The processing of your personal data is very important for our company and one of the main priorities of our company is to adhere to the principles of personal data protection. In this context, through our website, we fulfill our information obligation towards the persons concerned pursuant to Art. 13 and Art. 14 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC (General Data Protection Regulation) (hereinafter "GDPR Regulation“), On the processing of your personal data, what rights you have in this regard and how you can exercise them.
JOINT OPERATORS
The joint operators of your personal data are the companies Edenred Slovakia, sro, with its registered office at Karadžičova 8, POBOX 21, 820 15 Bratislava 215, ID number: 31 328 695, a company registered in the Commercial Register of the District Court Bratislava I, section Sro, file no. 3169 / B (hereinafter referred to asEdenred Slovakia“) And Ticket Service, sro, with its registered office at Karadžičova 8, 820 15 Bratislava, Company Identification Number: 52 005 551, a company registered in the Commercial Register of the District Court of Bratislava I, Section Sro, File no. 132404 / B (hereinafter referred to asTicket Service(Edenred Slovakia and Ticket Service, hereinafter referred to asoperator"Or"Edenred").
CONTACTING THE OPERATOR
The Operator has designated a responsible person for the supervision of personal data protection due to better transparency towards you as the persons concerned. The responsible person can be contacted by e-mail at the following e-mail address: GDPR.slovakia@edenred.com or by filling in the following form: Request from the person concerned.
Both companies, as joint operators, are responsible for exercising your rights as a data subject, so that the data subject's request can be addressed to either of these companies.
PROFILING AND AUTOMATED DECISION - MAKING
When processing your personal data, there is no profiling or automated decision-making about your rights and freedoms.
RIGHTS OF THE PERSONS CONCERNED
As a data subject, you have, among other things, the right to request access to your personal data from us (Article 15 of the GDPR Regulation), the right to correct incorrect personal data (Article 16 of the GDPR Regulation), the right to delete personal data (the right to (Article 17 of the GDPR Regulation), in cases provided by law, the right to restrict the processing of personal data (on the basis of which the controller data portability (Article 18 of the GDPR Regulation), the right to withdraw consent to processing (if the legal basis for processing is the consent of the data subject), the right to complain to the supervisory authority regarding the processing of personal data (Office for Personal Data Protection, https://dataprotection.gov. sk), resp. file a motion to initiate proceedings with regard to your personal data protection rights, e.g. in case of violation of your rights as an affected person by the operator.
For the purposes of processing below, where the legal basis of processing is a legitimate interest, you as the data subject have the right to object to the processing of personal data processed in this way and we assure you that the Operator has assessed the legitimacy of his interest in a written balance test, which is part of the system setup documentation. protection of the personal data of the operator.
EDENRED SLOVAKIA AND TICKET SERVICE AS A BENEFICIARY
The processing of personal data of clients' employees is based on the agreement of the client's employee as the affected person with his / her employer on the provision of the benefit, within which the employer has undertaken to provide the benefit. If the employee as an affected person has expressed an interest in the benefit, personal data is processed for the purpose of providing this benefit in connection with the provided benefit, ie the employee's personal data is transferred to another recipient, service provider, ie Edenred, to whom the benefit is provided. By default, personal data is sold to us in the range of the name and surname of our client's employee, the employee's e-mail address and data related to the duration of the employment relationship.
PURPOSES OF PERSONAL DATA PROCESSING
The information referred to in the paragraphs above relates to all purposes for which the controller processes personal data. In the following paragraphs, the controller provides the information to be provided when collecting personal data from the data subject, relating to specific processing purposes (information systems) at the controller, for which it is not possible to fulfill the information obligation together for all personal data systems but information differ according to specific information systems (purposes of processing) of personal data.
Edenred Slovakia and Ticket Service have jointly determined the following purposes and means of processing personal data of users of Edenred Group products and services:
Provision of Edenred Group products and services
The purpose is the provision of Edenred Group products and services to users (client employees).
Legal basis of processing the interest of the operator, or the performance of the contract with the client, and / or the performance of the contract with the person concerned (conditions of use of the card that you have accepted) is justified. The controller has a legitimate interest in processing personal data in connection with its business activities, as the processing is necessary for the operation of the operator's products and services.
Recipients of personal data are suppliers of related software solutions, suppliers of server solutions, suppliers of courier and postal services, service companies and the parent company.
In the event that in legal relations the operator receives personal data of the persons concerned from another operator in connection with the establishment, resp. by providing services to the data subject, the operator processes common personal data such as name, surname, personal number of the employee, email address and data or employment of the data subject to whom the benefit is to be provided still lasts.
When processing user transaction data there is a cross-border transfer of data to the supplier PrePay Technologies Ltd. - issuer of food cards and supplier of software solution for processing transactions and related operations - the company is part of the Edenred group, cross-border transfer to the UK, adequate guarantees in the form of a European Commission decision on the adequacy of data protection in the UK and standard contractual clauses.
Retention period is 10 years since the user's last financial transaction. The initial source of data is the operator's clients and then the source is the users themselves.
Provision of personal data is not a legal requirement. The provision of personal data by the client (user 's employer) is a contractual requirement of the operator, as the data are necessary for the operation of the operator' s software solutions. The provision of personal data is also a necessary requirement for the conclusion of a contract between the operator and the user's employer. If personal data is not provided, the operator will not be able to provide services to the client.
Providing support for Edenred Group products and services
The purpose is providing support for Edenred products and services to users, clients and partners.
Legal basis of processing the interest of the operator (in the case of clients and partners of natural persons) or the fulfillment of the contract with the person concerned (conditions of use of the card that you have accepted) is justified. The controller has a legitimate interest in processing personal data in connection with its business activities, as the processing is necessary for the provision of the operator's support services.
Recipients are suppliers of related software solutions, server solutions and parent company.
When processing user transaction data there is a cross-border transfer of data to the supplier PrePay Technologies Ltd. - supplier of software solution for transaction processing and related operations - the company is part of the Edenred group, cross-border transfer to the UK, adequate guarantees in the form of a European Commission decision on the adequacy of data protection in the UK and standard contractual clauses. At the same time, there is a cross-border transfer of data to Salesforce.com, Inc. Reasonable transfer guarantees are standard contractual clauses.
Retention period is 10 years after the relevant requirement has been resolved.
Provision of personal data it is neither a legal requirement nor a contractual requirement nor a requirement necessary for the conclusion of a contract between the operator and the person concerned. If personal data is not provided, the controller will not be able to provide support for the services and products of the data subject.
Processing of clients' personal data
The purpose is the processing of personal data of clients' representatives who are legal entities and clients who are natural persons for Edenred products and services.
Legal basis of processing is the fulfillment of the contract with the client and the fulfillment of the contract with the affected person (in the case of clients of natural persons).
When processing client data there is a cross-border transfer of data to Salesforce.com, Inc. Reasonable transfer guarantees are standard contractual clauses.
Retention period is 10 years after the termination of the contract with the client.
Provision of personal data is not a legal requirement, the provision of data is a contractual requirement and a requirement necessary for the conclusion of a contract with the operator. If personal data is not provided, the operator will not be able to enter into a contract with the client, as he will not be able to identify him.
Processing of personal data of partners
The purpose is the processing of personal data of representatives of partners who are legal entities and partners who are natural persons for Edenred products and services.
Legal basis of processing the interest of the operator and the performance of the contract with the person concerned (in the case of partners of natural persons) is justified. The controller has a legitimate interest in processing personal data in connection with its business activities, as the processing is necessary for the operation of the operator's products and services.
Recipients of data are suppliers of related software solutions, server solution vendors and parent company.
When processing user transaction data there is a cross-border transfer of data to the supplier PrePay Technologies Ltd. - supplier of software solution for transaction processing and related operations - the company is part of the Edenred group, cross-border transfer to the UK, adequate guarantees in the form of a European Commission decision on the adequacy of data protection in the UK and standard contractual clauses. At the same time, there is a cross-border transfer of data to the Salesforce.com, Inc. contract registration software solution provider. Reasonable transfer guarantees are standard contractual clauses. At the same time, there is a cross-border transfer to the JIRA software solution provider while handling support requests - Atlassian, Inc. based in the USA. Reasonable transfer guarantees are standard contractual clauses.
Retention period is 10 years after the termination of the contract with the partner.
Provision of personal data is not a legal requirement, the provision of data is a contractual requirement and a requirement necessary for the conclusion of a contract with the operator. If personal data are not provided, the operator will not be able to conclude a contract with a partner, as he will not be able to identify him.
Processing of personal data of suppliers
The purpose is the processing of personal data of suppliers of natural persons and contact persons of suppliers who are legal entities.
Legal basis of processing the interest of the operator is legitimate. The controller has a legitimate interest in processing personal data for that purpose, as this is processing inextricably linked to the conduct of business.
Recipients of data is a supplier of archiving services.
During processing there is no cross-border transmission personal data.
Retention period is 10 years from the end of the contract.
Provision of personal data is not a legal requirement, the provision of data is a contractual requirement and a requirement necessary for the conclusion of a contract with the operator. If personal data is not provided, the operator will not be able to identify the supplier and properly archive the accounting records.
Participation in tenders and public procurement
The purpose is the processing of personal data for the purpose of competition and the implementation of public procurement contracts, including data on the references of the operator.
Legal basis of processing the interest of the operator and the consent of the person concerned (in the case of references) are justified. The controller has a legitimate interest in processing personal data in connection with its business activities, as the processing is necessary for participation in public procurement.
Recipients of data are supervisory authorities and contracting authorities.
During processing there is no cross-border data transfer.
Retention period is 10 years after the termination of the competition contract.
Provision of personal data to the contracting authority is a legal requirement, a contractual requirement and a requirement necessary for the conclusion of the contract between the operator and the contracting authority. If personal data are not provided, the controller will not be able to participate in the public procurement.
Legal agenda
The purpose is the processing of personal data related to the legal agenda of the operator, which may include, in particular, the agenda related to contracts, litigation agenda, communication with public authorities, the agenda related to personal data protection, anti-social activities and registration matters.
Legal basis of processing the interests of the operator and the fulfillment of the legal obligations of the operator under the relevant legal regulations are justified. The controller has a legitimate interest in processing personal data in connection with its business activities, as the processing is necessary to exercise the rights and defend the rights and protected interests of the controller.
Recipients of data are suppliers of related software solutions, legal service providers, public authorities and the parent company.
During processing there is no cross-border data transfer.
Retention period is 10 years after the termination of the contract, judicial, administrative or other proceedings.
Provision of personal data is not a legal requirement, the provision of data is not a contractual requirement or a requirement necessary for the conclusion of a contract with the operator. If personal data are not provided, the controller will not be able to identify the data subjects for the purposes of the controller's legal agenda.
Accounting, tax matters and financial controlling
The purpose is the processing of personal data related to the legal obligation of the operator to keep accounts, file tax returns and the processing of personal data related to the control of financial transactions of partners and users.
Legal basis of processing the interest of the operator and the fulfillment of legal obligations under the relevant legal regulations are justified. The controller has a legitimate interest in processing personal data in connection with its business activities, as the processing is necessary to demonstrate the proper accounting of individual user transactions.
Recipients of data are suppliers of related software solutions, supplier of archiving services, supplier of payroll accounting services, suppliers of advisory and consulting services, auditors, public authorities and the parent company.
When processing user transaction data there is a cross-border transfer of data to the supplier PrePay Technologies Ltd. - supplier of software solution for transaction processing and related operations - the company is part of the Edenred group, cross-border transfer to the UK, adequate guarantees in the form of a European Commission decision on the adequacy of data protection in the UK and standard contractual clauses.
Retention period is 10 years after the relevant transaction or after the creation or maturity of the accounting record.
Provision of personal data for accounting and tax purposes is a legal requirement, the provision of data is not a contractual requirement or a requirement necessary for concluding a contract with the operator. If personal data are not provided, the controller will not be able to properly fulfill its legal obligations.
Human resources
In addition to the processing of personal data of employees for whom the information obligation is fulfilled individually, the operator as an employer also processes data of other persons related to the fulfillment of the operator's obligations as an employer or whose data the operator encounters in fulfilling its goals in building an employee team. For the stated purposes In addition to employee data, the operator also processes data on family members of employees and other persons, such as employees' contact persons in case of emergency (emergency contacts) or participants in events or competitions organized by the operator.
Legal basis of processing the interest of the operator is legitimate. The operator has a legitimate interest in that processing, as this is important for building a quality staff team and important for ensuring the continuity of the operator's activities.
Recipients of data they are public administration bodies, insurance companies, pension funds, the statistical office, suppliers of software solutions for employee social networks and suppliers of software solutions for competitions and attendance marking.
When processing data related to competitions and events, cross-border transmission takes place personal data to the United States, where the provider of the employee social networking software solution and the supplier of the competition and event attendance software solution are located. Reasonable transfer guarantees are standard contractual clauses.
Retention period it varies according to the individual purposes of processing. In the case of competitions, the data are stored within 1 month after the evaluation of the competition. In the case of data published on the operator's social network, the data are stored for 2 years, other data are stored for 1 year. The employee's emergency contact data is kept for the duration of the employee's employment.
Provision of personal data on family members is a legal requirement in the case of the use of data for tax benefits, in other cases the provision of data is not a legal requirement, a contractual requirement or a requirement necessary for concluding a contract with the operator. If personal data are not provided, the controller will not be able to fulfill the specific processing purpose it pursues (eg family members will not be able to participate in the controller's competitions and events).
Processing of personal data of job seekers
The purpose is the processing of personal data of job seekers.
Legal basis of processing is pre-contractual processing with the data subject and, in some cases, the consent of the data subject.
Recipients of data are suppliers of recruitment and selection services and a supplier of software solutions for the registration of group employees.
During processing cross-border transmission takes place to the US when using the employee registration software solution to the supplier of that solution. Reasonable transfer guarantees are standard contractual clauses.
Retention period in the case of unsuccessful applicants, 2 years from the last job application.
Provision of personal data is not a legal requirement, the provision of data is not a contractual requirement. The provision of data is a necessary requirement for concluding a contract with the operator. If personal data are not provided, the operator will not be able to assess the suitability of the job seeker.
Edenred Group
The purpose is the processing of personal data about shareholders, members of the company's bodies and employees of other Edenred Group companies for the purpose of exchanging information necessary for the operation of the Group.
Legal basis of processing the interest of the operator is legitimate. The legitimacy of the operator's interest in processing personal data for this purpose follows directly from the recitals of the GDPR Regulation.
Recipients of data are other Edenred Group companies and suppliers of the Group's employee registration software solution.
During processing cross-border transmission takes place personal data to the countries where the individual companies that are part of the Edenred Group are located. At the same time, there is a cross-border transfer to the USA when using a software solution for employee registration to the supplier of the said solution. Reasonable transfer guarantees are standard contractual clauses.
Retention period is 10 years after the termination of employment with an employee of the group.
Provision of personal data is not a legal requirement, the provision of data is a contractual requirement and a requirement necessary for the conclusion of a contract with the operator. If personal data is not provided, the operator will not be able to efficiently exchange the data necessary for the operation of the group between the individual companies of the group.
Marketing
The purpose is the processing of personal data for the purposes of marketing the activities of the operator. Marketing communications may be aimed at users of Edenred products and services, clients, partners or the general public, through competitions, marketing surveys, acquisition activities, public opinion building or through marketing communications.
Legal basis of processing the interest of the operator is justified and in some cases the consent of the person concerned. The controller has a legitimate interest in processing personal data in connection with its business activities, as the processing is important for the further development of the operator's business activities. The recipients of the data are the suppliers of related software solutions, the suppliers of server solutions, the call center, the social network operators on which the operator has created an account, the survey suppliers, the suppliers of contact details of potential customers and the supplier of technical support for marketing activities via social networks.
When processing data cross-border transmission takes place data to social network operators - Facebook Ireland Ltd., LinkedIn Ireland Unlimited and a survey software provider - Alchemer, LLC. In cooperation with these companies, there is a cross-border transfer of data to the USA. Reasonable transfer guarantees are standard contractual clauses.
Retention period in the case of marketing communication 5 years after sending the marketing e-mail, in the case of competitions to the evaluation of a specific competition, in the case of surveys within 1 year of the survey, in the case of acquisition activities to find out the recommended person's interest in the operator's services and products through social networks, data is stored according to the settings of a specific social network.
Provision of personal data for marketing purposes, it is neither a legal requirement nor a contractual requirement nor a requirement necessary for the conclusion of a contract with the operator. If personal data is not provided, the operator will not use the data for its marketing activities.
In the case of marketing communication carried out on a legal basis of legitimate interest the data subjects may object to the processing, by sending an e-mail to: GDPR.slovakia@edenred.com. The persons concerned are also informed about the right to object when sending each marketing e-mail by unsubscribing from the newsletter.
In the case of marketing communication carried out on the legal basis of the consent of the data subject person's consent can be revoked at any time either by changing the settings in the applications or by sending an e-mail to: GDPR.slovakia@edenred.com.
Software solutions testing and reporting
The purpose is the processing of personal data when testing software solutions when deploying a new solution or when changing an existing solution and the production of group (bulk data) reports on transactions with partners.
Legal basis of processing the interest of the operator is legitimate. The Operator has a legitimate interest in processing personal data in connection with its business activities, as the processing is important for analyzing the operation of the Operator's software solutions.
Recipients of data are suppliers of related software solutions, server solution provider and parent company.
When dealing with support requirements there is a cross-border transfer of data, since JIRA software from Atlassian, Inc. is used. based in the USA. Reasonable transfer guarantees are standard contractual clauses.
Retention period is 10 years after the end of the activity of the relevant virtual card.
Provision of personal data is not a legal requirement, the provision of data is not a contractual requirement or a requirement necessary for the conclusion of a contract with the operator. If personal data is not provided, the operator will not be able to properly analyze the operation of its software solutions.
Public relations
The purpose is the processing of personal data for the purposes of monitoring the legislative status of the operator and the legislative development of the position of the operator, public opinion polls and representation of the operator in a public forum.
Legal basis of processing the interest of the operator is legitimate. The controller has a legitimate interest in processing personal data for that purpose, as the processing is important for the further direction of the operator's business.
Recipients of data is a supplier of opinion polls.
During processing there is no cross-border transmission personal data.
Retention period opinion polls is 1 year after the survey.
Provision of personal data is not a legal requirement, the provision of data is not a contractual requirement or a requirement necessary for the conclusion of a contract with the operator. If personal data is not provided, the operator will not be able to properly forecast the direction of its further business activities.
Cameras
The purpose is the processing of personal data for the purposes of object security and for the purposes of protection of the operator's property.
Legal basis of processing the interest of the operator is legitimate. The controller has a legitimate interest in processing personal data for the stated purpose, as it has a legitimate interest in the protection of its premises and its property.
Recipients of data are law enforcement and labor inspection authorities.
During processing there is no cross-border transmission personal data.
O storage period informs the operator in the first layer of information - on alerts around the monitored area.
Provision of personal data is not a legal requirement, the provision of data on the work of employees with securities is a contractual requirement and a requirement necessary for concluding a contract with the operator. If personal data is not provided, the controller will not be able to properly protect its property.
Registry management
The purpose is the processing of personal data for archiving purposes after the end of the primary purpose of the processing.
Legal basis of processing the interest of the operator and the fulfillment of the legal obligation of the operator is justified. The controller has a legitimate interest in processing personal data for that purpose, as it has a legitimate interest in keeping the records it may need for its business, even if the record period does not specify a retention period for those records.
Recipients of data are public authorities and a supplier of archiving services.
During processing there is no cross-border transmission personal data.
Retention period is different, according to the primary purpose of the processing and according to the specific registry record.
Provision of personal data for the purposes of archiving and registration is a legal requirement, the provision of data is not a contractual requirement or a requirement necessary for concluding a contract with the operator. If personal data are not provided, the operator will not be able to fulfill its legal obligation to keep a registry and archive registry records.
Correspondence
The purpose processing is the processing of personal data of the data subjects in requested and unsolicited correspondence before their assignment to the relevant information system.
Legal basis of processing the interest of the operator is legitimate.
The controller has a legitimate interest in processing personal data for that purpose, as this is processing inextricably linked to the conduct of business.
Recipients data providers are postal, courier and archival service providers.
During processing there is no cross-border transmission personal data.
Retention period requested communication is 10 years, unsolicited communication is not stored.
Provision of personal data it is not a legal requirement, a contractual requirement or a requirement necessary for the conclusion of a contract with the operator. If personal data is not provided, the operator will not be able to identify the sender of the shipment.
Insurance events
The purpose is the processing of personal data in handling claims.
Legal basis of processing the interest of the operator is legitimate. The controller has a legitimate interest in processing personal data for the stated purpose, as this is the processing necessary to settle the insured event.
Recipients data are the relevant insurance companies and the supplier of archiving services.
During processing there is no cross-border transmission personal data.
Retention period is 11 years from the occurrence of the insured event.
Provision of personal data for the liquidation of the insured event is a legal requirement, the provision of data is not a contractual requirement or a requirement necessary for concluding a contract with the operator. In the event that personal data is not provided, the operator will not be able to resolve the insured event.
Charity events
The purpose is the processing of personal data related to the charitable actions of the operator.
Legal basis of processing the interest of the operator is legitimate.
The controller has a legitimate interest in processing personal data for that purpose, as this is the processing of personal data for the benefit of the data subject.
Recipients of data are the supplier of the social network operator, the supplier of the software solution for voting related to the charity and the parent company.
During processing cross-border transmission takes place to the US social network vendor and software solution vendor for charitable voting. Reasonable transfer guarantees are standard contractual clauses.
Retention period is 1 month after the provision of the charitable benefit and in the case of publishing the data on the operator's social network 2 years.
Provision of personal data is not a legal requirement, the provision of data is not a contractual requirement, nor a requirement necessary for the conclusion of a contract with the operator. If personal data are not provided, the operator will not be able to publish data related to the charity on its social network.
The Operator has taken appropriate security measures to ensure the security of personal data processed in all the above information systems and has documented these security measures in the company's security project.
