Privacy policy

This is a translation provided for information purposes. In the event of any discrepancy, the Slovak version of this document shall prevail.

Information for the data subject in connection with the collection and processing of personal data, provided by the controller to the data subject when collecting personal data from the data subject

The Controller hereby, in accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the "Regulation"), provides the Data Subject, from whom the Controller obtains personal data relating to them, with the following information:

Identity and contact details of the Controller:

The Controller is Wellipt s.r.o., with its registered office at Družby 318/56, 976 81 Podbrezová, Company ID (IČO): 56 210 914, Tax ID (DIČ): 2122241781, registered in the Commercial Register of the District Court Banská Bystrica, section: Sro, insert no. 49149/S, email: masazetatry@masazetatry.sk, phone number: +421 944 327 347.

Contact details of the data protection officer:

No data protection officer has been appointed.

Personal data processed:

The Controller processes the following personal data: first name, surname, place of residence, billing address, phone number, email address, IP address, cookies, account number, bank name, signature, health data.

Purposes of processing the Data Subject's personal data:

The purposes of processing the Data Subject's personal data are:

  • processing of accounting documents
  • performance and record-keeping of contracts
  • provision of massage services
  • records of clients and contractual partners for the purpose of concluding and performing contracts
  • archiving of documents in accordance with the law
  • correspondence and communication
  • marketing activities of the Controller

Legal basis for processing the Data Subject's personal data:

Depending on the specific personal data and the purpose of their processing, the legal basis for processing the Data Subject's personal data will be the consent of the data subject, compliance with a legal obligation of the controller, or the performance of a contract.

Specification of the legitimate interests pursued by the Controller or a third party:  Not applicable.

Recipients or categories of recipients of personal data:

Recipients of the Data Subject's personal data may be the controller's employees and associates, its business partners, suppliers and contractual partners, in particular: the accounting company, the company providing legal services to the controller, and the company providing services related to software development and maintenance.

Recipients of personal data will also be courts, law enforcement authorities, the tax office and other state authorities, in cases laid down by law.

Information on the intended transfer of personal data to a third country: No transfer takes place.

Personal data retention period:

In accordance with the law, personal data will be kept for the time necessary for the purposes of performing the contract and their subsequent archiving. If personal data are processed on the basis of the data subject's consent, they will be processed during that period. Personal data are processed at most until the Data Subject withdraws their consent to their processing or makes another request.

Information on the existence of the Data Subject's relevant rights:

Among other things, the Data Subject has the following rights:

1. the data subject's right of access under Article 15 of the Regulation, which includes:

  • the right to obtain from the Controller confirmation as to whether personal data concerning the Data Subject are being processed;
  • where the Data Subject's personal data are being processed, the right to access the personal data processed and the right to the following information:
    • information on the purposes of the processing;
    • information on the categories of personal data concerned;
    • information on the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
    • where possible, information on the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;
    • information on the existence of the right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data concerning the Data Subject, and of the right to object to such processing;
    • information on the right to lodge a complaint with a supervisory authority;
    • where the personal data are not collected from the Data Subject, any available information as to their source;
    • information on the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject;

2. the Data Subject's right to rectification under Article 16 of the Regulation, which includes:

  • the right to have the Controller rectify without undue delay inaccurate personal data concerning the Data Subject;
  • the right to have incomplete personal data of the Data Subject completed, including by means of providing a supplementary statement by the Data Subject;

3. the Data Subject's right to erasure of personal data (the "right to be forgotten") under Article 17 of the Regulation, which includes:

  • the right to obtain from the Controller the erasure of personal data concerning the Data Subject without undue delay where one of the following grounds applies:
    • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
    • the Data Subject withdraws the consent on which the processing is based, provided that there is no other legal ground for the processing of personal data;
    • the Data Subject objects to the processing of personal data under Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing, or the Data Subject objects to the processing of personal data under Article 21(2) of the Regulation;
    • the personal data have been unlawfully processed;
    • the personal data have to be erased for compliance with a legal obligation under European Union or Member State law to which the Controller is subject;
    • the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the Regulation;
  • the right that the Controller, which has made the Data Subject's personal data public, taking account of available technology and the cost of implementation, takes reasonable steps, including technical measures, to inform other controllers processing the personal data that the Data Subject has requested the erasure of any links to, or copies or replications of, those personal data;

whereby the right to erasure of personal data with the content of the rights under Article 17(1) and (2) of the Regulation [i.e. with the content of the rights under (i) and (ii) of this letter c) of point J. of this document] shall not arise to the extent that the processing of personal data is necessary:

  1. for exercising the right of freedom of expression and information;
  2. for compliance with a legal obligation which requires processing under European Union or Member State law to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
  3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the Regulation;
  4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the Regulation, in so far as the right referred to in Article 17(1) of the Regulation is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  5.  for the establishment, exercise or defence of legal claims;

4. the Data Subject's right to restriction of processing under Article 18 of the Regulation, which includes:

  • the right to obtain from the Controller restriction of processing of personal data where one of the following applies:
    • the accuracy of the personal data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the personal data;
    • the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
    • the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
    • the Data Subject has objected to processing under Article 21(1) of the Regulation, pending the verification whether the legitimate grounds of the Controller override those of the Data Subject;
  • the right that, where processing of personal data has been restricted under point (i) of this letter d) of point J. of this document, such personal data shall, with the exception of storage, only be processed with the Data Subject's consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State;
  • the right to be informed in advance before the restriction of processing is lifted;

5. the Data Subject's right to have the notification obligation towards recipients fulfilled under Article 19 of the Regulation, which includes:

  • the right that the Controller communicates any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 of the Regulation to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort;
  • the right that the Controller informs the Data Subject about those recipients if the Data Subject requests it;

6. the Data Subject's right to data portability under Article 20 of the Regulation, which includes:

  • the right to receive the personal data concerning the Data Subject, which they have provided to the Controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller, where:
    • the processing is based on the Data Subject's consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the Regulation, or on a contract pursuant to Article 6(1)(b) of the Regulation, and at the same time
    • the processing is carried out by automated means, and at the same time
    • the right to receive personal data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller will not adversely affect the rights and freedoms of others;
  • the right to have the personal data transmitted directly from one controller to another, where technically feasible;

7. the Data Subject's right to object under Article 21 of the Regulation, which includes:

  • the right to object at any time, on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning them which is based on Article 6(1)(e) or (f) of the Regulation, including profiling based on those provisions of the Regulation;
  • [when exercising the right to object at any time, on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning them which is based on Article 6(1)(e) or (f) of the Regulation, including profiling based on those provisions of the Regulation] the right that the Controller no longer processes the Data Subject's personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or defence of legal claims;
  • the right to object at any time to the processing of personal data concerning the Data Subject for direct marketing purposes, including profiling to the extent that it is related to such direct marketing; where the Data Subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes;
  • (in the context of the use of information society services) the right to exercise the right to object to the processing of personal data by automated means using technical specifications;
  • the right to object, on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning the Data Subject where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the Regulation, unless the processing is necessary for the performance of a task carried out for reasons of public interest;

8. the Data Subject's right related to automated individual decision-making under Article 22 of the Regulation, which includes:

  • the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects them, with the exception of the cases under Article 22(2) of the Regulation [i.e. except where the decision is: (a) necessary for entering into, or performance of, a contract between the Data Subject and the Controller, (b) authorised by European Union or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard the Data Subject's rights and freedoms and legitimate interests, or (c) based on the Data Subject's explicit consent].

Information on the Data Subject's right to withdraw consent to the processing of personal data:

The Data Subject is entitled to withdraw their consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

The Data Subject is entitled to withdraw their consent to the processing of personal data at any time – in full or only in part. Partial withdrawal of consent may relate to a certain type of processing operation / processing operations, while the lawfulness of the processing of personal data in respect of the remaining processing operations remains unaffected. Partial withdrawal of consent may relate to a certain specific purpose / certain specific purposes of processing personal data, while the lawfulness of the processing of personal data for other purposes remains unaffected.

The Data Subject may exercise the right to withdraw consent to the processing of personal data in paper form to the Controller's address registered as its registered office in the commercial register at the time of withdrawal of consent, or electronically (by sending an email to the Controller's email address stated in the identification of the Controller in this document, or by filling in the electronic form published on the Controller's website).

 

Information on the Data Subject's right to lodge a complaint with a supervisory authority:

The Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, if they consider that the processing of personal data relating to them infringes the Regulation, without prejudice to any other administrative or judicial remedy. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, Company ID: 36 064 220, email: statny.dozor@pdp.gov.sk, phone: +421 2 3231 3214.

 

Information on the existence / non-existence of an obligation of the Data Subject to provide personal data:

The Controller informs the Data Subject that the provision of the Data Subject's personal data is necessary for concluding and performing the contract. The Controller informs the Data Subject that the Data Subject is not obliged to provide personal data or to give consent to their processing. The consequence of not providing personal data and/or not giving consent to the processing of personal data will be that the Controller will not be able to conclude and perform the contract.