Informácia o spracúvaní osobných údajov

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter also referred to as „GDPR„)  

Controller: the company ForesServices, s. r. o. , registered office: Prievozská 14, Bratislava 821 09, ID No.: 35692103, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No.: 11155/B 

Contact details of the controller: tel. no.: +421(2)21293930, e-mail: info@fores.group

Contact person responsible: info@fores.group

In the course of our business activities, we process personal data of various data subjects, in particular personal data of contact persons of our customers and contractual partners or potential customers and contractual partners, job applicants, or other persons with whom we come into contact in the course of our business and entrepreneurial activities.  

In most cases, we obtain personal data directly from the data subjects (e.g. when filling in a contact form, when concluding a contract). If we obtain personal data from other sources, we will also provide the data subject with information on the source from which we obtained his/her personal data and information on the category of the personal data concerned; Depending on the specific purpose of the data processing, we may obtain the data, e.g. from a publicly accessible register (commercial register, trade register, etc.) or from a contractual partner.  

We process personal data on the following legal bases: 

• on the basis of contractual and pre-contractual relationships (Article 6(1)(b) GDPR) 

• on the basis of legitimate interests pursued by us (Article 6(1)(f) GDPR) 

• in compliance with a legal obligation (Article 6(1)(c) GDPR) 

• on the basis of the data subject’s consent (Article 6(1)(a) GDPR). 

The data subject is obliged to provide his or her personal data if the processing of the personal data is necessary in connection with the performance of a legal obligation of the controller.  

The data subject is also obliged to provide personal data in cases where their provision is a contractual requirement arising from a contract concluded between the controller and the data subject. Failure to provide the data could prevent the performance of the contract.  

The provision of your personal data in the framework of pre-contractual relations is necessary; as failure to provide them could prevent the participation of the data subject in the selection procedure and/or the conclusion of the contract. 

If the legal basis for the processing of personal data is the consent of the data subject, the provision of data for that purpose is voluntary. If we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.   

Where we process personal data of a data subject for the purposes of the legitimate interests pursued by us (Article 6(1)(f) GDPR), the data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of his or her personal data based on this legal basis.  

We do not use the personal data of data subjects for automated individual decision-making or profiling.   

Retention period of personal data: 

We will retain personal data for as long as necessary to achieve the purpose for which the personal data is processed.  

If your personal data is processed in the performance of the legal obligations of the controller and a legal regulation specifies a retention period or criteria for determining it, we will retain the personal data and related documentation for the period required by the relevant legal regulation.  

For more detailed information on the data retention period, please refer to the following document. 

We process personal data for the following purposes: 

Handling a request for information (query/question) submitted via the contact form on the website of the controller 

We process personal data for this purpose on the basis of the data subject’s consent, within the scope of the data filled in the contact form on our website. The provision of the data is voluntary, however, without the provision of the data it is not possible to process the request/respond to the enquiry.

You have the right to withdraw your consent at any time by sending an email to the contact email address of the controller info@fores.group . Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. 

Retention period: until the request has been processed (until the requested information has been provided), but for no longer than 1 year.  

Communicating with the potential contractual partner and carrying out activities aimed at concluding the contractual relationship, including handling the data subject’s enquiry about the service offered by the controller 

For this purpose, we process personal data of natural persons – potential contractual partners (e.g. suppliers operating on the basis of a trade license, potential customers). The provision of the data is necessary for the conclusion of a contractual relationship with the data subject (or for the provision of a service offered by the controller).  

The processing of the data subject’s personal data is necessary in order to carry out pre-contractual measures at the request of the data subject (pre-contractual relations).  

Retention period: until the conclusion of a contractual relationship with the data subject, up to a maximum of 1 year (unless a contract/service has been concluded within this period). 

Communication with the potential contractual partner and implementation of activities aimed at concluding the contractual relationship (contact persons) 

For this purpose, we process the personal data of the contact persons of the potential contractual partner (i.e. persons acting on behalf of the potential contractual partner or its employees) in the scope of title, name, surname, e-mail or telephone contact, link to the legal person whose contact person is the data subject and data on his/her function/position.  

This purpose includes the activities of the controller related to the process of communication, meetings, negotiations and other activities that must be carried out before concluding a deal with a potential contractual partner on the basis of its enquiry/order, and to the recording of the course of this process and related internal activities. 

The processing is based on our legitimate interest to ensure and monitor the contracting process with the prospective customer for the supply of the service/product. 

You have the right to object at any time on grounds relating to your particular situation to the processing of your personal data for the purposes of the legitimate interests pursued by us. You may object in person, in writing by delivering your objection to the controller’s registered office or by e-mail to the contact email address provided by the controller 

Retention period: until the conclusion of the contract, up to a maximum of 1 year (unless a contract is concluded within this period). 

Sending marketing emails and electronic newsletters 

On the basis of the consent, we will process the data on the e-mail address of the data subject, to which we will send e-mail messages presenting the services offered and newsletters. The legal basis for the data processing is the consent of the data subject. The provision of the data is voluntary; however, without the provision of the data, it is not possible to register for newsletters and marketing emails. The data subject has the right to withdraw his or her consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. You can withdraw your consent by clicking on the unsubscribe link or by delivering your withdrawal to the contact email address of the controller indicated above. 

If we have obtained the e-mail address of the data subject in connection with the sale of goods or services, we will process it for this purpose on the basis of our legitimate interest in informing customers about new products and services provided by the controller. We regularly send newsletters to our customers. 

In accordance with Article 21(2) of the GDPR, the data subject shall have the right to object at any time to processing of personal data for direct marketing purposes. In this case, we may no longer process the personal data for this purpose. You may object in writing by delivering your objection to the address of the controller’s registered office or by e-mail to the contact email address of the controller indicated above.   

Each marketing email or newsletter sent contains an unsubscribe link. If you no longer wish to receive information about news or offers, you can unsubscribe by clicking on this link. Once you unsubscribe, we will no longer send you newsletters and marketing messages.  

Shelf life: 5 years.  

Addressing customers by telephone with individual marketing offers   

On the basis of your consent, we will process your telephone number so that we can contact you with a presentation of the services, news and promotional offers we offer. Personal data is processed for this purpose on the basis of the data subject’s consent. You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.   

If we have received your telephone contact in connection with the sale of goods or services, we will process your data for this purpose on the basis of our legitimate interest in informing customers about the range of products and services that are tailored to the individual needs of our customers. We only carry out marketing of our own goods and services similar to those you have purchased from us on the basis of legitimate interest. In accordance with Article 21(2) GDPR, you have the right to object to the processing of your personal data for direct marketing purposes at any time. In this case, we may no longer process personal data for this purpose.   

Shelf life: 5 years. 

Registration of consents for the purposes of electronic marketing 

In accordance with Act No. 452/2021 Coll. on Electronic Communications, we are obliged to keep the durable medium on which the demonstrable (previous) consent for marketing purposes is recorded for at least four years after the withdrawal of consent.   

In accordance with the law, we do not use automated dialling and communication systems without human intervention, telefax, electronic mail or short message services to obtain consent. 

Retention period: for the fulfilment of this obligation, the controller will keep the personal data of the data subject for a period of four years from the expiry of the consent for the purpose of sending electronic newsletters (the consent is granted for 5 years) or for a period of four years from the withdrawal of consent (if the consent is withdrawn earlier). 

The valid conclusion and performance of contractual relations  

For this purpose, we process the personal data of persons authorised to act on behalf of the contractual partner/potential contractual partner and the data of employees of the contractual partners/potential contractual partners specified in the contract concluded with our contractual partner or in its draft, as well as the data specified in accounting and other documents related to the contractual relationship (invoices, orders, acceptance reports, etc.).  

We obtain the data directly from the data subjects or from the publicly accessible business register or from the contractual partner as the data subject’s employer. This includes, in particular, identification data, contact details, information on the link to the contractual partner, function or job title, signature.  

We process personal data for this purpose on the basis of the legitimate interest of the controller to ensure the valid conclusion of contracts and their effective performance. 

You have the right to object at any time on grounds relating to your particular situation to the processing of your personal data for the purposes of the legitimate interests pursued by us. You may object in person, in writing by delivering your objection to the controller’s registered office or by e-mail to the contact email address provided by the controller 

Retention period: until the settlement of the rights and obligations under the contract, but at least 10 years after the end of the contractual relationship. 

Implementation of existing contractual relations 

In this case, the processing is necessary for the performance of a contract to which the data subject is a party (customer, supplier – natural person / natural person – entrepreneur). The personal data necessary for the performance of the contract (for the exercise of rights and obligations under the contractual relationship) are processed, in particular identification data such as name, surname, title, if it is an entrepreneur FO – business name, place of business and ID number, contact details, bank account number and billing data and other data relating to the contractual relationship and its course.  

Retention period: until the settlement of the rights and obligations under the contract, but at least 10 years after the end of the contractual relationship. 

Bookkeeping, processing of accounting and tax documents, invoicing and cash register 

Processing for this purpose is necessary for the fulfilment of the legal obligations of the controller, in particular within the meaning of Act No. 431/2002 Coll. on Accounting, as amended, Act No. 222/2004 Coll. on Value Added Tax, as amended, Act No. 595/2003 Coll. on Income Tax, as amended, Act No. 283/2002 Coll. on Travel Compensation, as amended.  

Retention period: 10 years (in accordance with the Accounting Act).  

Customs declarations 

This purpose includes the processing of personal data to the extent necessary in connection with activities related to the processing of documents for the cross-border transport of goods and the payment of customs duties. The legal basis for the processing of your personal data in this case is the fulfilment of the legal obligations of the controller under Act No. 199/2004 Coll., the Customs Act and on amendments and supplements to certain acts, as amended.  

Retention period: for 10 years from the date of the final conclusion of the customs procedure initiated by the lodging of the customs declaration, or, where justified, for 20 years from the end of the year in which the outstanding customs debt became chargeable. 

Handling of complaints 

If you are a consumer making a complaint about our products/services, we will process your personal data for the purpose of handling your complaint. The processing of the data is necessary for the fulfilment of the legal obligations of the controller under consumer protection legislation.    

In the case of a complaint made by a data subject who is not a consumer, we will process your personal data for this purpose on the basis of the contract we have concluded with you and from the conclusion of which you have the right to claim liability for defects in the product or service. The legal basis for processing your personal data in this case is the performance of a contract to which the data subject is a party.   

Retention period: 10 years from the date of the claim. 

Fulfilment of obligations under the Public Sector Partners Register Act 

As a legal entity acting as a public sector partner within the meaning of Act No. 315/2016 Coll. on the register of public sector partners and on amendment and supplementation of certain acts, we process the personal data of the end-user of benefits, other persons who are part of the ownership structure and management structure of the controller (to ensure compliance with the obligation to identify and verify the identification of the end-user of benefits), as well as the personal data of the lawyer who performs for the controller the duties of an authorised person within the meaning of the Act in question, and to whom we also provide data relating to persons in the ownership and management structure of the controller.  

The legal basis for the processing of your personal data in this case is the fulfilment of the legal obligations of the controller pursuant to Act No. 315/2016 Coll. on the Register of Public Sector Partners and on Amendments and Additions to Certain Acts.   

Retention period: until the deletion of the controller as a registered public sector partner. 

Handling requests for the exercise of the rights of data subjects  

Personal data are processed for this purpose on the following legal basis: the processing is necessary for the fulfilment of the legal obligations of the controller under data protection legislation (GDPR), which the controller has in connection with the exercise of the rights of data subjects under Articles 15 to 22 GDPR.  

Retention period: 5 years from the date of processing of the request, but at least until the final conclusion of the administrative procedure initiated at the initiative of the data subject in relation to the request. 

Management of the company’s agenda, registration and notification of changes to the commercial register 

In this case, the processing is necessary for the fulfilment of the legal obligations of the controller (Act No. 530/2003 Coll. on the Commercial Register and on Amendments and Additions to Certain Acts, as amended, Commercial Code ). 

Retention period: personal data processed for this purpose (contained in the company’s socio-legal documents) are retained for the duration of the legal personality of the controller (also in the event of dissolution of the company with a legal successor). 

Selection procedure (job applicants) 

The processing of personal data of a job applicant by the controller includes in particular activities related to the receipt and assessment of the received CV and application for employment, the conduct of the selection procedure and informing the applicant of the result (acceptance or non-acceptance). In this case, the processing is necessary in order to carry out pre-contractual measures at the request of the data subject (pre-contractual relations).   

Retention period: until the end of the selection procedure. 

Proving, defending or asserting the rights and legal claims of the controller, including the management of litigation and the recovery of claims and other claims of the controller in judicial, extrajudicial or enforcement proceedings, including legal representation in such proceedings 

If we process personal data for this purpose, we do so on the basis of the legitimate interest pursued by us to protect the rights and legitimate interests of the controller, to prevent damage and to ensure the fulfilment of the claims and other legal claims of the controller. 

You have the right to object at any time on grounds relating to your particular situation to the processing of your personal data for the purposes of the legitimate interests pursued by us. You may object in person or in writing by delivering your objection to the controller’s registered office or by e-mail to the contact email address provided by the controller 

Within the scope of this purpose, we may provide personal data to an attorney at law who processes personal data of clients and other natural persons to the extent necessary for the purposes of advocacy in accordance with Act No. 586/2003 Coll. on Advocacy and on Amendment and Supplementation of Act No. 455/1991 Coll. on Trade Enterprise (Trade Licensing Act), as amended.  

Retention period: until the expiry of the limitation and prescription periods. The related documentation shall thereafter be retained for 5 years from the final conclusion of the relevant proceedings or until the settlement (repayment) of the legal claim enforced in the relevant judicial, extrajudicial, enforcement or bankruptcy proceedings.  

Ensuring network and information security  

The legal basis for the processing of personal data is the legitimate interest of the controller to prevent unauthorised access to electronic communications networks, to prevent damage to computer and electronic communications systems and to protect data contained in the IT technologies and systems of the controller. 

You have the right to object at any time on grounds relating to your particular situation to the processing of your personal data for the purposes of the legitimate interests pursued by us. You may object in person, in writing by delivering your objection to the controller’s registered office or by e-mail to the contact email address provided by the controller 

Retention period: 5 years following the end of the calendar year in which the log was recorded. 

Quality management of management processes and information security (ISO agenda) 

The legal basis for the processing of personal data is the legitimate interest pursued by the controller to improve the quality and functionality of the management and information security of the controller.  

You have the right to object at any time on grounds relating to your particular situation to the processing of your personal data for the purposes of the legitimate interests pursued by us. You may object in person, in writing by delivering your objection to the controller’s registered office or by e-mail to the contact email address provided by the controller 

Retention period: for as long as necessary to achieve the purpose, up to a maximum of 10 years from the date of the audit report. 

Operating the controller’s corporate profile on social networks (fan pages) 

When operating a company profile on social networks, we pursue a legitimate interest in raising awareness of the controller in the online environment and communicating with customers and those interested in services through fan pages.  

Through social networks we can present our activities and communicate. The personal data you post on our social networking fan pages such as comments, likes, videos, pictures, etc. will be published through the social networking platform.  

The personal identification data provided in the user profile on the social network (first name, surname or other user identification – nickname, login name), profile photo (if it is part of the profile) and other data that you post in connection with the use of social networks (in particular, data that you provide in the context of discussions, contributed content and other active communication on the network) are processed. 

The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her. You may object in writing by delivering your objections to the address of the controller’s registered office or by e-mail to the contact email address of the controller indicated above.   

Social network operators have their own adopted rules, service infrastructure and their own privacy provisions. We have no control over the transfer of your data and the use of your data by social network operators we recommend that you familiarize yourself with the privacy policy of the social network platform provider.  

Meta Platforms Ireland Limited (Facebook) stores the collected data as user profiles and uses it for its own advertising, market research purposes and/or to tailor its services and tools to registered users. The data subject shall have the right to object to the creation of such user profiles by contacting Meta Platforms Ireland Limited (Facebook). 

For the purpose of „social networks – statistical data„, we act as joint controllers with the operator of the social network Facebook – Meta Platforms Ireland Limited (hereinafter referred to as „Meta“) within the meaning of Article 26(4) of the GDPR. 

When managing our Facebook profile, your personal data may be processed for statistical purposes through a feature called Facebook Insight, which is provided to us free of charge by Meta Platforms Ireland Limited under non-changeable terms of use.

When you visit our profile set up on Facebook, Meta (Facebook) records, among other things, your Internet IP address, as well as other information that resides on your computer in the form of „cookies“, each of which contains a unique user code that is active for a period of two years and is stored by Meta on the hard drive of your computer or on another device of visitors to the fan page. The user code, which can be associated with the connection data of users registered on Facebook, is collected and processed when the fan pages are opened.   

This information is used to provide us, as the controllers of the Facebook pages, with statistical information about the use of the Facebook page. For more information about this statistical information („insights“), please visit:   

https://www.facebook.com/legal/terms/information_about_page_insights_data 

https://www.facebook.com/help/pages/insights 

For this processing, we act as joint controllers with Meta, and the basic elements of the joint controllers agreement for this case are available here:  

https://www.facebook.com/legal/terms/page_controller_addendum 

We may use services provided by Meta Platforms Ireland Limited that are designated as audience management for the execution of advertising campaigns, which may combine data processed by us with personal data processed in Meta’s databases. As part of this service, Meta processes personal data on our behalf to measure the performance and impact of our advertising campaigns and to provide us with reports of users who have seen and responded to our advertising content. This processing of personal data may occur if you interact with our advertising content or our websites when using your user profile set up on Facebook. In such cases, we use Meta Platforms Ireland Limited as a processor and the following legal safeguards apply to the processing of your personal data:   

https://www.facebook.com/legal/terms/businesstools  

https://www.facebook.com/legal/terms/dataprocessing  

Data retention period: until the fan unfollows the fan page or until the post, comment or other content is deleted by the data subject from our social network profile (delete posts on the timeline of the controller).  If you object to the processing, your posts will be deleted by us as the controller.  

The controller’s website uses cookies.

Visitors to the website can find more information about the cookies used and the processing of data via cookies in the cookie bar on the website.  

Recipients of personal data:  

The recipients of personal data are or may be entities designated by law, in particular state administration and public authorities for the exercise of control and supervision, courts, law enforcement authorities, the Central Office of Labour, Social Affairs and Family. 

Depending on the purpose of the processing and the specific circumstances, the recipients of your personal data may also include other persons (in the capacity of processor or independent controller), in particular:  

• bank, 

• postal service provider, 

• Auditor,  

• provider of payroll and HR processing services and accounting services, 

• external service providers in the field of information systems and software products (e.g. provider of design, development, implementation and other related services in the field of IT systems and solutions, provider of installation, integration, migration, configuration, customisation, custom development, reporting and training services for Microsoft Project and Microsoft SharePoint products), 

• providers of IT training products and solutions, 

• provider of certification audit services of integrated management system, namely quality management system and information security management system, 

• provider of the CRM tool ZOHO, 

• communication service providers,  

• cloud service provider, 

• your internet and data connection provider, 

• provider of recruitment services for the search and selection of candidates to fill positions, 

• controllers of job advertising websites, 

• a provider of commission services related to customs clearance, 

• provider of website support and operation,  

• web hosting service provider, 

• operator of the social networks Facebook and Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland), 

• visitors to the website of the controller and users of social networks on which the controller has created a profile in relation to the data published on them. 

When using the services of a social network operator (Facebook and Instagram) and the communication and cloud services and software products of a Microsoft Corporation vendor, personal data is transferred to third countries (the United States of America).  

Facebook, Instagram (network operator – Meta Platforms Ireland Limited):  

The transfer of data takes place in accordance with European Commission Decision 2000/518/EC of 10.7.2023 on the adequate protection of personal data relating to the EU-US Privacy Shield Framework on the basis of Article 45 of the General Data Protection Regulation (the so-called EU-US Privacy Shield Framework). Meta Platforms, Inc. has certified that it complies with the principles of the Privacy Shield Legal Framework.   

Microsoft Corporation: 

The transfer of data to third countries (USA) takes place in accordance with European Commission Decision 2000/518/EC of 10.7.2023 on the adequate protection of personal data relating to the EU-US Privacy Shield Framework on the basis of Article 45 of the General Data Protection Regulation (EU-US Privacy Shield Legal Framework). Microsoft Corporation has certified to participate in the framework.  

Rights of data subjects: 

Right of access to personal data under Article 15 GDPR: 

The data subject shall have the right to obtain confirmation as to whether the controller processes personal data relating to him or her. The data subject has the right to obtain access to his or her personal data (the right to be provided with a copy of the personal data held by the controller about the data subject) and information about how the controller processes it, to the extent provided for in Article 15 of the GDPR.  

The right to rectification of personal data under Article 16 GDPR: 

The data subject shall have the right to have personal data concerning him or her rectified if it is incorrect or to have it completed if it is incomplete. The controller must comply with the request for rectification or completion of the personal data without undue delay.   

Right to erasure (right to be forgotten) under Article 17 GDPR: 

The data subject shall have the right to obtain from the controller, without undue delay, the erasure of personal data concerning him or her, if one of the grounds referred to in Article 17(1) of the GDPR is met (e.g. if the personal data concerning him or her obtained by the controller are no longer necessary for the purposes for which they were collected or otherwise processed). This right of the data subject shall be assessed by the controller in the light of all relevant circumstances in accordance with Article 17 GDPR (e.g. the controller shall not grant the request if the processing is necessary – for compliance with a legal obligation of the controller or for the establishment, exercise or defence of legal claims).  

The right to restriction of processing of personal data pursuant to Article 18 GDPR: 

The data subject shall have the right to have the controller restrict the processing of his or her personal data if one of the cases referred to in Article 18(1) of the GDPR occurs (e.g. if the data subject contests the accuracy of the personal data during the period for verifying their accuracy). 

Where processing has been restricted in accordance with Article 18(1) of the GDPR, such personal data shall be processed, with the exception of storage: a) only with the consent of the data subject, or b) for the establishment, exercise or defence of legal claims, or c) for the protection of the rights of another natural or legal person, or d) for reasons of important public interest of the Union or of a Member State.  

The right to portability of personal data under Article 20 GDPR: 

Where the processing is based on consent or on a contract and is carried out by automated means, the data subject shall have the right to obtain his or her personal data which he or she has provided to the controller in a structured, commonly used and machine-readable format and shall have the right to transmit those data to another controller. As far as technically feasible, he or she shall have the right to have the data transmitted directly from one controller to another.  

Right to object under Article 21 GDPR:  

If the processing is based on legitimate interests (Article 6(1)(f) GDPR), the data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her, including to profiling based on the provisions of Article 6(1) (f) GDPR. In such a case, the controller may no longer process the personal data unless it demonstrates compelling legitimate grounds which override the interests, rights and freedoms of the data subject or the establishment, exercise or defence of legal claims.  

If the data subject objects to the processing of his or her personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing, the personal data may no longer be processed for such purposes. 

Right to bring a data protection action  

You may at any time submit a petition for initiation of a personal data protection procedure regarding the processing of your personal data to the supervisory authority, i.e. the Office for Personal Data Protection of the Slovak Republic, Park One Building, Námestie 1. mája 18, 811 06 Bratislava, tel.: +421 2 3231 3214, www.dataprotection.gov.sk.