Privacy Policy
1. PREAMBLE
The company ELEKTRO - HARAMIA s.r.o., Lozorno 927, 900 55 Lozorno, Company ID: 35 922 664, registered in the Commercial Register kept by the Municipal Court Bratislava III., Section: Sro, File No. 35037/B, as the controller, processes personal data in accordance with the applicable legal regulations of the Slovak Republic and the European Union, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council („GDPR“) and Act No. 18/2018 Coll. on the Protection of Personal Data.
The purpose of this "Privacy Policy" document is to provide clients, business partners, website visitors and other data subjects with transparent information about:
-
what personal data we process,
-
for what purpose we process personal data,
-
on what legal basis we process personal data,
-
to whom personal data may be provided,
-
how long we keep personal data,
-
what rights data subjects have in relation to the processing of personal data.
The operator takes appropriate technical and organizational measures to ensure the protection of personal data against unauthorized access, loss, damage, misuse or unauthorized disclosure.
This privacy policy is published on the operator's website and may be updated continuously depending on changes in legislation or the operator's processing activities.
2. SCOPE
This Privacy Policy applies to the processing of personal data of clients, business partners, website visitors and other natural persons whose personal data the operator processes as part of its activities.
The document regulates in particular:
-
conditions for processing personal data,
-
purposes and legal bases of processing,
-
the method of obtaining and storing personal data,
-
personal data protection,
-
rights of data subjects,
-
provision of personal data to third parties.
These principles apply to all forms of processing of personal data, in particular:
-
via the website,
-
electronic communication,
-
e-mail communication,
-
telephone communication,
-
when concluding contractual and business relationships,
-
through the operator's internal information systems and records.
The operator takes appropriate technical, organizational and security measures to protect personal data against unauthorized access, misuse, loss, damage or unauthorized disclosure.
If the operator uses intermediaries or external service providers, it ensures that the processing of personal data is carried out in accordance with the GDPR and applicable personal data protection laws.
The operator does not carry out automated individual decision-making or profiling, unless otherwise stated in a specific information obligation or required by a specific legal regulation.
3. TERMS AND DEFINITIONS
Personal data
According to Article 4(1) of the GDPR, personal data are data and information relating to an identified or identifiable natural person (e.g. name, address, telephone number, e-mail address).
A combination of different information that together allows the identification of a specific person is also considered personal data.
Controller
A natural or legal person, public authority or other entity which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processing
Any operation or set of operations performed on personal data, such as collection, recording, organization, storage, adaptation, retrieval, use, disclosure by reference, restriction, erasure or destruction.
4. NECESSITY OF PROVIDING PERSONAL DATA
In some cases, the provision of personal data is necessary to conclude a contractual relationship, process an inquiry, provide a service, or fulfill the operator's legal obligations.
If the necessary personal data is not provided, it may not be possible to conclude a contract, process the data subject's request, or provide the requested service.
The provision of personal data for marketing purposes or processing based on the consent of the data subject is voluntary and the data subject may withdraw their consent at any time.
5. APPLICATIONS FOR EMPLOYMENT
The operator processes the personal data of job applicants, mainly included in CVs, motivation letters and other submitted documents, for the purposes of implementing the selection procedure and registering job applicants.
The processed data includes in particular identification, contact and professional data, data on education, experience and qualifications. Providing personal data is voluntary, but necessary for the inclusion of the applicant in the selection procedure.
The legal basis for processing is:
-
Art. 6 para. 1 letter b) GDPR – implementation of measures prior to the conclusion of an employment contract,
-
Art. 6 para. 1 letter a) GDPR – consent of the data subject in the case of recording a CV for future job opportunities.
Personal data is stored for the duration of the selection procedure, but no longer than 1 year from the date of delivery of the CV, unless the applicant grants new consent. The applicant may withdraw their consent at any time by sending an e-mail to ivana.stolarova@elektroharamia.sk
6. PURPOSE OF PROCESSING PERSONAL DATA, LEGAL BASIS AND STORAGE PERIOD
The operator processes the personal data of the data subjects only to the extent necessary to fulfill the specific purpose of the processing, in accordance with the GDPR, Act No. 18/2018 Coll. on the Protection of Personal Data and other generally binding legal regulations.
Name of the processing operation | Purpose of processing | Personal data category | Legal title | Retention period |
Camera system (if used) | Protection of property and safety of persons | Video recording | Art. 6 (1) (f) GDPR – legitimate interest | Typically 72 hours |
Disclosure of video recordings to law enforcement agencies | Providing video footage to law enforcement agencies | Video recording | In accordance with Article 6(1)(c) | The records may also be used to prove legal claims and the operator will process them for the period necessary to prove them. |
Registry management | Registration, management and archiving of registry records | Identification and contact details listed in registry records | Art. 6 (1) (c) GDPR – compliance with a legal obligation | According to the registry plan and special legal regulations |
Payroll and personnel agenda | Management of employee labor and payroll agenda | Identification data, contact data, payroll and employment data | Art. 6 (1) (c) GDPR – compliance with a legal obligation | According to specific legislation, generally 10 to 70 years |
Accounting and billing agenda | Fulfillment of legal obligations | Billing and identification data | Art. 6 (1) (c) GDPR – legal obligation | 10 years |
Contractual relationships with clients | Conclusion and performance of the contract | Identification and contact details | Art. 6 (1) (b) GDPR – performance of a contract | During the duration of the contractual relationship |
Receiving and Processing Customer Requests and Orders | Recording and processing service orders, communicating with the customer and taking measures before concluding a contract | Customer identification and contact details (name, surname, address, telephone number, e-mail), data on ordered services, or billing details | Art. 6 (1) (b) GDPR – pre-contractual relations | 3 months from the date of processing the request |
7. PRINCIPLES OF PROCESSING PERSONAL DATA
The operator processes personal data in accordance with the GDPR Regulation, Act No. 18/2018 Coll. on the Protection of Personal Data and other generally binding legal regulations.
7.1 Legality and transparency
The operator processes personal data lawfully, fairly and transparently in accordance with Article 5 of the GDPR.
When obtaining personal data, the data subject is informed in particular about:
identification and contact details of the operator,
the purpose of processing personal data,
the legal basis for processing,
the period of retention of personal data,
the rights of the data subject.
Personal data are processed only if one of the legal bases pursuant to Article 6 GDPR is met, in particular:
performance of the contract,
fulfillment of a legal obligation,
legitimate interest of the operator,
consent of the person concerned.
If the processing is based on consent, the data subject has the right to withdraw this consent at any time.
7.2 Purposeful binding
Personal data shall be collected and processed only for specific, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those purposes.
Only authorized persons have access to personal data to the extent necessary to perform their work or contractual obligations.
Persons authorized to process personal data are obliged to maintain confidentiality of personal data and to take appropriate measures to protect personal data against unauthorized access, loss or misuse. The obligation of confidentiality continues even after the termination of the employment or similar relationship.
7.3 Data minimization
Only data necessary for the specified purpose is processed.
Where possible, anonymized data is used.
7.4 Storage restriction and deletion
Personal data will be deleted when it is no longer necessary for the purpose for which it was collected, unless statutory retention periods prevent this.
Retention periods must always be observed.
If there is a legitimate reason for further storage, the data is stored until its expiration.
7.5 Data integrity and security
The operator takes appropriate technical, organizational and security measures to protect personal data against unauthorized access, loss, damage, misuse or unauthorized disclosure.
To ensure the protection of personal data, the operator mainly uses:
-
access rights control,
-
information systems security,
-
password protection and antivirus programs,
-
encrypted communication via security protocols (e.g. HTTPS/TLS),
-
regular instruction of authorized persons.
Personal data may only be processed by authorized persons who have been informed about their rights and obligations in the protection of personal data and are bound by a duty of confidentiality.
Personal data may only be made available to processors if they provide adequate safeguards for the protection of personal data and the processing is carried out in accordance with the GDPR.
8. USE OF COOKIES
We use cookies and similar technologies on our website to ensure the proper functioning of the website, improve user comfort, analyze traffic and for marketing purposes.
Cookies are small text files that are stored on your device when you visit a website. They allow the website to remember your settings, preferences, or information about your visit to the site.
The use of cookies does not directly identify the user. Cookies do not pose a security risk to your device and do not allow access to data stored on your device.
Types of cookies used
We mainly use:
-
technically necessary cookies,
-
analytical and statistical cookies,
-
marketing cookies.
Legal basis for processing
-
technically necessary cookies: § 109 para. 8 of Act No. 452/2021 Coll. on electronic communications,
-
analytical and marketing cookies: Art. 6 (1) (a) GDPR – consent of the data subject.
Cookie settings
The user can change the cookie settings through their internet browser or through the cookie bar displayed on the website. Restricting the use of cookies may affect the functionality of some parts of the website.
9. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
The operator does not transfer personal data to third countries outside the European Union or the European Economic Area, unless otherwise stated.
10. RECIPIENTS OF PERSONAL DATA
Personal data may be made available or provided to the extent necessary, in particular:
-
IT and hosting service providers,
-
web providers
-
email and cloud service providers,
-
public authorities, if required by a special legal regulation,
-
to processors who process personal data on behalf of the controller on the basis of a contract pursuant to Article 28 of the GDPR.
The operator provides personal data to third parties only to the extent necessary to fulfill the purpose of processing and while ensuring adequate protection of personal data.
11. RIGHTS OF DATA SUBJECTS
The data subject is any natural person whose personal data is processed by the operator, in particular clients, customers, website visitors, business partners or other persons whose personal data have been provided to the operator.
The data subject has, in particular, the following rights under the GDPR:
-
the right to access personal data,
-
the right to correct incorrect or incomplete personal data,
-
the right to erasure of personal data ("right to be forgotten"),
-
the right to restrict the processing of personal data,
-
the right to object to the processing of personal data,
-
the right to data portability,
-
the right to withdraw consent to the processing of personal data, if the processing is based on consent,
-
the right to file a petition to initiate proceedings with the supervisory authority, which is the Personal Data Protection Office of the Slovak Republic.
The data subject may exercise his or her rights in writing or electronically via the contact details of the controller provided in this document.
The operator will process the request of the data subject without undue delay, usually within 30 days of receipt of the request.
We would be happy if you would contact us directly in the first instance if you have any questions or concerns. We will do our best to handle your request correctly, transparently and to your satisfaction.
12. Contact
In case of questions regarding the protection of personal data or the exercise of the rights of data subjects, you can contact the operator using the following contact details:
Contact email: ivana.stolarova@elektroharamia.sk
Correspondence address: ELEKTRO - HARAMIA s.r.o., Lozorno 927, 900 55 Lozorno
13. CHANGES/
UPDATES
Document preparation: 8.7.2026.