GDPR

Information obligation of the controller

(hereafter referred to as the "EOI Principles")

pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation") in accordance with Section 19 of Act No. 18/2018 Coll. on the Protection of Personal Data (hereinafter referred to as the "Act").

CONTROLLER:

Business name: BizPartner Investments, j. s. a.

Registered office: Dlhé hony 5031/6

ID: 53 095 731

registered in ORSR OS Prešov

Contact details of the Operator:

Contact person:

Ing. Martin Fodor

+421 911 660 535

martin.fodor@bizpartnergroup.com

Rights of data subjects:

• Right of access to personal data
• Right to rectification
• Right to erasure
• Right to accuracy
• Right to restriction of processing
• Right to object
• Right to file a petition

The data subject is the natural person whose personal data we process, in particular, but not exclusively, employees and clients. Such data subjects about whom personal data are processed in our information systems for specified purposes have rights which they can exercise

in writing or electronically to the contact person of the controller. The data subject is YOU.

Right of access to personal data

i.e. the right to obtain confirmation from a competent person of whether personal data of the data subject who has exercised his or her right are being processed, and the right of access to those data. As a data subject, you are entitled to access information on: the purposes of the processing, the category of personal data concerned, the range of recipients, the duration of the processing and storage, the procedure for any automated processing or the consequences of such processing, etc. (Article 15 of the Regulation). As the controller, we have the right to use all reasonable measures to verify the identity of the data subject who requests access to the data, in particular in relation to online services and identifiers. At the request of the data subject, the controller will issue a confirmation as to whether the personal data relating to the data subject is being processed. Where the controller processes such data, it shall, upon request, issue a copy of those personal data to the data subject. The issue of the first copy shall be free of charge. For any additional copies requested

the person requests, the controller will charge a fee corresponding to the administrative costs incurred by the controller in issuing the copy. If the person requests the information by electronic means, it will be provided to him or her in a commonly used electronic form, in the form of an e-mail, unless he or she requests otherwise.

Right to restriction of processing

can be exercised if, as a data subject, you contest the accuracy of the personal data and other particulars within the meaning of Article 18, recital 67 of the Regulation, in the form of a temporary transfer of the selected personal data to another processing system, the blocking of users' access to the selected personal data, or the temporary removal of the processing.

Right to rectification

if the controller has incorrect personal data recorded about him or her. At the same time, the data subject shall have the right to completion of  incomplete personal data. The controller shall carry out the rectification or, where appropriate

Right to erasure

 "forgetting" those personal data relating to him/her. However, this right of the data subject is, due to its nature and gravity, limited by the establishment of further preconditions, i.e. the controller shall erase the personal data without undue delay after the exercise of this right by the data subject if one of the following conditions is met:  (a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) the data subject withdraws the consent on the basis of which the processing is carried out; (c) the data subject objects to the processing of the personal data; (d) the personal data have been unlawfully processed; (e) the ground for erasure is the fulfilment of an obligation imposed by law, a special regulation or an international treaty by which the Slovak Republic is bound; or (f) the personal data have been collected in connection with the offer of information society services to a person under the age of 16. 

The data subject will not have the right to erasure of the personal data provided that the processing is necessary:  (a) for the exercise of the right to freedom of expression and information; (b) for the performance of an obligation under a law, a special regulation or an international treaty by which the Slovak Republic is bound, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (c) for reasons of public interest in the field of public health; (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the right to erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing; or (e) for the establishment, exercise or defence of legal claims.

The controller shall erase the personal data of the data subjects upon request and without undue delay after it has assessed that the data subject's request is justified.

Right to bring an action

The data subject shall have the right to lodge a petition with the Office for Personal Data Protection of the Slovak Republic if he/she considers that his/her rights in the field of personal data protection have been violated.

Right to object

The data subject shall have the right to object at any time to processing of his or her personal data on grounds relating to his or her particular situation. He or she may object to the processing of his or her personal data on the grounds of (a) the performance of a task carried out in the public interest or in the exercise of official authority, or the legitimate interest of the controller; (b) the processing of personal data for direct marketing purposes; (c) processing for scientific or historical research purposes or for statistical purposes. We will consider the objection received within a reasonable time. In this case, we may not further process the personal data unless we can demonstrate compelling legitimate interests for the processing of the personal data which override the rights or interests of the data subject or grounds for asserting a legal claim.

Right to portability of personal data

As a data subject, you have the right to have the personal data that you have provided to the controller transferred to another controller in a commonly usable and machine-readable format, provided that the personal data have been collected on the basis of the data subject's consent or on the basis of a contract and their processing is carried out by automated means.

Further information:

- The purpose of the processing of personal data is the reason for which the controller processes the personal data of the data subjects in information systems on specifically identified legal bases. Any processing of personal data shall be based on a specific legal basis and for a specifically identified, legitimate and explicitly stated purpose.

- In order to protect your personal data to the maximum extent possible, we, as the Data Controller, have taken appropriate personal, organisational and technical measures. Our aim is to prevent or reduce the risk of leakage, misuse, disclosure or other use of your personal data as far as possible. In the event that a fact likely to result in a high risk to the rights and freedoms of natural persons should occur, you, as the data subject, will be contacted without delay (Article 34 of the Regulation).

- In order to preserve the principles of the processing of personal data laid down by the Regulation as well as by law, in particular the principle of data minimisation, we require from you as a data subject only those personal data which are a necessary legal or contractual requirement for the fulfilment of the purpose of the processing. Please note that failure to provide these mandatory data necessary for the conclusion of a contract may result in the contractual relationship not being concluded.

Purposes of processing, legal basis, categories of recipients, retention period, information on cross-border transfers, categories of data subjects and information on automated decision-making, including profiling, broken down by individual information systems:

SOCIAL NETWORKS

Purpose of processing personal data

- The purpose is to promote (direct and indirect marketing) and offer the Company's services on social networks, to communicate with users, to promote competitions and accompanying activities through social networks, to provide information to the general public

Legal basis

Article 6(1)(f) of the Regulation - Legitimate interest

A legitimate interest is: the creation of an official profile of the Company on the relevant social network (fanpage). The legitimate interest is the promotion (direct and indirect marketing) and offer of the Company's services on social networks, communication with users, organizing competitions and accompanying activities through social networks, providing information to the general public.

Social networks

The Operator operates the following social networking sites:

Facebook: https://www.facebook.com/

Instagram: https://www.instagram.com

Youtube: https://www.youtube.com/

TikTok: https://www.tiktok.com

Categories of recipients and personal data

• The data you post on our social networking sites is published through the social networking platform and is never processed or used by us for any other purpose. However, we reserve the right to delete infringing content if necessary, e.g. infringing posts, hateful comments, vulgar comments (e.g. with sexual content) or attachments(e.g. images or videos) that violate copyright, intellectual property rights, criminal law or the Company's ethical principles.
• We may share your content on our Site if it is a feature of a social networking platform and we communicate with you through the social networking platform. The legal basis is Article 6(1)(b) of the Regulation as we are jointly party to the social network contract and have accepted the terms and conditions of this service. In some cases, we may also have a legitimate interest under Article 6(1)(f) of the Regulation, which is justified by the Company's interest in developing our relationship with the public and communicating with you.
• With regard to data that you send us confidentially (e.g. via the private message function, by letter or email), we exclude in principle the transfer of this personal data to a third party outside the ownership structure of the BizPartner Group. Exceptionally, data may be processed through intermediaries authorised by us. These are carefully selected in each individual case, regularly checked by us and contractually bound in accordance with Article 28 of the Regulation. In addition, it may be necessary to refer your complaint to our contractual partner (e.g. our supplier in the case of product-specific requests) in order to deal with it. In these cases, your complaint will be anonymised before it is forwarded in such a way that a third party will not be able to associate it with you. If, in a particular case, it would also be necessary to pass on your personal data to a third party, we will inform you of this need in advance and ask for your consent.

Time limits for erasure of personal data. data

- All personal data that you have provided to us in connection with your complaint sent via direct message to our social networking site will be deleted or permanently anonymised (by deleting all your identification data) by us no later than 90 days after the final response has been sent to you.

The retention of data for 90 days after the final response has been sent reflects the fact that it may rarely be the case that you will contact us again on the same matter after receiving a response, and it will be necessary on our part to be able to follow up on the previous communication.

All social networking functionality is not managed and maintained by us and therefore, for example, all posts published on our social networking site will remain on your timeline indefinitely unless we remove them due to updating the underlying topics, or due to them being in breach of the law or our guidelines, or unless you remove the post yourself.

We have no control over the deletion of your data by the social network operator itself.

The privacy policy of the respective social network operator therefore additionally applies.

The retention period for Youtube can be found at https://www.youtube.com/legal/privacypolicy

Categories of data subjects

• Registered logged-in users, registered non-logged-in users and non-registered users

Social network platform operator

• In addition to us, the operator of the relevant social network platform is a separate operator. In some cases, it also acts as an agent for us in accordance with Article 28 of the Regulation in order to provide us with the management and operation of our account on the relevant social network. We remind you that the operator of the social network is also an independent controller carrying out the processing of personal data, over which, however, we have only limited influence, but whose terms and conditions you accepted when registering for the social network in question. In cases where we can influence and determine the terms and conditions of the processing of personal data, we endeavour, within the limits of the possibilities provided to us by the social network operator, to ensure that the processing of personal data is carried out in accordance with the relevant legislation.
• As mentioned above, where the provider of the social networking platform has allowed us to do so, we ensure that our social networking pages comply with data protection. Therefore, in particular, we do not define target groups for advertising purposes on the basis of demographic, interest parameters or location information, even if the social network provider has made such data available to us. We can only influence the statistics provided to us by the operator of the social network platform to a limited extent, but we cannot turn them off. However, we make sure that no additional optional statistics are provided to us.

Information about the existence of automated decision-making, including profiling - Not applicable

Cross-border transmission of axes. Data -The social media data of Facebook is processed by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook") as described in Facebook's policy at https://www.facebook.com/policy. The company would like to point out that, in this case, users' data may also be processed outside the European Union