+421 911 602 443 +421 904 172 074 info@fakturkovo.sk
Shopping basket

0 items

Your basket is empty

Choose from our services and add the package that suits you.

Browse services

Privacy policy

PROTECTION OF PERSONAL DATA

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the „GDPR“) imposes on the controller the obligation to provide the data subject with all the information referred to in Articles 13 and 14 and all communications under Articles 15 to 22 and Article 34 relating to processing, in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Since personal data is also processed in connection with the provision of services through the website www.fakturkovo.sk (hereinafter the „Website“), the controller heyfox s. r. o., with its registered office at Láb 531, 900 67 Láb, registered in the Commercial Register of the District Court Nitra, Section: Sro, Insert No. 62183/N, Company ID: 55 941 001 (hereinafter the „Controller“), hereby fulfils its information obligation and, through this document, informs the data subject of the conditions under which personal data is processed. When processing personal data, the Controller proceeds in accordance with the applicable legislation, in particular the GDPR and Act No. 18/2018 Coll. on the protection of personal data and on amendments to certain acts (hereinafter the „Data Protection Act“).

1. BASIC CONCEPTS

Controller

  1. The controller is a natural or legal person who determines the purposes and means of the processing of personal data.

Data subject

  1. The data subject is any identified or identifiable natural person whose personal data is processed by the controller. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a surname, an identification number (birth number, identity card number), location data (address) or an online identifier (IP address, cookies), or by reference to one or more factors specific to their physical identity, physiological identity, genetic identity, psychological identity, mental identity, economic identity, cultural identity or social identity.
  2. For the purposes of this document, the data subject is deemed to be a natural person – a visitor to the Website, or another natural person who has provided the Controller with their personal data.

Personal data

  1. Personal data means any information relating to an identified or identifiable natural person.

Processing of personal data

  1. Processing of personal data means any operation or set of operations performed on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, whether or not by automated means.

Legal basis

  1. The controller is entitled to process personal data only where permitted by one of the following legal bases set out in the Article of the GDPR (one or more):
  2. the data subject has given consent to the processing of their personal data for one or more specific purposes,
  3. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract,
  4. processing is necessary for compliance with a legal obligation to which the controller is subject,
  5. processing is necessary in order to protect the vital interests of the data subject or of another natural person,
  6. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
  7. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Retention period for personal data

• In general, the controller retains the personal data of data subjects only for the period necessary for the relevant purpose and to the extent reasonably required to comply with any applicable legislation or as is appropriate in connection with the relevant provisions on limitation periods.

2. INFORMATION AND ACCESS TO PERSONAL DATA

Controller: heyfox s. r. o.

registered office: Láb 531, 900 67 Láb

registered: in the Commercial Register of the District Court Nitra, Section: Sro, Insert No. 62183/N

Company ID: 55 941 001

Contact details: +421 911 602 443 info@fakturkovo.sk

Purpose of processing personal data: Provision of the service, Issuing a tax document, Contacting the customer regarding the order, Performance of the contract, Asserting liability for defects, damage and other claims arising from the contract.

Legal basis for processing personal data:

  1. Article 6(1)(a) of the Regulation – the data subject has given consent to the processing of their personal data for one or more specific purposes;
  2. Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract (provision of services) to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
  3. Article 6(1)(c) of the Regulation – processing is necessary for compliance with a legal obligation to which the controller is subject (arising in particular, but not exclusively, from Act No. 40/1964 Coll., the Civil Code, Act No. 222/2004 Coll. on value added tax and Act No. 431/2002 Coll. on accounting);
  4. Article 6(1)(f) of the Regulation – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. The Controller's legitimate interest is the pursuit through the courts of its claims arising from the provision of services.

Recipients: Depending on the individual purposes of processing, the data processed by the Controller is made available to the following recipients:

  1. persons who process personal data on the direct authorisation of the Controller;
  2. processors (accountant);
  3. the managing director;
  4. public authorities which process personal data on the basis of a special regulation or an international treaty by which the Slovak Republic is bound (the Social Insurance Agency, the tax office, the Office for Personal Data Protection, the courts, law enforcement authorities and the like).

Transfer to a third country and to an international organisation: The Controller does not transfer personal data to any country outside the territory of the EU (EEA).

Retention period: We retain personal data in a form which permits identification for no longer than the period necessary to achieve the purpose for which the personal data is processed.

3. RIGHTS OF THE DATA SUBJECT

Right of access to personal data

The data subject has the right to obtain confirmation from the controller as to whether it processes personal data concerning them. If the controller processes personal data, the data subject has the right to obtain access to it and further information on the purpose of its processing, the category of personal data processed, to whom it has been or is to be disclosed, in particular a recipient in a third country or an international organisation, where possible; where personal data is transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards required by law and of the retention period of the personal data; where this is not possible, of the criteria used to determine it, of the right to request rectification of personal data, its erasure or restriction of its processing, or of the right to object to the processing of personal data, of the right to lodge a request for the initiation of proceedings on the protection of personal data, of the source of the personal data where it was not obtained from you, and of the existence of automated individual decision-making including profiling. Profiling means any form of automated processing of personal data consisting of the use of that personal data to evaluate certain personal aspects relating to a person, in particular aspects concerning performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. In such cases the controller shall provide the data subject with information in particular on the procedure applied and on the significance and the envisaged consequences of such processing of personal data for the data subject. The controller is obliged to provide the personal data it processes. For a repeated provision of personal data, the controller may charge a reasonable fee corresponding to administrative costs. The controller is obliged to provide you with personal data in the manner you request. The right to obtain personal data must not adversely affect the rights of other natural persons.

Right to rectification

The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning them. Depending on the purpose of processing, they have the right to have incomplete personal data completed.

Right to object to the processing of personal data

The data subject has the right to object to the processing of their personal data on grounds relating to their particular situation, where the controller carries out profiling or processes personal data on the following legal bases:

  1. the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
  2. the processing of personal data is necessary for the purposes of the legitimate interests of the controller or of a third party.

The controller may no longer process the data subject's personal data unless it demonstrates compelling legitimate grounds for the processing which override the data subject's rights or interests, or grounds for the establishment, exercise or defence of legal claims. The data subject has the right to object to the processing of personal data concerning them for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the controller may no longer process the personal data for such purposes. The data subject has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them where the personal data is processed for scientific purposes, for the purposes of historical research or for statistical purposes, except where the processing of personal data is necessary for the performance of a task carried out for reasons of public interest.

Right to erasure (right to be forgotten)

The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay. If you request the controller to erase personal data, the controller is obliged to erase it in the following cases:

  1. the personal data is no longer necessary for the purpose for which it was collected or otherwise processed,
  2. the data subject withdraws the consent on which the controller's processing of their personal data is based and there is no other legal basis for the processing of the personal data,
  3. the data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing, or objects to the processing of personal data for direct marketing purposes including profiling to the extent that it is related to such direct marketing,
  4. the personal data has been unlawfully processed,
  5. the ground for erasure is compliance with an obligation laid down by law,
  6. the personal data was collected in relation to the offer of information society services under Section 15(1) of the Data Protection Act.

Where the controller has made the data subject's personal data public and is obliged to erase it under the conditions set out above, it is at the same time obliged, taking account of available technology and the cost of implementation, to inform other controllers processing the personal data that they are to erase any links to, and any copies or replications of, that personal data.

The controller is not obliged to erase personal data where it is necessary

  1. for exercising the right of freedom of expression or the right to information,
  2. for compliance with an obligation under an act or an international treaty, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
  3. for reasons of public interest in the area of public health,
  4. for archiving purposes, for scientific purposes, for the purposes of historical research or for statistical purposes, where erasure is likely to render impossible or seriously impair the achievement of the objectives of such processing, or
  5. for the establishment, exercise or defence of legal claims.

Right to restriction of processing

The data subject has the right to obtain from the controller the restriction of the processing of their personal data where

  1. they contest the accuracy of their personal data; the controller shall restrict the processing of their personal data for the period needed to verify its accuracy,
  2. the processing of their personal data is unlawful and the data subject requests the restriction of its use instead of erasure,
  3. the controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the establishment, exercise or defence of legal claims, or you object to the processing of personal data;
  4. the controller shall restrict the processing of personal data pending verification of whether the legitimate grounds of the controller override those of the data subject.

Where the processing of personal data has been restricted, the controller may, apart from storage, process the personal data only with the data subject's consent or for the establishment, exercise or defence of legal claims, for the protection of persons, or for reasons of public interest. The controller is obliged to inform the data subject before the restriction of processing is lifted.

Notification obligation regarding rectification, erasure or restriction of processing of personal data

The controller is obliged to communicate to each recipient (anyone to whom the data subject's personal data has been disclosed) any rectification of personal data, erasure of personal data or restriction of processing of personal data, unless this proves impossible or involves disproportionate effort. If the data subject so requests, the controller shall inform them about those recipients.

Right to data portability

The data subject has the right to receive the personal data concerning them which they have provided to the controller in a structured, commonly used and machine-readable format. They also have the right to transmit that personal data to another controller where technically feasible and where the processing of your personal data is carried out by automated means (i.e. electronically), whereby the personal data is processed either

  1. on the basis of consent,
  2. where the processing is carried out by automated means,
  3. or where it is necessary for the performance of a contract to which the data subject is party, or in order to take a step prior to entering into a contract at their request.

This right must not adversely affect the rights of others. The exercise of the right to data portability is without prejudice to the right to erasure of personal data. The right to portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to lodge a request for the initiation of proceedings on the protection of personal data

Should the data subject be directly affected in the rights conferred on them by the Data Protection Act, they have the right, under Section 100 of that Act, to lodge with the Office for Personal Data Protection of the Slovak Republic a request for the initiation of proceedings on the protection of personal data. The purpose of the proceedings is to establish whether the rights of natural persons have been infringed in the processing of their personal data or whether the Act has been breached and, where shortcomings are found and it is justified and expedient, to impose remedial measures or, as the case may be, a fine for breaching the Act. A model request is published by the Office on its website. The request for the initiation of proceedings must contain evidence in support of the assertions made in it and a copy of the document or other evidence proving that the right was exercised with the controller (right of access to personal data, right to request rectification of personal data, right to erasure or restriction of processing of personal data, right to object to the processing of personal data, right to portability of personal data), where the data subject has exercised such a right, or a statement of reasons deserving special consideration for not having exercised the right in question.

The rights set out above (except the right to lodge a request for the initiation of proceedings on the protection of personal data) may be exercised by e-mail or in writing by post with the controller, which supervises the processing of personal data. A personal data breach or other serious circumstances concerning the processing of personal data by the controller may likewise be reported to the controller.

A data subject's request under the Data Protection Act shall be handled by the controller free of charge, except for a payment which may not exceed the amount of the reasonably incurred material costs associated with making copies, obtaining technical media and sending the information to the data subject, unless a special act provides otherwise. The controller is obliged to handle the data subject's request in writing no later than within 30 days of the day the request was delivered. Any restriction of the data subject's rights under the Data Protection Act shall be notified in writing by the controller, without undue delay, to the data subject and to the Office for Personal Data Protection of the Slovak Republic.

Automated individual decision-making, including profiling

As a data subject, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

When processing personal data for any of the purposes set out above, the controller does not use automated individual decision-making or profiling.

4. COOKIES

We process cookies on the legal basis under Article 6(1)(a) of the GDPR – the data subject has given consent to the processing of their personal data for one or more specific purposes. The data subject has the right to withdraw their consent at any time, by e-mail or in writing by post to the address of the Controller's registered office. The withdrawal of consent does not affect the lawfulness of processing of personal data based on consent before its withdrawal. The Website uses cookies to ensure the necessary functionality as well as to make the site more attractive, to remember user settings and to collect statistical information about users.

5. PROTECTION OF PERSONAL DATA

The controller approaches the protection of personal data responsibly and seriously. It treats personal data as confidential, in accordance with the relevant legislation and with this document.

The controller processes personal data either manually or using electronic systems. The controller has adopted all necessary and requisite organisational, technical and administrative measures to ensure the accuracy and currency of personal data, as well as to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, so that the level of protection of personal data is as high as possible.

This personal data protection document may change over time. The Controller will publish any changes to this document on the Website.

In Láb, on 28.04.2025