GDPR
WOODCOTE GROUP sro
Information on the processing of personal data
In connection with the processing of personal data, pursuant to Art. 13 Regulation of the European Parliament and of the EU Council 2016/679 (GDPR) of April 27, 2016 on the protection of natural persons in the processing of personal data and the free movement of such data, we provide the following information: CONTROLLER (STATUS OF JOINT CONTROLLERS) The joint controllers of personal data are the companies

WOODCOTE

GROUP sro, Vajnorská 135, 831 03 Bratislava, ID: 31364951 and WOODCOTE FRANCHISE PARTNER, sro, Vajnorská 135, 831 02 Bratislava, ID: 31404367 (hereinafter only joint operators).

BASIS OF PERSONAL DATA PROCESSING

The current legislation allows personal data to be processed on the basis of several legal bases, while personal data may be processed even without the consent of the person concerned. If there is no other legal basis for processing personal data, personal data will be processed only on the basis and to the extent of the consent of the person concerned.

The purpose of personal data processing is the activities of joint operators detailed below. The data processing period varies in individual cases, but it is at least 2 years. The detail according to the cases is detailed below. Consent can be revoked at any time in writing to the address of one of the listed operators. You can also use the online form to exercise the rights of affected persons: www.woodcote.sk/formular-gdpr

Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

ONLINE FORM FOR THE EXERCISE OF THE RIGHTS OF THE PERSONS CONCERNED PROVIDING

DATA TO THIRD PARTIES

Personal data processed by the Joint Controller may also be processed by third parties, provided that the Joint Controller decides so, or the obligation to provide personal data follows from the legal order of the Slovak Republic. In cases where the choice of the recipient of personal data is up to the Joint Operator, when choosing these partners, it always ensures that a high standard of protection of the personal data of the person concerned is guaranteed.

Recipients that process personal data on behalf of the operator are companies:

e.g. Google, Facebook, Mailchimp, providing online marketing services
hosting company ALTRON as, ID: 64948251, Czech Republic,
Agency for sending newsletters within the loyalty program SVET VÝHOD, AMDEN s.r.o., ID: 35941731.
As a data subject, you have the right to access information, the right to correction, the right to deletion, the right to restriction processing. You have the right to file a complaint with the supervisory authority, which is the Personal Data Protection Office of the Slovak Republic. Further information on personal data protection can be found at www.woodcote.sk/gdpr

CIRCLES OF PERSONS CONCERNED

Contractual partners of the operator, customers of the operator, potential customers of the operator, persons whose data was recorded by a camera system (this information describes only the activities of personal data processing, published according provisions of Article 14 paragraph 5 letter b) of the GDPR Regulation)

Joint operators process the personal data of natural persons in the following processing activities:

Records of contractual partners,
Debt collection,
Direct marketing – potential customers,
Direct marketing – customers,
Marketing Blacklist,
Camera monitoring,
Requests of affected persons.
SECURITY OF PERSONAL DATA

Joint operators process personal data manually or using electronic information systems and guarantee the protection of processed personal data with specifically designed measures and standard risk analysis. No processed personal data is transferred to third countries or countries that do not ensure an adequate level of their protection. No processed personal data is published. The representative of the operator has not been determined. The person responsible for supervising the protection of personal data has not been appointed.

The supervisory authority is the Personal Data Protection Office of the Slovak Republic, Hraničná 12, Bratislava.

The purposes of personal data processing in individual processing activities, categories of personal data affected, recipients or categories of recipients of personal data, conditions of publication and registry, or retention periods of processed personal data are described below in this information.

The affected person is obliged to provide the operator with data that the operator is obliged to process on the basis of special laws.

The affected person is not obliged to provide the operator with data that is necessary for contractual negotiations and for the implementation of the contract; however, without providing this data, the respective contract cannot be formed.

THE PERSON CONCERNED IS AUTHORIZED

withdraw consent to the processing of personal data in the processing activities of Direct marketing – potential customers and Direct marketing – customers,
request from the operator access to personal data concerning the person concerned,
request from the operator personal data concerning him and which he provided to the operator, in a structured, in a commonly used and machine-readable format for the purpose of transfer to another contractual partner (only customers and contractual partners who are natural persons),
to request from the operator the correction of processed personal data,
to request from the operator the deletion of processed personal data,
request from the operator a limitation of processing and object to processing, if the legal basis is not the operator’s legal obligation to process personal data, the
right to file a complaint with the supervisory authority,
request from the operator information on the source of the personal data, or information on whether the data comes from public accessible resources.
You can exercise your rights in writing at the company’s headquarters, or by using the online form for exercising the rights of affected persons, which can be found at www.woodcote.sk/formular-gdpr

We will respond to your request free of charge within 30 days. In the case of complexity or a large number of requests, we are entitled to extend this deadline by another 60 days. If this happens, we will inform you about it and the reasons. However, if your request is clearly unjustified or repeated, we are entitled to charge a reasonable administrative fee to cover the costs associated with providing this service.

The right of the affected person to withdraw consent cannot be exercised in the processing activities of Contractual partner records, Debt collection, Marketing Blacklist, Camera monitoring and Requests of affected persons, because the consent of the affected person is not their legal basis.

The right of the data subject to object to automated decision-making cannot be exercised in the described sets of processing activities, because the described processing activities do not contain automated decision-making.

PERSONAL DATA PROCESSING
Records of contractual partners
Purpose of personal data processing and legitimate interest of the operator

Records of contractual partners (self-employed persons) and natural persons acting on behalf of contractual partners (legal entities).
Scope of affected persons Contractual partners of the operator, self-employed persons and persons acting on behalf of contractual partners.
List of personal data Name, surname, business data, name and registered office.
Processing by an intermediary on behalf of the operator
Processing activities Circle of intermediaries
Financial accounting contract service provider
IT infrastructure management and HW service contract service provider
Legal services law firm, contract service provider
Provision of personal data
Circle of beneficiaries Legal basis
Courts, executors Commercial Code, Civil Code, Civil Dispute Procedure
Law enforcement authorities proceedings Criminal Code
Debt collection
Purpose of personal data processing and legitimate interest of the operator Exercising property rights of the operator
Range of affected persons Contractual partners of the operator, self-employed persons and persons acting on behalf of contractual partners.
List of personal data Name, surname, business data, name and registered office.
Processing by an intermediary on behalf of the operator
Processing activities Group of intermediaries
factoring, forfaiting contractual partner entrusted with enforcement
Legal services law firm, contractual service provider
Financial accounting management contractual service provider
Provision of personal data
Beneficiary group Legal basis
Courts, executors Commercial Code, Civil Code, Civil Dispute Procedure
Authorities criminal proceedings
Criminal Code

Estimated deadlines for erasure of personal data
Category Deadline / Legal basis
contact details of natural persons 3 years / Provision § 100 of the Civil Code (natural persons – consumers)
contact details of natural persons 4 years / Provision § 397 of the Commercial Code (natural persons – entrepreneurs, natural persons acting on behalf of legal persons)
information on business cases 10 years / Income Tax Act, Value Added Tax Act

Direct marketing – potential customers
Purpose of personal data processing Offers – addressed communication with potential customers.
Circle of affected persons Potential customers of the operator
List of personal data title, first name, surname, delivery address of the affected person, e-mail address, telephone number
Processing by intermediaries on behalf of the operator
Processing activities Range of intermediaries
none
Provision of personal data
Range of recipients Legal basis
none
Expected deadlines for erasure of personal data
Category Term / Legal basis
contact data of natural persons 3 years / Provision § 100 of the Civil Code (natural persons – consumers)
contact data of natural persons 4 years / Provision § 397 of the Commercial Code (natural persons – entrepreneurs, natural persons acting on behalf of legal persons)

Direct marketing – customers
Purpose of personal data processing and legitimate interest of the Offer operator – direct communication with customers.
Circle of affected persons Customers of the operator
List of personal data title, first name, last name, delivery address of the person concerned, e-mail address, telephone number
Processing by intermediaries on behalf of the operator
Processing activities Range of intermediaries
none
Provision of personal data
Range of recipients Legal basis
none
Expected deadlines for deletion of personal data
Category Deadline / Legal basis
contact data of natural persons 3 years / Clause § 100 of the Civil Code (natural persons – consumers)
contact data of natural persons 4 years / Clause § 397 of the Commercial Code (natural persons – entrepreneurs, natural persons acting on behalf of legal entities)

Marketing Blacklist
The purpose of processing personal data and the legitimate interest of the operator Exclusion of data from processing based on the objection of the person concerned against processing for direct marketing purposes. Processing of the database of persons excluded from processing for the purposes of direct marketing.
Circle of affected persons Persons excluded from processing for the purposes of direct marketing.
List of personal data title, first name, last name, delivery address of the person concerned, e-mail address, phone number
Processing by intermediaries on behalf of the operator
Processing activities Range of intermediaries
none
Provision of personal data
Range of recipients Legal basis
none
Expected deadlines for deletion of personal data
Category Term / Legal basis
contact data of natural persons 3 years / Provision § 100 of the Civil Code (natural persons – consumers)
contact data of natural persons 4 years / Provision § 397 of the Commercial Code (natural persons – entrepreneurs, natural persons acting on behalf of legal entities)

Camera monitoring of premises accessible to the public
Purpose of personal data processing and legitimate interest of the operator Detection of crime, violations of security, protection of property or health.
Circle of affected persons open
List of personal data image recording
Processing by intermediaries on behalf of the operator
Processing activities Circle of intermediaries
Legal services law firms
Advice on personal data protection consulting companies
Provision of personal data
Recipients Legal basis
Courts Civil Code, Civil Litigation Procedure
Expected periods for erasure of personal data
Category Period / Legal basis
all processed data 15 days / period not regulated by law

Requests of affected persons
Purpose of personal data processing and the legitimate interest of the operator Records of requests and suggestions of affected persons – requests for access, correction, deletion and restriction of processing, requests to provide data for transfer, objections to the processing of personal data for the purpose of marketing and objections to profiling or automated decision-making.
Scope of affected persons Persons who submit requests for access, correction, deletion and restriction of processing, requests to provide data for transfer, objections to the processing of personal data for marketing purposes and objections to profiling or automated decision-making.
List of personal data Name, surname, address of permanent residence or delivery address.
Processing by intermediaries on behalf of the operator
Processing activities Circle of intermediaries
Legal services law firms
IT infrastructure management and HW service contractual service provider
Registry management contractual service provider
Supervision of personal data protection contractual responsible person
Provision of personal data
Beneficiary group Legal basis
Courts Civil Code, Civil dispute procedure
Expected periods for erasure of personal data
Category Period / Legal basis
all processed data 3 years / Provision § 100 of the Civil Code (natural persons – consumers)


Update: 2.8.2021



Joint operators

WOODCOTE GROUP sro

WOODCOTE FRANCHISE PARTNER, s.r.o.,