PDP – IS Travel agency VoxTravel
Personal Data Processing Information
For the information system: IS Travel agency
Information on personal data processing concerning data subjects in accordance with Section 19 and Section 20 of Act No. 18/2018 on personal data protection and on amendment and supplementation to certain acts (hereinafter only the “Act”) and Art. 13 and 14 of Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter only the “Regulation”).
The aim of this information is to inform you on what personal data we process, how we handle them, for what purpose we use them, to whom we may disclose them, where you can receive the information on your personal data and exercise you rights with regard to processing of your personal data.
Identification and contact data:
The controller of your personal data is VOX spol. s r. o., Miletičova 21, 821 08 Bratislava, company ID No. (IČO): 35 806 508, firstname.lastname@example.org.
Contact details of data protection officer responsible for supervising personal data processing:
- The purpose and lawful basis on which personal data is processed
The purpose of personal data processing is: to prepare and fulfil service contracts, maintain records of individuals in relation to the travel agency and travel tours.
Personal data are processed based on: Section 13(1)(b) of the Act.
Legitimate interests of the controller or of a third party
Processing of personal data for the purpose of legitimate interests of the controller or of a third party is not performed.
- Identification of personal data processing concerning data subjects
The data subjects whose personal data are processed include: customers/clients, travellers, natural persons in a contractual and pre-contractual relationship.
The scope of the personal data processed: academic title, name, surname, residence, telephone number, date of birth, birth registration number, ID card number, passport number, nationality, address of temporary residence, date of travel tour, destination, any and all information necessary for the contract fulfilment.
- Identification of recipients, categories of recipients
The operator can provide personal data to authorised subjects such as institutions and organisations that are authorised to process personal data according to a special regulation or by the contracting partner (mainly a data processor), that have contractually undertaken to adopt adequate guarantees to provide protection of the personal data processed as follows:
|Other authorised subject||Act of general application pursuant to Section 13(1)(c) of Act No. 18/2018 on personal data protection and on amendment and supplementation to certain facts|
|Contracting partner (based on a contract)||Section 34 of Act No. 18/2018 on personal data protection and on amendment and supplementation to certain facts|
With the data subject’s consent or based on his/her order, personal data may be disclosed to other recipients.
- Transfer of personal data to a third country / international organisation
Transfer of personal data to third countries or international organisations is not performed.
- Identification of the source from which personal data were obtained
Directly from the data subject or his/her legal representative (in person, via e-mail, telephone, the controller’s website)
From other authorised subjects proceeding in accordance with special regulations
- Personal data retention period
The controller processes personal data for a period of time as may be necessary to achieve the purpose; however no longer than 3 years.
The Controller does not process personal data by profiling or by any similar method based on automated decision-making.
- Rights of data subjects
The data subjects have the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability and to ineffectiveness of automated decision-making including profiling as well as the right to bring an action before the supervisory authority. Where the controller processes personal data based on the data subject’s consent, the data subject has the right to withdraw his/her consent to processing of personal data at any time. The consent withdrawal has no effect on the lawfulness of the personal data processing based on the consent prior to the withdrawal. The data subject may exercise his/her rights by sending an e-mail to the following address: email@example.com or in writing, to the controller’s address.
- Obligation to provide personal data
The provision of personal data is a legitimate requirement /contracting requirement or a requirement necessary for a contract to be concluded. The data subject is obliged to provide his/her personal data; otherwise the controller will not provide services to the data subject.