Information provided to data subjects
if personal data have not been obtained from the data subject
in accordance with Art. 14 of the GDPR
Data subjects: the controller’s contractors and persons whose personal data are processed by the controller’s contractors1
The controller Garwan Consulting s.r.o. with registered office at Palackého 4, 811 02 Bratislava, IČO: 44 006 101, processes the personal data of natural persons in the processing activities below:
- Registering contractors,
- Operating customer information systems (as a processor on behalf of customers),
- Recording requests by data subjects.
The controller guarantees the protection of personal data processed through specific measures. No processed personal data will be transferred to countries that fail to provide an adequate level of protection. No processed personal data will be made public.
No controller’s representative has been named. No data protection officer has been appointed to supervise personal data protection.
The supervisory authority is the Office for Personal Data Protection, Hraničná 12, Bratislava.
The purposes of the processing of personal data in individual processing activities, the categories of personal data concerned, the recipients or categories of recipients of personal data, the conditions for disclosure and registry and the retention periods of processed personal data are described in the supplement to this information.
Data subjects are required to provide the controller with data the controller is obliged to process in compliance with specific laws.
Data subjects are not required to provide the controller with data necessary for contractual negotiations and for performance of contracts; the relevant contract cannot be agreed without the provision of such data.
A data subject has the right:
- To request from the controller access to his/her personal data concerning him/her;
- To request from the controller personal data concerning him/her which the data subject has provided to the controller, in a structured, commonly used and machine-readable format in order to transfer the data to another contractor (applies only to customers and contractors that are natural persons);
- To request from the controller rectification of processed personal data;
- To request from the controller erasure of processed personal data;
- To request from the controller restriction of the processing and to object to the processing if the legal basis is not a legal obligation by the controller to process the personal data;
- To lodge a complaint with the supervisory authority;
- To require from the controller information about the source where the personal data originate, and if applicable, whether it came from publicly applicable sources.
A data subject cannot exercise the right to revoke his/her consent in described process activities because the consent of a data subject is not the legal basis for them.
A data subject cannot exercise the right to object to automated decision-making in the described sets of processing activities because they do not involve automatic decision-making.
Questions, suggestions and actions relating to the exercise of rights concerning to the processing of personal data may be made by e-mail to: info@garwan.sk
Supplement to information provided to data subjects
if personal data have not been obtained from the data subject
in accordance with Art. 14 of the GDPR
Data subjects: the controller’s contractors
| Registering contractors | |
|---|---|
| Purpose of processing personal data and legitimate interests of the controller | Registering contractors (self-employed) and natural persons acting on behalf of contractors (legal persons). |
| Data subjects | Contractors (self-employed) and natural persons acting on behalf of contractors (legal persons). |
| Personal data to be processed | Full name, business data, trade name and registered office. |
| Personal data processed by a processor on the controller’s behalf | |
| Processing activities | Processors |
| Financial accounting | Contracted service provider |
| IT infrastructure management and hardware servicing | Contracted service provider |
| Legal services | Law office, contracted service provider |
| Disclosure of personal data | |
| Recipients | Legal basis |
| Courts, enforcement agents | Commercial Code; Civil Code; Civil Litigation Procedure Code |
| Law enforcement agencies | Penal Code |
| Envisaged time limit for erasure of personal data | |
| Category | Period-/legal basis |
| Natural person’s contact data | 4 years/as provided in Sec. 397 of the Commercial Code (individuals - self-employed, individuals acting on behalf of legal entities) |
| Information about business cases | 10 years/as provided by income tax and value added tax laws |
Information provided to data subjects
if personal data have not been obtained from the data subject
in accordance with Art. 14 of the GDPR
Data subjects: persons whose personal data are processed by the controller’s contractors
| Information systems of customers | |
|---|---|
| Purpose of processing personal data and legitimate interests of the controller | Managing customer applications - IS operators, upgrading and updating applications, in exceptional cases logical access to processed personal data. |
| Data subjects | Natural persons whose personal data are processed through processing applications. |
| Personal data to be processed | Scope of processed personal data is determined by the controller. |
| Subcontracted processing | |
| Processing activities | Processors |
|
access to processed data data correction on demand |
contracted subcontractors |
| Disclosure of personal data | |
| Recipients | Legal basis |
| None | |
| Envisaged time limit for erasure of personal data | |
| Category | Period-/legal basis |
| All processed data | Period determined by the controller (customer of Garwan Consulting s.r.o.) |
Information provided to data subjects
if personal data have not been obtained from the data subject
in accordance with Art. 14 of the GDPR
Data subjects: the controller’s contractors and persons whose personal data are processed by the controller’s contractors
| Data subject requests | |
|---|---|
| Purpose of processing personal data and legitimate interests of the controller | Recording data subject requests and initiatives - requests for access, rectification, erasure and restriction of processing, requirements for provision of data for transfer, objections to processing of personal data for marketing purposes and objections to profiling and automated decision-making. |
| Data subjects | Persons submitting requests for access, rectification, erasure and restriction of processing, requirements for provision of data for transfer, objections to processing of personal data for marketing purposes and objections to profiling and automated decision-making. |
| Personal data to be processed | Full name and permanent residence or postal address. |
| Personal data processed by a processor on the controller’s behalf | |
| Processing activities | Processors |
| Legal services | Law offices |
| IT infrastructure management and hardware servicing | Contracted service provider |
| Records management | Contracted service provider |
| Supervision over personal data protection | Contracted data officer |
| Disclosure of personal data | |
| Recipients | Legal basis |
| Courts | Civil Code, Civil Litigation Procedure Code |
| Envisaged time limit for erasure of personal data | |
| Category | Period-/legal basis |
| All processed data | 3 years/as provided in Sec. 100 of the Civil Code (individual consumers) |
1 This information describes only personal data processing activities disclosed under provisions of Art. 14 (5) (b) of the GDPR