Privacy Policy

We take a responsible approach to the protection of your personal data and strive to ensure your right to information. In processing personal data, we also adhere to the principles of lawfulness, purpose limitation, minimisation of the scope and storage, accuracy, integrity, confidentiality and accountability, with particular emphasis on security and protection of personal data.

With effect from 25 May 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ("Regulation" or "GDPR") and Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments and Additions to Certain Acts ("Personal Data Protection Act") apply to the processing of personal data.

In accordance with Articles 13 and 14 of the GDPR and Section 19 of the Personal Data Protection Act, EPF Group, a.s. is obliged to provide you with the following information:

 

1. Contact details of the controller

The data controller (Article 4(6) GDPR and § 5(o) of the Personal Data Protection Act) is EPF Group, a.s., with registered office at Mlynské Nivy 70, Bratislava 821 05, ID No.: 52 326 039, registered in the Commercial Register of the District Court Bratislava I, Section: Sa, Insert No. 6924/B, contact details: tel.: 02/43412279, e-mail: , https://www.e-personal.eu („company“).

2. Purpose of personal data processing

The company processes your personal data in order to provide its services in a quality manner, it knows some personal data of the data subjects and needs to provide them to other recipients for the purpose of fulfilling its legal obligations.

The Company processes the personal data provided for several purposes:

  • processing of contractual and pre-contractual obligations
  • processing of personnel and payroll records
  • processing of accounting records

3. Legal basis for the processing of personal data

The company processes your personal data in accordance with the current and valid law. The legal basis for the processing of personal data is:

  • specific legal provisions, in particular:
    • Social Insurance Act, Labour Code, applicable payroll and accounting regulations, Commercial Code, Civil Code, Trade Licensing Act, Occupational Health and Safety Act
  • the data subject's consent to the processing of personal data, depending on the purpose of the processing of personal data
  • fulfillment of the contract to which the affected person is a party
  • processing of personal data for the protection of life, health or property of a person concerned
  • legitimate interest of the company.

The company processes personal data without the consent of the data subject in the following cases:

a) The purpose of processing personal data, the scope of data subjects, and the list of personal data or their extent are determined by a directly applicable legal act of the European Union, an international treaty to which the Slovak Republic is bound, or this law. If the list or extent of personal data is not determined, the company may process personal data only to the extent and in a manner necessary to achieve the specified purpose of processing while complying with the basic obligations under § 13 para. 3 letters a) to e) i) of the Personal Data Protection Act.

b) The company further processes personal data without the consent of the data subject if the purpose of processing personal data, the scope of data subjects, and the list of personal data are determined by a special law, and only to the extent and manner prescribed by that special law. Processed personal data may be provided, made accessible, or disclosed only if a special law establishes the purpose of provision, accessibility, or disclosure, the list of personal data that may be provided, made accessible, or disclosed, as well as third parties to whom personal data are provided, or the scope of recipients to whom personal data are made accessible, if the Personal Data Protection Act does not provide otherwise.

c) The processing of personal data is necessary to protect the life, health, or property of the data subject,

d) Personal data that have already been published in accordance with the law and properly identified by the controller are processed; the person claiming to process published personal data shall, upon request, prove to the authority that the processed personal data have already been lawfully published,

e) The company processes personal data that are necessary to protect the rights and legitimate interests of the controller or a third party for these purposes.

  • provision of pre-contractual/contractual relations

4. Recipients, or categories of beneficiaries

The recipients are the company's employees, who are authorized to process personal data related to the agenda of job applicants based on their job classification and on the basis of the company's mandate.

5. Transfer of personal data to a third country or to an international organization

The company does not and will not transfer your personal data to a third country, nor will it transfer them to any international organization.

6. Period of storage of personal data

The retention period of personal data is determined by the purpose of processing personal data and by the requirements of specific regulations.

Specific retention periods are prescribed by the internal regulation, the Filing Plan of the company, developed in accordance with the law on archives and filing systems.

The company shall dispose of the personal data in a prescribed manner when the purpose of processing and the retention period have ended. After the defined purpose has ended, the company is authorized to process personal data to the extent necessary for research or statistical purposes in their anonymized form.

The company ensures that the personal data of data subjects are processed in a manner that allows the identification of individual data subjects for no longer than necessary to achieve the purpose of processing.

 

7. Your rights as a data subject

Based on a written request, the person concerned has the right to demand from the company:

  • You have the right to request access to your personal data at any time - upon your request, the company will provide you with information about what personal data it processes about you, for what purpose, from what source these personal data were obtained, to whom the personal data have been provided, and what is the expected retention period of personal data.
  • You also have the right to request correction of your inaccurate, incomplete, or outdated personal data that are subject to processing.
  • You also have the right to request erasure of personal data that are no longer necessary for the purpose for which they were originally obtained or processed.
  • You have the right to request the restriction of the processing of personal data - you can ask the company not to delete your personal data that it would otherwise be obliged to delete and you can also ask the company not to work with your personal data further until it becomes clear whether the processed data is accurate or whether Your objection to the processing of personal data was justified.
  • You have the right to object to the processing of your personal data at any time (only in the case of personal data for which the legal basis for processing is the legitimate interest of the company). If you do so, the company will continue to process your personal data only if it is proven that there are serious legitimate reasons for such a procedure.
  • You have the right to prevent the processing of personal data, which you assume are or will be processed for direct marketing purposes without its consent, and to request their disposal,
  • You have the right to transfer personal data to another operator.

If you believe that your rights have been violated in connection with the processing of your personal data, you have the right to file a complaint with the supervisory authority - the Personal Data Protection Office of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, tel. 02 323 132 14, e-mail: , or contact the office through its website https://dataprotection.gov.sk/uoou/sk. 

If the person concerned does not have full legal capacity, his rights can be exercised by a legal representative. If the person concerned is not alive, his/her rights, which he/she had under this Act, can be exercised by a close person.

According to the Act on the Protection of Personal Data, the company will handle the request of the person concerned free of charge, except for payment in an amount that cannot exceed the amount of material costs incurred for the purpose of making copies, importing technical media and sending information to the person concerned, unless a special law provides otherwise.

The company is obliged to process the request of the affected person in writing no later than 30 days from the date of delivery of the request.

 

8. How can you exercise your rights?

You exercise your rights (including the right to revoke consent) with the operator - the company in one of the following ways: in writing or by e-mail (contact details are listed in point 1 above).

9. What personal data will be processed

The company will process the following personal data:

  • name and surname;
  • date of birth;
  • residential address, or contact address;
  • achieved education (including relevant documents);
  • information about previous work experience;
  • E-mail adress;
  • phone contact.

The company hereby informs you, as the person concerned, about the protection of your personal data and instructs you about your rights in relation to the protection of personal data within the scope of this written information obligation.

In Bratislava on 01.05.2019

EPF Group, a.s.
JUDr. Jozef Petrík, Chairman of the Board