Source: http://www.sojka.eu/en/protection-of-personal-data
Timestamp: 2019-04-22 17:00:34+00:00

Document:
Privacy statement for the provision of accommodation services and other related services of Sojka sro, ID: 36039314, registered office: Malatíny 104, 032 15 Malatíny, registered in the Commercial Register of the District Court of Žilina, Ltd., No. 1, 1445 / L.
(hereinafter also referred to as the "Service" or together as "Services") according to the objects of business registered in the Commercial Register.
The subject of this statement is to modify the mutual rights and obligations of the Provider and the User. This statement is an integral part of the Agreement between the Provider and the User.
This statement applies exclusively to the provision of those User Services contained therein and together with all other written contractual documents and oral arrangements concluded between the Provider and the User in connection with the provision of the Services, defines the content of the engagement relationship between the Provider and the User.
The terms and expressions defined or used in this statement shall be used and have the same meaning in all engagements of engagement between the Provider and the User relating to the Services unless otherwise expressly agreed otherwise by the parties in writing or by the parties to the contract.
By paying the Prize for the ordered Service, the User confirms that he has become familiar with the statement of this statement.
The user who is a natural person, by signing the Agreement or by sending an Order confirms that personal data provided by him in the scope of his name, surname, address, e-mail address, telephone number, date of birth, nationality, visa, passport number, or other identification document, billing information (ID, VAT ID, VAT ID) is accurate and true. The processing of personal data is done on a legal basis: the processing of personal data is necessary for the fulfillment of the Contract to which the User is a party or for the implementation of a measure prior to the conclusion of the Contract at the request of the User, Article 6 (1) (b) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC (hereinafter referred to as GDPR). The purpose of the processing of personal data is the collection, storage and processing of personal data by the Provider and its use for billing purposes, accommodation purposes, purposes specified by applicable laws (provision of data to the general / city authorities, foreign police, etc.) and other actions related to the ordered and provided Service , including later communication with the User (complaint, withdrawal, etc.), as well as for the needs of the Provider's own marketing, for the purpose of offering the Services, sending product information, including by electronic means (e-mail, sms, telemarketing). The user bears full responsibility for damages caused by the inaccuracies or outdatedness of the provided personal data. The purpose of the processing of personal data is the collection, storage and processing of personal data by the Provider and its use for billing purposes, accommodation purposes, purposes specified by applicable laws (provision of data to the general / city authorities, foreign police, etc.) and other actions related to the ordered and provided Service , including later communication with the User (complaint, withdrawal, etc.), as well as for the needs of the Provider's own marketing, for the purpose of offering the Services, sending product information, including by electronic means (e-mail, sms, telemarketing). The user bears full responsibility for damages caused by the inaccuracies or outdatedness of the provided personal data. The purpose of the processing of personal data is the collection, storage and processing of personal data by the Provider and its use for billing purposes, accommodation purposes, purposes specified by applicable laws (provision of data to the general / city authorities, foreign police, etc.) and other actions related to the ordered and provided Service , including later communication with the User (complaint, withdrawal, etc.), as well as for the needs of the Provider's own marketing, for the purpose of offering the Services, sending product information, including by electronic means (e-mail, sms, telemarketing). The user bears full responsibility for damages caused by the inaccuracies or outdatedness of the provided personal data. (data provided to the general / city authorities, foreign police, etc.) and other acts related to the ordered and provided by the Service, including later communication with the User (complaint, withdrawal from the contract, etc.) as well as for the needs of its own marketing Provider, for the purpose of offering the Services, to send product information, including by electronic means (e-mail, sms, telemarketing). The user bears full responsibility for damages caused by the inaccuracies or outdatedness of the provided personal data. (data provided to the general / city authorities, foreign police, etc.) and other acts related to the ordered and provided by the Service, including later communication with the User (complaint, withdrawal from the contract, etc.) as well as for the needs of its own marketing Provider, for the purpose of offering the Services, to send product information, including by electronic means (e-mail, sms, telemarketing). The user bears full responsibility for damages caused by the inaccuracies or outdatedness of the provided personal data. for the purpose of offering the Services, sending product information, including by electronic means (e-mail, sms, telemarketing). The user bears full responsibility for damages caused by the inaccuracies or outdatedness of the provided personal data. for the purpose of offering the Services, sending product information, including by electronic means (e-mail, sms, telemarketing). The user bears full responsibility for damages caused by the inaccuracies or outdatedness of the provided personal data.
The Provider is authorized to process personal data related to the online provision of services in the form of cookies, IP addresses, pixels, and browsers. This information is used to improve intranet services, such as showing relevant ads, locating (for example mapping to operate), for statistical purposes, and so on. For statistical purposes, the Provider may use third-party services such as Google Analytics or other counters whose data is located on third-party servers, but they are not directly associated with the User unless it has been otherwise specified for a particular Service.
Provider is authorized to process personal data beyond the range specified in point 2.1. and 2.2 of these GTC and whose processing is incompatible with the legal basis mentioned in point 2.1. and 2.2 of these GBCs only on the basis of the prior consent given by the User voluntarily and for a predetermined purpose, scope and time. The user has the right to withdraw consent at any time in writing. Revocation of consent is effective on the date of its delivery to the Provider.
The Provider undertakes not to use and not to provide personal data beyond the scope necessary for the operation of the ordered Service and its operation. Personal data is not provided to any third party except to provide data to third parties, determined by applicable laws or products and services, which are expressly stated to the contrary. In such a case, however, the Provider is obliged to agree in a contractual relationship with a third party the protection of personal data in accordance with applicable laws, in particular the Personal Data Protection Act, and it is required in the Contract to inform the User that the provision of personal data to a third party is necessary for the performance of the Contract otherwise it is not possible to provide the Service. For these purposes, it is necessary for the Provider to obtain the consent from the User.
All personal data are protected under applicable laws, in particular the Personal Data Protection Act.
The Provider undertakes to take all necessary steps to ensure the highest level of security of the User's personal data, as well as to secure all User data, database and mail files prior to their loss, damage or destruction.
The Provider may not authorize the processing of personal data of another intermediary without the prior written consent of the User. In the case of written consent of the User, the Provider is obliged to impose on the other mediator in a contract or other legal obligation the same personal data protection obligations as set forth in this Agreement, where the Provider is liable to the User if the other intermediary fails to fulfill its obligations regarding the protection of personal data.
The Provider undertakes to process personal data only for the purpose of providing the Services.
The Provider processes personal data throughout the validity and effectiveness of the Agreement between him and the User.
Provider processes personal data to the same extent as the User processes them.
The affected persons are the users of the User.
The provider is authorized to process with personal data only the processing operations necessary for the purpose of processing, in particular: collection, collection, storage and disposal.
The Provider is obliged to process personal data only to the extent necessary to achieve the purpose of the processing and only in accordance with the terms of this GBT article or the User's written instructions, including in the case of the transfer of personal data to a third country or international organization. In the case of the transfer of personal data to a third country or to an international organization under a special regulation or an international treaty binding the Slovak Republic, the Provider is obliged to notify the User of such a request prior to the processing of personal data, if a special regulation or an international treaty The Slovak Republic is bound, it does not prohibit such communication on grounds of public interest.
The Provider is obliged to protect the processed personal data prior to their damage, destruction, loss, alteration, unauthorized access and disclosure, provision or disclosure, as well as any other inaccessible processing.
The Provider declares that it guarantees the security of the processed personal data while taking technical and organizational measures in order to ensure the protection of the rights and protection of personal data of the User's customers, in particular, against the accidental or unlawful destruction, loss, alteration or unauthorized provision of transmitted personal data, stored personal data or otherwise processed personal data or unauthorized access takes into account the nature, scope, context and purpose of the processing of personal data, risks that are likely to impair the security of the protection of personal data and their severity.
The Provider is obliged not to disclose personal data to third parties, to use personal data for purposes other than the agreed purpose, not to abuse for his / her benefit or the benefit of a third person and not to store personal data contrary to this GBC article.
The Provider and his staff are obliged to maintain the confidentiality of the personal data obtained from the User's customers. Personal data must not be used for personal use, may not be disclosed, provided or made available. This confidentiality is committed to preserve even after the expiry and effectiveness of the Treaty. The Provider is responsible for maintaining the confidentiality of his employees and other authorized persons as well as possible external collaborators.
The Provider is obliged to ensure that the collected personal data is processed in a form that permits identification of the User's users only during the necessary time to achieve the purpose of the processing.
The Provider undertakes to cooperate and provide the User with assistance in ensuring compliance with the User's obligations to respond to User's requests in the exercise of their rights under the provisions of Chapter III of the GDPR, including the User's notice of any written request for access received by the Provider in connection with the User's obligations under GDPR, of Act no. 18/2018 Z. z. on the Protection of Personal Data and on Amendments to Certain Acts (the "Personal Data Protection Act") and other related regulations.
consult with the Data Protection Office before performing any processing if the personal data protection impact assessment implies that such processing would lead to a high risk should the User not take measures to mitigate this risk.
The Provider undertakes to provide the User with all the information necessary to demonstrate the fulfillment of the obligations stipulated in Art. 28 GDPR, and provide the User with a User-Audited or Audit-Assisted User Assurance Audit.
The Provider is obliged to notify the User immediately if, in the Provider's opinion, any instruction given by the User violates the Personal Data Protection Act, a special regulation or an international treaty with which the Slovak Republic is bound, concerning the protection of personal data.
The Provider undertakes to terminate the validity and effectiveness of the Agreement upon the User's decision to erase personal data or to return the personal data to the User and to delete existing copies containing personal data if a specific regulation or an international agreement to which the Slovak Republic is bound does not require the storage of such personal data .
In special cases, if the Provider is required to provide personal data to a third party or to transfer personal data to a third country, the Provider will provide this information to the User.
The Provider keeps personal data for the entire duration of the Service.
The user has the right to request from the Provider access to personal data relating to the person concerned, the right to rectify personal data, the right to delete personal data or the right to limit personal data, the right to object to the processing of personal data, as well as the right to transfer personal data.
When suspecting that his or her personal data is being misused, the user may file with the Office for Personal Data Protection of the Slovak Republic a motion to initiate the procedure for the protection of personal data pursuant to § 100 of the Personal Data Protection Act.
Provide the personal data listed in point 2.1. Users are required to conclude the Agreement and provide the Service.
The right of access to personal data under Art. 15 GDPR: The person concerned has the right to obtain from the Provider a confirmation of the processing of personal data concerning him / her. The person concerned has the right to access these personal data and the information listed in point 2.7.
The right to rectify personal data under Art. 16 GDPR: The person concerned has the right to have the Provider corrected incorrectly personal data relating to him without undue delay. With regard to the purpose of the processing of personal data, the person concerned is entitled to supplement incomplete personal data.
personal data have been obtained in connection with the information society services offer.
the person concerned objects to the processing of personal data, until the verification of whether the legitimate reasons on the part of the Provider prevail over the legitimate reasons of the person concerned.
The person concerned, whose processing of personal data is limited, shall be obliged to inform the Provider before the limitation of the processing of personal data is canceled.
Based on Art. 19 GDPR, the Provider is obliged, if required by the person concerned, to inform the person concerned about the recipients to whom the Provider has notified the correction of personal data, the deletion of personal data or the limitation of the processing of personal data.
The right to the portability of personal data, 20 GDPR: The person concerned has the right to obtain personal data relating to him and which he has provided to the Provider in a structured, commonly used and machine-readable format and has the right to transfer these personal data to another operator.
Based on Art. 22 GDPR, the person concerned has the right not to be covered by a decision which is based solely on the automated processing of personal data, including profiling, and which has legal effects that affect him or have a similar effect on him.
Based on Art. 34 The GDPR has the right for the Provider to notify the Provider without undue delay of a breach of personal data protection if such breach of personal data protection can lead to a high risk to the rights of a natural person.
The Provider is obliged to provide the person concerned with the information according to Art. 13 GDPR and notifications under Art. 15 to 22 and Art. 34 GDPR concerning the processing of its personal data. Information is required to be provided in paper or electronic form, generally in the same format as the application. If requested by the person concerned, the Provider may also provide the information orally if the person concerned proves his / her identity in another way. The Provider is in the exercise of the rights under Art. 15 to 22 GDPR is obliged to provide the person concerned with co-operation.
The Provider is obliged to provide the person concerned with the information referred to in point 1 within one month of receipt of the request. The Provider may, in justified cases with a view to the complexity and the number of applications, extend this period by another two months, even repeatedly. The Provider is obliged to inform the affected person of any such extension within one month from the receipt of the application together with the reasons for the extension of the time limit.
The Provider is provided free of charge in accordance with point 1.
If the request of the person concerned is manifestly unfounded or inappropriate, in particular for its recurrent nature, the Provider may request an appropriate fee, taking into account the administrative costs of providing the information or a reasonable fee taking into account the administrative costs of the notification or a reasonable fee, on request.
Restrictions on the rights of the person concerned Restrictions on the rights of the person concerned in accordance with, 23 GDPR and § 30 of the Personal Data Protection Act The Provider informs the person concerned if the purpose of the restriction is not jeopardized.
All actions resulting from GDPR may be made by the User through the available online tools of a specific service or through any valid contact email provided on the Provider's website.
This declaration is drawn up and concluded in the Slovak language. In case they are also signed in foreign language, the Slovak version is decisive.
A natural person who signs a Contract on behalf of a legal entity such as a User is personally liable for all legal consequences and damage caused, unless the User has been authorized to act or if the Commercial Code, valid in the Slovak Republic, does not provide otherwise.
This statement entered into force and became effective on 25.05.2018.

References: Art. 28
 § 100
 Art. 15
 Art. 16
 Art. 19
 Art. 22
 Art. 34
 Art. 13
 Art. 15
 Art. 34
 Art. 15
 § 30