Personal data processing information pursuant to Art. 13 and 14 of General Data Protection Regulation (GDPR)
Controller’s identity and contact details:
RED ARROW, s.r.o., Pred poľom 12, 911 01 Trenčín, Slovakia, ID: 50 157 256, redarrow@redarrow.sk, +421 915 433 061.
Processing purposes and legal basis for processing:
- The controller gathers data from the data subject mainly for the purpose of entering into a contract. This data will be used for pre-contract negotiations and for fulfilling the contract itself. The legal basis is the performance of the contract (Article 6, point 1, letter b) of the GDPR).
- Data provided by the data subject as per point 1. shall be also used for fulfilling the controller’s legal obligations. The legal basis is fulfilling legal obligations (Article 6, point 1, letter c) of the GDPR).
- Data provided by the data subject as per point 1. can also be used to protect controller’s legal interests. The legal basis is the legitimate interest of the controller (Article 6, point 1, letter f) of the GDPR).
- The controller can ask the data subject to give consent on processing the data for marketing purposes (references, etc.). The data subject is not obliged to give the consent and, shall the data subject give the consent, is authorized to withdraw the given consent at any time. The legal basis is consent (Article 6, point 1, letter a) of the GDPR). The amount and type of provided data, as well as means of its processing, shall be in the scope of the given consent.
Recipients of personal data and cross-border processing:
The controller plans to provide the personal data of the data subjects to the controller’s trusted contractual partners which the controller uses to provide services, including contractual partners from different countries. Cross-border processing of the personal data will primarily take place within EU. In the case of data transfer to a third country, the controller shall adopt adequate measures to ensure the protection of the concerned data in accordance with EU standards.
Personal data storage period:
The controller shall store the personal data for a period necessarily needed to conclude contract negotiations with the data subject, no longer than 3 years since the data was provided. After the contract is entered into, the controller shall store the personal data for the duration of the contract and 20 years after the contract expires, unless there is a longer period defined by the law. In that case, the controller shall store the personal data for this longer period.
Personal data, obtained and processed on the basis of the given consent (4th purpose of processing), shall be processed for the time period, stated in the consent itself. Shall the data subject withdraw the consent, the controller shall stop processing of the data as soon as possible, but no later than 10 days after the withdrawal of the consent. Lawfullness of processing the data before the withdrawal shall not be affected.
Rights of the data subject:
The data subject shall have the right to request from the controller access to their personal data, as well as the right to:
- rectification of their personal data;
- erasure of their personal data;
- restriction of processing of their personal data;
- object to processing of their personal data;
- data portability;
- lodge a complaint with a supervisory authority.
Cookies:
The controller uses cookies to record anonymous information about the use of the controller’s website (number of unique visitors; the address from which the visitors came to the controller’s website; the address to which they left the controller’s website; their movement and navigation on the controller’s website) via Google Analytics service. This information shall be solely used for the purpose of evaluating performance of the controller’s website. They are not linked to any other personal data the controller processes and cannot be associated with any identifiable data subject. More information about cookies can be found e.g. here: https://en.wikipedia.org/wiki/HTTP_cookie or here: https://en.wikipedia.org/wiki/Google_Analytics.
More details:
The controller requires the data subjects to provide their personal data for the purpose of contract. Failure to provide personal data by the data subject will result in the controller’s inability to provide services to the data subject.
The controller may perform profiling of the data subjects, mainly based on their primary business orientation, age (if provided), sex, domicile, etc. This data can be used to evaluate the performance of controller’s services.
The controller shall not process any special categories of personal data (e.g. biometric data, medical records, etc.).
Principles of data processing if the data are obtained from other subject than from the data subject itself (Article 14 of GDPR):
Shall the data be obtained from other subject than from the data subject itself, the controller shall evaluate if the processing of such data is necessary. Shall the processing not be necessary, the controller shall destroy the data immediately and make sure the data is no longer processed. Shall the processing be necessary, the controller shall define the purpose, data storage period and legal basis of the processing of the data, as well as other parameters, required by the GDPR. The controller shall then fulfill his obligation to inform the data subject about the processing, following Article 14 of GDPR. The text of this personal data processing information shall be used accordingly. Part of the information, provided to the data subject, shall focus on identifying the source of the data.


