Information on the Rights of the Data Subject
According to Act No. 122/2013 Coll. on Personal Data Protection and on Amendments to Certain Acts, as amended
MOKA design s.r.o., Tureň 161, 903 01 Tureň is, for the purposes of Act No. 122/2013 Coll. on Personal Data Protection and on Amendments to Certain Acts, as amended (hereinafter referred to as the "Personal Data Protection Act"), the operator of information systems in which personal data of data subjects are processed in accordance with the Personal Data Protection Act, based on: directly applicable legally binding act of the European Union, international treaty binding on the Slovak Republic, provisions of this Act or special law, consent of the data subject or based on a contract with the data subject.
Hereby, the operator fulfills its legal obligation towards data subjects whose personal data it processes in its information systems, pursuant to § 15 par. 1 of the Personal Data Protection Act – to notify the data subject in advance of the following information:
1. Identification data of the operator: MOKA design s.r.o., Tureň 161, 903 01 Tureň, Company ID: 56 612 613, VAT ID: SK2122359767
2.Identification data of the processor with whom the operator has concluded an Agreement on Ensuring the Protection of Personal Data processed by the processor pursuant to § 8(3) of the Personal Data Protection Act.
3.The purpose of personal data processing is defined in the Records/Notifications/Applications for Special Registration and related documents maintained on the operator's information systems. Through these forms, the operator fulfills its obligation to maintain records/notification obligations/special registration of its information systems according to § 33-44/ 35-36/ § 37-39 of the Personal Data Protection Act. The operator will make the data from records/notifications/special registration available upon request.
4.The list or scope of personal data processed by the operator in individual information systems is defined in the Records/Notifications/Applications for Special Registration and related documents maintained on the operator's information systems. Through these forms, the operator fulfills its obligation to maintain records/notification obligations/special registration of its information systems according to § 33-44/ 35-36/ § 37-39 of the Personal Data Protection Act. The operator will make the data from records/notifications/special registration available upon request.
5. Additional information necessary for the data subject to guarantee their rights and legally protected interests (third parties, recipients, form of disclosure, third countries) is defined in the Records/Notifications/Applications for Special Registration and related documents maintained on the operator's information systems. Through these forms, the operator fulfills its obligation to maintain records/notification obligations/special registration of its information systems according to § 33-44/ § 35-36/ § 37-39 of the Personal Data Protection Act. The operator will make the data from records/notifications/special registration available upon request.
6. Under the operator's conditions, personal data is only collected by persons who can prove their identity as authorized persons and prove their affiliation with the operator through a credible document.
7. Under the operator's conditions, if personal data is collected based on the consent of the data subject pursuant to § 11, such data is collected exclusively on a voluntary basis, and the data subject is aware of the validity period of their consent.
8. Under the operator's conditions, if personal data is collected based on a directly applicable legally binding act of the European Union, international treaty binding on the Slovak Republic, or law, the operator shall inform the data subject of the legal basis imposing this obligation and notify them of the consequences of refusing to provide personal data.
All data subjects whose personal data are processed under the operator's conditions in individual IS have the following rights according to § 28 of the Personal Data Protection Act:
Based on the search results, the data subject has the right to request from the operator based on a written request:
a) Confirmation whether or not personal data about them are being processed
b) Information about personal data processing in the information system in a generally understandable form within the scope according to § 15 par. 1 letters a) to e) points two to six; when issuing a decision according to paragraph 5, the data subject is entitled to familiarize themselves with the processing procedure and evaluation of operations
c) Precise information in a generally understandable form about the source from which their personal data were obtained for processing
d) A list of their personal data that are subject to processing in a generally understandable form
e) Correction or deletion of their incorrect, incomplete or outdated personal data that are subject to processing
f) Deletion of their personal data if the purpose of their processing has ended; if official documents containing personal data are being processed, they may request their return
g) Deletion of their personal data that are subject to processing if there has been a violation of the law
h) Blocking of their personal data due to withdrawal of consent before the expiry of its validity period, if the operator processes personal data based on the data subject's consent
2. The right of the data subject under paragraph 1 letters e) and f) may be restricted only if such restriction arises from a special law or if its application would violate the protection of the data subject or would violate the rights and freedoms of other persons.
3. Based on a written request, the data subject has the right to object to the operator against:
The data subject has the right to object to the processing of their personal data which they suspect are or will be processed for direct marketing purposes without their consent, and to request their deletion.
The use of personal data specified in § 10 paragraph 3 letter a) [The operator processes personal data without the data subject's consent also when the processing concerns exclusively the title, name, surname and address of the data subject without the possibility to assign additional personal data to them and their use is intended exclusively for the operator's needs in postal communication with the data subject and records of such data; if the operator's business activity includes direct marketing, such personal data may be provided, without the possibility of making them accessible and publishing them, only if they are provided to another operator with the same business activity, exclusively for direct marketing purposes, and the data subject has not filed a written objection under § 28 paragraph 3 letter c)] for direct marketing purposes in postal communication, or providing personal data specified in § 10(3)(d) for direct marketing purposes.
The provision of personal data specified in § 10(3)(d) for direct marketing purposes.
The data subject, based on a written request or in person if the matter cannot be delayed, has the right to object to the operator at any time against the processing of personal data in cases under § 10 paragraph 3 letters a), e), j) or g).
[The operator processes personal data without the consent of the data subject also when:
a) The processing of personal data is necessary for the purposes of creating artistic or literary works, for the needs of informing the public through mass media, and if the personal data is processed by an operator for whom this follows from the subject of their activity; this does not apply if by processing personal data for such purpose the operator violates the data subject's right to protection of their personality and privacy, or if such processing of personal data without the consent of the data subject is excluded by a special law or international treaty binding on the Slovak Republic.
b) Personal data that have already been made public in accordance with the law are being processed and the operator has duly marked them as published; anyone who claims to process published personal data shall prove to the Office upon request that the processed personal data have already been legally published.
c) The processing of personal data is necessary for the fulfillment of an important task carried out in the public interest or
d) The processing of personal data is necessary for the protection of rights and legally protected interests of the operator or third party, particularly personal data processed within the protection of property, financial or other interests of the operator and personal data processed to ensure the operator's security through cameras or similar systems; this does not apply if in such processing of personal data the fundamental rights and freedoms of the data subject that are subject to protection under this Act prevail] by stating legitimate reasons or presenting evidence of unauthorized interference with their rights and legally protected interests that are or may be damaged in the specific case by such processing of personal data; if there are no legal reasons preventing it and it is proven that the data subject's objection is justified, the operator is obliged to block the personal data whose processing the data subject objected to without undue delay and delete them as soon as circumstances allow.
4.The data subject, based on a written request or in person if the matter cannot be delayed, further has the right to object to the operator at any time and not to be subject to the operator's decision, which would have legal effects or significant impact on them, if such decision is issued solely based on automated processing of their personal data. The data subject has the right to request the operator to review the issued decision by a method different from automated processing, and the operator is obliged to comply with the data subject's request in such a way that an authorized person will have the decisive role in reviewing the decision; the operator shall inform the data subject about the method of review and the result of the findings within the period according to § 29 par. 3. The data subject does not have this right only if it is stipulated by a special law which regulates measures to ensure the legitimate interests of the data subject, or if within pre-contractual relations or during the existence of contractual relations the operator issued a decision which complied with the data subject's request, or if the operator based on a contract adopted other appropriate measures to ensure the legitimate interests of the data subject.
5.If the data subject exercises their right:
In writing and if the content of their request shows that they are exercising their right, the request is considered to be submitted according to this Act; a request submitted by email or fax must be delivered in writing by the data subject no later than three days from the date of its sending.
In person orally in the form of a written record, which must clearly show who exercised the right, what they are requesting and when, and who prepared the record, their signature and the signature of the data subject; the operator is obliged to provide a copy of the record to the data subject.
With the processor according to letter a) or letter b), they are obliged to submit this request or record to the operator without undue delayWith the processor according to letter a) or letter b), they are obliged to submit this request or record to the operator without undue delay
6. If the data subject suspects that their personal data is being processed unlawfully, they may submit a proposal to the Office to initiate proceedings on personal data protection.
7. If the data subject does not have full legal capacity, their rights may be exercised by their legal representative.
8. If the data subject is deceased, their rights under this Act may be exercised by a close person.
PROVISION OF INFORMATION TO THE DATA SUBJECT ACCORDING TO § 29:
1. The request of the data subject according to § 28(1) letters a) to c), e) to h) and paragraphs 3 to 5 shall be processed by the operator free of charge.
2. The request of the data subject according to § 28(1)(d) shall be processed by the operator free of charge except for a fee that cannot exceed the amount of effectively incurred material costs associated with making copies, obtaining technical media, and sending information to the data subject, unless otherwise provided by a special law.31)
3. The operator is obliged to process the data subject's request according to paragraphs 1 and 2 in writing no later than 30 days from the date of receipt of the request.
NOTIFICATION OF RESTRICTION OF DATA SUBJECT'S RIGHTS ACCORDING TO § 30
The restriction of the data subject's rights according to § 28 par. 2 shall be notified by the operator in writing without undue delay to the data subject and to the Office.