Information obligation towards data subjects - clients of the controller Slovenská pošta, a.s.

Partizánska cesta 9, 975 99  Banská Bystrica, ID No.: 36631124, Infoline: 0850/122413
www.posta.sk (hereinafter also referred to as 'SP')
Responsible person: zodpovedna.osoba@slposta.sk

In connection with the processing of your personal data by SP as the controller, we hereby provide you as the person whose personal data we process (hereinafter referred to as the "data subject") with information according to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of physical persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "GDPR"), which we have drafted in the form of questions in such a way as to make this information comprehensible, clear and practical for you. Your personal data will be stored securely, in accordance with the security policy of the controller and processor and only for the time necessary to fulfil the purpose of the processing. Access to your personal data will be limited to persons authorised by the controller to process your personal data and who process it on the instructions of the controller, in accordance with the controller's security policy.

Your personal data is backed up, in accordance with the SP retention policy. Your personal data will be completely erased from the backed-up storage as soon as possible in accordance with the back-up policy. The personal data stored on backup storage is used to prevent security incidents, in particular a data availability breach as a result of a security incident. The SP is obliged to ensure that data is backed up in accordance with the security requirements of the GDPR and Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts. In accordance with the GDPR, SP as a controller processes your personal data to the extent and under the conditions set out in the special regulations, based on the statutory conditions set out in Article 6 of the GDPR. As a rule, we process a common category of personal data about you.

1) Who is the controller of your personal data?
Slovenská pošta, a.s., Partizánska cesta 9, 975 99 Banská Bystrica                        
Company Registration No.: 36 631 124, Tax Registration No.: 2021879959     
VAT ID: 2021879959                
The Commercial Register of the District Court of Banská Bystrica, Section Sa,
Insert No. 803/ S                    

SP has a designated personal data protection officer who oversees the proper processing of personal data and can be contacted at any time.                                   

2) For what purposes and on what legal basis do we process your personal data?

The processing of personal data is carried out for the purpose of fulfilling SP's obligations as a postal operator undertaking:

- from generally binding legal regulations,
- contractual relations with clients and contractual partners,
- the legitimate interests we pursue.

SP as the controller processes your personal data mainly for the purpose of:

1. the provision of postal services and postal payments,
2. the provision of the eKolok service (or central fee registration system), whereby, in accordance with the "Commission Decision on the application of Article 106(2) of the Treaty on the Functioning of the European Union to State aid in the form of public service compensation granted to certain undertakings entrusted with the operation of services of general economic interest", the provision of this service is in the public interest. This service in the public interest is fulfilled by the joint operators of the eKolok system, which are the Ministry of Finance of the Slovak Republic and SP, in accordance with statutory obligations and other contractual obligations,
3. the handling of complaints, claims and other submissions,
4. prevention of security, protection of persons, property and valuables entrusted to the Post Office - CCTV scanning. The persons concerned are informed about the location of the CCTV system by means of a warning sign placed in a visible place at the entrances to the monitored premises,
5. the execution of contracts and contractual obligations and the accounting agenda (for example: procurement of goods, works and services),
6. registration of persons in accommodation facilities, visits and entrances to SP facilities,
7. the provision of dual training,
8. the provision of the Post Card Bonus Scheme,
9. marketing outreach, promotion of SP and its products, implementation of the Christmas Post project,
10. registry management.
    
    The legal basis for the processing of personal data is:

1. Act No. 324/2011 Coll. on Postal Services and on Amendments and Additions to Certain Acts (hereinafter referred to as the Postal Services Act), Act No. 297/2008 Coll. on the Protection against the Legalization of Proceeds of Crime and on the Protection against the Financing of Terrorism and on Amendments and Additions to Certain Acts, which authorizes the SP to carry out identification and verification of the client's identification when carrying out a business transaction whose value reaches at least € 1,000,

2. Act No. 145/1995 Coll. on Administrative Fees, as amended, Act No. 71/1992 Coll. on Court Fees and the Fee for the Criminal Record Extract, as amended,
3. Act No. 250/2007 Coll. on Consumer Protection, as amended, Act No. 513/1991 Coll. on the Commercial Code, as amended, Act No. 40/1964 Coll. on the Civil Code, as amended, Act No. 540/2007 Coll. on Auditors, Auditing and Supervision of Auditing and on Amendments and Additions to Certain Acts, Act No. 211/2000 Coll. on Free Access to Information and on Amendments and Additions to Certain Acts, as amended,
4. the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR, Act No. 311/2001 Coll., the Labour Code as amended (§ 13, paragraph 4), Act No. 40/1964 Coll., the Civil Code as amended,
5. Act No. 431/2002 Coll. on Accounting, as amended, Act No. 513/1991 Coll. on the Commercial Code, as amended, Act No. 222/2004 Coll. on Value Added Tax, as amended, and other legislation,
6. the legitimate interest of the controller pursuant to Article 6, paragraph 1, letter f) GDPR, Act No. 253/1998 Coll. on the reporting of the residence of citizens of the Slovak Republic, as amended, Act No. 454/2004 Coll., amending and supplementing Act No. 253/1998 Coll. on the declaration of residence of citizens of the Slovak Republic and the population register of the Slovak Republic, as amended,
7. Act No. 61/2015 Coll. on Vocational Education and Training and on Amendments and Additions to Certain Acts,
8. performance of a contract to which the data subject is a party pursuant to Article 6, paragraph 1, letter b) GDPR,
9. the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR or the data subject's consent to the processing of personal data for one or more purposes.
10. Act No. 395/2002 Coll. on archives and registers and on the amendment of certain acts, as amended.

  To ensure the provision of postal services, it is possible to use the mobile application     "Slovenská pošta", for which the following information on the protection of personal          data when using it applies:

Manual addition of the postal item number
The application stores this data on the SP servers to display its current status and to obtain extended information on the postal items. This data is not provided to third parties.

Email and phone number
The application stores this data on the SP servers after activation of the Recipient Verification service. Postal items for which the sender provides your phone number or e-mail address in the app will automatically be displayed in the "Postal Items" section. This data is not provided to third parties.

Location data - Post Offices and ParcelBOXes (Parcel Lockers)
The app will display a list of the nearest Post Offices and ParcelBOXes from the user's current location after consent has been granted to monitor location while using the app. This data is not stored, processed or provided to third parties.

Location data - Notifications about a parcel stored near you
After giving consent for location monitoring, even when the app is closed or not in use, the app sends notifications if you are near a post office or ParcelBOX where you have parcels stored. This data is not stored, processed or provided to third parties.

Device model, operating system version and application version
The application stores this data on SP's servers, for the purpose of more accurate identification when troubleshooting technical issues. This data is not provided to third parties.

We may also process your personal data in the performance of SP's duties as an employer, if you are, for example, a family member or close relative of an SP employee.
We use cookies on our website in order to improve the quality of our services.

SP as an intermediary processes your personal data on the basis of the instructions of the controllers agreed in the intermediary contracts within the meaning of Articles 28 and 29 GDPR, in particular for the purpose of:

1. delivery of pensions,
2. the provision of electronic services to the State,
3. the provision of SIPO (Joint Collection of Utility Payments),
4. the provision of services by 365.bank, Inc,
5. provision of payment services for SKPAY, a. s., (eVoucher, for example for payment of invoices for O2 telecommunications services),
6. the provision of Western Union services,
7. provision of services to the telecommunications company SWAN,
8. mediation of registration (or change and deregistration) in the Register of Payers of Payment according to the current Act on Payment for Public Services Provided by the Radio and Television of Slovakia,
9. provision of services to TIPOS, National Lottery Company, Inc,
10. the provision of the hybrid mail service,
11. concluding contracts for the issue of the Card and the provision of the “Post Card” payment functionality,
12. carrying out financial intermediation for Union Insurance Company, Inc.

In the context of concluding contracts between SP and customers, personal data is processed for the purpose of fulfilling SP's obligations arising from legal regulations (tax laws and other public law regulations, where applicable).

SP also processes the contact personal data of its customers, i.e. e-mail and telephone number. SP obtains this contact data when providing certain products and services where it is justified to use it for the benefit of the customer, e.g. eShop, ePosting sheet, electronic notification of postal items, tracking of postal items via mobile application and possibly others. In cases where SP needs to process personally identifiable information in order to exercise and defend its legal claims (claims procedure, litigation), this is processing of personal data for the purposes of SP's legitimate interests.

It is also in SP's legitimate interest to reach out to its contract customers with marketing offers, based on taking into account the reasonable expectations of customers towards SP. This means that SP does not have to have the customer's consent to such solicitation. If the customer objects in writing to such solicitation, SP will no longer approach the customer for marketing purposes.

3)  Which entities have access to your personal data?

To ensure the proper functioning of the SP, third parties have access to personal data. These include in particular IT service providers (cloud service providers, electronic application developers...), paper disposal services, auditors and other persons who provide services to the SP and with whom the SP has concluded correct contracts for the processing of personal data in accordance with the GDPR, including entities to which the disclosure of personal data is required by law (to members of the Police Force as well as to criminal law enforcement authorities).

4)  Does SP transfer personal data to third countries?

SP electronically transfers the personal address data of addressees and senders to the countries of delivery in order to improve and speed up the delivery.

5)  How long do we store your personal data?
The personal data that SP processes on the basis of the Postal Services Act in operational documents and services is stored mainly for 3 years, selected payment documents (postal vouchers) for 5 years. Complaints, complaints and other submissions are kept for 5 years and records of entries into premises for 2 years.  Documents relating to the eKolok SP service shall be kept for 10 years. In some cases, on the basis of other laws, for the period required by the relevant legislation in accordance with the Law on Archives and Registers and in accordance with the SP's Registration Rules and Plan. 
If a video recording is made of your visit to the SP, which contains general (common) categories of personal data, without biometric functionality, and is not used for the purposes of criminal or misdemeanour proceedings, the video recording will be automatically destroyed within 7 calendar days (exceptionally 15 calendar days depending on the capacity of the disk) from the day following the day on which it was made.
If the SP processes your personal data on the basis of consent, your personal data will be processed for the purpose for as long as the consent is valid or until you withdraw your consent Withdrawal of consent does not affect the lawfulness of the processing of personal data about you by the SP on the basis of that consent.

6)  What rights do you have in relation to the processing of personal data?            

You have the right to contact the person in charge at any time and to request information and access to personal data concerning you as a data subject, upon written request submitted through any branch of the Post Office. You also have the following rights:

Withdraw consent - where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. You can withdraw your consent by notifying us electronically or in writing (to the e-mail or address of the person responsible). Withdrawal of consent does not affect the lawfulness of the processing of personal data about you by SP on the basis of that consent.

Right of access - you have the right to be provided with a copy of the personal data we hold about you, as well as information about how we process your personal data. In most cases, your personal data will be provided to you in written paper form, unless you request a different method of provision. If you have requested this information by electronic means, it will be provided to you electronically where technically possible.

Right to rectification - We take reasonable steps to ensure that the information we hold about you is accurate, complete and up to date. If you believe that the information we hold is inaccurate, incomplete or out of date, please do not hesitate to ask us to correct, update or complete the information.

Right to erasure (to be forgotten) - you have the right to ask us to erase your personal data, for example, if the personal data we have collected about you is no longer necessary to fulfil the original purpose of the processing. However, your right must be considered in light of all the relevant circumstances. For example, we may have certain legal and regulatory obligations which mean that we may not be able to comply with your request.

Right to restrict processing - in certain circumstances you are entitled to ask us to stop using your personal data. This is for example where you think that the personal data we hold about you may be inaccurate or where you think we no longer need to use your personal data.

Right to data portability - in certain circumstances, you have the right to ask us to transfer the personal data you have provided to us to another third party of your choice. However, the right of portability only applies to personal data that we have obtained from you by consent or under a contract to which you are a party.

Right to object - you have the right to object to processing based on our legitimate interests. If we do not have a compelling legitimate ground for processing and you object, we will no longer process your personal data.

The right to initiate personal data protection proceedings - if you believe that your personal data is being processed unfairly or unlawfully, you can initiate a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07  Bratislava 27, phone number: +421/2/32313214; https://dataprotection.gov.sk Email: statny.dozor@pdp.gov.sk. As a data subject, you also have the right to lodge a complaint with any other supervisory authority in the member state of the European Union where you have your habitual residence, place of work or where the alleged breach of the GDPR is taking place.

In the case of electronic submission, it must comply with the requirements of Article 19(1) of Act No. 71/1967 Coll. on Administrative Procedure (Administrative Procedure Code).

7)  Do we use profiling and automated decision-making when processing your personal data?

SP does not use automated decision-making and profiling in its activities.

If the data subject already has the information, which means that the data has already been provided to him/her previously, SP does not need to provide it to him/her again. However, it must subsequently provide the information that is not in the data subject's possession.

If you have any further questions about the information on the processing of personal data, you can contact the person responsible by email at: zodpovedna.osoba@slposta.sk, by telephone on the Info line 0850 122 413 or in writing at:

Slovenská pošta, a.s.
Data Protection Department
Partizánska cesta 9
975 99  Banská Bystrica