Principles and rules for personal data protection

Welcome to the https://www.eperia.sk/ website. As a first step, before starting to use our website and visiting the EPERIA Shopping Mall situated at Armádneho Generála L. Svobodu 25, 080 01 Prešov, the Slovak Republic (hereinafter referred to as "shopping mall"), it is recommended to attentively read and familiarise yourself with the following principles and rules for personal data processing (hereinafter referred to as "rules") that we observe in processing of personal data you have provided.

We appreciate your privacy and value our relationship with you. We process your personal data in compliance with Regulation (EC) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("Regulation") and Act No 18/2018 Coll. on Personal data protection and amending some acts ("The Personal Data Protection Act").

All our activities are based on strong ethical principles and we undertake to protect privacy of all visitors of our websites as well as of the shopping mall itself. Therefore, the way we collect and maintain information depends on how our websites and related services of the shopping mall are used.

We would like to explain to you, how your personal data are processed and what you are entitled to in accordance with the Personal Data Protection Act, see below.

Content

1      Operator 2

2      Collection of personal data. 2

3      Legal basis and purpose of processing. 3

4      Recipients of personal data. 5

5      Rights of data subject 5

1               Operator

The VSV consulting, a. s. company with registered office at Karloveská 34, 841 04 Bratislava - mestská časť Karlova Ves, the Slovak Republic, company registration No: 31 716 334, incorporated in the Trade Register of the District Court of Bratislava I, section Sa, rider No: 6452/B ("company" or "we") is a person that alone or jointly with others determines the purposes and means of personal data processing of persons concerned who visit shopping mall and/or website of the shopping mall, https://www.eperia.sk/, and/or of data subjects who provide their personal data to us by other means.

Ing. Martin Kuľhavý is Data Protection Officer of the company ("Data Protection Officer").

Should you have any queries or requirements regarding personal data processing, you can contact Data Protection Officer on a phone number +421 948 559 388 on working days between 8:00 AM and 4:30 PM or at the e-mail address: dpo5@proenergy.sk.

2               Collection of personal data

We collect your personal data in following ways:

Ø  directly from you at your completion of contact form at the website of shopping mall, https://www.eperia.sk/kontakt;

Ø  directly from you at your request for sending of information e-mails (newsletters);

Ø  directly from you during advertising campaigns and events held by shopping mall;

Ø  directly from you by personal data you provide to us in telephone or e-mail communication;

Ø  at your entrance into premises of shopping mall (including records produced under camera system of the company);

Ø  provided by yourself in person.

Company collects and processes personal data only in an extent that is adequate to the purposes of processing. Company pays particular attention to safety and protection of personal data and rights of data subjects.

Legal basis and purpose of processing of personal data acquired from persons concerned is further specified in section 3 of the principles, where it is necessary to process personal data of data subjects interested to be informed of current activities and events, sales, discounts, gift cards program of the shopping mall, novelties of shopping mall and its tenants as well as persons concerned we intend to reach in realisation of marketing activities of the shopping mall.

Personal data collected from the persons concerned shall be processed in compliance with principles stated in the regulation and the Personal Data Protection Act, while amongst other things, we take particular care to the principle of data minimisation of data subjects directly imposed by the regulation, and for that reason we shall process your personal data only to the extent necessary, that includes: name, surname and e-mail address.

When visiting the https://www.eperia.sk/ website your personal data shall be also processed through your technical interaction with us. Different technologies may be used on the website (https://www.eperia.sk/) of our shopping mall with aim to make them more user-friendly, practical and safer.  The technologies can lead to automatic collection of data by our party or the third parties, who provide services to us in the field of information technologies. Examples of the technologies are cookies, flash cookies a web analytics tools.  More details on this subject are available at https://www.eperia.sk/pouzivanie-cookies.

3               Legal basis and purpose of processing

Purpose of personal data processing is provision of quality business and information services, especially securing information of data subjects on the shopping mall, delivery of information and details required on a particular offer or response to inquiry of the data subject. Purpose of personal data processing may also include subsequent marketing activities conducted by means of direct marketing, in particular by direct mail, targeted offers, etc.

We process your personal data based on the following valid legal titles provided for in the Regulation and the Personal Data Protection Act:

Ø  Legitimate interest

Our company can process your personal data, providing it is necessary for the purposes of legitimate interests of the company or the third persons, except where   such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. The legitimate interests of our company include especially the following:

• marketing activities within a framework of direct marketing of the company, which means informing on selected products, novelties, sales and discounts, events and gift cards program of the shopping mall; communication may also include customer satisfaction surveys; marketing communication shall be sent occasionally, normally several times a year, no more than approximately once a month; and personal data for this purpose shall be retained for a period of maximum 3 years from their obtaining. In case of marketing activities you shall be entitled to object against processing of your personal data for the given purpose (direct marketing) at any time, namely in a way referred to in point 5 - Rights of the data subject. In case your personal data are processed for the purpose of direct marketing in a form of sending the information e-mails on the latest news, novelties, sales and events related to a range of goods and services offered by the shopping mall and its tenants that we consider interesting for you, you shall be able to unsubscribe from receiving of such information e-mails at any time, providing you are not interested to receive them in the future.
• recovery of debts owed to the company as well as other claims; company shall retain personal data for that purpose no longer than for the duration of the respective limitation periods;
• elimination of deception, if company has reasonable grounds to believe that there is a risk such the acting; company shall retain personal data for that purpose for no longer than 5 years from their obtaining;
• protection of rights that follow from general binding legal rules and contracts related to contractors and to other persons and for purposes of administration and protection of the website; company shall retain personal data for that purpose for a period necessary for protection of the rights and legitimate interests;
• protection of property, life and health; for the purpose company shall retain personal data of persons entering premises of shopping mall for a period no longer than seven (7) calendar days from the entry.

Ø  Execution of the contract

Company shall process personal data of the data subjects for purposes related to execution of contractual obligations of both parties, namely conclusion, amendments and termination of the contract, awarding of full powers by the data subjects, invoicing, etc. Provision of personal data by data subject to the company in a necessary extent shall be a condition precedent to the conclusion of the contract. Witholding of personal data can make delivery of goods and services to the data subject by the company impossible.  Company shall provide to the data subject information on which data are necessary for conclusion of contract and which can be provided e.g. for purposes of improvement in communication efficiency.

Company shall retain personal information for purposes of execution of the contract within duration of contractual relationship between the company and the data subject, and for 10 years from its termination for archiving purposes pursuant to the relevant legislation.

Ø  Compliance with legal obligations

Company can process personal data including their provision to national authorities and other persons, where that obligation results from the law. Owing to its legal obligation the company may for instance provide personal data to the Slovak Trade Inspection, law enforcement authorities or other authorities or persons. 

Company retains personal data for purposes of execution of legal obligations for a period necessary for performance of respective legal obligation provided for in general binding legal rules.

Ø  Authorisation granted by the data subject

Company shall process personal data of the data subject on the basis of authorisation expressly granted by the data subject for the purpose expressly indicated in the authorisation concerned by the data person.

Company shall retain personal data processed on a basis of authorisation by the data person for a period no longer than duration of the authorisation or revocation, whichever comes first.

Data subject shall be entitled to withdraw their consent with processing of personal data at any time and freely. Withdrawal of consent shall not affect the lawfulness of the processing of personal data following from processing prior to the consent.

For the avoidance of doubt regarding period of personal data processing the company shall process your personal data only for a period necessary to fulfill purposes intended for processing of the personal data, for which your personal data had been collected. We shall monitor running of time of personal data processing period to ensure compliance with the Regulation, the Personal Data Protection Act and other general binding rules.

4               Recipients of personal data

Our company can authorise the third persons, the so called intermediaries, to process the personal data. Intermediaries of our company are e.g. persons who secure performance of certain marketing activities, persons who secure operation of the website of the shopping mall and operation the shopping mall itself, consulting companies, security services, etc. Intermediaries process personal data for us solely based on contract on personal data processing that shall meet requirements provided for in the Regulation and the Personal Data Protection Act, and in these cases our company shall take particular care to protection of personal data provided to intermediaries.

In case of some activities, e.g. recovery of debts or administration of information system, administration of website, our company shall cooperate with the third parties, where disclosure of some personal data of data subjects is necessary. [1]

Another recipients of your personal data can be e.g. the following companies: CBRE, s.r.o. - centre administration; Progress Agency s. r. o. - SBS; BTS-PO, s.r.o. - BOZP; PNP s.r.o.- marketing; SCR design s.r.o. - marketing; LOYALTEK S.A. - loyalty cards.

In some cases the company can provide personal data of the data subjects to intermediaries situated outside the EU member states and states that are not a contractual party of the Agreement on the European Economic Area ("third parties") that do not guarantee appropriate standard of personal data protection at present. Should the company provide personal data of the data subject to intermediates in the third countries, it must state, whether there exists the European Commission's adequacy decision, or not, or the company shall indicate a reference to adequate or appropriate guarantees and methods for obtaining copies of the personal data or place of their publishing.

5               Rights of data subject

In compliance with the Regulation and the Act you shall be entitled to

Ø  require from us:

• certificate indicating, whether your personal data are processed, or not; if the person data have not been obtained directly from you, you can require provision of any available information regarding the resource ("the right of access to personal data")
• if your personal data are processed, you shall be entitled to obtain access to the personal data and additional information and obtain a copy of the personal data that the company processes (" the right to be informed of the processing"); however, company shall be entitled to charge you with a reasonable administration charge with regard to for your request for a copy of personal data;
• correction of inaccurate/incomplete personal data processed about you ("the right of rectification");
• deletion of data, if any of reasons indicated in the Regulation or the Personal Data Protection Act is met; especially if personal data are no longer needed for purposes for which they had been acquired or processed by the company, in case you withdraw consent and company has no other legal basis for processing, in case you object against processing, or in case the personal data had been processed unlawfully ("the right to erasure");
• restriction of processing of personal data, if some of reasons indicated in the Regulation and the Personal Data Protection Act is met; e.g., if you communicate that the company processes inaccurate personal data, you can require not processing them until their correction ("the right of restriction");
• obtaining of personal data relating to you and that you have provided to the company in a structured normally used machine-readable format; you have also a right of transfer of these personal data to another operator, if technically possible, and if conditions indicated in the Regulation and in the Personal Data Protection Act are met ("a right to portability");

Ø  object for the reasons concerning particular situations against personal data processing that are relating to you and that are necessary for the purposes of legitimate interests pursued by the company or the third party, except where your interests prevail over those interests or fundamental rights and freedoms that require personal data protection, including objecting against profiling; object against processing of personal data relating to you for reasons concerning the particular situation, and that are necessary for fulfilment of task realised in public interest, including objecting against profiling; object against personal data processing for purposes of direct marketing without your consent, including profiling, in so far as it relates to such the direct marketing (" the right to object“);

Ø  object against applying of company decision based on automatic processing to you, including profiling that produces legal effects concerning you, or similarly significantly affects you, unless otherwise provided for by the regulation and the Personal Data Protection Act ("automatic decision-making, including profiling");

Ø  withdraw your consent to personal data processing by the company at any time with effect from a moment of withdrawal of consent ("the right to withdraw consent");

Ø  where there is a suspicion of unauthorised use of your personal data, you shall be entitled to make a reference for a ruling on personal data protection to the Office for Personal Data Protection of the Slovak Republic, with a seat at Hraničná 4826/12, 820 07 Bratislava, the Slovak Republic, telephone number:  + 421 2 3231 3220, www.dataprotection.gov.sk.

If the data subject does not have full legal capacity, their rights can be applied by legal representative pursuant to the Regulation and the Personal Data Protection Act. Pursuant to the Regulation and the Personal Data Protection Act rights of the data subject who is not alive, can be applied by a party relationship.

Data subject can apply their rights in the following ways:

Having regard to possible risks of misuse and to ensure personal data protection of data subjects bellow we indicate communication means, how we can receive and react to your requests related to personal data we process. In case of doubts regarding your identity we should like to ask you to verify your identity subsequently.

Right of access and the right to be informed of processing

-       - by postal matter (signature of the data subject must be officially certified) sent to registered office address;

-       - by an e-mail to the info@eperia.sk address of company and/or to the dpo5@proenergy.sk address of Data Protection Officer or by postal matter (signature of the data subject must by officially certified) sent to EPERIA Shopping Mall, Armádneho Generála L. Svobodu 25, 080 01 Prešov, the Slovak Republic (on envelope indicate, please: "For attention of: Data Protection Officer, EPERIA Shopping Mall").

-       - by telephoning on + 421 51 321 6983.

Right of rectification, right to erasure, right of restriction, right to data portability, right to object, automated decision-making, including profiling and right to withdraw consent

-       - by postal matter sent to registered office address

-       - by an e-mail to the info@eperia.sk address of company and/or to the dpo5@proenergy.sk address of Data Protection Officer or by postal matter (signature of the data subject must by officially certified) sent to EPERIA Shopping Mall, Armádneho Generála L. Svobodu 25, 080 01 Prešov, the Slovak Republic (on envelope indicate, please: "For attention of: Data Protection Officer, EPERIA Shopping Mall").

-       - by telephoning on + 421 51 321 6983.

Automated decision-making, including profiling

At present we do not conduct automated decision-making, including profiling of personal data of data subject that shall produce legal effects or similarly significantly affect the data subject.

Amendment of rules

Having regard to growth of company and changes in legal and other regulations the company may, at its own discretion, modify, amend and replace the rules.