Information Memorandum
Declaration of the controller on personal data protection
Bratislava, 20.05.2018
Contents
General information
The new personal data protection rules established by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) and Act No. 18/2018 Coll. of 29 November 2017 on the protection of personal data have been in effect since 25 May 2018.
ECS Slovensko, s r.o., Opletalova 75, 841 07 Bratislava, SR, Company ID: 44 996 365, as the data controller, would like to inform you that it respects the privacy of all data subjects it comes into contact with. It is important to us that everyone understands which personal data we process, why we do so and what your rights are.
We may process your personal data in various ways and in various situations depending on whether you are a customer, supplier, employee or job applicant, or another data subject.
We have prepared this Information Memorandum for you and recommend that you read it to find out how we handle your personal data.
If you have any questions after reading it, please send them by email to: ba-gdpr@kuester-group.com, or to the address of the controller ECS Slovensko, s r.o., Opletalova 75, 841 07 Bratislava, SR.
Data controller
The data controller is ECS Slovensko, s r.o., Opletalova 75, 841 07 Bratislava, SR, Company ID: 44 996 365, to which you have provided your personal data for the fulfilment of one or more purposes. The controller manages your personal data, processes it, disposes of it and is responsible for its lawful processing.
Data we process
We process only such personal data as is necessary to offer you professional services and products and to comply with our legal obligations and protect our legitimate interests. We collect data primarily about employees and our business partners.
Identification data
Such data includes name, surname, birth number, gender, marital status, date of birth, identity document number, home address, nationality, and if you are self-employed, also your company ID and address of the company you represent.
Contact data
We also process phone numbers and email addresses and data connected with the products and services you use from us.
Property protection – CCTV recordings
For the purpose of protecting property and the health of persons on company premises, we also operate CCTV camera systems. Recorded areas are clearly marked. CCTV recordings are used solely for the purpose of property and personal safety protection.
Reasons and purpose of processing
We always process personal data that we obtain from you or that third parties obtain from you on our behalf, e.g. recruitment agencies that provide us with your personal data to the necessary extent based on your consent.
- Processing of personal data for purposes required by specific legislation
- Processing of personal data necessary for the performance of a contract
- Processing of personal data necessary for the purposes of the company's legitimate interests
- Processing of personal data based on the data subject's consent
| Activity (what we do with personal data) | Purpose of processing (why we do it) | Legal basis | Categories of data subjects |
|---|---|---|---|
| We exchange personal data with the Processor | Preparation for hiring + entry interview | Framework agreement with the processor | Job applicant |
| We store data for the preparation of the employment contract | Preparation for hiring + entry interview | Consent | Job applicant |
| We file the data in the employee's file | Determining the qualifications of a potential employee | Consent | Job applicant |
| We use the data to register the employee as required by law | We must fulfil legal obligations when hiring an employee | Act No. 311/2001, 461/2003, 584/2004, 595/2003 Coll. | Company employee |
| We use the data to deregister the employee as required by law | We must fulfil legal obligations when deregistering an employee | Act No. 311/2001, 461/2003, 584/2004, 595/2003 Coll. | Company employee |
| We store data for the preparation of the employment contract | Preparation for hiring + entry interview | Consent | Job applicant |
| Personal data is stored for the records of agency workers | We have a legal obligation to do so | Act No. 5/2004, 311/2001, 461/2003, 584/2004, 595/2003, 124/2006 Coll. | Agency worker |
| We place personal data in the archive | For attendance records of agency workers | Legitimate interest | Agency worker |
| Fingerprint data is stored in the access system | For attendance records of agency workers | Legitimate interest | Agency worker |
| Printouts from the Patrol system | We want to create attendance reports for payroll | Legitimate interest | Agency worker |
| We upload data to the attendance system | Ensuring the technical operation of the attendance system | Legitimate interest | Company employee |
| We provide the supplier only with quantities and sizes | Protecting employees against accidents at work | Legitimate interest | Company employee |
| We provide the supplier with anonymised personal data for the production of clothing | We need to provide the manufacturer with clothing sizes | Legitimate interest | Company employee |
| We send personal data to the physician | Records for medical examinations | Act No. 311/2001 Coll. Labour Code | Company employee |
| Personal data is sent to the customer for record-keeping | Records for medical examinations – forklift trucks | Legitimate interest | Company employee |
| Personal data is sent to the customer for record-keeping | Verifying whether an employee may perform a specialised activity | Legitimate interest | Company employee |
| Personal data is processed by SDC | For processing employee travel allowances | Act No. 311/2001, 461/2003, 584/2004, 595/2003, 663/2007, 283/2002 Coll. | Company employee |
| We keep records of persons supplying and selling our products | Deliveries of goods | Legitimate interest | Supplier |
| We keep records of customer contacts | Deliveries of goods | Legitimate interest | Supplier |
| We provide a third party with presentation training | Keeping records for training | Consent | Company employee |
| We keep records of which employees have completed the training | Keeping records for training | Consent | Company employee |
Rights of data subjects
In connection with the processing of personal data, you have the following rights:
- the right of access to personal data,
- the right to rectification or completion,
- the right to erasure,
- the right to restriction of processing,
- the right to data portability,
- the right to object,
- the right not to be subject to automated individual decision-making, including profiling,
- the right to lodge a petition to initiate personal data protection proceedings.
Right of access to personal data
Upon your request, we will inform you whether and for what purpose we process your personal data, which categories of data, the list of recipients, the retention period, the source of the data and whether automated decision-making takes place.
Right to rectification and completion
You have the right to have your personal data rectified if you find that it is inaccurate or incorrect.
Right to erasure
You have the right to request the deletion of processed personal data. We will comply if we have no legal obligation to process the data and are not bound by other contracts.
Right to restriction of processing and portability
You have the right to have processing suspended and to receive your data in a structured, commonly used and machine-readable format, where technically feasible.
For questions, contact us at ba-gdpr@kuester-group.com.
Non-provision of personal data, Withdrawal of consent, Initiating proceedings
You have the right to refuse to provide personal data; however, if its provision is necessary, we cannot subsequently provide you with a service, sell you goods, employ you or allow you to enter the premises.
In cases where we require your consent, you are entitled to withdraw it at any time – by written request sent to the controller's address or by email to ba-gdpr@kuester-group.com. Withdrawal does not affect the processing of data during the validity of the consent or processing based on other legal grounds.
If you believe that your rights have been infringed, you are entitled to lodge a petition to initiate proceedings with the Office for Personal Data Protection of the Slovak Republic.
Privacy and personal data protection is supervised by:
Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
Hraničná 12, 820 07 Bratislava, SR · Company ID: 36 064 220
Phone: +421 (2) 3231 3214 · E-mail: statny.dozor@pdp.gov.sk
Data protection officer
The company has designated a data protection officer to ensure the proper performance of activities related to personal data protection. Questions and consultations regarding GDPR are handled at ba-gdpr@kuester-group.com.
Data protection officer (DPO) of the controller:
Ing. Michal Marák
E-mail: michal.marak@kuester-group.com
Phone: +421 907 813 338
Glossary
Personal data – data relating to an identified or identifiable natural person (name, identification number, location data, online identifier, etc.).
Consent of the data subject – a freely given, specific, informed and unambiguous indication of the data subject's wishes regarding the processing of personal data.
Processing of personal data – an operation or set of operations performed on personal data (collection, storage, alteration, retrieval, use, disclosure, erasure, etc.).
Profiling – automated processing to evaluate personal aspects of a natural person (performance, interests, behaviour, location, etc.).
Pseudonymisation – processing in such a manner that the data can no longer be attributed to a specific person without additional, separately kept information.
Controller – the one who determines the purposes and means of processing and processes data in its own name. Processor – the one who processes data on behalf of the controller. Data subject – any natural person whose data is being processed.
Controller: ECS Slovensko, s r.o. · Ing. Michal Marák – statutory body, managing director.