk
– for the provision of information under Act No. 211/2000 Coll.: info@pdp.gov.sk
– website: webmaster@pdp.gov.sk
– to submit requests for information under Act No. 211/2000 Coll. on Free Access to Information, please use the online form.
– e-mail address through which the Office will provide you with advice on personal data protection. It is intended for children, young people, students, teachers and parents who suspect that their personal data have been misused: statny.dozor@pdp.gov.sk

Processing activities of the Controller

One of the principles of processing of personal data is the principle of purpose limitation. Under this principle, personal data may be collected only for a specified, explicit and legitimate purpose and may not be further processed in a manner that is incompatible with that purpose.

The processing of personal data should be closely linked to the purpose of the processing of personal data, in particular as regards the list or scope of the personal data processed, which should be necessary for the purpose to be achieved by processing the personal data concerned. It is not appropriate for the list or scope of personal data to be extended artificially or subsequently in relation to the purpose. Where the purpose and the list or scope of personal data are laid down by law, they must be respected; where the list or scope of the personal data processed is determined by the controller, the controller should take care not to extend it unnecessarily beyond the purpose.

The Personal Data Protection Act lays down the obligation of the controller to provide the data subject with information on the purpose of the processing of personal data for which his or her personal data are intended, including where the personal data are not obtained directly from the data subject. This information must be provided to the data subject at the latest when his or her personal data are obtained, or sufficiently in advance, clearly and comprehensibly and in such a way that the data subject can genuinely acquaint himself or herself with the information and understand it.

Rights of the data subject

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the “GDPR”) and Act No. 18/2018 Coll. on Personal Data Protection and amending and supplementing certain acts, as amended (hereinafter the “Act”) guarantee you, as a data subject, the following rights:

a) the right of the Data Subject of access to personal data, which comprises:

• the right to obtain from the Controller confirmation as to whether or not personal data concerning the Data Subject are being processed;
• where the personal data of the Data Subject are being processed, the right to obtain access to the personal data processed and the right to obtain the following information:
  – information on the purposes of the processing;
  – information on the categories of personal data concerned;
  – information on the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  – where possible, information on the envisaged period for which the personal data will be stored, or, if not possible, information on the criteria used to determine that period;
  – information on the existence of the right to request from the Controller rectification or erasure of personal data concerning the Data Subject or restriction of processing, and on the existence of the right to object to such processing;
  – information on the right to lodge a complaint with a supervisory authority;
  – where the personal data were not collected from the Data Subject, any available information as to their source;
  – information on the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing of personal data for the Data Subject;
• the right to be informed of the appropriate safeguards pursuant to Article 46 of the Regulation relating to the transfer of personal data, where personal data are transferred to a third country or to an international organisation;
• the right to be provided with a copy of the personal data undergoing processing, subject, however, to the condition that the right to be provided with a copy of the personal data processed must not adversely affect the rights and freedoms of others;

The right of the Data Subject of access to personal data essentially means that the Data Subject has the right to obtain from us confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, has the right to obtain access to those personal data. At the request of the Data Subject, we will provide a copy of the personal data undergoing processing. For any further copies requested by the Data Subject, we may charge a reasonable fee based on administrative costs. Where the Data Subject has made the request by electronic means, the information will be provided in a commonly used electronic form, unless otherwise requested by the Data Subject. The information must be provided immediately, at the latest within 1 month. We have the right to extend the period for handling the request by a further 2 months where the request is complex or frequent. However, the Data Subject must be informed of the reason for extending the handling period within 1 month. In the case of an unfounded or excessively frequent request, we have the right to charge a fee reasonable in relation to the costs or to refuse the request. We must explain the reason for the refusal and the right of the data subject to lodge a complaint with the supervisory authority.

b) the right of the Data Subject to rectification of personal data, which comprises:

• the right to have the Controller rectify without undue delay inaccurate personal data concerning the Data Subject;
• the right to have incomplete personal data of the Data Subject completed, including by means of providing a supplementary statement of the Data Subject;

The right of the Data Subject to rectification of personal data means that you may ask us at any time to rectify or complete your personal data if they are inaccurate or incomplete. The Data Subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

c) the right of the Data Subject to erasure of personal data (the so-called right “to be forgotten”), which comprises:

• the right to obtain from the Controller the erasure of personal data concerning the Data Subject without undue delay where one of the following grounds applies:
  – the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  – the Data Subject withdraws the consent on which the processing is based, subject to the condition that there is no other legal ground for the processing of personal data;
  – the Data Subject objects to the processing of personal data pursuant to Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing of personal data, or the Data Subject objects to the processing of personal data pursuant to Article 21(2) of the Regulation;
  – the personal data have been unlawfully processed;
  – the personal data have to be erased for compliance with a legal obligation under the law of the European Union or the law of a Member State to which the Controller is subject;
  – the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the Regulation;
• the right to have the Controller which has made the personal data of the Data Subject public, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers which are processing the personal data that the Data Subject has requested them to erase any links to, or copy or replication of, those personal data;

whereby the right to erasure of personal data comprising the rights under Article 17(1) and (2) of the Regulation [i.e. comprising the rights under (i) and (ii) of this letter c) of point J. of this document] shall not arise where the processing of personal data is necessary:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing under the law of the European Union or the law of a Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) of the Regulation, as well as Article 9(3) of the Regulation;
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the Regulation, in so far as the right referred to in Article 17(1) of the Regulation is likely to render impossible or seriously impair the achievement of the objectives of that processing of personal data; or
5. for the establishment, exercise or defence of legal claims;

The right of the Data Subject to erasure of personal data therefore means that we must erase your personal data if (i) they are not necessary for the purposes for which they were collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, or (iv) we are required to do so by a legal obligation.

d) the right of the Data Subject to restriction of processing of personal data, which comprises:

• the right to obtain from the Controller restriction of processing of personal data where one of the following applies:
  – the accuracy of the personal data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the personal data;
  – the processing of personal data is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
  – the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
  – the Data Subject has objected to processing pursuant to Article 21(1) of the Regulation, pending the verification whether the legitimate grounds of the Controller override those of the Data Subject;
• the right that, where the processing of personal data has been restricted pursuant to sub-point (i) of this letter d) of point J. of this document, such personal data subject to restricted processing shall, with the exception of storage, be processed only with the consent of the Data Subject or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State;
• the right to be informed in advance of the lifting of the restriction of processing of personal data;

The right of the Data Subject to restriction of processing of personal data means that, until we have resolved any disputed issues concerning the processing of your personal data, we must restrict the processing of your personal data in such a way that we may only store the personal data of the data subject and not further process them.

e) the right of the Data Subject to the fulfilment of the notification obligation towards recipients, which comprises:

• the right to have the Controller communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 of the Regulation to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort;
• the right to have the Controller inform the Data Subject about those recipients if the Data Subject requests it;

The right of the Data Subject to the fulfilment of the notification obligation towards recipients means the obligation of the Controller to communicate to each recipient to whom it has disclosed the personal data of the Data Subject any rectification and erasure of personal data or restriction of their processing. The only case in which the Controller does not have this obligation is where such communication is impossible for objective reasons or involves disproportionate effort.

f) the right of the Data Subject to portability of personal data, which comprises:

• the right to receive the personal data concerning the Data Subject which he or she has provided to the Controller in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller, where:
  – the processing is based on the consent of the Data Subject pursuant to Article 6(1)(a) of the Regulation or Article 9(2)(a) of the Regulation, or on a contract pursuant to Article 6(1)(b) of the Regulation, and at the same time;
  – the processing is carried out by automated means, and at the same time;
  – the right to receive the personal data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller will not adversely affect the rights and freedoms of others;
• the right to have the personal data transmitted directly from one controller to another controller, where technically feasible;

The right to data portability means that you have the right to receive from us your personal data which you have previously provided to us in a structured, commonly used and machine-readable format and you have the right to request that we transmit your personal data to another controller, subject to the statutory conditions being met; the exercise of this right is without prejudice to your right to erasure of personal data. However, the right to portability applies only to personal data which we have obtained from you on the basis of a contract to which you are a party.

g) the right of the Data Subject to object, which comprises:

• the right to object at any time, on grounds relating to the particular situation of the Data Subject, to the processing of personal data concerning him or her which is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including objecting to profiling based on those provisions of the Regulation;
• [in the event of exercise of the right to object at any time, on grounds relating to the particular situation of the Data Subject, to the processing of personal data concerning him or her which is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including objecting to profiling based on those provisions of the Regulation] the right to have the Controller no longer process the personal data of the Data Subject unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or grounds for the establishment, exercise or defence of legal claims;
• the right to object at any time to the processing of personal data concerning the Data Subject for direct marketing purposes, including profiling to the extent that it is related to direct marketing; whereby, where the Data Subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes;
• (in the context of the use of information society services) the right to exercise the right to object to the processing of personal data by automated means using technical specifications;
• the right to object, on grounds relating to the particular situation of the Data Subject, to the processing of personal data concerning the Data Subject where the personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the Regulation, except, however, where the processing is necessary for the performance of a task carried out for reasons of public interest;

The right of the Data Subject to object therefore means that, as a Data Subject, you may object to the processing of your personal data which we process for direct marketing purposes or on legitimate grounds. In the case of processing of personal data for marketing purposes, we will stop immediately upon receipt of the objection.

h) the right of the Data Subject related to automated individual decision-making , which comprises:

• the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects him or her, except in the cases under Article 22(2) of the Regulation [i.e. except where the decision is: (a) necessary for entering into, or the performance of, a contract between the Data Subject and the Controller, (b) authorised by the law of the European Union or the law of a Member State to which the Controller is subject and which also lays down suitable measures to safeguard the rights and freedoms and legitimate interests of the Data Subject, or (c) based on the explicit consent of the Data Subject];

The right of the Data Subject related to automated individual decision-making means that, as a Data Subject, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Where such processing is necessary for entering into, or the performance of, a contract or is based on the explicit consent of the Data Subject, the controller shall implement suitable measures to safeguard the rights and freedoms and legitimate interests of the Data Subject, in particular it shall adopt at least such measures as the right to obtain human intervention on the part of the controller, the right of the data subject to express his or her point of view and the rights of the data subject to contest the decision. The Controller shall provide the data subject with information on action taken on a request under Articles 15 to 22 of the GDPR without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The Controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. In the cases referred to, the controller may refuse to act on the request of the data subject in exercising his or her rights under Articles 15 to 22 of the GDPR only if it demonstrates that it is not in a position to identify the data subject.

i) The right of the data subject to file a petition to initiate proceedings pursuant to Section 100 of the Personal Data Protection Act , which comprises:

• the right of the Data Subject who believes that his or her personal data are being processed without authorisation or that his or her personal data have been misused to file a petition to initiate personal data protection proceedings with the Office for Personal Data Protection of the Slovak Republic (hereinafter the “Office”);
• The petition to initiate proceedings may be filed in writing, in person orally for the record, by electronic means, in which case it must be signed with a guaranteed electronic signature, by telegraph or by telefax, which, however, must be supplemented in writing or orally for the record within 3 days at the latest;
• Pursuant to Section 100(3) of the Personal Data Protection Act, the petition in question must contain:
  – the first name, surname, permanent residence address and signature of the petitioner;
  – identification of the person against whom the petition is directed; the name or first name and surname, registered office or permanent residence, or, where applicable, the legal form and identification number;
  – the subject matter of the petition, indicating which rights, as alleged by the petitioner, have been infringed in the processing of personal data;
  – evidence in support of the allegations made in the petition;
  – a copy of the document proving the exercise of the right under Section 28, if such right could have been exercised, or a statement of the reasons deserving special consideration;
• The Office shall subsequently decide on the petitioner’s petition within 60 days from the date of commencement of the proceedings. In justified cases, the Office may appropriately extend this time limit, but by no more than 6 months. The Office shall inform the parties to the proceedings of the extension of the time limit in writing;
• A model petition to initiate personal data protection proceedings can be found on the Office’s website ( https://dataprotection.gov.sk/uoou/sites/default/files/vzor_navrhu_na_zacatie_konania_podla_noveho_zakona.docx ).

Processing of cookies

Cookies are small text files which may be sent to your web browser when you visit websites and stored on your device (a computer or another device with internet access, such as a smartphone or tablet). Cookies are stored in the file folder of your web browser. Cookies usually contain the name of the website from which they originate and the date of their creation. On your next visit to the site, the web browser reloads the cookies and sends this information back to the website that originally created the cookies. The processing of cookies always requires your prior consent, and such consent meets the requirements of consent under the GDPR. The only exception where we do not need your consent is the processing of so-called functional cookies (or technical cookies), which are necessary for the proper functioning of the website itself. We archive consent to the processing of cookies. Of course, as a data subject, you have the right to withdraw your consent at any time.

CCTV system

INFORMATION ON THE PROCESSING OF YOUR PERSONAL DATA

in accordance with Article 13 of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (hereinafter the “GDPR”) and in accordance with Section 19 of Act No. 18/2018 Coll. on Personal Data Protection (hereinafter the “Act”)

CCTV SYSTEM

Since the use of the CCTV system involves the processing of personal data, we would like to inform you, as a data subject, of your rights and of the conditions of the processing of your personal data. At the same time, we would like to assure you that the protection of your personal data is important to us and that, for this purpose, we have implemented security measures in accordance with the GDPR.

Pursuant to Article 32 of the General Data Protection Regulation, the Controller, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, has adopted appropriate technical and organisational measures to ensure a level of security appropriate to that risk.

Persons authorised to access the recording device have been entrusted with the processing of personal data, maintain confidentiality regarding the personal data with which they come into contact and are regularly trained in the field of personal data protection. Unauthorised persons do not have access to the recording device.

Protection of the property of the controller and of third parties

Purpose of processing: the legitimate interest pursued by the controller – specifically, the protection of the property of the controller and of third parties.

Legal basis for processing: Article 6(1)(f) of Regulation (EU) No 2016/679 of the EP and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation.

Each entrance to the monitored area is marked with a pictogram and a notice that the area is monitored by a CCTV system.

Category of recipients:
Recipient in a third country or international organisation: none
Recipient in another EU and EEA Member State: none
Public authority which processes personal data on the basis of law: law enforcement authorities and the court.

Data transfer: no data transfer takes place.

Retention period: 72 hours.

The Controller does not carry out automated decision-making, including profiling, referred to in Article 22(1) to (4) of the GDPR.

Rights of the data subject: as a data subject, you may exercise several rights, in particular the right of access to your data or the right to erasure. You can read more about the individual rights in the “Rights of the data subject” tab.

Documents in English: General Terms and Conditions · GDPR and Cookies · Alternative Dispute Resolution · Accommodation Rules · Complaints Procedure