Principles of processing and protection of personal data

1. Personal data processing policies

CORNiCO Company, sro with its registered office at Diaľničná cesta 16B, 903 01 Senec, Company ID 35 752 271 (hereinafter referred to as the "Controller"), pursuant to Regulation 2016/679 GDPR on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation") and Act No. 18/2018 Coll. on the protection of personal data and on the amendment and supplementation of certain acts (hereinafter referred to as the "Act"), has developed security measures that are regularly updated. They define the scope and method of security measures necessary to eliminate and minimize threats and risks affecting the information system in order to ensure:

• availability, integrity and reliability of management systems using the most modern information technologies,
• protect personal data from loss, damage, theft, modification, destruction and maintain their confidentiality,
• identify and prevent potential problems and sources of disruption.

Contact person responsible for supervising the processing of personal data: rastislav@cornico.sk

 

2. Privacy Policy

Your personal data will be stored securely, in accordance with the data retention policy and only for the period necessary to fulfill the purpose of the processing. Only persons authorized by the controller to process personal data have access to personal data, who process them on the basis of the controller's instructions. Your personal data will be backed up in accordance with the controller's retention rules. Personal data stored on backup storage serves to prevent security incidents, which could arise in particular from a security breach or damage to the integrity of the processed data.

 

3. Definition of terms
   1. "personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
   2. "processing" means any operation or set of operations which is performed upon personal data or upon sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, whether or not by automated means;
   3. "restriction of processing" means the marking of stored personal data with the aim of restricting their processing in the future;
   4. "profiling" means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects of the natural person concerned relating to his or her performance at work, financial situation, health, personal preferences, interests, reliability, behaviour, location or movements;
   5. "information system" means any structured set of personal data that is accessible according to specified criteria, regardless of whether it is a centralised, decentralised or distributed system on a functional or geographical basis;
   6. ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are laid down in Union or Member State law, the controller or the specific criteria for its determination may be determined in Union or Member State law;
   7. "processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
   8. "third party" means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or the processor, are entrusted with the processing of personal data;
   9. "consent of the data subject" means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
   10. "personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data being transmitted, stored or otherwise processed;
   11. "relevant and reasoned objection" means an objection to a draft decision on whether there has been
       to an infringement of this Regulation, or whether the intended measure in relation to the controller or processor is in accordance with this Regulation, which must clearly demonstrate the seriousness of the risks posed by the draft decision with regard to the fundamental rights and freedoms of the data subjects and, where applicable, the free movement of personal data within the Union.

 

4. Purposes of processing personal data
   1. Order of goods/services → purchase contract

We process personal data about our customers on the basis of a contract pursuant to Article 6(1)(b) of the Regulation (processing is necessary for the performance of a contract to which the data subject is a party, or in order to take measures prior to entering into a contract at the request of the data subject) . The scope of the processed personal data: title, first name, last name, signature, residential address, delivery address, telephone number, e-mail address. They are then stored in accordance with Act No. 395/2002 Coll. on archives and registries. Your personal data may be provided to third parties (our contractual carriers). You can find a list of carriers at the following web link: https://www.cornico.eu/transport/

1. 2. Requirements record

The personal data that we process via the contact forms on our website and e-mails are processed only to process your request. By completing and sending the request, you agree to the processing of personal data pursuant to Article 6(1)(a) of the Regulation (the data subject has consented to the processing of their personal data for one or more specific purposes) . Scope of the processed personal data: name, surname, address, telephone, e-mail. Personal data will be stored only until the purpose for which they were processed is fulfilled (max. 1 year). If retention periods under commercial and tax law must be observed, the retention period is governed by Act No. 395/2002 Coll. on archives and registries. Personal data will not be transferred to a third country. Personal data will not be used for automated individual decision-making, including profiling.

1. 3. Bonus club

We process personal data that we process through the "Bonus Club" for our registered customers in accordance with the General Terms and Conditions "GTC" on the basis of a contract pursuant to Article 6, paragraph 1, letter b) of the Regulation. The scope of processed personal data: title, name, surname, residential address, delivery address, telephone, e-mail. They are then processed for the duration of the contract. Your personal data may be provided to third parties (our contracted carriers). You can find a list of carriers at the following web link: https://www.cornico.eu/transport/

1. 4. Processing of accounting documents

The processing is necessary to comply with the legal obligation of the controller pursuant to Article 6(1)(c) of the Regulation. The scope of the processed personal data: title, name, surname, address, telephone number, account number, e-mail and signature. They are subsequently stored in accordance with Act No. 395/2002 Coll. on archives and registries.

1. 5. Complaints

In the case of complaints, personal data are processed pursuant to Article 6(1)(c) of the Regulation. Scope of processed personal data: title, name, surname, address, telephone number, e-mail. They are subsequently stored in accordance with Act No. 395/2002 Coll. on archives and registries.

1. 6. Debt collection

In the case of debt collection, personal data are processed pursuant to Article 6(1)(c) of the Regulation. Scope of personal data processed: name, surname, birth number, address, telephone,
e-mail. They are subsequently stored in accordance with Act No. 395/2002 Coll. on archives and registries.

1. 7. Executions

The processing of personal data is necessary to comply with the legal obligation of the controller pursuant to Article 6(1)(c) of the Regulation. Scope of the processed personal data: ordinary personal data, other personal data obtained or provided in the course of the procedure. They are subsequently stored in accordance with Act No. 395/2002 Coll. on archives and registries.

1. 8. Job applicant records

The processing of personal data of job applicants is carried out on the basis of the "Consent" to the processing of personal data pursuant to Article 6(1)(a) of the Regulation, which is provided by the applicant. The operator will contact only successful applicants. Personal data is stored for a period of 12 months from the date of consent.

 

Personal data will not be transferred to a third country. Personal data will not be used for automated individual decision-making, including profiling.

 

You have the right to withdraw your consent to the processing of personal data at any time before the expiry of the specified period by sending a request to the email address: rastislav@cornico.sk or by sending a request to the Controller's address with the text "GDPR withdrawal of consent" on the envelope. The Controller declares that in the event of a written request from the data subject to terminate the processing of personal data before the specified deadline, the data will be deleted within 30 days of receipt of the withdrawal of consent.

1. 9. Newsletter

If you wish, you can subscribe to our newsletter, which is located on our website. www.cornico.eu . Personal data will only be processed to send newsletters to the e-mail address you have provided. By subscribing to the newsletter, you agree to the processing of personal data. We process personal data pursuant to Article 6(1)(a) of the Regulation. Your e-mail address will be processed until you unsubscribe. You can unsubscribe by clicking on the "unsubscribe" link in each newsletter you receive from us. After you unsubscribe, you will no longer receive any newsletters from us. Scope of personal data processed: e-mail address.

1. 10. Monitoring premises for asset protection

Our facility has a camera information system that monitors the operator's external and internal premises for the purpose of protecting property in accordance with the operator's legitimate interest in accordance with Article 6(1)(f) of the Regulation. The recordings from the camera system are not provided to third parties. They are only accessible to authorized persons of the operator and IT specialists who perform maintenance on them. Personal data obtained by the camera system are used to protect property and to provide evidence in administrative proceedings in cases where personal data obtained by the camera system are used as evidence in ongoing administrative proceedings. If the recorded data is not used for the purposes of criminal proceedings or misdemeanor proceedings, the record is automatically destroyed by program activity within 5 days from the day following the day on which the record was made.

1. 11. Records of suppliers and customers' representatives

The processing of personal data of suppliers and customers is carried out in accordance with the legitimate interests of the controller, in accordance with Article 6(1)(f) of the Regulation. The scope of the processed personal data: title, first name, last name, job title, service titles, functional title, employee personal number, professional department, place of work, telephone number, fax number, workplace email address and employer identification data. They are then stored for 10 years after the termination of the contract or business relationship.

1. 12. Direct marketing

We process personal data about our customers for marketing purposes (activities related to the offer of products and related services that the operator provides for its clients, as well as to survey opinions on satisfaction with the services provided and other marketing offers via electronic mail) based on the legitimate interest of the operator pursuant to Article 6(1)(f) of the Regulation. Scope of processed personal data: name, surname, address, telephone and e-mail. They are then stored for the duration of the contractual or business relationship between the client and the operator.

 

5. Rights of the data subject
   1. Right to withdraw consent - in cases where we process your personal data based on your consent, you have the right to withdraw this consent at any time. You can withdraw your consent electronically, at the address of an authorized person, in writing, by notification of withdrawal of consent or in person at the registered office of our company. Withdrawal of consent does not affect the lawfulness of the processing of personal data that we processed about you based on it.
   2. Right of access - you have the right to be provided with a copy of the personal data we hold about you
      available, as well as information about how we use your personal data. In most cases, your personal data will be provided to you in written, hard copy form, unless you request it to be provided in another way. If you have requested this information by electronic means, it will be provided to you electronically, if technically possible.
   3. Right to rectification - we take reasonable steps to ensure the accuracy, completeness
      and the timeliness of the information we hold about you. If you believe that the information we hold about you is inaccurate, incomplete or out of date, please do not hesitate to ask us to correct, update or supplement this information.
   4. Right to erasure (to be forgotten) - you have the right to ask us to erase your personal data, for example where the personal data we have collected about you is no longer necessary for the purposes for which it was processed. However, your right needs to be assessed in the light of all the relevant circumstances. For example, we may have certain legal and regulatory obligations which mean we will not be able to comply with your request.
   5. Right to restriction of processing - in certain circumstances you have the right to ask us to stop using your personal data. This includes cases where you believe that the personal data we hold about you may be inaccurate or where you believe that we no longer need to use your personal data.
   6. Right to data portability - in certain circumstances, you have the right to ask us to transfer the personal data you have provided to us to another third party of your choice. However, the right to portability only applies to personal data that we have collected from you based on your consent or on the basis of a contract to which you are a party.
   7. Right to object - you have the right to object to data processing that is based on our legitimate interests. If we do not have a compelling legitimate reason for the processing and you object, we will no longer process your personal data.

 

If you believe that any personal data we hold about you is incorrect or incomplete, please contact us.

If you wish to object to the way we process your personal data, please contact our Data Protection Officer by email at: rastislav@cornico.sk or in writing: to the address:

CORNiCO Company, sro

Highway 16B

903 01 Senec

Our designated person will review your complaint and work with you to resolve the matter.

If you believe that your personal data is being processed unfairly or unlawfully, you may file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; tel. number: +421 /2/ 3231 3214; e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk .

Revised on 01.05.2021