General Data Protection Regulation
Instruction on the rights of the data subject
in accordance with Act no. 18/2018 Coll. on the protection of personal data (hereinafter referred to as the “Act”) and in accordance with the Regulation of the European parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “Regulation”)
I. Right to information (Art. 13 of the Regulation)
With the aim of the information obligation of the controller, which represents the right of the data subject to information, in line with Art. 19 of the Act and Art. 13 of the Regulation, the controller hereby provides the data subject with the following information:
(i) Identification data and contact data of the controller:
Business name : Carlton Property, s. r. o.
Seat : Hviezdoslavovo nám. 3, 811 02 Bratislava
Id. no. : 36 860 492
Registration : Commercial Register of the
District Court Bratislava I, Section : Sro, File no.: 54960/B
Tel. : +421 2 3266 1280
E-mail : firstname.lastname@example.org
(ii) Contact data of the data protection officer:
Name and surname : Matej Sojka
Tel. : +421 905 303 903
E-mail : email@example.com
(iii) List of processed personal data:
- name and surname,
- mail address,
- No. of ID card,
- purpose of the visit,
- CCTV recording
(iv) The purposes of the processing of the personal data of the data subject by the controller:
- the record and restriction of entry of persons in the premises of our company, monitoring of the premises of our company through the camera system.
The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter f) of the Regulation, i. e. our legitimate interest. Our legitimate interest is the protection of the property of our company, property and health of persons moving within the premises of our company and the restriction of the entry of unwelcomed persons in our premises.
- sending of info newsletters of Carlton complex, in particular with regard to the events organized in the premises of the Controller, daily menu and other events of the Savoy restaurant, traffic constraints, fire training courses.
The legal basis for the processing of your personal data for this purpose is Art. 6, para. 1, letter a) of the Regulation, i. e. your explicit consent to the processing of the personal data.
(v) We shall process your personal data you provide us with for the purpose of the record and restriction of entry of persons in the premises of our company as stated above (i.e. name, surname, No. of ID card, purpose of the visit) in the period of 2 years. After the laps of this period, the personal data shall be deleted.
We shall process your personal data you provide us with for the purpose of sending of info newsletters of Carlton complex as stated above (i.e. name, surname, e-mail address) until the termination of the lease between the company you work for and us, resp. until the termination of your employment relationship with the tenant, whichever occurs earlier. After the laps of this period, the personal data shall be deleted.
(vi) We inevitably need your personal data for the purpose of record and monitoring of the entry in our premises;
(vii) Any of your personal data shall be archived in our internal systems and shall not be further provided neither made accessible by us to third persons.
II. Further rights of the data subject
(i) Right to withdraw the consent (art. 7 par. 3 of the Regulation)
You shall have the right to withdraw your consent with processing your personal data at any time, the same mean it was granted to us. However, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
(ii) Right of access (art. 15 of the Regulation)
You shall have the right to obtain the confirmation as to whether or not your personal data are being processed and where that is the case, you shall have the right to obtain access to the personal data (copies thereof), as well as any additional information in the extent prescribed by Article 15 of the Regulation. In the majority of cases, these copies of your personal data and any additional information shall be provided in written document form, unless you ask for a different form of provision. Shall you make the request by electronic means, the data shall be provided electronically, if technically possible.
(iii) Right to rectification of personal data (art. 16 of the Regulation)
We take appropriate actions to secure accuracy, completeness and relevance of your personal data provided to us. This right entitles you to request the rectification of inaccurate personal data and complete your personal data, if incorrect, incomplete or irrelevant without undue delay.
(iv) Right to erasure of personal data (right to “be forgotten”) (art. 17 of the Regulation)
You shall have the right to request the erasure of your personal data without undue delay after such request, for example in case your personal data are no longer necessary in relation to the purpose for which we collected and processed them, if you withdraw the consent on which the processing is based, if you object to the processing of such personal data pursuant to art. 21 para. 1 of the Regulation or if your personal data have been processed unlawfully. It is necessary to evaluate this right with the relevant circumstances. For example, we could have certain legal and regulation obligations, meaning we could not comply with such a request.
(v) Right to restriction of processing of personal data (art. 18 of the Regulation)
In certain cases, as specified by the law, you shall have the right to request from us to stop processing your personal data, e.g. if you object the accuracy of the personal data we have on you (albeit only during the period allowing us to verify the accuracy of your personal data), in case processing of your personal data is unlawful and you oppose the erasure of your personal data, while instead request the restriction of their use or you object the erasure of your personal data, which we as controller do not need anymore and want to erase them but they are required by you for the establishment, exercise or defence of legal claims.
(vi) Right to data portability (art. 20 of the Regulation)
You shall have the right to receive your personal data from us, as they were previously provided to us, in a structured, commonly used and machine-readable format and you have the right to request for us to transmit your personal data to another controller while fulfilling the lawful conditions; the exercise of this right shall be without prejudice to the right to erasure of your personal data. The right to data portability shall however only pertain to personal data, which were received by us from you on the basis of your consent or on the basis of a contract, to which you are a contractual party.
(vii) Right to object the processing of the personal data (art. 21 of the Regulation)
In case the processing of your personal data is based on our legitimate interest, you have the right to object such processing of your personal data. In case you object and we fail to prove a convincing, legitimate interest to processing of your personal data, we shall no longer process your personal data for these purposes.
(viii) Right to inefficiency of automated individual decision-making including profiling (art. 22 of the Regulation)
By processing of your personal data by us does not come to an automated decision-making or profiling.
(ix) Right to lodge a complaint to start proceedings on the protection of personal data (para. 100 of the Act; Art. 77 and 79 of the Regulation)
In case you suspect, that the processing of your data infringes the Act or the Regulation, you shall have the right to lodge a complaint and a petition to start proceedings on the protection of personal data with the Office for personal data protection, with registered office at Hraničná 12, 820 07 Bratislava, the Slovak Republic, Id. No.: 36 064 220 (hereinafter referred to as “Office”) or other respective authority mostly in other Member State of your respective habitual residence, place of work or place of the alleged infringement. The petition to start proceedings (hereinafter referred to as the “petition”) must contain
a) name, surname, correspondence address and the signature of the petitioner,
b) description of the person against whom the petition is directed, while specifying the name and surname, place of habitual residence or business name, registered office and identification number, if they were granted,
c) the subject of the petition, with the designation of rights which were allegedly infringed during the processing of personal data,
d) any evidence to support the claims of the petition,
e) the copy of a document or other evidence demonstrating the assertion of a right, in accordance with the second part of the second chapter of the Act or the Regulation, if such a right was asserted by the data subject, or the statement of reasons worthy of special consideration about the renouncement of the assertion of the right, if the petition was filed by the data subject. The draft version of the petition to start proceedings with the Office is published on the web domain of the Office. Without affecting your right to demand the protection of your rights through the petition to start proceedings with the Office, you shall also have the right to demand your rights at the court of the Slovak Republic having jurisdiction, if you suspect, that as a result of the processing of your personal data in breach of the Regulation we breached your rights as stated in the Regulation. This document becomes effective on 25th May 2018.