Personal data protection policy

1. Principles of personal data processing

Company IQ PRODUCT s.r.o. with  its registered office at Družstevná 549/7, 922 10 Trebatice, ID 51 825 163  (hereinafter referred to as the “Controller”) within the meaning of Regulation 2016/679 GDPR on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of Such Data (hereinafter referred to as the “Regulation”) and Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (hereinafter referred to as the “Act”) has developed security measures,  which are updated regularly. They define the scope and manner of security measures necessary to eliminate and minimize threats and risks affecting the information system in order to ensure:

• availability, integrity and reliability of management systems using state-of-the-art information technologies,
• protect personal data against loss, damage, theft, modification, destruction and maintain its confidentiality,
• identify and prevent potential problems and sources of disruption.

Data Protection Officer (DPO) contact: dpo@iosec.eu

2. Privacy Policy

Your personal data will be stored securely, in accordance with the data retention policy and only for the time necessary to fulfill the purpose of processing. Access to personal data is restricted to persons authorized by the controller to process personal data who process them on the instructions of the controller. Your personal data will be backed up in accordance with the retention rules of the operator. Personal data stored in backup repositories serve to prevent security incidents that could arise in particular by security breaches or damage to the integrity of the processed data.

3. Definitions
   • ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to physical, physiological, genetic, mental, economic  the cultural or social identity of that natural person;
   • ‘processing‘ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
   • ‘restriction of processing’ means the marking of stored personal data with a view to limiting their processing in the future;
   • ‘profiling’ means any form of automated processing of personal data consisting of the use of those personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects of the natural person concerned relating to performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
   • ‘filing system’ means any structured set of personal data which are accessible according to specified criteria, whether centralised, decentralised or distributed on a functional or geographical basis;
   • ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
   • ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
   • ‘third party ‘ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
   • ‘the data subject’s consent ‘ means any freely given, specific, informed and unambiguous indication of his or her wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
   • ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
   • ‘relevant and reasoned objection ‘ means an objection  to a draft decision as to whether
     there has been an infringement of this Regulation or whether a planned measure in relation to a controller or processor complies with this Regulation, which clearly demonstrates the seriousness of the risks posed by the draft decision to the fundamental rights and freedoms of data subjects and, where applicable, to the free movement of personal data within the Union;

4. Purposes of personal data processing
   • Order of goods/services → purchase contract

We process the personal data we process about our customers on the basis of a contract within the meaning of Article 6(1)(b) of the Regulation. Scope of processed personal data: title, name, surname, address of residence, delivery address, telephone and e-mail. Subsequently, they are stored in accordance with Act No. 395/2002 Coll. on archives and registries.

• Direct marketing

We process personal data that we process about our customers for marketing purposes on the basis of the legitimate interest of the controller within the meaning of Article 6(1)(f) of the Regulation. Scope of processed personal data: title, name, surname, job title, place of work, telephone number and e-mail address. Subsequently, they are stored for the duration of the contract between the operator and the client

• Newsletter

If you wish, you can subscribe to our newsletter newsletter, which is located on our website https://www.agfoil.eu/. Personal data (e-mail, name) will only be processed for sending newsletter messages to the e-mail address you entered. By subscribing to the newsletter, you agree to the processing of personal data. We process personal data in accordance with Article 6(1)(a) of the Regulation. Your email address will be processed until you unsubscribe. You can unsubscribe by clicking on the “unsubscribe” link provided in every newsletter you receive from us or on our website via the link: https://www.agfoil.eu/newsletter/delete. After unsubscribing, you will no longer receive any newsletter messages.

• Processing of accounting documents

The processing is necessary for compliance with the controller’s legal obligation under Article 6(1)(c) of the Regulation. Scope of processed personal data: title, name, surname, address, account number, signature. Subsequently, they are stored in accordance with Act No. 395/2002 Coll. on archives and registries.

• Claim

In case of complaints, personal data are processed in accordance with Article 6(1)(c) of the Regulation. Scope of processed personal data: title, name, surname, address, telephone, e-mail. Subsequently, they are stored in accordance with Act No. 395/2002 Coll. on archives and registries.

• Debt

In the case of debt collection, personal data are processed in accordance with Article 6(1)(c) of the Regulation. Scope of processed personal data: title, name, surname, address, telephone, e-mail. Subsequently, they are stored in accordance with Act No. 395/2002 Coll. on archives and registries.

• Execution

The processing of personal data is necessary for compliance with the controller’s legal obligation under Article 6(1)(c) of the Regulation. Scope of processed personal data: title, name, surname, birth number, address,. Subsequently, they are stored in accordance with Act No. 395/2002 Coll. on archives and registries.

• Monitoring of premises to protect property

A camera information system is located on our premises, which monitors the external and internal premises of the operator in order to protect property in accordance with the legitimate interest of the operator in accordance with Article 6(1)(f) of the Regulation. Recordings from the camera system are not provided to third parties. They are made available only to authorized persons of the operator and IT specialists who perform maintenance on them. Personal data obtained by the camera system are used for the protection of property and for the taking of evidence in administrative proceedings in cases where personal data obtained by the camera system are used as evidence in ongoing administrative proceedings. If the recorded record is not used for the purposes of criminal or misdemeanor proceedings, the record is automatically destroyed by programme action within 5 days from the  day following the date on which the recording was made.

• Records of supplier and customer representatives

The processing of personal data of suppliers and customers is carried out in accordance with the legitimate interests of the controller, in accordance with Article 6(1)(f) of the Regulation. Scope of processed personal data: title, name, surname, job title, service classification, functional classification, personal number of the employee, professional department, place of work, telephone number, fax number, e-mail address to the workplace and identification data of the employer. Subsequently, they are stored in accordance with Act No. 395/2002 Coll. on archives and registries.

• Registration of job seekers

The processing of personal data of job seekers is carried out on the basis  of a “Consent” to the processing of personal data within the meaning of Article 6(1)(a) of the Regulation provided by the applicant. The operator will contact only successful candidates.

No transfer of personal data to a third country takes place. Personal data will not be used for automated individual decision-making, including profiling.

Personal data is stored for a period of 12 months from the granting of consent. You have the right to withdraw your consent to the processing of personal data at any time before the expiry of this period by sending a request to the e-mail address: profesia@agfoil.com or by sending a request to the address of the Operator with the text “GDPR withdrawal of consent” on the envelope. The operator declares that in the event of a written request of the data subject to terminate the processing of personal data before the specified period, they will be deleted within 30 days of receipt of the withdrawal of consent.

5. Rights of the data subject
   • Right to withdraw consent – in cases where we process your personal data based on your consent, you have the right to withdraw this consent at any time. You can withdraw your consent electronically, at the address of the responsible person, in writing, by notice of withdrawal of consent or in person at the registered office of our company. The withdrawal of consent does not affect the lawfulness of the processing of personal data that we have processed about you on its basis.
   • Right of access – you have the right to be provided with a copy of
     the personal data we have about you, as well as information about how we use your personal data. In most cases, your personal data will be provided to you in written paper form, unless you request another way of providing it. If you have requested this information by electronic means, it will be provided to you electronically, if technically feasible.
   • Right to rectification – we take reasonable measures to ensure that the
     information we hold about you is accurate, complete and up to date. If you believe that the data we hold is inaccurate, incomplete or out of date, please do not hesitate to ask us to modify, update or supplement this information.
   • Right to erasure (to be forgotten) – you have the right to ask us to erase your personal data, for example if the personal data we have collected about you are no longer necessary to fulfill the original purpose of processing. However, your right must be assessed in the light of all relevant circumstances. For example, we may have certain legal and regulatory obligations, which means that we will not be able to comply with your request.
   • Right to restriction of processing – under certain circumstances, you are entitled to ask us to stop using your personal data. For example, if you think that the personal data we hold about you may be inaccurate or if you think we no longer need to use your personal data.
   • Right to data portability – under certain circumstances, you have the right to ask us to transfer the personal data you have provided to you to another third party of your choice. However, the right to portability only applies to personal data that we have obtained from you on the basis of consent or under a contract to which you are one of the parties.
   • Right to object – you have the right to object to data processing that is based on our legitimate interests. If we do not have a convincing legitimate reason for processing and you object, we will no longer process your personal data.

If you believe that any personal data we hold about you is incorrect or incomplete, please contact us.

If you wish to object to the way we process your personal data, please contact our Data Protection Officer by e-mail to: dpo@iosec.eu or in writing to: IQ PRODUCT s.r.o., Cooperative 549/7, 922 10 Trebatice. Our Data Protection Officer will investigate your objection and work with you to resolve the matter.

If you believe that your personal data are processed unfairly or illegally, you may file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; tel. number: +421 /2/ 3231 3214; Email: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk.

Revised on 15/01/2021