The data controllers, ableneo Slovensko s.r.o. and ableneo Česká Republika s.r.o., process personal data in the operation of the website https://ableneo.com  and are therefore obliged, in line with the principle of transparency, to inform the data subjects about the processing of their personal data.

This document properly informs data subjects about the scope, purpose, and duration of the processing of their personal data. Personal data may be processed by automated means or manually in paper form by employees or processors of ableneo Slovensko s.r.o. and ableneo Česká Republika s.r.o.

Joint Controllers

ableneo Slovensko s.r.o.
Vysoká 26, 811 06 Bratislava, Slovakia
+421 2 32 144 791
info-sk@ableneo.com
Id. No 47 002 140

ableneo Česká Republika s.r.o.
Zárybničná, 2339/35, 141 00 Prague, Czechia
+420 234 749 659
info-sk@ableneo.com
Id. No 05173167

Data Protection Officer

The controllers do not designate a data protection officer

Purpose of the processing

Personal data of data subjects are processed for these purposes:

• operating of the contact form, handling received messages, responding to them, and using them to improve the provided services
• sending newsletters
• protecting the legitimate interests of the controllers or third parties, which is in particular:
• direct marketing.

The provision of personal data of the data subject is necessary for the use of these services provided by the controllers.

Legal basis for the processing

The processing of personal data of data subjects for operating the contact form, handling received messages, responding to them, and using them to improve the provided services is based on the consent pursuant to Article 6(1)(a) GDPR. The consent is given before the sending of message via the contact form.

The processing of personal data of data subjects for the purpose of sending the newsletter is based on the consent pursuant to Article 6(1)(a) GDPR. The consent is given prior to subscribing to the newsletter.

The processing of personal data of data subjects for the purposes of protecting the legitimate interests of the controllers or of the third parties may be based on legitimate interest pursuant to Article 6(1)(f) of the GDPR.

Scope of the processed personal data

The controllers process personal data specified in the message sent via the contact form, particularly the name, the surname, the phone and the e-mail. The personal data is obtained directly from the data subject or provided to the controllers by the sender of the message.

The controllers process the e-mail for sending the newsletter and for direct marketing. The personal data is obtained directly from the data subject.

The controllers do not process the special categories of personal data.

Consent

The consent, which is the legal basis for processing personal data, can be withdrawn by the data subject at any time and the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The withdrawal of this consent does not affect the right of the controllers to process the personal data based on other legal basis mentioned in the generally binding legal regulations.

Retention period

The retention period of the processed personal data will be a maximum of 3 years concerning personal data processed for the purpose of operation of the contact form or until withdrawal of consent, whichever comes first, 10 years concerning personal data processed for the purpose of sending the newsletter or until withdrawal of consent, whichever comes first, as long as there is a legitimate interest in processing.

When dealing with personal data, the controllers apply the principle of minimisation, which means that as soon as the period for which the controllers are entitled to store personal data expires, the controllers immediately anonymise the personal data from databases and information systems. The controllers have set strict internal rules for the retention of personal data, which ensure that it is not held for longer than the controllers are entitled or obliged to.

Recipients

The personal data of the data subjects shall be disclosed to the company Intuit Mailchimp, 405 N Angier Ave. NE, Atlanta, GA 30308 USA that is the data processor and provides the services of sending the newsletter (“MailChimp”).

The personal data of the data subjects may be disclosed to the employees and the processors of the controllers, the accounting advisors, the attorneys, the auditors, the archives, the software, and support providers, including the employees of these persons.

The personal data of data subjects may be disclosed to public or other authorities, particularly those exercising supervision or oversight over the activities of the controllers.

The controllers shall only disclose personal data to the extent necessary and subject to the confidentiality of the recipient.

Transfer to third countries

The controllers do not transfer personal data to international organisations or third countries. MailChimp as a data processor transfers the data to the USA in line with the following rules: https://mailchimp.com/help/mailchimp-european-data-transfers/.  

Rights of data subject

The data subject is entitled to exercise the following rights using the controllers’ contact details provided above:

• Right of access to personal data (Article 15 GDPR) – the right to be provided with a copy of the personal data held by the controllers about the data subject, as well as information about how the controllers use this personal data.
• Right to rectification of processing (Article 16 GDPR) – the right to request rectification of personal data if inaccurate or incorrect personal data is processed.
• Right to erasure of personal data (Article 17 GDPR) (i) when the data are no longer necessary for the purposes for which they were collected, (ii) when consent has been withdrawn and there is no other legal basis for the processing, (iii) when the data subject has objected to the processing based on a legitimate interest and their interests, rights, and freedoms are not overridden by those of the controller, or when they have objected to the processing for direct marketing purposes, or (iv) when the personal data have been unlawfully processed.
• The right to restriction of processing (Art. 18 GDPR) (i) when the data subject considers that incorrect personal data are being processed, pending verification of their accuracy, (ii) when the processing is unlawful and the data subject requests restriction of processing instead of erasure, (iii) when the controllers no longer need the personal data but the data subject need them for their own purposes for the establishment, exercise or defence of legal claims, (iv) when the data subject objects to the processing, pending verification whether the legitimate grounds of the controllers override their interests, rights and freedoms.
• Right to data portability (Article 20 GDPR) – the right to request the transfer of personal data in a structured, commonly used, and machine-readable format to another controller where personal data are processed based on consent and/or contract by automated means.

If the data subject considers that the processing of personal data concerning them are contrary to generally applicable law, they have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, based at Hraničná 12 in Bratislava.

Right to object

The data subject has the right to object the processing of their personal data for direct marketing purposes at any time, in which case the personal data may no longer be processed for these purposes.

If the controllers process personal data to protect their legitimate interests or the legitimate interests of others, the data subject may object to such processing on grounds relating to their particular situation (Article 21 of the GDPR); in such a case, the controller may further process their personal data only if they demonstrate the existence of compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or if the data are necessary for the establishment, exercise or defence of legal claims.

Automated processing including profiling

The processing of personal data by the controller does not involve decision-making pursuant to Article 22 of the GDPR based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them.