Privacy Policy and Privacy Scheme under the GDPR

KOVACO, spol. s r. o. respects the privacy of every visitor to our website www.kovacocompany.com as the protection of personal data is very important to us. We consider compliance with the legal conditions for the processing of personal data of data subjects to be a priority. All actions carried out at the individual stages of the personal data processing shall be carried out with the utmost attention to the protection of the fundamental rights of data subjects, in particular, the protection of personality and privacy and compliance with the principles of lawful processing of personal data.
Therefore, it is very important that you read this Privacy Policy and Privacy Scheme under the GDPR (hereinafter referred to as the “Privacy Policy”), which will provide you with more information about the processing of your personal data by KOVACO.

This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data within the meaning of Articles 13 and 14 of the Regulation (hereinafter referred to as the “GDPR”) and Act No. 18/2018 Coll. on the protection of personal data (hereinafter referred to as the “Personal Data Protection Act”).

We may update this document from time to time without notice. For this reason, we recommend that you visit our website regularly and familiarize yourself with the current version of the Privacy Policy.

Data about the Operator

KOVACO, spol. s r. o.
Registered office: Mostová 2, 811 02 Bratislava – Old Town
Company ID No.: 36 038 911
Company registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 167483/B
E-mail: kovacicova@kovaco.sk
Telephone number: +421 918 977 904
(hereinafter referred to as the “Operator”, “KOVACO”)

Correspondence address:

KOVACO, spol. s r. o.
Mostová 2
811 02 Bratislava – Old Town

What is personal data?

Personal data is data relating to an identified natural person or an identifiable natural person who can be identified, directly or indirectly, in particular, by reference to a commonly used identifier, to another identifier such as a first name, a surname, an identification number, location data or an online identifier, or to one or more characteristics or attributes which constitute his or her physical identity, physiological identity, genetic identity, psychological identity, mental identity, economic identity, cultural identity or social identity.

What is personal data processing?

Processing of personal data means a processing operation or set of processing operations concerning personal data or sets of personal data, in particular, the obtaining, recording, organisation, structuring, storage, alteration, retrieval, browsing, use, disclosure by transmission, dissemination or otherwise, shuffling or combination, restriction, erasure, whether or not by automated or non-automated means.
The Operator (Controller) is not obliged to appoint/designate a Responsible Person.

Sources and categories of personal data

The Operator only collects those personal data to the processing and use of which the user gives his/her voluntary consent. By expressing consent, the user also agrees to the following terms and conditions for processing personal data:

By opening this website, some data is stored automatically on our servers for the purpose of system administration or for statistical and support purposes. This information includes the name of your internet service provider, your internet protocol (IP) address, the software version of your browser, the operating system of the computer you use to access our website, the website you use to open our website. This data may be used to understand the profile of users of our website, but always without using any data relating to a specific person. Such data will only be used if provided anonymously.

If you voluntarily provide us with personal data through one of the contact forms on the KOVACO website, the sub-pages you visited before filling in the form and, in some cases, the page you visited directly before arriving at the KOVACO website will be recorded on our server. We will not use, process, or transfer such data to a third party beyond the limitations of the law or beyond the limits specified by you in your consent statement. We will only disclose your personal data if we are compelled to do so by a court or other public authority decision.

We will post any changes to this Privacy Policy on this website.

Legal basis for processing personal data

The legal basis for processing your personal data is:

• Your consent to the processing of your personal data for the purpose of providing direct marketing pursuant to Article 6(1)(a) of the GDPR
• Performance of the contract between you and the Operator pursuant to Article 6(1)(b) of the GDPR
• The processing is necessary for compliance with a legal obligation of the Operator pursuant to Article 6(1)(c) of the GDPR

Purpose of processing personal data

We always collect personal data from you for a specific, predetermined purpose. These purposes may be:

1. Provision of our services – processing of orders and conclusion of commercial contracts for the supply of goods and services where personal data is required for the successful performance of the contract pursuant to Article 6(1)(b) of the Regulation (this includes the subsequent payment, delivery of goods or services, handling of complaints, etc.); processing of customer personal data takes place without customer’s consent as the legal basis for the processing of their personal data for the purposes of the performance of the contract is the specific contract between the customer and the Operator. Provision of personal data is a necessary requirement for the conclusion and performance of a contract. Without the provision of personal data, it is not possible to conclude a contract or, for the Operator, to fulfil the terms and conditions thereof.
2. Contact form for initial contact on the Operator’s website.
3. Running social media profiles – (Facebook, Instagram, Youtube). Personal data that you post on our social media sites, such as, comments, likes, videos, images, etc., will be published via the social media platform. We do not subsequently process personal data for any other purpose. Social media operators have their own adopted rules, service infrastructure and their own privacy provisions. We have no influence on the data transfer and use of your data by social media operators. We recommend that you familiarize yourself with the privacy policy of the social media platform provider. In certain processing operations, we act as joint controllers with social network operators within the meaning of Article 26(4) of the GDPR. There is no automated individual decision-making on the part of the Controller within the meaning of Article 22 of the GDPR.
4. Promotions, events, activities – organising offline and online promotions, events and activities for customers and potential customers.
5. Newsletter – sending newsletters to new and existing customers (via SMS, e-mail), mainly informing about news, trends or current offers of the Operator
6. Reviews and feedback – processing and publishing customer reviews and feedback in order to build the company’s reputation.
7. Correspondence – sending and receiving electronic and letter documentation.
8. Complaints – in the case of a need to complain about the goods.

Retention period

It is the time frame during which the Operator retains the personal data of the data subjects during processing. The retention period shall be based on the purpose for which the data are processed and shall be determined in accordance with the legal obligations, legitimate interests or consent of the data subjects. The data shall only be kept for as long as necessary to achieve the stated purpose. After the retention period has expired, the Operator shall discard the personal data. After the expiration of the period of storage of personal data resulting from Act No. 395/2002 Coll., the Act on Archives and Registers and on the amendment of certain acts, the Operator shall dispose of the personal data.

Recipients of personal data

The recipient of personal data is anyone to whom the personal data is disclosed, regardless of whether they are a third party. A public authority which processes personal data on the basis of a special regulation shall not be considered a recipient. The Operator does not provide, disclose or make personal data available to third countries.

Conditions for the security of personal data

The Operator declares that it has taken appropriate personal, technical and organisational measures to ensure the security of personal data. The Operator has taken technical measures to secure the data storage and storage of personal data in file form. The Operator declares that the personal data can only be accessed by persons authorised by the Operator, who are contractually obliged to maintain the confidentiality of this data and may not use it for any other purpose.

Rights of data subjects under the Regulation and the Personal Data Protection Act

We consider it important that you understand that the personal data we process is your data and that there are rights associated with the processing of that data. As a data subject, you have the following rights in relation to the protection of personal data:

Right of access to your personal data – according to Article 15 of the GDPR, you have the right to be provided with a copy of the personal data we hold about you, as well as information about how we use your personal data. In most cases, your personal data will be provided to you in written paper form, unless otherwise requested by you. If you request this information by electronic means, it will be provided to you electronically where technically possible. You can submit your application electronically at the following e-mail address kovacicova@kovaco.sk, or by mail at our correspondence address.

Right to rectification of personal data – according to Article 16 of the GDPR. The Operator takes reasonable steps to ensure that the information we hold about you is accurate, complete and up to date. If you believe that the information we hold is inaccurate, incomplete or out of date, please do not hesitate to ask us to amend, update or supplement this information electronically at the following e-mail address kovacicova@kovaco.sk, or by mail at our correspondence address.

Right to restriction of processing of personal data – you have the right to ask us to stop using your personal data. If we grant your request, we will only store your personal data and will not work with it further. Restriction of the processing of your data will occur if:

• you challenge the accuracy of the personal data, during a period that allows us to verify the accuracy of the personal data,
• the processing is illegal and you decide to request a restriction on the processing of your personal data instead of requesting its erasure,
• we no longer need your personal data for the purposes of processing, but you need it to prove, exercise or defend legal claims,
• you object to the processing of your personal data until we have verified that our legitimate interests outweigh your reasons.

Right to erasure of personal data – according to Article 17 of the GDPR, you have the right to require that KOVACO spol. s r. o. erases your personal data without undue delay and stops processing it if:

• the personal data is no longer necessary in connection with the purposes for which it was collected or otherwise processed,
• you have withdrawn your consent or objected to the processing of your personal data,
• the processing of your personal data does not comply with the Personal Data Protection Act for other reasons,
• you are a child, or the parent of a child, who has consented to the processing of personal data via the Internet.

Right to object – according to Article 21 of the GDPR, you have the right to object to the processing of your personal data, in particular, if you believe that your individual rights and freedoms override our legitimate interests in processing your personal data. You also have the right to object to the processing of your data for direct marketing purposes.

Right to transfer personal data – according to Article 21 of the GDPR, you have the right to ask us to provide your personal data in a structured, commonly used and machine-readable format to another third party of your choice. However, the right of transferability only applies to personal data that we have obtained from you on the basis of your consent or on the basis of a contract to which you are a party.

Right to withdraw consent to the processing of personal data – it allows you to stop or withdraw your prior consent to the processing of your personal data by the Operator. This act of withdrawal of consent is simple, voluntary and can be done at any time, without any negative consequences.

Right to lodge a complaint – you have the right to lodge a complaint if you believe that your data protection rights have been violated.

How to exercise your rights

Your request to exercise your rights may be oral, written, electronic or by other means (the General Data Protection Regulation does not prescribe a specific form).
You can contact us electronically with your request to exercise your rights at the following e-mail address kovacicova@kovaco.sk, or by mail at our correspondence address.

Should you believe that your personal data protection rights have been violated, you have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Company ID No.: 36064220, VAT ID No.: 2021685985, E-mail: statny.dozor@pdp.gov.sk

This Privacy Policy is effective from 31 August 2023 and replaces the previous Privacy Policy.