Privacy policy

Information Obligation of the Controller towards Data Subjects

pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “Regulation EU 2016/679” or “GDPR“)

Controller:

DCP timber, s.r.o., with its registered office at Dúbravca 1, 036 01 Martin, Slovakia, ID No. (IČO): 36 014 419, a company registered in the Commercial Register of the District Court of Žilina, Section: Sro, Insert No.: 3759/L, tel: +421 43 4300421, email: dcp@dcp.sk

Person responsible for personal data protection (Data Protection Officer): ak T ak, s. r. o., Škultétyho 472/10, 036 01 Martin, ID No. (IČO): 53 093 216, email: zodpovednaosoba@aktatk.sk

How did we obtain your personal data?

DCP timber, s.r.o. obtains and processes your personal data in its own name through authorized persons, who are its employees.

When your personal data is processed by DCP timber, s.r.o., you are the data subject, i.e., the person whose personal data relating to them is being processed.

DCP timber, s.r.o. processes personal data of data subjects, who are mainly:

• job applicants, employees, and former employees;
• persons close to employees;
• the statutory body of the company;
• third parties in a contractual relationship with the controller (customers, suppliers, etc.);
• visitors to the company premises;
• other persons.

DCP timber, s.r.o. obtains your personal data:

• most often directly from you (if you are a job applicant, employee, visitor, client, etc.);
• in special cases from third parties

(e.g., from courts, bailiffs, the social insurance agency, and other public authorities, from publicly available registers maintained pursuant to special legal regulations, or directly from your close person through necessary documents submitted in accordance with legal regulations for the purpose of exercising the rights and claims of that person).

For the processing of your personal data that DCP timber, s.r.o. obtained from third parties in the performance of its tasks and obligations under special legal regulations, the exceptions under Art. 14(5) GDPR apply appropriately to the controller’s obligation to transparently inform data subjects. For an employee, this includes, for example, documents proving the entitlement to a child tax bonus (e.g., marriage certificate for women, birth certificate of the child) or documents proving the entitlement to an employer’s contribution for recreation under § 152a of the Labor Code.

Personal data that DCP timber, s.r.o. did not obtain directly from you may be processed as part of the performance of obligations and tasks resulting from legal regulations and public interest:

• as an employer, if you are, for example, a family member of a DCP timber, s.r.o., Martin employee or a person close to them;
• as an entity performing registry management tasks, processing agendas of which it is the originator in its registry centers, such as personal files of employees.

Principles of Personal Data Protection

When processing your personal data, DCP timber, s.r.o. adheres to the principles under Article 5 GDPR, particularly lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity, and confidentiality. Last but not least, it also ensures the principle of secure processing.

Only authorized persons of DCP timber, s.r.o. commissioned with the processing of personal data to the specified extent and for specified purposes have access to your personal data. These persons are obliged to process your personal data in accordance with legal and internal regulations of DCP timber, s.r.o., based on the instructions of the controller and its responsible persons.

DCP timber, s.r.o. has a legal obligation to provide your personal data during inspections, supervisory activities, or at the request of authorized state authorities or institutions if it results from special regulations (e.g., for criminal proceedings or at the request of a court or bailiff).

On what basis will your data be processed?

Your personal data will be processed lawfully for one of the main purposes of processing, and usually also for another purpose that can be merged with the original purpose of processing and legal processing operations (especially for the purpose of registry management and archiving of documents in the public interest and the purpose of statistics in the public interest), while the legal basis for processing is one/several of the following conditions:

• compliance with a legal obligation of the controller under special legal regulations;
• performance of a contract to which the data subject is a party or pre-contractual relations based on the request of the data subject;
• processing necessary for the purposes of legitimate interests pursued by the controller or a third party (except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, especially if the data subject is a child);
• performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• consent of the data subject to the processing of their personal data for one or more specific purposes.

What are the possible consequences of not providing personal data?

If DCP timber, s.r.o. processes your personal data according to special legal regulations (fulfillment of a legal obligation) and in connection with the performance of tasks in the public interest, providing personal data is a legal requirement. It is your duty to provide the requested data and tolerate its processing for the duration of the processing purpose. Failure to provide your personal data could result in partial or full failure to implement the performance resulting from these regulations, or the rejection of your submission/request.

If DCP timber, s.r.o. processes your personal data for the needs of pre-contractual and contractual relations in which you are one of the parties (standard contract, employment contract, order, etc.), providing personal data is mandatory and necessary for the valid conclusion of these contractual relations. If not provided, the contractual relationship may not be concluded.

If DCP timber, s.r.o. obtains and processes your data based on your consent, providing personal data is voluntary and you can withdraw your consent at any time, usually in the same way you provided it. You have the option to effectively object to the processing of personal data for direct marketing or profiling purposes. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

If DCP timber, s.r.o. processes your personal data for the purposes of achieving legitimate interests pursued by DCP timber, s.r.o. or a third party, providing your data is mostly necessary for the given purpose, provided that these legitimate interests never override the interests or fundamental rights and freedoms of the data subject.

An overview of the processing purposes set by the controller and their legal bases is individually listed in the Record of Processing Activities document.

Who are the recipients of your personal data?

Categories of possible recipients:

• authorized persons of DCP timber, s.r.o.,
• state administration and public authorities,
• courts,
• law enforcement agencies,
• bailiffs,
• contractual processors,
• data subjects in the position of applicant, job seeker, complainant, etc.,
• other authorized entities,
• visitors to the premises of DCP timber, s.r.o.,
• the public (e.g., if data is published in the public interest or under special legal regulations or published based on the consent of the data subject).

Detailed information about recipients for individual processing purposes can be found in the Record of Processing Activities document.

Will your personal data be provided outside the European Union?

The transfer of personal data to a third country or an international organization does not take place for our processing purposes.

Will your data be used for automated individual decision-making?

Personal data will not be used for automated individual decision-making, including profiling.

How long will your personal data be stored?

Your personal data will be stored securely, in accordance with the internal directive and only for the period necessary to fulfill the purpose of processing and during the storage period specified by the Registry Rules or until the withdrawal of consent, whichever occurs first.

Detailed information about the data retention period for individual processing purposes can be found in the Record of Processing Activities document.

Do we use cookies for behavior tracking and profiling?

The controller’s websites use cookies but do not store any personal data about site visitors. The controller’s websites also do not perform profiling or automated processing of personal data.

Do we perform transfers of personal data to third countries?

DCP timber, s.r.o. does not transfer personal data to third countries. More information on whom your personal data is provided to can be found under the individual processing purposes in the Record of Processing Activities.

What are your rights?

Withdraw consent – in cases where we process your personal data based on your consent, you have the right to withdraw this consent at any time. You can withdraw consent electronically, at the address of the responsible person, in writing, or in person at the controller. Withdrawal of consent does not affect the lawfulness of processing based on it prior to its withdrawal.

Right of access – you always have the right to be provided with information on whether we process personal data about you. You can request copies of the personal data we have available, as well as information on how we use your personal data.

Right to rectification – you have the right to the correction of data during the duration of the processing purpose. We take reasonable measures to ensure the accuracy and completeness of the information we have.

Right to erasure (right to be forgotten) – you have the right to ask us to delete your personal data if it is no longer necessary for the original purpose. However, your right must be assessed in light of all relevant circumstances (e.g., legal obligations).

Right to restriction of processing – in certain circumstances, you are entitled to ask us to stop using some of your personal data, for example, if you believe the data we have may be inaccurate.

Right to data portability – in certain circumstances, you have the right to ask us to transfer the personal data you provided to another third party of your choice.

Right to object – you have the right to object to data processing based on our legitimate interests or public interests. During the investigation period, the controller will temporarily suspend the processing of your data.

Right to file a motion to initiate proceedings on personal data protection – if you believe your personal data is processed incorrectly or unlawfully, you can file a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Námestie 1. mája 18, 811 06 Bratislava; tel. number: +421 /2/ 3231 3214; email: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk.