GDPR

Information on the processing of personal data

Processing of personal data of persons participating in the tour. CK informs the persons mentioned in the contract for the tour (hereinafter also referred to as “data subject” in the appropriate grammatical form) that, in accordance with Act 18/2018 Coll. on the protection of personal data (hereinafter also referred to as the Act) processes personal data for the purpose of fulfilling the contract on the procurement of the tour and the contractual obligations arising from the contract on the procurement of the tour. For the processing of personal data provided in connection with the performance of the tour contract, the CK is not obliged to require special consent. In the event of failure to provide the requested personal data, it is not possible to ensure the fulfilment of the contractual obligations of the CK under the tour contract. The CK processes the personal data of the data subjects to the extent to which they have been provided and recorded in the tour contract, namely: name, surname, title, date of birth, permanent address or contact address, travel document details (place and date of issue, date of validity), nationality, email address, telephone number, details of specific requirements (per diems, assistance). Personal data is kept by the CK for an indefinite period of time for archiving purposes, marketing (sending offer catalogues for the new season), for the purpose of keeping its own records. The data subject has the right to object to the processing of personal data concerning him or her for the purpose of direct marketing, including profiling to the extent that it is related to direct marketing. If the data subject objects to the processing of personal data for the purpose of direct marketing, the CK may no longer process the personal data for the purpose of direct marketing. The data subject shall have the right to object to processing of his or her personal data on grounds relating to his or her particular situation carried out pursuant to Article 13(1)(e) (processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) or (f) (processing of personal data is necessary for the purpose of the legitimate interests of the controller or of a third party, except where those interests are overridden by the interests or rights of the controller or of a third party, or where the processing of personal data is necessary for the purpose of the processing of personal data for the purposes of the processing of personal data for the purposes of the processing of personal data for the purposes of the processing of personal data for the purposes of the processing of personal data

of the data subject requiring the protection of personal data, in particular where the data subject is a child; this legal basis shall not apply to the processing of personal data by public authorities in the performance of their duties.) Act No 18/2018 Coll. including profiling based on these provisions. The CK may no longer process personal data unless it demonstrates compelling legitimate interests for the processing of personal data which override the rights or interests of the data subject or grounds for exercising a legal claim. In relation to the use of information society services, the data subject may exercise his or her right to object by automated means using technical specifications. The data subject shall have the right to object to the processing of personal data concerning him or her on grounds relating to his or her particular situation, except where the processing of personal data is necessary for the performance of a task for reasons of public interest, where the personal data are processed for scientific purposes, for historical research purposes or for statistical purposes pursuant to Article 78(8) of Act No. 18/2018 Coll. The CK hereby informs the data subjects that their personal data is transferred to a third country (the destination specified in the contract for the tour, as well as to the carriers providing transport to and from the destination). Such transfer is necessary for the performance of the travel contract between the data subject and the CK and for the performance of pre-contractual measures. Rights of the persons participating in the tour in relation to the processing of their personal data. Each data subject has the right to obtain confirmation from the CK as to whether personal data concerning him/her are being processed. Where such personal data are processed by the CK, the data subject shall have the right to obtain access to such personal data and information on; the purpose of the processing of the personal data; the category of personal data processed; the identification of the recipient or the category of recipient to whom the personal data have been or are to be disclosed, in particular a recipient in a third country or an international organisation, where applicable; the period of retention of the personal data; if this is not possible, information on the criteria for its determination; the right to request from the CK the rectification, erasure or restriction of the processing of personal data relating to the data subject, or the right to object to the processing of personal data; the right to bring an action for the protection of personal data (pursuant to Article 100 of Act No. 18/2018 Coll.); the source of the personal data, if

personal data have not been obtained from the data subject; the existence of automated individual decision-making, including profiling pursuant to Article 28(1) and (4) of Act No. 18/2018 Coll.; in these cases, the CK shall provide the data subject with information, in particular, on the procedure used, as well as on the significance and the expected consequences of such processing of personal data for the data subject. The data subject has the right to be informed by the CK of the appropriate safeguards concerning the transfer of his/her personal data to a third country or an international organisation. The CK is obliged to provide the data subject with the personal data it processes. For the repeated provision of personal data requested by the data subject, the CC may charge a reasonable fee corresponding to the administrative costs. The CK is obliged to provide the personal data to the data subject in the manner requested by the data subject. The data subject shall have the right to have inaccurate personal data concerning him or her rectified by the CK without undue delay. With regard to the purpose of the processing of personal data, the data subject shall have the right to have incomplete personal data completed. The data subject shall have the right to have personal data concerning him or her erased by the CK without undue delay. The CK is obliged to delete the personal data without undue delay if the data subject has exercised the right to deletion pursuant to the preceding sentence, if the conditions for such deletion pursuant to Sections 23(2) and (4) of Act No. 18/2018 Coll. are also fulfilled. The data subject shall have the right to have the CK restrict the processing of personal data if a) the data subject objects to the accuracy of the personal data during the period allowing the CK to verify the accuracy of the personal data, b) the processing of the personal data is unlawful and the data subject objects to the erasure of the personal data and requests instead the restriction of their use, c) the CK no longer needs the personal data for the purpose of the processing of the personal data, but the data subject needs them for the exercise of a legal claim, or d) the data subject objects to the processing of the personal data pursuant to Section 27, Paragraph 1, Article 2, of the Act on the processing of personal data. 18/2018 Coll. until it is verified whether the legitimate grounds on the part of the CK outweigh the legitimate grounds of the data subject.

If the processing of personal data has been restricted pursuant to the preceding paragraph, in addition to storage, the CK may only process the personal data with the consent of the data subject or for the purpose of exercising a legal claim, for the protection of persons or for reasons of public interest. The data subject whose processing of personal data is restricted in this way must be informed by the CK before the restriction on the processing of personal data is lifted. The data subject has the right to obtain the personal data concerning him or her provided by the CK in a structured, commonly used and machine-readable format and has the right to transfer these personal data to another controller (the CK) if this is technically feasible and if the personal data are processed pursuant to Section 13(1)(a), Section 16(2)(a) or Section 13(1)(b) of Act No. 18/2018 Coll. and the processing of personal data is carried out by automated means. The data subject shall have the right not to be subject to a decision which is based solely on automated processing of personal data, including profiling, and which has legal effects concerning him or her or similarly significantly affects him or her. The preceding sentence shall not apply if (a) the decision is necessary for the conclusion of a contract or the performance of a contract between the data subject and the CC, (b) made on the basis of a special regulation or an international treaty to which the Slovak Republic is bound and which also provides for appropriate measures guaranteeing the protection of the data subject’s rights and legitimate interests, or (c) based on the data subject’s explicit consent. The CK is obliged to notify the data subject without undue delay of a personal data breach if such personal data breach may lead to a high risk to the rights of the natural person. The notification under the preceding sentence must include a clear and plainly worded description of the nature of the personal data breach and information on the contact details of the responsible person or other point of contact where more information can be obtained; a description of the likely consequences of the personal data breach; a description of the measures taken or proposed by the CC to remedy the personal data breach, including, where necessary, measures to mitigate its potential adverse effects.

The CK is not obliged to make the notification according to the previous paragraph if, (a) the CK has taken appropriate technical and organisational protection measures and applied them to the personal data to which the personal data breach relates, in particular encryption or other measures which render the personal data unreadable to persons who are not authorised to have access to it, (b) CK has taken subsequent measures to ensure a high risk of violation of the rights of the data subject (c) it would require disproportionate effort; the CC shall inform the public or take other action to ensure that the person concerned is informed in an equally effective manner. The data subject shall have the right to withdraw consent to the processing of personal data concerning him or her (if he or she has given such consent) at any time. Withdrawal of consent shall not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal; the data subject shall be informed of this fact before consent is given. The data subject may withdraw consent in the same way as he or she gave consent. In cases where another person (family member, legal representative, authorised person, etc.) has concluded the contract on behalf of other passengers, the travel agency is obliged to provide the data subject with information on the source of the personal data or on whether it comes from publicly available sources. Ck is obliged to provide the data subject with information on the measures taken on the basis of his/her request pursuant to points 1. to 10. the preceding paragraphs within one month of receipt of the request. In justified cases, taking into account the complexity and the number of applications, the CK may extend this period by another two months, even repeatedly. The CK is obliged to inform the person concerned of any such extension within one month of receipt of the request, together with the reasons for the extension. If the data subject has submitted a request in electronic form, the CK shall provide the information in electronic form, unless the data subject has requested the information to be provided in another way. Identification data of the CK as the controller of the personal data information system Ponte Tour, s.r.o. Toplianska 2, 82107, Bratislava

ID: 48053589
Registered: OR OS Bratislava I, od. SRO insert no.: 102934/B
Contact details of the responsible person
Under the law, it is not obligatory for the CK to have a designated person.
The recipient of your personal data is
Ponte Tour, s.r.o.
Toplianska 2, 82107, Bratislava
ID No.: 48053589
Registered: OR OS Bratislava I, od. SRO insert no.: 102934/B