In accordance with Articles 13 and 14 of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (“Regulation” or “GDPR”), this document provides you, as a data subject whose personal data is processed by MONTEZA, s.r.o., located at Továrenska 7, 064 01 Stará Ľubovňa, ID No. 36836532, registered in the Commercial Register of the District Court of Prešov, Section: Sro, Insert No. 19134/P, with information in accordance with the Regulation, specifically including:
• Details about MONTEZA, s.r.o., as the data controller
• The scope of data processed about you
• Categories of recipients and processors to whom your personal data may be disclosed
• Purposes for which your personal data may be used
• The legal basis for processing
• Information on your rights and how to exercise them
1. CONTACT DETAILS OF THE DATA CONTROLLER
MONTEZA, s.r.o. (hereinafter also referred to as “MONTEZA, s.r.o.” or “controller”)
• Address: Továrenska 7, 064 01 Stará Ľubovňa
• ID No. (IČO): 36836532
• Trade Register: District Court of Prešov, Section: Sro, Insert No. 19134/P
• Phone: +421 918 407 055
• Email: monteza@monteza.sk
MONTEZA, s.r.o., has not appointed a Data Protection Officer as it is not required by the Regulation.
2. CATEGORIES OF PERSONAL DATA, PURPOSE, AND LEGAL BASIS FOR DATA PROCESSING
2.1 Legal Basis and Purpose of Data Processing
MONTEZA, s.r.o. provides its services on a contractual basis, and its activities are regulated by legal requirements that mandate the collection and processing of personal data. In some cases, the processing of personal data is in MONTEZA, s.r.o.’s legitimate interest, or we may request your consent. The main purposes of processing include:
• Carrying out the business activities for which the company is authorized and fulfilling related obligations
• Marketing communication
• Protecting MONTEZA, s.r.o.’s legitimate interests and asserting legal claims
The legal basis for processing your personal data generally includes:
a) Processing necessary for the performance of a contract to which the data subject is a party, or to take measures at the request of the data subject before entering into a contract.
MONTEZA, s.r.o. generally enters into written contracts with clients, requiring personal data to identify the contractual parties. This requirement applies even without consent, generating new personal data during the performance of contractual rights and obligations (e.g., payment data). In the event of a breach of rights or obligations under the contract, data may be disclosed to third parties and recipients to assert MONTEZA, s.r.o.’s claims.
b) Compliance with a legal obligation.
In cases where data processing is required for MONTEZA, s.r.o.’s legal obligations, consent is not required. The legal basis may be statutory, and the data may be processed within the scope and purposes stipulated by law, often specifying minimum retention periods.
c) Processing for legitimate interests pursued by MONTEZA, s.r.o. or a third party.
MONTEZA, s.r.o., monitors its premises through video surveillance for legitimate interests, such as direct marketing based on profiling to tailor offers. You have the right to object to processing based on these legitimate interests.
d) Processing for the establishment, exercise, or defense of legal claims.
This may apply where data is processed based on consent that is later withdrawn, and data is needed for legal claims.
e) Consent of the data subject.
When the legal basis is your consent, MONTEZA, s.r.o., will not condition the provision of services on granting consent. Consent must be freely given and revocable. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
2.2 Scope of Personal Data Processing
MONTEZA, s.r.o. generally processes data within the following scope:
• Identification data (name, surname, permanent residence, national ID number if assigned, date of birth, nationality, type, and number of ID document; for entrepreneurs, place of business, type of business, and registration data)
• Contact data (contact phone number, fax number, email address, temporary residence, correspondence address, or social media ID)
• Video surveillance recordings (surrounding premises of MONTEZA, s.r.o., at Poľovská 367, 040 15 Košice – Poľov)
These data are obtained directly from you, other individuals (e.g., a client if you represent them), or specific registers.
If you are an employee of a contractual partner of MONTEZA, s.r.o., we process data such as title, name, surname, job title, and work contact details.
3. DISCLOSURE OF YOUR PERSONAL DATA TO THIRD PARTIES
3.1. Recipients
MONTEZA, s.r.o. processes your personal data primarily through its employees or similar persons, bound by confidentiality and limited to fulfilling their job duties. Data may also be provided to other recipients as necessary.
Recipients include:
• Companies to whom we assign claims
• Law firms and auditing companies
• Appraisers
• Service providers such as Slovak Post
• Public authorities and entities specified by law
3.2. Processors
MONTEZA, s.r.o. uses third-party processors as necessary, ensuring appropriate technical and organizational measures are taken in accordance with the Regulation.
4. TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY OR INTERNATIONAL ORGANIZATION OUTSIDE THE EU
Your personal data is processed by MONTEZA, s.r.o., within the EU, and the company ensures that suppliers process personal data primarily within EU territory. If, for technical or operational reasons, it becomes necessary to process your data outside the EU, MONTEZA, s.r.o., will ensure compliance with the GDPR requirements for such processing.
5. DATA RETENTION PERIOD
Your personal data is processed manually and electronically in a manner that ensures its security, integrity, and availability.
The duration for which personal data is processed and stored depends on the processing purpose, as determined by MONTEZA, s.r.o., as the controller, or by legal regulations. Legal regulations set minimum retention periods that MONTEZA, s.r.o., is obligated to follow.
When MONTEZA, s.r.o., independently determines the retention period, it is set to be proportionate to the processing purpose:
Legal Basis for Processing Duration
Consent Specified in the consent; if not specified, data is retained for the duration of the contractual relationship and 5 years after its termination.
Legitimate Interest of MONTEZA, s.r.o. An appropriate retention period is determined according to the specific legitimate interest of MONTEZA, s.r.o.
If multiple retention periods apply to the same information, the longest duration is used.
6. RIGHTS OF THE DATA SUBJECT
As a data subject, you have rights in relation to the processing of your personal data by MONTEZA, s.r.o., as the controller, in accordance with the GDPR.
It is MONTEZA, s.r.o.’s obligation to ensure you can exercise these rights easily. However, MONTEZA, s.r.o., also has a duty to protect your data from unauthorized access or modification.
To verify your identity and safeguard your rights, MONTEZA, s.r.o., recommends that you submit requests directly at the company’s office. If you exercise your rights via other methods, such as by letter, email, or phone, MONTEZA, s.r.o., may request verification of your identity (e.g., by appearing in person at the company’s office) to prevent unauthorized access or misuse of your rights.
If the identity cannot be verified, MONTEZA, s.r.o., reserves the right to take no action on the request.
If requests are manifestly unfounded or excessive, particularly due to their repetitive nature, the company may either (i) charge a reasonable fee reflecting the administrative costs of providing information or (ii) refuse to act on the request.
If you exercise your right to rectification, erasure, or restriction of processing, MONTEZA, s.r.o., will inform each recipient to whom your personal data was disclosed about the exercised rights, unless this proves impossible or involves disproportionate effort.
6.1. Right of Access
You have the right to obtain confirmation from MONTEZA, s.r.o., as the controller, about whether your personal data is processed, and, if so, access to the personal data and information regarding:
• Processing purposes
• Categories of personal data concerned
• Recipients or categories of recipients to whom personal data has been or will be disclosed, particularly in third countries or international organizations
• Where possible, the anticipated data retention period or criteria for determining it
• Existence of the right to request rectification or erasure of personal data or restriction of processing, or the right to object to processing
• Right to lodge a complaint with a supervisory authority
• Source of personal data, if not collected from the data subject
• Appropriate safeguards in place for international data transfers, if applicable
Upon request, we will provide a copy of your personal data. However, the right to obtain a copy must not adversely affect the rights and freedoms of others.
If we process a large amount of information about you, we may ask you to specify the information or processing activities to which your request relates.
MONTEZA, s.r.o., may charge a reasonable fee for additional copies, based on administrative costs. If you submit your request electronically, the information will be provided in a commonly used electronic format unless you request otherwise.
6.2. Right to Rectification
MONTEZA, s.r.o., aims to process accurate and complete personal data. If you become aware that data is inaccurate, you have the right to request that MONTEZA, s.r.o., rectify it without undue delay. Given the purpose of processing, you also have the right to have incomplete personal data completed, including through a supplementary statement.
6.3. Right to Erasure
As a data subject, you have the right to request MONTEZA, s.r.o., to erase your personal data without undue delay, and MONTEZA, s.r.o., is obligated to do so if one of the following applies:
• Data is no longer necessary for the purposes it was collected or otherwise processed
• Consent is withdrawn, and there is no other legal basis for processing
• You object to automated processing, and there are no overriding legitimate grounds for processing, or you object to the processing of your personal data for marketing purposes
• Data was processed unlawfully
• Data must be erased to comply with a legal obligation under Union or Member State law to which MONTEZA, s.r.o., is subject
This right may not apply if the conditions in Article 17 of the GDPR are met, such as when processing is necessary for establishing, exercising, or defending legal claims.
6.4. Right to Restriction of Processing
In the cases set out in Article 18 of the GDPR, you have the right to request that MONTEZA, s.r.o., restrict the processing of your personal data as specified in the Regulation.
6.5. Right to Data Portability
If processing is based on consent or a contract and carried out by automated means, you have the right to receive your personal data, which you provided to MONTEZA, s.r.o., in a structured, commonly used, and machine-readable format, and to transmit this data to another controller, including direct transfer if technically feasible.
This right must not adversely affect the rights and freedoms of others.
If you request that we transfer your data directly to another controller, we will require the contact details of the new controller (email and phone number). MONTEZA, s.r.o., will ensure a secure method of transfer, but is not responsible for the data processing by the new controller upon receipt.
6.6. Right to Object
You have the right to object at any time to processing based on the performance of a task carried out in the public interest, in the exercise of official authority, or necessary for legitimate interests pursued by the controller or a third party. MONTEZA, s.r.o., will then assess whether its legitimate interests override your stated reasons.
You also have the right to object to processing for scientific, historical research, or statistical purposes, or direct marketing, including profiling. If you object, your data shall no longer be processed for direct marketing.
6.7. Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement if you believe that the processing of personal data concerning you violates the GDPR.
The relevant supervisory authority is:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12
820 07 Bratislava 27
Slovak Republic
https://dataprotection.gov.sk/sk
In Stará Ľubovňa, dated 18.10.2024
Mgr. Kristián Diňa
Managing Director
MONTEZA, s.r.o.