Lessons learned

Privacy Policy Who is the controller of your personal data ?  The controller processing your personal data is : GUZMÄNNER, s.r.o., Námestie sv. Anny 20C/7269, 911 01 Trenčín. If you have any questions or comments regarding privacy issues, please use our email address: info@guzmanner.sk or write to us at the above correspondence address. Scope, legal basis and purpose of the processing of personal data  We process your personal data in accordance with applicable law and on the basis of the legal grounds arising from applicable law, with or without your consent. The controller processes your personal data only for the stated purpose, to the extent and for the period necessary to fulfil the stated purpose. The legal basis for the processing of personal data may be one of the following:

1. The processing is necessary for the performance of a contract to which the data subject is a party or to take pre-contractual measures at the request of the data subject,
2. The processing is necessary for compliance with a legal obligation to which the company is subject
3. The processing is necessary to protect the vital interests of the data subject or another natural person
4. The processing is necessary for the purposes of the legitimate interests of the company
5. Explicit consent to the processing of personal data given by the data subject for one or more specific purposes.
6. The processing of personal data is necessary for the execution of the order
7. The processing of the data subject's personal data is communicated to third parties, in particular to the transport company and the post office, for the purpose of delivering the goods.

  Processing of personal data with your consent Register of jobseekers

1. Scope of personal data : First name, surname, e-mail address, telephone number, highest education level or other data provided in the reply or response to the job offer
2. Legal basis : Processing based on your consent as a data subject pursuant to Article 6(1)(a) of the GDPR
3. Purpose : Inclusion in the selection process

Processing of personal data without your consent Performance of the contract, including the handling of any complaints

1. Scope of personal data : basic data, which are your name and surname, address, ID number, VAT number , contact data, which are your e-mail, telephone number or contact address, transaction data, other data provided in the order form, records of e-mail communication or other communication in electronic or other written form.
2. Legal basis : The processing of personal data is necessary for the performance of a contract to which the data subject is a party, or to carry out pre-contractual measures at the request of the data subject pursuant to Article 6(1)(b) of the GDPR - the processing is necessary for compliance with a legal obligation of the controller pursuant to Article 6(1)(c) of the GDPR
3. Purpose : Performance of rights and obligations under a contract or pre-contractual relationship

Accounting and tax purposes

1. Scope of personal data : billing data, which are your name and surname, address, ID number, VAT number
2. Legal basis : the processing is necessary for compliance with the legal obligation of the controller pursuant to Article 6(1)(c) of the GDPR
3. Purpose : accounting and tax records

  Clearance of outstanding overdue receivables

1. Scope of personal data : all personal data provided in the context of the performance of the contract
2. Legal basis : the processing is necessary for the purposes of the legitimate interests pursued by the controller pursuant to Article 6(1)(f) of the GDPR
3. Purpose : proper fulfilment of a monetary obligation under a contractual relationship

  Processing of messages sent via the contact form

1. Scope of personal data : name and surname, e-mail address, or other data provided in the contact form
2. Legal basis : The processing of personal data is necessary for the performance of a contract to which the data subject is a party or, at the request of the data subject, for the performance of pre-contractual measures pursuant to Article 6(1)(b) of the GDPR The processing is necessary for the purposes of the legitimate interests pursued by the controller pursuant to Article 6(1)(f) of the GDPR
3. Purpose : sales promotion and communication with potential customers

Contact line and contact e-mail

1. Scope of personal data : The data you tell us about yourself by phone or email
2. Legal basis : processing according to the specific content of your communication The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party pursuant to Article 6(1)(f) of the GDPR
3. Purpose : sales support and communication with potential customers

Who do we provide your personal data to ? When processing your personal data, we also use the services of vetted and contracted external business partners to help us process and protect your personal data. These are so-called intermediaries who process your personal data for our purposes, generally in the delivery of the services we have ordered. The recipients of personal data of data subjects are various groups of entities to which we provide your personal data, most often in the context of fulfilling our legal obligations or our own employees with whom you come into contact as data subjects.   Our intermediaries :

• Cloud service providers where personal data is processed
• Suppliers of software and technical support to the company
• Mail carriers and postal undertakings
• Lawyers, bailiffs, notaries
• Auditors

To which countries do we transfer your personal data ? As a standard practice, we restrict any cross-border transfers of personal data to third countries outside the European Economic Area unless it is necessary. However, some of our subcontractors and the aforementioned recipients of personal data may be established or their servers may be located in the United States of America, which - as such - constitutes a third country that does not guarantee protection of personal data equivalent to that of the EU. However, companies that have certified themselves under the so-called EU-US Privacy Shield mechanism are considered to provide adequate protection for personal data as in the EU under the EU Commission Decision. If we do transfer personal data to third countries, we do so only on the basis of the EU Commission's adequacy decision or require other data protection safeguards to be met (e.g., contractual clauses). Is there automated individual decision-making with legal effect on you ? At GUZMÄNNER, s.r.o., there is no decision-making based solely on automated processing, including profiling, which would have legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR. How long do we keep your personal data ?  Your personal data is processed for as long as it is necessary for the purposes for which the personal data is processed. We most often stop processing your personal data after :

• Expiry of the retention periods set out in the records retention schedule for records containing your personal data and after approval
• Expiry of the retention periods set out in the records management plan for records containing your personal data
• Expiry of the maximum retention period of your personal data processed for a specific purpose
• Full settlement of our mutual contractual obligations
• Withdrawal of your consent to the processing of personal data.

  Online media Cookies Cookies are used in various places on our website. Cookies cannot run programs or transmit viruses to your computer in the current state of the art. Cookies are usually small text files that users recognise when they use the website again. However, they do not store any personal data such as first name, last name or address. This information is not identifiable. Opening our website When you open our website, a browser is automatically sent to your end device without your intervention:

• IP address of the enabled end device
• Date and time of access
• Name and URL of the open file
• The website/application from which access was made (referrer - URL)
• the browser and, if applicable, operating system of your PC with internet access, as well as the name of your internet service provider
• The server of our website is temporarily stored in memory in a so-called Log - File for the following purposes : a) to ensure an uninterrupted connection b) to ensure comfortable use of our website/application c) evaluating the security and stability of the system

  Categories of recipients of personal data We provide your personal data only in justified cases and to the extent necessary to the following categories of recipients :

• Suppliers and service providers
• Accounting firms, auditors and tax advisors
• IT service providers
• Law firms, collection companies, courts and bailiffs
• Public authorities, including law enforcement authorities

We obtain your personal data from the following sources :

• The personal data has been provided by you as the data subject or personal data has been obtained by us in selected justified cases from public sources, lists and registers. Our company does not transfer your personal data to third countries or international organisations

  Retention period of personal data In the case of the data subject's consent pursuant to Article 6(1)(a) of the GDPR, we process your data until you withdraw your consent, but no more than 5 years after you have given it. In the case of performance of a contract pursuant to Article 6(1)(b) of the GDPR Regulation, we process your personal data for as long as the contractual relationship lasts. In the case of performance of a legal obligation pursuant to Article 6(1)(c) of the GDPR Regulation, we process your personal data for the period of time that results from specific legislation. In the case of a legitimate interest pursuant to Article 6(1)(f) of the GDPR Regulation, we process your personal data for the duration of the legitimate interest, depending on the specific purpose for which the personal data is processed.   Your rights as a data subject In relation to your personal data, you have the following rights against us, which we are prepared to exercise against you: You have the right to obtain confirmation from our company whether your personal data are being processed and, if so, your right to access those personal data and the following information: the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations, where applicable, the envisaged period of retention of the personal data or, if this is not possible, the criteria for determining this period of retention. Existence of a right request a repair from our company your personal data, erasure, restriction of processing, the right to object to such processing and the right to lodge a complaint with a supervisory authority, any available information as to its source if your personal data was not obtained from you as the data subject. The existence of automated decision-making, including the profiling referred to in Article 22(1) and (4) of the GDPR and, in such cases, at least meaningful information about the process used as well as the significance and foreseeable consequences of such processing for you as the data subject. The appropriate safeguards under Article 46 of the GDPR relating to the transfer if your personal data is transferred to a third country or an international organisation. If you make a request by electronic means, we will provide you with the information in a commonly used electronic format, unless you have requested otherwise. We will provide you with a copy of your personal datathat are processed. We may charge a reasonable fee for any additional copies you request, which will correspond to the administrative costs. The right to obtain a copy must not adversely affect the rights and freedoms of others. You have the right to rectification of your personal datawe process about you if your personal data is incorrect, incomplete or has changed. Please contact us and we will correct them without undue delay. You have the right to erasure your personal data if :

1. The personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
2. You have withdrawn the consent on the basis of which the processing is carried out and if there is no other legal basis for the processing
3. You have objected to being the subject of a decision based on automated processing of your personal data for direct marketing purposes
4. Personal data have been unlawfully processed
5. The personal data must be erased in order to comply with a legal obligation under Union law or the law of a Member State to which the controller is subject
6. The personal data was collected in connection with the offer of information society services.

If we have disclosed your personal data and we are required to erase it, we will take reasonable steps, including technical measures, taking into account the technology available and the cost of implementing the measures, to inform the controllers that process your personal data that you are asking them to erase any references to that personal data, or a copy or replica of it. You do not have the above rights if the processing is necessary :

1. To exercise the right to freedom of expression and information
2. For compliance with a legal obligation requiring processing under Union law or the law of a Member State to which our company is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in our company
3. For reasons of public interest in the field of public health in accordance with Article 9(2)(h) and (i) of the GDPR as well as Article 9(3) of the GDPR,
4. For archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the right to erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing
5. For proving, asserting or clarifying legal claims.

You have the right to restriction processing, unless :

1. You have challenged the accuracy of your personal data during the period allowing our company to verify the accuracy of your personal data,
2. If the processing is unlawful, you object to the erasure of your personal data and request restrictions on its use instead,
3. We no longer need your personal data for processing purposes, but you as the data subject need it to establish, exercise or defend legal claims
4. You have objected to the processing of your personal data pursuant to Article 21(1) of the GDPR, pending verification whether the legitimate grounds on the part of our company outweigh your legitimate grounds as a data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, be processed only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. We are obliged to inform you before the restriction of processing is lifted. You have the right to data portabilityconcerning you that you have provided to us to the other controller, in a structured, commonly used and machine-readable format, without hindering you if :

1. The processing is based on your consent pursuant to Article 6(1)(a) of the GDPR Regulation or Article 9(2)(a) of the GDPR Regulation or for the performance of a contract pursuant to Article 6(1)(b) of the GDPR Regulation; and
2. Where processing is carried out by automated means.

You have the right to the transfer of personal data directly from our company as the controller to the other controller, as far as technically possible. The right to data portability must not adversely affect the rights and freedoms of others. You have  the right to object to processing of your personal data by our company, which is carried out on the basis of Article 6(1)(e) of the GDPR Regulation or Article 6(1) of the GDPR Regulation, including objecting to profiling based on those provisions, as well as you have the right to object to the processing of your personal data by our company for the purposes of direct marketing, including profiling to the extent that it is related to such direct marketing. You have the right to automated individual decision-makingif you discover or believe that such processing is unlawful or in breach of your rights. The processing of personal data does not involve automated decision-making, including profiling, as referred to in Article 22(4) of the GDPR. You have the right to withdraw your consent to processing your personal data where the processing of your personal data is based on consent without affecting the lawfulness of processing based on consent given before its withdrawal. You have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava. You have the right to make a request, enquiry or complaint of our company. You can contact our company with your requests, questions or complaints by email : info@guzmanner.sk or by post at the address of our registered office.