Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter also the “Regulation” or “GDPR”) lays down the obligation of the controller to provide the data subject with any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and Article 34 relating to processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. When requested by the data subject, the information may also be provided orally, provided that the data subject has proven his or her identity.
Since personal data are also processed in connection with the operation of the websites www.make-me-hot.com, Afinode, s.r.o., Povina 234, 023 33 Povina, Company ID: 47428830, Tax ID: 2023942734, VAT ID: SK2023942734, as the controller, fulfils its information obligation in accordance with the applicable legislation of the Slovak Republic and of the European Union and, by means of this document, informs the data subject of the conditions of processing of personal data.
1. Basic terms
Controller
Afinode, s.r.o., Povina 234, 023 33 Povina, Company ID: 47428830, Tax ID: 2023942734, VAT ID: SK2023942734, registered in the Commercial Register of the District Court Žilina, section Sro, insert no. 67976/L, as the operator of the websites www.make-me-hot.com (hereinafter the “websites”).
When processing personal data, the controller acts in accordance with the Regulation and Slovak Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (hereinafter also the “Act”).
Given the scope and subject of its activities, the controller is not obliged to designate a data protection officer under § 44 of the Act. If you, as a data subject, have any questions concerning the processing of your personal data, write to the controller at the e-mail address: [email protected], call: +421 948 042 641, or visit the controller in person at the address of its registered office.
Data subject
A data subject is any identified or identifiable natural person whose personal data the controller processes. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier:
- name, surname, date of birth,
- an identification number – personal identification number (birth number), identity card number, location data (address),
- genetic data relating to the inherited or acquired genetic characteristics of a natural person,
- data concerning the health of the data subject which reveal information about the past, current or future physical or mental health status of the data subject,
- data specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person,
- online identifier – natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols (IP address, cookies or other identifiers).
For the purposes of this document, a data subject means a natural person – a visitor to the controller’s websites – or any other natural person who has provided his or her personal data to the controller.
Personal data
Personal data means any information relating to an identified or identifiable natural person.
Processing of personal data
Processing of personal data means any operation or set of operations which is performed on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, whether or not by automated means.
Legal basis
The controller may process personal data only where one of the legal bases laid down by the GDPR permits it to do so. When processing personal data, the controller relies on one or more of the following legal bases:
- the data subject has given consent to the processing of his or her personal data for one or more specific purposes,
- processing is necessary for the performance of a contract to which the data subject is party,
- processing is necessary for compliance with a legal obligation of the controller,
- processing is necessary in order to protect the vital interests of the data subject or of another natural person,
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
- processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
Retention period of personal data
In general, the controller retains the personal data of data subjects only:
- for the period necessary for the relevant purpose,
- to the extent reasonably necessary to comply with any applicable legislation, or as appropriate in view of the applicable provisions on limitation periods.
2. Personal data and the purpose of their processing
Processing of personal data for the purposes of the contact form:
- Purposes of processing personal data:
- sending questions concerning the services provided by the controller, or any other questions and suggestions. - Scope of personal data processed:
- e-mail address. - Legal basis for processing personal data:
Article 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
The data subject has the right to withdraw his or her consent to the processing of personal data for the purposes of completing the contact form at any time, in writing to the address of the controller’s registered office or by e-mail to [email protected]. The withdrawal of consent does not affect the lawfulness of processing of personal data based on consent before its withdrawal. - Retention period of personal data:
- 1 year. - Recipients of personal data:
- for the purpose of operating the websites, the controller provides personal data to the web hosting provider Websupport, s.r.o., with its registered office at Staré Grunty 12, 841 04 Bratislava,
- the controller provides personal data to a public authority that processes personal data on the basis of a special regulation or an international treaty by which the Slovak Republic is bound.
3. Cookies
We process cookies on the legal basis of Article 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
The data subject has the right to withdraw his or her consent to the processing of personal data for the purposes of completing the contact form at any time, in writing to the address of the controller’s registered office or by e-mail to [email protected]. The withdrawal of consent does not affect the lawfulness of processing of personal data based on consent before its withdrawal.
Cookie settings
Google Analytics
In connection with cookies, the controller also uses the Google Analytics service, through which it analyses user behaviour in order to optimise the functionality of the websites. The controller uses Google Analytics with the “IP anonymisation” feature activated.
4. Rights of the data subject
As a data subject, you have the right, on the basis of a written request, to obtain from the controller:
- confirmation as to whether or not personal data concerning you are being processed,
- in a generally intelligible form, information on the processing of personal data in the information system, covering: the identification details of the controller and of the processor (if appointed); the purpose of the processing of personal data; the list or scope of the personal data processed; information on whether the provision of the requested personal data is voluntary or mandatory, the period of validity of consent, or a notice of which legal regulation imposes the obligation to provide the personal data; third parties, if the personal data are to be provided to them; the range of recipients, if the personal data are to be made accessible to them; the form of publication of the personal data, if the personal data are to be published; third countries, if personal data are to be transferred to those countries,
- in a generally intelligible form, accurate information about the source from which the controller obtained the personal data for processing,
- in a generally intelligible form, a list of the personal data that are the subject of processing,
- the rectification or destruction of his or her inaccurate, incomplete or outdated personal data that are the subject of processing,
- the destruction of personal data whose purpose of processing has ended; where official documents containing personal data are the subject of processing, the data subject may request their return,
- the destruction of personal data that are the subject of processing, where the law has been infringed,
- the blocking of personal data on account of the withdrawal of consent before the expiry of its period of validity, where the controller processes personal data on the basis of consent.
The data subject may address the above request, or information about a personal data breach or other serious facts concerning the processing of personal data by the controller, to the controller at the address stated above or by telephone at: +421 948 042 641, or at the e-mail address: [email protected].
Right of access to personal data
The data subject has the right to obtain from the controller confirmation as to whether it processes personal data concerning him or her. Where the controller processes personal data, the data subject has the right to access them and to further information about the purpose of their processing; the category of personal data processed; to whom they have been or will be disclosed, in particular recipients in third countries or international organisations, where possible; where personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards required by law; the period for which the personal data will be stored or, if that is not possible, information about the criteria used to determine that period; the right to request rectification or erasure of personal data or restriction of their processing, or the right to object to the processing of personal data; the right to file a request to initiate proceedings on personal data protection; the source of the personal data, where the personal data were not collected from you; and the existence of automated individual decision-making, including profiling. Profiling means any form of automated processing of personal data consisting of the use of those personal data to evaluate certain personal aspects relating to a natural person, in particular concerning performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. In these cases, the controller shall provide the data subject with information in particular about the logic involved, as well as the significance and the envisaged consequences of such processing of personal data for the data subject. The controller is obliged to provide the personal data it processes. For any further copies of the personal data, the controller may charge a reasonable fee based on administrative costs. The controller is obliged to provide you with the personal data in the manner you request. The right to obtain personal data must not adversely affect the rights of other natural persons.
Right to rectification of personal data
The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing of personal data, the data subject has the right to have incomplete personal data completed.
Right to object to the processing of personal data
The data subject has the right to object, on grounds relating to his or her particular situation, to the processing of his or her personal data where the controller carries out profiling or processes personal data on the following legal bases:
- the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
- the processing of personal data is necessary for the purposes of the legitimate interests of the controller or of a third party.
The controller may no longer process the personal data of the data subject unless it demonstrates compelling legitimate grounds for the processing of personal data which override the data subject’s rights or interests, or grounds for the exercise of a legal claim. The data subject has the right to object to the processing of personal data concerning him or her for direct marketing purposes, including profiling to the extent that it is related to direct marketing. Where the data subject objects to the processing of personal data for direct marketing purposes, the controller may no longer process the personal data for direct marketing purposes. The data subject has the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her where the personal data are processed for scientific purposes, historical research purposes or statistical purposes, unless the processing of personal data is necessary for the performance of a task carried out for reasons of public interest.
Right to erasure of personal data (“right to be forgotten”)
The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay. If you ask the controller to erase personal data, the controller is obliged to erase them in the following cases:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
- the data subject withdraws the consent on the basis of which the controller processes his or her personal data, and there is no other legal ground for the processing of personal data,
- the data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing of personal data, or objects to the processing of personal data for direct marketing purposes, including profiling to the extent that it is related to direct marketing,
- the personal data have been unlawfully processed,
- the erasure is required for compliance with an obligation laid down by law,
- the personal data have been collected in relation to the offer of information society services under § 15(1) of the Act.
Where the controller has made the personal data of the data subject public and is obliged to erase them under the conditions set out above, it is also obliged, taking account of available technology and the cost, to inform other controllers which are processing the personal data that those controllers should erase any links to, or copies or replications of, those personal data.
The controller is not obliged to erase personal data where they are necessary
- for exercising the right of freedom of expression or the right to information,
- for compliance with an obligation under law or an international treaty, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
- for reasons of public interest in the area of public health,
- for archiving purposes, scientific purposes, historical research purposes or statistical purposes, where erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
- for the exercise of a legal claim.
Right to restriction of processing of personal data
The data subject has the right to obtain from the controller restriction of processing of his or her personal data where
- the data subject contests the accuracy of his or her personal data; the controller shall restrict the processing of his or her personal data for a period enabling it to verify their accuracy,
- the processing of his or her personal data is unlawful and, instead of erasure, the data subject requests the restriction of their use,
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the exercise of a legal claim, or
- you object to the processing of personal data;
- the controller shall restrict the processing of personal data pending verification of whether the legitimate grounds of the controller override the legitimate grounds of the data subject.
Where the processing of personal data has been restricted, the controller may, with the exception of storage, process the personal data only with the consent of the data subject, or for the exercise of a legal claim, for the protection of persons or for reasons of public interest. The controller is obliged to inform the data subject before the restriction of processing of personal data is lifted.
Notification obligation regarding rectification or erasure of personal data or restriction of processing
The controller is obliged to communicate any rectification of personal data, erasure of personal data or restriction of processing of personal data to each recipient (anyone to whom the personal data of the data subject have been disclosed), unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
Right to data portability
The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format. The data subject also has the right to transmit those personal data to another controller, where technically feasible and where the processing of your personal data is carried out by automated means (i.e. electronically), and the personal data are processed either
- on the basis of consent,
- if the processing is carried out by automated means,
- or are necessary for the performance of a contract to which the data subject is party, or in order to take steps at the data subject’s request prior to entering into a contract.
This right must not adversely affect the rights of others. The exercise of the right to data portability is without prejudice to the right to erasure of personal data. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Right to file a request to initiate proceedings on personal data protection
Should the data subject be directly affected in his or her rights laid down by the Personal Data Protection Act, he or she has the right under § 100 of the Act to file a request to initiate proceedings on personal data protection with the Office for Personal Data Protection of the Slovak Republic. The purpose of the proceedings is to establish whether the rights of natural persons have been infringed in the processing of their personal data or whether the law has been infringed and, where shortcomings are found and if justified and expedient, to impose remedial measures or, where appropriate, a fine for the infringement of the law. The Office publishes a template of the request on its website. The request to initiate proceedings must contain evidence supporting the claims made in the request and a copy of a document or other evidence demonstrating that the right was exercised with the controller (right of access to personal data, right to request rectification of personal data, right to erasure or restriction of processing of personal data, right to object to the processing of personal data, right to data portability), if the data subject has exercised such a right, or a statement of reasons worthy of special consideration for not exercising that right.
The above rights (except the right to file a request to initiate proceedings on personal data protection) may be exercised by e-mail or in writing by post with the controller, which supervises the processing of personal data. A personal data breach or other serious facts concerning the processing of personal data by the controller may likewise be reported to the controller.
If the data subject suspects that his or her personal data are being processed without authorisation, he or she may file a request to initiate proceedings on personal data protection with:
Office for Personal Data Protection of the Slovak Republic
with its registered office at Hraničná 12, 820 07 Bratislava 27
or contact the Office through its website http://www.dataprotection.gov.sk.
If the data subject does not have full legal capacity, his or her rights may be exercised by a legal representative. If the data subject is deceased, the rights he or she had under this Act may be exercised by a close person.
The controller shall handle a request of the data subject under the Personal Data Protection Act free of charge, except for a payment in an amount which may not exceed the amount of reasonably incurred material costs associated with making copies, obtaining technical media and sending the information to the data subject, unless a special act provides otherwise. The controller is obliged to handle the data subject’s request in writing no later than 30 days from the date of receipt of the request. The controller shall notify the data subject and the Office for Personal Data Protection of the Slovak Republic in writing, without undue delay, of any restriction of the data subject’s rights under the Personal Data Protection Act.
5. Transfer of personal data to a third country or an international organisation
The controller does not transfer any personal data to third countries or to international organisations.
6. Automated individual decision-making, including profiling
As a data subject, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
When processing personal data for any of the purposes stated above, the controller does not use automated individual decision-making or profiling.
7. Retention and protection of personal data
The operator of the websites approaches the protection of personal data responsibly and seriously. It treats personal data as confidential in accordance with the applicable personal data protection legislation and this document.
The controller processes personal data either manually or by means of electronic systems. The controller has adopted all necessary and essential organisational, technical and administrative measures to ensure the accuracy and up-to-dateness of personal data, to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, and to ensure that the level of personal data protection is as high as possible.
This privacy document may change over time. The controller will publish any changes to this document on the websites and will inform the data subjects whose personal data it processes before making any changes. Where required by law, the controller will obtain the data subject’s consent before making any change to this document.