Privacy Policy

1. Performance of contractual obligations

We process your personal data to the extent that you have filled in the individual fields of the web form when creating and managing a user account, for the purpose of performing the contract between us, in accordance with the General Terms of Portal Use. The legal basis for processing personal data is in this case the performance of a contract under Article 6(1)(b) GDPR. We will process your personal data only for the necessary period, which is individual for each type of data. We will process and store your personal data for the duration of your user account and subsequently for 4 years after the termination of your user account or the contract concluded between us through the Portal, for the purpose of defending against possible claims. Data on individual card transactions will be retained for a minimum of 10 years. After the expiry of these periods, personal data will be destroyed or further retained for the period required by applicable law.

2. Sending direct marketing messages (newsletter)

We also process your personal data, specifically first name, surname, and email address, for the purpose of sending direct marketing messages (newsletter) to your email address in order to inform you about our news and current information about our services. The legal basis for this processing is our legitimate interest under Article 6(1)(f) GDPR, in carrying out direct marketing in order to provide you with information and offer services that may be relevant and interesting to you. We will process your personal data for this purpose until you unsubscribe from direct marketing messages or raise an objection to the processing of your personal data for this purpose.

3. Provision, improvement, and optimization of portal operation

We also process your personal data, including data obtained from your use of the portal as described above, for the purpose of providing, improving, and optimizing portal operation, as well as to enhance user comfort, provide technical support, or perform analytical and statistical evaluation of usage. Furthermore, for profiling, detecting and preventing misuse (including fraud prevention, security incidents, and similar activities), or for risk assessment and compliance with legal obligations. The legal basis for processing personal data is in this case our legitimate interest under Article 6(1)(f) GDPR, specifically to ensure proper portal operation and optimization of its functionalities. In addition, the legal basis is also the performance of the contract created by opening a user account, within the meaning of Article 6(1)(b) GDPR. We will process your personal data for this purpose for the duration of your user account and for 4 years after its termination. You can prevent this processing by disabling the use or storage of cookies on your device by changing your browser settings. However, some portal features may then not work properly. You can also delete cookies stored on your device. You can also browse our portal in 'private mode', which will limit the scope of data stored by cookies.

4. Responding to questions, requests, and inquiries

We process your personal data, specifically first name, surname, email address, phone number, and any other data you choose to provide via the contact form or by email, for the purposes of mutual communication and handling your questions, requests, or inquiries. The legal basis for processing personal data is in this case also our legitimate interest under Article 6(1)(f) GDPR to ensure our operations and administration and provide assistance and support to our customers. Your personal data will be processed for this purpose for the time necessary to respond to your question, request, or inquiry, or until other measures are taken in relation to your question, request, or inquiry, but no longer than 3 years. After this period, your personal data will be deleted.

5. Handling requests related to the exercise of your rights

We also process your personal data, specifically first name, surname, email address, and any other data you choose to provide via the contact form or by email, for the purposes of examining, assessing, carrying out actions, handling, and informing you about the handling of your request relating to exercising any of the rights under Articles 15 to 22 GDPR. The legal basis for processing personal data is in this case the performance of our legal obligation under Article 6(1)(c) GDPR. Your personal data will in this case be processed and retained for 10 years from the date of receipt of the request.

We disclose your personal data in the following cases:

• where we have such an obligation under applicable law, in particular at the request of law enforcement authorities, courts, other public authorities, or other authorized persons;
• where it is necessary for the performance of our obligations and for the protection of our legitimate interests, in particular to our lawyers, advisors, auditors, IT service providers, marketing and advertising agencies, etc.

The following processors assist us in providing services, and their activities comply with European personal data protection standards:

• provider of server services for the portal provider – netcup GmbH and AWS Europe, for the purpose of storing all portal data. The servers are located in the European Union.
• email delivery service provider – Mailjet and SmartEmailing – for sending bulk email messages. MailChimp's personal data is transferred to the USA, however MailChimp complies with the EU-U.S. Privacy Shield requirements.
• portal analytics service provider – Google Analytics, which complies with European personal data protection standards.

1. You have the right of access to your personal data under Article 15 GDPR. In particular, you have the right to request confirmation of whether personal data relating to you are or are not being processed by us. And if so, you have the right to obtain access to such data and to the following information:

• the purpose of processing personal data;
• the categories of personal data processed;
• the identification of the recipient or category of recipient to whom the personal data have been or are to be provided, in particular recipients in third countries or international organizations, where possible;
• the planned retention period for personal data; if not possible, information on the criteria for determining it;
• the existence of the right to request from us the correction or erasure of personal data relating to you, or the restriction of their processing, or the right to object to the processing of personal data;
• the right to lodge an application to initiate proceedings for the protection of personal data;
• the source of personal data, if we did not obtain the personal data from you;
• the possible existence of automated individual decision-making, including profiling referred to in Article 22(1) and (4) GDPR, in particular information about the procedure used, as well as the significance and the envisaged consequences of such processing of personal data for you as the data subject.

We may charge a fee for repeated access to personal data.

2. Right to rectification

You have the right to request that we correct, without undue delay, your inaccurate personal data and, with regard to the purpose of their processing, also the right to have incomplete personal data completed.

3. Right to erasure

You have the right to request that we erase your personal data without undue delay if:

• they are no longer necessary for the purpose for which we collected or otherwise processed them;
• you have withdrawn your consent to their processing and there is no other legal basis for their processing under Article 6 GDPR;
• you raise an objection to their processing and there are no overriding legitimate grounds for their processing;
• we have processed your personal data unlawfully;
• there is a reason for their erasure in order to fulfil a legal obligation laid down by the GDPR, another special regulation, or an international treaty by which the Slovak Republic is bound; or
• personal data were obtained in connection with the offer of information society services pursuant to Article 8(1) GDPR (offer of information society services to a child).

4. Right to restriction of processing

You have the right to request that we restrict the processing of personal data if:

• you contest their accuracy, for a period necessary to allow us to verify their accuracy;
• their processing is unlawful but you refuse their erasure;
• we no longer need them for our purposes but you need them for the establishment, exercise, or defence of legal claims;
• you have raised an objection to their processing pursuant to Article 21(1) GDPR, pending verification of whether our legitimate grounds override yours.

5. Right to data portability

You have the right to request that we provide you with personal data relating to you in a structured, commonly used, and machine-readable format, or that we transmit such personal data to another controller. This applies only where the legal basis for their processing is your consent or the performance of a contract and the processing was carried out by automated means.

6. Right to object to the processing of personal data

You have the right to raise an objection to the processing of your personal data where such processing is based on our legitimate interest. Based on your objection, we will assess whether, taking into account your specific situation, the protection of your legitimate interest prevails over ours. In this connection, you have in particular the right to object to the processing of personal data for direct marketing purposes.

7. Right to lodge a complaint with the supervisory authority

If you have doubts about the way in which we process your personal data, you have the right to initiate proceedings for the protection of personal data before the Office for Personal Data Protection by lodging a complaint.