GDPR (General Data Protection Regulation)

MAC - GASTRO spol. s r. o., Dulovo nám. 1, 821 08 Bratislava, Registration OR MS BA III, No. 2524/B, Company ID No. (IČO): 31320589, Tax ID No. (DIČ): 2020516839, VAT ID No. (IČ DPH): SK2020516839, as the controller, provides data subjects with this PRIVACY POLICY on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation") and Article 19 of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts.

Purpose of the processing of personal data in the Register of Accounting and Tax Documents: the activity involves the processing of personal data in the processing of accounting documents, and the administrative work associated with its processing.

Categories of data subjects: natural persons – clients, employees.

Type of personal data: name, surname, title, permanent address, temporary address, telephone number, email address, date of birth, type and number of identity document, signature, bank account number of the natural person.

Legal basis for the processing of personal data: Act No. 431/2002 Coll. on Accounting, as amended; Act No. 222/2004 Coll. on Value Added Tax, as amended; Act No. 40/1964 Coll., the Civil Code, as amended; Act No. 152/1994 Coll. on the Social Fund and on Amending Act No. 286/1992 Coll. on Income Tax, as amended; Act No. 311/2001 Coll., the Labour Code, as amended.

Categories of recipients: the Social Insurance Agency, health insurance companies, tax office, and entities to which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities. No transfer of personal data to third countries takes place.

Time limits for erasure of personal data: 10 years for accounting documents. No automated decision-making, including profiling, takes place. In order to comply with the principle of minimisation, all personal data provided by you are a necessary legal requirement for the fulfilment of the purpose of their processing.

Purpose of the processing of personal data in the Incoming and Outgoing Mail Register and in the administration of the registry: the activity involves the processing of personal data in the registration of incoming and outgoing mail, and in operations related to the administration of the registry.

Categories of data subjects: natural persons – addressees, employees.

Type of personal data: name, surname, title, address, name of organisation, job title, email address, subject and content of mail.

Legal basis for the processing of personal data: Act No. 395/2002 Coll. on Archives and Registers and on Amendments to Certain Acts.

Categories of recipients: entities to which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities. No transfer of personal data to third countries takes place.

Time limits for erasure of personal data: 3 years for routine correspondence. No automated decision making, including profiling, takes place. In order to comply with the principle of minimisation, all personal data provided by you are a necessary legal requirement for the fulfilment of the purpose of their processing.

Purpose of the processing personal data – accommodated guests/foreigners. The activity involves the processing of personal data in the registration of hotel services, hotel guests, room reservations, the registration of personal data in the guest databank of the hotel system, and the registration of guests-foreigners.

Categories of data subjects: clients – accommodated guests.

Type of personal data: name, surname, title, date and place of birth, citizenship, permanent residence in the home country, purpose of travel to the Slovak Republic, passport number, visa: type, number, validity, name and address of the accommodation in the Slovak Republic, accompanying children, length of stay in Slovakia. Legal basis for the processing of personal data: Act No. 40/1964 Coll., the Civil Code; Act No. 455/1991 Coll. on Trade Business; Act No. 595/2003 Coll. on Income Tax; Act No. 222/2004 Coll. on Value Added Tax; Act No. 431/2002 Coll. on Accounting; full text of Act No. 496/2008 Coll.; Act No. 253/1998 Coll. on Reporting the Residence of Citizens of the Slovak Republic and the Population Register of the Slovak Republic, as amended; Act No. 582/2004 Coll. on Local Taxes and the Local Fee for Municipal Waste and Small Construction Waste, as amended; Act No. 404/2011 Coll. on the Stay of Aliens and on Amendments to Certain Acts, as amended. Categories of recipients: entities to which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities. No transfer of personal data to third countries takes place.

Time limits for erasure of personal data: 5 years. No automated decision-making, including profiling, takes place. In order to comply with the principle of minimisation, all personal data provided by you are a necessary legal requirement for the fulfilment of the purpose of their processing.

Purpose of the processing of personal data – reservation system: the activity involves the processing of personal data for records related to the reservation of the services provided.

Categories of data subjects: natural persons – customers/clients.

Type of personal data: title, name, surname, telephone number, email, reservation date and time.

Legal basis for the processing personal data: consent of the data subject. Categories of recipients: entities to which a special regulation confers the power to decide on the rights and obligations of natural persons: courts, law enforcement authorities. No transfer of personal data to third countries takes place.

Time limits for erasure of personal data: 2 years. No automated decision-making, including profiling, takes place. The data subject shall have the right to withdraw consent to the processing of personal data concerning him or her at any time. Withdrawal of consent shall not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal; the data subject shall be informed of this fact before consent is given.

The data subject may withdraw consent in the same way as he or she gave consent.

Purpose of the processing of personal data in the camera information system: the activities include the processing of personal data for the purpose of the maintenance of order and security, the detection of crime, and the protection of health and property.

Categories of data subjects: persons present in the area monitored by the CCTV system.

Type of personal data: CCTV footage. Legal basis for the processing of personal data: the legitimate interest of the controller. Categories of recipients: courts, law enforcement authorities – the processing is necessary for the fulfilment of the legal obligation of the controller pursuant to Act 301/2005 Coll., the Code of Criminal Procedure, as amended; Act No. 162/2015 Coll. the Administrative Procedure Code, as amended by Act No. 88/2017 Coll.; Act No. 125/2016 Coll. on Certain Measures Related to the Adoption of the Civil Dispute Code, the Civil Non-Dispute Code and the Administrative Procedure Code and on Amendments to Certain Acts. Authorised state authority – the processing is necessary for the fulfilment of the legal obligation of the controller within the meaning of the General Data Protection Regulation. No transfer of personal data to third countries takes place.

Time limits for erasure of personal data: 7 days for audio/video recordings. No automated decision-making, including profiling, takes place. The main legitimate interest is the protection of the property, financial and other interests of the controller, as well as the protection of the property, life and health of the data subjects. Data subjects about whom personal data are processed for specified purposes may exercise the following rights: Right to request access to their personal data – Right to rectification of personal data – Right to erasure of personal data – Right to restriction of processing of personal data – Right to object to the processing of personal data – Right to data portability of personal data – Right to lodge a complaint with a supervisory authority, i.e. the Office for Personal Data Protection of the Slovak Republic; the above rights of the data subject are further specified in Articles 15 to 21 of the Regulation. The data subject shall exercise these rights in accordance with the Regulation and other relevant legal regulations. The data subject may exercise his or her rights vis-à-vis the controller by means of a written request or by electronic means. Where the data subject requests the information orally, the information may be provided in this way, provided that the data subject has provided proof of his or her identity. MAC-GASTRO spol. s r. o. has taken all appropriate personal, organisational and technical measures to protect your personal data to the greatest extent possible in order to reduce the risk of misuse. Pursuant to our obligation under Article 34 of the Regulation, we hereby notify you, as data subjects, that if a situation arises where we, as the controller, breach the protection of your personal data in a way that is likely to result in a high risk to the rights and freedoms of natural persons, we will notify you of this without undue delay. The legal regulations and related ways of processing of your personal data may change. If we decide to update this policy, we will post the changes on our website and notify you of the changes. In cases where there is to be a major change to this policy, or where we are required to do so by law, we will inform you in advance. We ask that you read this policy carefully and check this policy regularly when you communicate with us or use our website.

If you have any questions regarding the processing of your personal data, including the exercise of the above rights, you can contact our Responsible Person provided by EuroTRADING s.r.o. (www.eurotrading.sk) by email at zo@eurotrading.sk. We will properly investigate all your suggestions and complaints and send you a statement. If you are not satisfied with our response or believe that we are processing your personal data unfairly or unlawfully, you may lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, https://dataprotection.gov.sk, Hraničná 12, 820 07 Bratislava 27; tel. number: +421 /2/ 3231 3214; Email: statny.dozor@pdp.gov.sk

The supervision of the processing of personal data in our company is provided by EuroTRADING s.r.o., and in accordance with § 44 of Act no. 18/20128 Coll. and Article No. 37 REGULATION OF THE EUROPEAN PARLIAMENT AND COUNCIL (EU) 2016/679, provides us with a responsible person who can be contacted at zo@eurotrading.sk. You can read more information here: www.eurotrading.sk/zo