PDP – IS Voice records VoxTravel

Personal Data Processing Information

For the information system: IS Voice records

Information on personal data processing concerning data subjects in accordance with Section 19 and Section 20 of Act No. 18/2018 on personal data protection and on amendment and supplementation to certain acts (hereinafter only the “Act”) and Art. 13 and 14 of Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter only the “Regulation”)

The aim of this information is to inform you on what personal data we process, how we handle them, for what purpose we use them, to whom we may disclose them, where you can receive information on your personal data and exercise you rights with regard to processing of your personal data.

Identification and contact data:

The controller of your personal data is VOX spol. s r. o., Miletičova 21, 821 08 Bratislava, company ID No. (IČO): 35 806 508, gdpr@voxtravel.com.

Contact details of data protection officer responsible for supervising personal data processing:

E-mail: gdpr@voxtravel.com

  1. The purpose and lawful basis on which personal data is processed

The purpose of the processing is to record and store records of telephone communication between the controller’s employees and clients. Personal data are processed based on: Section 13(1)(a) of the Act.

Legitimate interests of the controller or of a third party

Processing of personal data for the purpose of legitimate interests of the controller or of a third party is not performed.

  1. Identification of personal data processing concerning data subjects

Data subjects whose personal data are processed include: customers/clients, natural persons.

The scope of the personal data processed: academic title, name, surname, residence, telephone number, date of birth, birth registration number, voice.

  1. Identification of recipients, categories of recipients

The operator can provide personal data to authorised subjects such as institutions and organisations that are authorised to process personal data according to a special regulation or by the contracting partner (mainly a data processor), that have contractually undertaken to adopt adequate guarantees to provide protection of the personal data processed as follows:


Other authorised subjectAct of general application pursuant to Section 13(1)(c) of Act No. 18/2018 on personal data protection and on amendment and supplementation to certain facts.
Contracting partner (based on a contract)Section 34 of Act No. 18/2018 on personal data protection and on amendment and supplementation to certain facts.


With the data subject’s consent or based on his/her order, personal data may be disclosed to other recipients.


  1. Transfer of personal data to a third country / international organisation

Transfer of personal data to third countries or international organisations is not performed.

  1. Identification of the source from which personal data were obtained

Directly from the data subject (in person, via e-mail, telephone, the controller’s website).

  1. Personal data retention period

The controller processes personal data for a period of time as may be necessary to achieve the purpose; however no longer than 2 years.

  1. Profiling

The Controller does not process personal data by profiling or by any similar method based on automated decision-making.

  1. Rights of data subjects

The data subjects have the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability and to ineffectiveness of automated decision-making including profiling as well as the right to bring an action before the supervisory authority. Where the controller processes personal data based on the data subject’s consent, the data subject has the right to withdraw his/her consent to processing of personal data at any time. The consent withdrawal has no effect on the lawfulness of the personal data processing based on the consent prior to the withdrawal. The data subject may exercise his/her rights by sending an e-mail to the following address: gdpr@voxtravel.com or in writing, to the controller’s address.

  1. Obligation to provide personal data

The data subject provides his/her personal data voluntary, based on consent (the provision is not a legitimate/contracting requirement); in case of non-provision, the data subject may use other telecommunication devices that are not recoded.