Privacy policy

On this page we provide information on the processing and protection of personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”), and Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (the “Personal Data Protection Act”).

The controller, CHETRA SK, s.r.o., with its registered office at Sládkovičova 1937, 093 02 Hencovce, Company ID (IČO): 36 497 274 (the “controller”), has adopted appropriate technical and organisational measures to protect the rights of data subjects, which guarantee the lawful processing of personal data. The controller has also introduced a transparent system for recording security incidents and queries from data subjects and other persons.

You can also obtain individual information by phone on +421 918 542 137 or by e-mail at gdpr@typton.sk.

1. Controller

CHETRA SK, s.r.o.
Sládkovičova 1937
093 02 Hencovce
Company ID (IČO): 36 497 274

We process your data for our own purposes as a controller. This means that we determine the purpose for which we collect your personal data, determine the means of processing and are responsible for ensuring that it is carried out properly.

2. Processors

In certain cases, the controller may also process the personal data of data subjects through processors whom it has engaged to process personal data under Article 28 GDPR.

Processors process the personal data of data subjects on behalf of the controller. Processing through a processor has no negative effect on the exercise and enforcement of the data subject’s rights. The controller only uses processors that provide appropriate technical, organisational and other measures so that the processing meets the requirements of the GDPR and the protection of the data subject’s rights is ensured in full.

When processing personal data, the controller uses the following categories of processors:

• providers of the technical solution, web hosting, maintenance and support of the IT systems used by the controller,
• providers of accounting and tax compliance services for the controller.

Categories of recipients of personal data: persons acting on the authority of the controller, legal representative, auditor, state administration and public authorities when carrying out inspection and supervision.

3. Purpose of processing personal data

As a controller, we only process personal data for which we can demonstrate a legitimate legal basis and a defined purpose.

Receiving and handling an order

We process the personal data from an order you place electronically, in person, by phone or in writing in order to handle it, i.e. to provide the services ordered. The processing takes place under Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. We also process personal data for mutual communication and to fulfil obligations and exercise rights arising from this contractual relationship.

Newsletter

On our website you can subscribe to our newsletter if you wish to be kept informed in good time about news and current offers. The processing takes place under Art. 6(1)(a) GDPR, i.e. on the basis of your consent to receiving news by e-mail at the address you have given us. You can withdraw your consent at any time via the link in every newsletter or by e-mail at gdpr@typton.sk.

Contact form and enquiries made by other means

If you contact us through the form on the website, send us your opinion or a review, or have another enquiry or problem, we will be happy to help. For this purpose we process your contact details under Art. 6(1)(f) GDPR. Our legitimate interest is to help clients and to deal with questions, requests or complaints from third parties. You can object to such processing at any time.

4. List of personal data processed

Depending on the specific purpose, we process different categories of personal data:

5. Secure internet banking

When you pay online, you enter all your payment details on the bank’s secure pages. We do not come into contact with your sensitive payment details; we only learn whether the transaction was successful.

6. Period of processing and retention of personal data

Personal data that we have processed or are processing under Art. 6(1)(b) GDPR in the course of fulfilling the controller’s obligations is further processed to comply with legal obligations in the area of taxes and accounting (for example, keeping accounting records and invoices under Act No. 431/2002 Coll. on Accounting, and demonstrating compliance with tax obligations under Act No. 595/2003 Coll. on Income Tax and Act No. 563/2009 Coll. on Tax Administration). We keep it for the period laid down by these regulations. However, we always follow the principle of storage limitation under Art. 5(1)(e) GDPR, so we erase or anonymise personal data that is not subject to archiving under specific regulations.

Personal data processed under Art. 6(1)(a) GDPR, i.e. on the basis of consent, for example for sending marketing news, is processed for 3 years or until consent is withdrawn. Before the end of this period we contact the data subject, and consent for the same purpose can be renewed for a further period. If the data subject does not give consent or does not respond, we no longer process their personal data: we remove it from our records, erase electronic data from our systems and shred paper records.

Personal data processed under Art. 6(1)(f) GDPR, i.e. on the basis of legitimate interest, which we obtained when dealing with an enquiry, suggestion or question, is processed for the time needed to deal with it. If no pre-contractual or contractual relationship arises from the enquiry, we erase it without delay.

We erase personal data without undue delay after:

• all contractual relationships between you and the controller have ended, and/or
• all your obligations towards the controller have ceased, and/or
• all your complaints and requests have been dealt with, and/or
• all other rights and obligations between you and the controller have been settled, and/or
• all purposes of processing laid down by law or purposes for which you gave consent have been fulfilled, and/or
• the period for which consent was given has expired or you have withdrawn your consent, and/or
• we have complied with your request for erasure of personal data, and/or
• a decisive legal fact for ending the purpose of processing has occurred and the protective retention period has also expired,
• and at the same time the controller’s legitimate interest no longer applies and all obligations under generally binding regulations requiring the retention of personal data (in particular for archiving or tax audit purposes) have ceased.

We do not systematically process accidentally obtained personal data for any purpose. Where possible, we inform the data subject that we have obtained it and assist them in regaining control over it. Immediately afterwards, we securely destroy the accidentally obtained personal data.

If you would like to know more about how long we keep specific data, please contact us.

7. Disclosure of data

We do not publish the personal data we obtain.

8. Cross-border transfer and profiling

We do not carry out cross-border transfers of personal data or profiling.

The exception is the map in the website footer. It is loaded from Google Maps only when you click the Show map button. Google Ireland Limited then obtains your IP address and browser data as an independent controller and may also transfer them to the USA in accordance with its privacy policy. Until you click the button, the website sends nothing to Google.

9. Rights and obligations of the data subject

• The customer is obliged to provide only complete and true data.
• The customer undertakes to update their data if it changes, at the latest before their next order.
• If the customer provides the personal data of a third party (first name, surname, phone number), they do so only with that person’s consent, and that person is aware of the procedures, rights and obligations set out on this page.
• As a client and data subject, you have the right, to the extent laid down, to decide how your personal data is handled. You can exercise your rights in person at the controller’s registered office, by phone, or in writing by post or e-mail.

We will reply as soon as possible, and always no later than 30 days from receiving your request. The GDPR and the Personal Data Protection Act guarantee you in particular the following rights:

Right of access. You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to obtain a copy of it and further information under Art. 15 GDPR and Section 21 of the Personal Data Protection Act. If we process a large amount of data about you, we may ask you to specify your request.

Right to rectification. So that we only process up-to-date data, please let us know of any change as soon as possible. If we process inaccurate data about you, you have the right to have it rectified.

Right to erasure. If the conditions of Art. 17 GDPR and Section 23 of the Personal Data Protection Act are met, you can request the erasure of your personal data, for example if you have withdrawn your consent and there is no other legal basis for the processing, if we process the data unlawfully, or if the purpose for which we processed it no longer applies. We will not erase the data if it is needed for the establishment, exercise or defence of legal claims.

Right to restriction of processing. If the conditions of Art. 18 GDPR and Section 24 of the Personal Data Protection Act are met, you can request restriction of processing, for example while you contest the accuracy of the data, or if the processing is unlawful and you want only its restriction instead of erasure. We continue to process the data if it is needed for the establishment, exercise or defence of legal claims.

Right to data portability. If the processing is based on consent or on the performance of a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a commonly used machine-readable format. If you request it and it is technically feasible, we will transmit it directly to another controller. This right does not apply to processing carried out in the public interest or in the exercise of official authority.

Right to object. If we process personal data in the performance of a task carried out in the public interest, in the exercise of official authority or on the basis of legitimate interest, you have the right to object to the processing. Following an objection, we restrict the processing, and unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims, we no longer process the data and erase it. You can object at any time to processing for direct marketing purposes, including profiling; following an objection we no longer process the data for that purpose.

Right to lodge a complaint. If you believe that the processing of your personal data infringes the GDPR or the Personal Data Protection Act, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. In Slovakia, the supervisory authority is the Office for Personal Data Protection of the Slovak Republic (contact details below).

Right to withdraw consent. If the processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the processing carried out before it. If you later wish to receive our offers again, you can give your consent again through any of the contacts listed.

10. Office for Personal Data Protection

Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
Hraničná 12, 820 07 Bratislava 27
Company ID (IČO): 36 064 220

• filing office: Monday – Thursday 8:00 – 15:00, Friday 8:00 – 14:00,
• telephone consultations: Tuesday and Thursday 8:00 – 12:00, +421 2 323 132 20,
• e-mail: statny.dozor@pdp.gov.sk,
• website: dataprotection.gov.sk.

A template for a petition to initiate personal data protection proceedings is available on the Office’s website.

11. Cookies

Which cookies the website stores and why is described on the Cookies page.