header_image

According to the Article 13 of the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural person with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "the Regulation") and in accordance with the Section 19 of Act no. 18/2018 Coll. on the personal data protection (hereinafter referred to as "the Act").

Dear Applicant for a job or collaboration at Hotovo s. r. o., this document serves to provide you with basic information about why we collect your personal data, on what legal basis we process and collect data, to whom we can provide it to, along with other necessary information arising from personal data protection legislation. If you have any questions, do not hesitate to contact us. Please find appropriate contacts listed below.

Controller

Business Name: HOTOVO s. r. o.
Registered Office: Štúrova 44 040 01 Košice
BIN: 45635404
registered in the Business Register of the City Court Košice, section Sro, insert No. 25976/V

Data Controller Contact Person: Ján Strelka

privacy@hotovo.com
Štúrova 44 040 01 Košice

Data Subject’s Rights

The Data Subject is a natural person whose personal data we process, in particular, but not exclusively, employees and clients. Such Data Subjects, about whom personal data is processed through our information systems for specific defined purposes, have rights that they can exercise in writing or electronically with the Controller designated contact person. The Data Subject is YOU.

The right of access to personal data

i.e. the right to obtain confirmation from the competent person as to whether the personal data of the Data Subject, who has exercised their right, is being processed, as well as the right to obtain access to such data. As a Data Subject, you are entitled to access information on: the purposes of the processing, the category of personal data concerned, the range of recipients, the processing and retention time, the progress of each automatic processing, or the consequences of such processing, and so forth. (See Article 15 of the Regulation for further information). As the Controller, we have the obligation to take all reasonable steps to verify the identity of the Data Subject who is requesting access to the data, in particular in relation to online services and identifiers. At the request of the Data Subject, the Controller shall issue a certificate as to whether the personal data of the Data Subject concerning them is being processed. If the Controller processes this data, a copy of the personal data is provided of the Data Subject upon request. Issuance of the first copy is free of charge. For any additional copies requested by the Data Subject, the Controller will charge a fee corresponding to the administrative costs they will incur with the issuance of the copy. If a person requests information by electronic means, it will be provided to them in a commonly used electronic form, via e-mail, unless requested otherwise.

The right to restrict processing

Can be applied if, as the Data Subject, challenges the accuracy of personal data and other details within the meaning of Article 18, recital 67 of the Regulation, by temporarily transferring selected personal data to another processing system, denying users access to selected personal data or temporarily removing processing.

The right to rectification

In the event that the Controller holds inaccurate personal data about the Data Subject. The Data Subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. The Controller shall correct or supplement concerned personal data without undue delay after the Data Subject concerned has issued a request.

The right to erasure

The right to be forgotten. "Removal" of personal data concerning them. However, due to its nature and gravity, this right of the Data Subject is limited by the setting of other preconditions, the Controller shall without undue delay delete all personal data after the exercise of this right by the Data Subject if any or all of the following conditions are met: (a) the personal data is no longer necessary for the purposes for which they were collected or otherwise processed; (b) the Data Subject withdraws the consent on the basis of which the processing takes place; (c) the Data Subject objects to the processing of personal data; (d) personal data have been processed illegally; e) the reason for deletion is the fulfillment of the obligation of a law, special regulation or international agreement by which the Slovak Republic is bound, or f) personal data was obtained by a company offering services to a person under the age of 16.
The Data Subject shall not have the right to have personal data erased provided that their processing is necessary: (a) to exercise the right to freedom of expression and information; b) to fulfill an obligation under the law, a special regulation or an international agreement by which the Slovak Republic is bound, or to fulfill a task carried out in the public interest or in the exercise of public power entrusted to the Controller; (c) for reasons of public interest in the field of public health; (d) for archiving purposes in the public interest, for scientific or historical research or for statistical purposes, where the right of erasure is likely to prevent or seriously impede the attainment of the objectives of such processing; or (e) to establish, assert or defend legal claims.
The Controller shall delete all the personal data of the Data Subject upon request, without delay, after assessing that the data subject’s request is justified.

The right to lodge a complaint to initiate the personal data protection proceeding

The Data Subject has the right to file a motion to initiate proceedings with the Office for Personal Data Protection of the Slovak Republic  if they, the Data Subject, consider that their personal data protection rights have been violated.

More information can be found under the Regulation 2016/679 and the Act (§ 19 of Act no. 18/2018 Coll.)

The right to object

The Data Subject has the right to object at any time to the processing of their personal data on grounds relating to their specific situation. The Data Subject may object to the processing of their personal data on the basis of: (a) the legal title of the performance of tasks performed in the public interest or in the exercise of official authority, or the legal title of the legitimate interest of the controller; (b) processing of personal data for direct marketing purposes; (c) processing for scientific or historical research or for statistical purposes. The objection will be reviewed when received in a timely manner. In this instance, further processing of personal data may cease, unless demonstrated that necessary legitimate interests for the processing of personal data outweighs the rights or interests of the Data Subject or the grounds for a legal claim.

The right to data portability of personal data

As a Data Subject, you have the right to obtain and transfer the personal data you have provided to the Controller to another in a usable and machine-readable format, provided that the personal data has been obtained with the data subject’s consent or contract and is processed by automated means.

More details

  • The purpose of processing personal data is the reason for the Controller to process the personal data of the Data Subjects in the information systems on specific legal bases. Any processing of personal data is based on a specific legal basis and for a specific, legitimate and explicit purpose.
  • In order to maximize the protection of your personal data, we as the Controller have taken appropriate personnel, organizational and technical measures. Our aim is to prevent (in the event of a breach) and/or reduce the risk of leakage, misuse, disclosure or other use of your personal data against your will. Should any breach event occur, which is likely to cause a high risk situation to the rights and freedoms of a natural person, you will be contacted immediately as the Data Subject concerned (Article 34 of the Regulation).
  • In order to maintain the principles of personal data processing set out in the Regulation, as well as in the law, in particular the principles of minimizing personal data, we require from you, as the Data Subject, only the personal data that is necessary, for legal or contractual requirements to fulfill the purpose of their processing. Please note that failure to provide this mandatory information necessary for the conclusion of the contract, may result in the non-conclusion of the contractual relationship.

Processing purposes, legal basis, categories of recipients, retention period, information about cross-border transfers, categories of data subjects and information on automated decision-making, including profiling, broken down per information systems:

The candidates database system

Basic info

The Controller keeps a record of persons - candidates - for a job or similar employment relationship or business relationships in the commercial area of the Controller. The Candidates Database System contains data of the candidate, in particular his or her CV, contact details and is subsequently updated by other relevant data resulting from further communication, ongoing selections in which the Data subject has participated with the Controller, information on the improvement of qualifications with the Controller and other data provided by the Data subject to the Controller directly or through the relevant applications or tools.

Personal Data processing purposes

The purpose of maintaining The Candidates Database System is for individuals who have voluntarily submitted a cooperation inquiry to the Controller, either through a selection procedure or without a declared selection procedure, with the intention of possible contact regarding a future announced selection process, in the event that the Controller currently does not have suitable cooperation opportunities. The Controller shall also include in the records individuals who they actively searched for among job applicants on third-party platforms (such as LinkedIn, Profesia, etc.). The purpose of maintaining the database is to enable flexible, fast, and professional placement of individuals into the Controller’s projects.

Legal basis

Legitimate interest within the meaning of Article 6(1)(f) of the Regulation. The main legitimate interest is the flexible, swift and professional identification and placement of persons in the projects of the Controller. The personal data of the Data subjects involved in the selection procedure at the time of the selection procedure are processed within the meaning of Article 6(1)(b) of the Regulation - so-called pre-contractual relationships.

Receiver Categories

  • Authorized staff
  • Internal contractors involved in hiring process
  • HR department
  • IT administrator
  • Attorney at law, audítor

Due dates for Personal Data deletion

Without undue delay after the Data subject has expressed his or her opposition to the keeping of related records, but no later than 30 days after the Data subject has expressed his or her opposition.

Data subject categories

Candidate for project placement in the form of an employment or commercial business relationship.

Information about the existence of automated decision-making, including profiling - Not being carried out

Cross border transmission of the personal data outside EU - Due to the purpose of the processing of personal data and the possibilities of using technology, cross-border processing of personal data may occur, provided that all the provisions of the "GDPR" Regulation are complied with.

The contact form

Basic info

One of the ways of contacting the Controller with an enquiry about the inclusion of the Data subject in the project or in the Candidates Database System of applicants is the contact form located on the official website of the Controller.

Personal Data processing purposes

Processing personal data of natural persons in the information system, who have contacted the Controller are processed through a contact form accessible on the company's website. The Controller processes the data for the purposes of response and subsequent communication with a specific person.

Legal basis

according to the Art. 6 section 1b) of the Regulation (EU) 2016/679 of the European Parliament and of the Council, the so-called pre-contractual relations: processing is necessary for the performance of a contract to which the Data subject is party or in order to take steps at the request of the Data subject prior to entering into a contract;

Receiver Categories

  • Authorized staff
  • internal contractors involved in hiring process
  • HR department
  • IT administrator
  • Attorney at law, audítor

Due dates for Personal Data deletion

Without undue delay after the Data subject has expressed his or her opposition to the keeping of related records, but no later than 30 days after the Data subject has expressed his or her opposition.

Data subject categories

Natural persons who have contacted the Controller with the inquiry via the contact form.

Information about the existence of automated decision-making, including profiling - Not being carried out

Cross border transmission of the personal data outside EU - Due to the purpose of the processing of personal data and the possibilities of using technology, cross-border processing of personal data may occur, provided that all the provisions of the "GDPR" Regulation are complied with.

The necessary records

Basic info

Keeping records of people who were candidates for inclusion in the project but for various reasons that was interrupted or terminated. In this case, the majority of the data subject's personal data is destroyed and recorded solely for the purpose of preventing any further communication with the data subject.

Personal Data processing purposes

The purpose of the processing is to prevent any undesired communication towards unselected candidates and to prevent the creation of new records in the future.

Legal basis

according to the Art. 6 section 1f) of the Regulation (EU) 2016/679 of the European Parliament and of the Council, The main legitimate interest is to safeguard the interests of both the Data subject and the Controller not to contact Data subjects for whom the conditions for non-contact have arisen, e.g. if the Data subject so requests.

Receiver Categories

  • Authorized staff
  • internal contractors involved in hiring process
  • HR department
  • IT administrator
  • Attorney at law, audítor

Due dates for Personal Data deletion

Immediately after the reason for non-contact purpose ceases to exist.

Data subject categories

Natural person for whom the conditions for non-contact have been met.

Information about the existence of automated decision-making, including profiling - Not being carried out

Cross border transmission of the personal data outside EU - Due to the purpose of the processing of personal data and the possibilities of using technology, cross-border processing of personal data may occur, provided that all the provisions of the "GDPR" Regulation are complied with.