1. Data controller:
The data controller, i.e. the entity that processes the personal data of data subjects, is BioWell s.r.o., with registered office at Pavla Horova 28, Bratislava 841 07, company ID: 46451099 (hereinafter referred to as “Controller”).
We value the privacy of all individuals and respect their right to data protection. In the processing of personal data, the Controller proceeds in accordance with Act No. 18/2018 Coll. on personal data protection, as amended, and with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (hereinafter referred to as “Act”).
In connection with our activities, we process personal data for various purposes. In most cases, personal data processing is required by a special regulation or an international treaty by which the Slovak Republic is bound.
The Controller processes personal data only on lawful legal grounds: – the performance of a contract or pre-contractual arrangements; – the performance of our legal obligation under a special regulation; – the performance of a task in the public interest; – the pursuit of our legitimate interests, unless these interests are
overridden by the legitimate interests of the data subject; – where necessary to protect the life, health or property of the data subject or other natural person. In other cases, we process data subjects’ personal data only with the consent of the data subject, which the data subject may withdraw at any time.
2. Purposes and legal basis for personal data processing:
If a contractual relationship exists between the data subject and the Controller, the Controller processes the personal data of data subjects on the legal basis of the contract, only to the extent necessary for the fulfilment of the purposes of the contract.
For the purpose of resolving complaints, dealing with deficiencies and surveys, the Controller processes the personal data of data subjects on the legal basis of legitimate interest or consent of the data subject, which only include name, surname, address, email and telephone number, the processing of which is necessary to achieve the above.
If the data subject voluntarily discloses his/her personal data to the Data Controller without any prior action by the Data Controller, the personal data shall be processed by the Data Controller to the extent necessary on the legal basis of legitimate interest (mainly for the purpose of reviewing the data subject’s request and providing a response to the data subject).
BioWell s.r.o. processes personal data for the following purposes:
• invoicing for services supplied;
• sending email offers for products of BioWell s.r.o.
BioWell s.r.o. shall not provide personal data to third parties, except: – Lemesta s.r.o. , Dunajská 8, Bratislava 81108
Provision of human resources and accounting services
Some competitions may take the form of data sharing, mainly comments, through the social media profiles of data subjects (e.g. the data subject’s response to the Controller’s fun page through his/her Facebook or Instagram profile). In this case, the Controller, for the purpose of the data subject’s participation in the competition or the announcement/publication of the winner of the competition (on the Controller’s profile page on the social media platform) and contacting him/her in order to deliver the prize (through direct messages on the social media platform), shall process personal data which mainly include their user name. The legal basis for the personal data processing is the data subject’s consent in the form of voluntary participation in the competition. In order to deliver the prize to the winners, the Controller may also process other personal data, i.e. name, surname and home address, which are necessary to achieve the purpose of delivering the prize, on the legal basis of the data subject’s consent. The data subject may withdraw the consent at any time using the addresses stated below. The Controller shall process these personal data for the period necessary to achieve the purpose of the competition or until the data subject’s consent is withdrawn. After the consent is withdrawn, the Controller shall no longer processpersonal data for the purpose to which the withdrawal of consent relates. However,the Controller may continue to process the personal data of the data subject to a limited extent on the legal basis of legitimate interest even after the withdrawal of consent, for the period necessary to demonstrate the lawfulness of the personal data processing, to exercise legal claims or to comply with obligations arising from generally binding legal regulations (typically for 3 years from the withdrawal of consent to personal data processing).
3. Personal data retention period:
All personal data shall be processed only to the extent necessary for the fulfilment of the purposes set out in Clause 2 of this Policy and only for the period necessary for the achievement of these purposes, but no longer than the period specified by or in accordance with the relevant legislation.
Personal data processed by the Controller on the legal basis of the data subject’s consent are processed until the consent is withdrawn; However, the Controller may process some of these data even after the consent is withdrawn, if it has another lawful reason to do so (e.g. for the purpose of demonstrating the correctness and lawfulness of the personal data processing or for the possibility of defending against legal claims).Personal data processed by the Controller on the legal basis of legitimate interest or personal data processed by the Controller for the purpose of direct marketing are processed until the data subject objects to the processing of his/her personal data.
4. Identification of personal data recipients:
The Controller may disclose data subjects’ personal data to third parties only if required or permitted by law or with the data subject’s consent. The Controller discloses the usual types of personal data to the following processors or other recipients:
• Suppliers of external services for the Controller (mainly programming or other technical support services, server services, sending emails, services related to measuring traffic to our site and adapting its content to user preferences);
• Operators of backup servers or operators of technologies used by the Controller who process them to ensure the functioning of the relevant services of the Controller;
• To the extent strictly necessary for the Controller’s legal, financial and tax consultants and the Controller’s auditors who process them in order to provide consulting services to the Operator.
5. Rights of data subjects:
Right of access to personal data – the data subject shall have the right to obtain from the Controller, upon request, confirmation as to whether or not the data subject’s personal data are processed and, if so, to request information about the processing of personal data relating to the data subject.
The data subject shall have the right to the rectification of personal data relating to him/her with respect to the purpose of the personal data processing and to the completion of incomplete personal data. In the case of personal data processing on the legal basis of a contract or on the legal basis of the data subject’s consent, the data subject shall have the right to the portability of personal data relating to him/her provided to the Controller, in a structured, commonly used and machine-readable format, if the data subject’s personal data processing is performed using aed means and before the end of the personal data retention period. The exercise of this right shall not adversely affect the rights of other persons.
The data subject shall have the right to the erasure of personal data being processed, if:
1. personal data are processed in breach of the law; or
2. on the basis of the data subject’s withdrawal of consent (when personal data are processed on the legal basis of the data subject’s consent); or
3. the data subject objects to the processing of personal data on the legal basis of the Controller’s legitimate interest and the Controller’s legitimate grounds for the personal data processing do not prevail; or
4. the personal data are no longer necessary for the purpose for which they were collected or otherwise processed; or
5. after the end of the personal data retention period.
The right to data erasure in accordance with Clause 5(d) shall not apply if the personal data processing is necessary for the Controller:1. 2. 3. to exercise the right to freedom of expression or to exercise the right to information; to comply with the obligations under Act No. 18/2018 on personal data protection, 4. as amended (effective from 25.5.2018), or a special regulation; to exercise a legal claim; 5. for archiving, scientific, historical research or statistical purposes under Section 78(8), if the right under paragraph 1 is likely to render impossible or seriously impede the achievement of the purposes of such processing.
The right to the restriction of personal data processing, if:
1. the data subject objects to the accuracy of the personal data, during a period allowing the Controller to verify the accuracy of the personal data and, if necessary, to update the personal data;
2. the personal data processing is unlawful and the data subject objects to the
3. erasure of the personal data and requests the restriction of their use instead; the Controller no longer needs the personal data for the purpose of processing but the data subject needs them to exercise a legal claim; or
4. the data subject objects to the personal data processing in accordance with Section 27(1) of Act No. 18/2018 on personal data protection, as amended (effective from 25.5.2018), pending verification whether the legitimate grounds of the Controller override the legitimate grounds of the data subject.
Right to object to personal data processing:
The data subject shall have the right to object to the processing of personal data relating to him/her in all cases where the legal basis of personal data processing is the Controller’s legitimate interest. The data subject shall have the right to object to the processing of personal data relating to him/her, even if the personal data are processed for the purpose of direct marketing, including profiling, to the extent that it is related to direct marketing.
If the data subject suspects that personal data are processed unlawfully, he/she has the right to initiate data protection proceedings by the Office for Personal Data Protection.
If the legal ground for processing the personal data of the data subject is his/her consent, the data subject may withdraw such consent at any time free of charge using the email address stated below. Withdrawal of consent shall not affect the lawfulness of processing based on consent given prior to its withdrawal. The data subject has the right to withdraw his/her consent at any time by sending an email to balco@biowell.sk or a letter to the Controller’s address: Pavla Horova 28, Bratislava 841 07, BioWell s.r.o.