Personal data is any information relating to a designated or identifiable data subject. The data subject may be identified directly or indirectly on the basis of a number, code or one or more elements specific to his physical, physiological, mental, economic, cultural or social identity. Personal data includes, in particular, the contact details of natural persons, their IP address, which may be information on the use of services or on the activities and preferences of a natural person. The protection of personal data is regulated by Act no. 122/2013 Coll. and no. 18/2018 Coll. On the protection of personal data and with effect from 25 May 2018 Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (“GDPR”).
The purpose of this information is to explain how the Slovak Gas and Oil Association, with its registered office at Mlynské nivy 44 / a, 821 09 Bratislava, Slovak Republic, IČO: 30845475, registered by the Ministry of the Interior of the Slovak Republic under no. VVS / 1-2200 / 90-237 (“union”) processes the personal data of the data subjects and what are their rights under the regulation and the law on personal data protection.
1.1 How SPNZ obtains personal information
The association obtains personal data in the following ways:
- directly from its members when concluding a collective membership agreement or an individual member’s application;
- From publicly available sources such as public registers and records;
- from persons who have voluntarily provided the company with their personal data and given its consent to their processing (by telephone, e-mail, via the company’s website, when registering for an event organized by the association, etc.);
- from the authors of entries at events and to the journal and diploma competition
The Association acquires and processes personal data only to the extent that is appropriate for the purpose of their processing. The company places special emphasis on the security and protection of personal data and the rights of data subjects.
1.2 What is the legal basis and purpose of the processing
The company processes personal data on the basis of the following legal titles established by the Regulation and the Personal Data Protection Act:
- Legitimate interest
The Association may process the personal data of data subjects if this is necessary for the legitimate interests of the company or of third parties, but except where such interests outweigh the interests or fundamental rights and freedoms of the data subject requiring personal data protection, in particular the person concerned is a child. Such legitimate interests of the company are in particular:
- Protection of the rights which companies derive from generally binding legal regulations and contracts in relation to contractual partners and other persons; to this end, the company retains personal data for as long as is necessary to protect such rights and legitimate interests;
- marketing activities of the company, which means in particular information about the activities organized by the association and through a 100% subsidiary Slovenská plynárenská agentúra, s.r.o. This marketing communication is sent occasionally, usually several times a year; and for this purpose, the company retains personal data for a maximum of the legitimate interest of the company.
- Performance of the contract
The Association processes the personal data of the persons concerned for purposes related to the fulfillment of the contractual obligations of both parties, in particular the conclusion, changes and termination of the contract and the contractual relations resulting from the application for the event organized by the Association. The provision of personal data by the affected person of the association to the necessary extent is a condition for concluding a contract or participating in an event. Failure to provide personal data may prevent participation in an event organized by the association. The association shall provide the data subject with information on which personal data are necessary for the conclusion of the contract and which may be provided, for example, for the purpose of increasing the efficiency of communication.
The Association retains personal data for the purposes of performing the contract for the duration of the contractual relationship between the company and the person concerned and the necessary time after its termination.
- Compliance with legal obligations
The Association may process personal data, including their provision to state authorities and other persons, if such an obligation arises from the law. Due to a legal obligation, the Association may, for example, provide personal data to the Office for the Regulation of Network Industries, the Slovak Trade Inspection Authority, bodies active in criminal proceedings or other bodies or persons.
The Association retains personal data for the purposes of fulfilling a legal obligation for a maximum period necessary for the fulfillment of the relevant legal obligation stipulated by generally binding legal regulations.
- Consent given by the data subject
The association processes the personal data of the persons concerned with the consent expressly given by the person concerned.
The Association shall store personal data processed with the consent of the data subject for no longer than the duration of such consent or until its revocation, whichever is the earlier.
1.3 Who are the recipients of your personal information
The association may entrust the processing of personal data to third parties, the so-called intermediaries. The company’s intermediaries are, for example, persons who ensure the publication of Slovgas magazine for the company, an external employee for economic activities performing certain marketing activities, external vendors, consulting companies or security services. Intermediaries process personal data for the company exclusively on the basis of a contract on the processing of personal data, which must meet the requirements set by the Regulation and the Personal Data Protection Act, and in such cases the company strictly observes the protection of personal data provided by intermediaries.
1.4 What are the rights of the people affected
The person concerned has the right to:
- Require the union:
- Confirm whether or not her personal data is being processed. if personal data have not been obtained from the data subject, the data subject may request the provision of any available information as to its source (“ right of access to personal data “);
- if its personal data is processed, obtain access to personal data and other information and receive a copy of the personal data that the association processes (“ the right to be informed about the processing “); the company is entitled to charge the data subject a reasonable administrative fee in connection with the request for a copy of personal data;
- Correction of incorrect / incomplete personal data processed by the association (“ right to rectification “);
- Deletion of personal data if any of the reasons set out in the regulation or the law on personal data protection is met; in particular, if the personal data are no longer necessary for the purposes for which they were obtained or processed by the association, if the data subject withdraws his consent and the association has no other legal basis for processing, if the data subject objects to the processing or if the association processed personal data illegally; if official documents containing personal data are processed, the data subject may request their return (“ right of erasure “);
- Restriction on the processing of personal data if one of the grounds set out in the Regulation and the Personal Data Protection Act is met; for example, if the data subject reports that the company is processing incorrect personal data about him or her, he or she may request that such personal data not be processed until it has been corrected (“ right to restriction “);
- Obtaining personal data concerning it which it has provided to the association in a structured, commonly used and machine-readable format; the data subject has the right to transfer this personal data to another controller, if technically possible and if the conditions set out in the Regulation and the Personal Data Protection Act are met (“ right to portability “);
- to object, on grounds relating to the specific situation, to the processing of personal data concerning it which is necessary for the performance of a task carried out in the public interest, including objections to profiling; object to the processing of personal data for the purposes of direct marketing without its consent, including profiling, in so far as it relates to such direct marketing (“right to object”);
- To object not to be covered by a union decision based solely on automated processing, including profiling, which has legal effects affecting it or similarly significantly affecting it, unless otherwise provided by the regulation and the law on personal data protection ( “Automated decision-making, including profiling”);
- at any time withdraw the consent to the processing of personal data granted to the association with effect from the moment the withdrawal of consent (“right to withdraw consent”);
- if it is suspected that its personal data are being processed illegally, submit a proposal to initiate proceedings on personal data protection to the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 4826/12, 820 07 Bratislava, Slovak Republic, telephone number: + 421 2 3231 3220, www.dataprotection.gov.sk.
If the data subject does not have full legal capacity, his rights under the Regulation and the Personal Data Protection Act may be exercised by a legal representative. The rights of the data subject within the meaning of the regulation and the law on personal data protection, which does not live, can be exercised by a close person.
1.5 How affected individuals can exercise their rights
With regard to the possible risks of misuse and ensuring the protection of personal data of the data subjects, the association determines the means of communication by which the data subject’s request can be received and responded to in relation to the personal data processed by the association. the union also takes into account the technical aspects of some h the rights of the data subject and adapts the means of communication to ensure those rights of the data subject. in case of doubt about the identity of the person concerned, the association is entitled to request additional verification of his / her identity.
The person concerned may exercise his rights in the following ways:
- in person at the SPNZ Secretariat;
- by post (the signature of the person concerned must be officially certified) sent to the address of the registered office of the association;
- by e-mail to the union address firstname.lastname@example.org;
1.6 What is automatic decision making and profiling
In some cases, the association carries out automated decision-making, including the profiling of the personal data of the data subject, which has legal effects affecting or similarly significantly affecting him. In such cases, the association shall notify the person concerned of such processing in an appropriate manner.
For this purpose, the association may inform the person concerned who has provided them to the association in the framework of previous participations in the association’s events about the most suitable actions of the association (application).
The consequence of analyzing and evaluating the interest in the person concerned is to adapt the offers for the association’s activities (conferences, seminars on various topics) as close as possible to the needs of the person concerned.