Personal data processing policies
1. Introductory Provisions
EKOM spol. s r. o. (hereinafter referred to as the “Company” or the “Controller”) processes personal data of natural persons in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and Act No. 18/2018 Coll. on the Protection of Personal Data.
The purpose of these principles is to provide data subjects with adequate information on the conditions for the processing of personal data, in particular on the scope of the processed data, the purposes of processing, the legal bases, the recipients, and the retention period, as well as on the rights of the data subjects.
These principles apply in particular to:
- visitors to the website,
- business partners and their contact persons,
- job applicants,
- persons entering the Company’s premises.
2. Identification of the Controller
EKOM spol. s r. o.
Priemyselná 3051/18
921 01 Piešťany
Slovak Republic
e-mail: personal.data@ekom.sk
tel.: +421 33 7967 211
3. Principles of Personal Data Processing
The Company processes personal data in accordance with the principles set out in Article 5 GDPR, in particular:
- lawfulness, fairness and transparency,
- purpose limitation,
- data minimisation,
- accuracy,
- storage limitation,
- integrity and confidentiality.
Personal data are processed exclusively to the extent necessary to achieve the specified purpose and for the period necessary to fulfil that purpose.
4. Scope of Processed Personal Data
The Company processes personal data mainly to the following extent:
- identification data (first name, last name, title),
- contact data (e-mail address, telephone number, address),
- data resulting from communication between the data subject and the Company,
- professional data and data stated in the curriculum vitae,
- technical and electronic identifiers (IP address, cookies),
- video recordings from the camera system,
- data recorded upon entry into the premises.
The specific scope of processed personal data depends on the purpose of the processing and the nature of the legal relationship between the data subject and the Company.
5. Purposes of Personal Data Processing and Legal Bases
5.1 Visiting the Website
When visiting the website, personal data are processed through cookies and similar technologies.
Personal data may be processed for the purposes of:
- ensuring the proper functioning of the website,
- traffic analysis and content optimisation,
- carrying out marketing activities.
The legal basis for processing is:
- the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR (in the case of necessary cookies),
- the consent of the data subject pursuant to Article 6(1)(a) GDPR (in the case of analytical and marketing cookies).
Details on the processing of personal data through cookies are set out in a separate document: Information on cookies
5.2 Contact Forms and Communication
If a data subject contacts the Company through the contact form, e-mail, or in another way, personal data are processed to the extent necessary to handle the inquiry.
This concerns in particular:
- identification and contact data,
- the content of the communication.
The purpose of processing is in particular:
- handling the request,
- communication with the data subject,
- possible preparation of a contractual relationship.
The legal basis for processing is:
- taking steps prior to entering into a contract pursuant to Article 6(1)(b) GDPR,
- or, where applicable, the consent of the data subject pursuant to Article 6(1)(a) GDPR.
Personal data are retained for the period necessary to fulfil the purpose, usually for no more than 2 years, unless specific circumstances justify their longer retention.
5.3 Business Partners and Contact Persons
The Company processes personal data of natural persons acting on behalf of business partners, in particular to the extent of identification and contact data.
The purpose of processing is in particular:
- entering into and performing contractual relationships,
- conducting business communication,
- fulfilling legal obligations arising from specific legal regulations.
The legal basis for processing is:
- performance of a contract pursuant to Article 6(1)(b) GDPR,
- compliance with a legal obligation pursuant to Article 6(1)(c) GDPR,
- legitimate interest pursuant to Article 6(1)(f) GDPR (in particular in the case of regular business communication).
Personal data are retained for the duration of the contractual relationship and subsequently for the period required by legal regulations, in particular in the field of accounting and tax obligations.
5.4 Job Applicants
The Company processes personal data of job applicants to the extent necessary for carrying out the recruitment procedure.
This concerns in particular data contained in:
- the curriculum vitae,
- covering documents,
- communication between the applicant and the Company.
The purpose of processing is to assess the suitability of the candidate and to carry out the recruitment process.
The legal basis for processing is:
- taking steps prior to entering into an employment contract pursuant to Article 6(1)(b) GDPR,
- the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR.
If no employment relationship is established, the personal data are erased without undue delay, unless there is another legal basis for their further retention.
5.5 Camera System
A camera system may be operated on the Company’s premises.
The purpose of processing is in particular:
- protection of the controller’s property,
- ensuring the safety of persons,
- prevention and clarification of unlawful activities.
The legal basis for processing is the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR.
Video recordings are retained for the period necessary, usually not exceeding 72 hours, unless they need to be retained longer for the purpose of resolving a specific incident.
5.6 Visitor Log
Upon entry into the Company’s premises, personal data may be processed as part of the visitor log.
The processed data may include:
- first name and last name,
- company name,
- time of entry and departure.
The purpose of processing is to ensure access control to the premises and to protect security.
The legal basis for processing is the legitimate interest of the controller.
6. Recipients of Personal Data
Personal data may be disclosed to third parties, in particular:
- providers of IT and technical services,
- providers of marketing and analytical tools,
- legal, tax and accounting advisers,
- public authorities in cases provided for by legal regulations.
The Company has concluded personal data processing agreements with processors in accordance with Article 28 GDPR.
7. Transfer to Third Countries
Transfers of personal data to third countries take place only to the extent necessary, in particular in connection with the use of global technological solutions.
Such transfer is carried out in accordance with GDPR, in particular through standard contractual clauses or other appropriate safeguards.
8. Retention Period of Personal Data
Personal data are retained for the period necessary to fulfil the purpose of processing, taking into account in particular:
- the nature and purpose of processing,
- the controller’s legal obligations,
- the need to protect legal claims.
9. Rights of Data Subjects
The data subject has the right to:
- request access to personal data,
- rectification of inaccurate or incomplete data,
- erasure of personal data if the legal conditions are met,
- restriction of processing,
- object to processing,
- data portability,
- withdraw consent at any time,
- lodge a complaint with the supervisory authority.
The supervisory authority is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Námestie 1.mája 18, 811 06 Bratislava; https://dataprotection.gov.sk/uoou/sk.
10. Final Provisions
These principles may be updated from time to time. The current version is always available on the Company’s website.
