PERSONAL DATA PROTECTION
PERSONAL DATA PROCESSING PRINCIPLES IN THE COMPANY V5 Consulting s.r.o.

Preamble

The company V5 Consulting s.r.o. (hereinafter referred to as the Company) provides job placement and counseling providing to labour market participants. Currently, when using information technology, remote access and replacing personal contact, is the aim of the Company to protect personal data which are provided notified to the Company or which becomes available to it in any way.

Primarily, for the purpose of the personal data protection the Company adopt inevitable and relevant measures which are aimed at introducing security mechanisms into the system of operated technologies.

Article 2

Introductory provisions and the definitions of the used terms

The Company processes personal data of person concerned always exclusively in accordance of the relevant provision of the Law Nr. 18/2018 Coll. of Law on protection of personal data in the version in force and in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC on the protection of personal data.

The Company is an operator of personal data.

This document adjust the basic principles of processing personal data by the Company in providing services via the website www.v5consulting.sk (hereinafter referred to as the Company's Website). The company reserves the right to amendment this document. Business partners and individuals who have provided personal data to the Company are informed about the changes by publishing them on the Company's Website with an indication of the date of their entry into force.

The rights, obligations and relations which are not expressly stated in this document are governed by valid and effective legal regulations in the territory of the Slovak Republic.

This document specifies the rights and obligations adjusted in the legislation listed below, namely:

• Act no. 22/2004 Coll. of Law on Electronic Commerce and on Amendments to Act No. 128/2002 Coll. of Law on State control of the single market in matters of consumer protection and on amendments to certain laws as amended by Act no. 284/2002 Coll. of Law as amended,
• Act no. 351/2011 Coll. of Law on Electronic communications, as amended,
• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC on the protection of personal data, as amended (hereinafter referred to as the Regulation),
• Act no. 18/2018 Coll. of Law on the Protection of personal data in the version in force (hereinafter referred to as the Act).

The principles of processing the personal data are always available on the website www.v5consulting.sk/en/GDPR.

For the purposes of this document, the terms used in this document have the meanings assigned to them below. In the case, that term used in document is not defined in this document, this term is understood with its generally binding legal regulation valid and effective in the territory of the Slovak Republic, and if there is no such definition, a grammatical interpretation shall be used.

Anonymization of the personal data is an act by which personal data is adjusted into such a form that it cannot be attributed to person concerned.

The database of CV is a database that contains CVs provided to the Company by job seekers, regardless of the form and method of their providing (filling a questionnaire, sending a form, sending a structured curriculum vitae).

A person concerned is the person to whom the personal data relates.

A Client is a natural or legal person who uses or intends to use the services provided by the Company or available on the Company's Website. For the purposes of this document, the Client shall mean any person who is job-seeker, including anyone interested in employment in the Company. The Client is any job seeker who uses the services provided by the Company or available on the Company's Website.

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the person concerned), an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

A partner or a business partner is a natural or legal person whose concern is finding an employee and who uses the services of the Company or services available on the Company's Website for this or a similar purpose.

Providing of the personal data is submission of the personal data by the Company to a third party, which further processes them.

An Operator is the Company (under the Act and regulations is in general operator any natural or legal person, public authority, agency or other entity that alone or together with others determine the purposes and means of personal data processing; in the case that this purposes and means are determined in of EU Law or in the law of a Member State, the controller or the specific criteria for its designation may be determined in European Union law or in the law of a Member State).

Services are those services that the Company provides to clients primarily via the Company's Website. The services include in particular (but not limited): the possibility to apply on the job position via the Company's website, make available or provide the CV to the Company and save this in the CV database, address job offers from the Company to the job seeker, post job offer of the partner on the Company's website or to make it available to one or more job seekers.

Processing the personal data means performance of operations or set of operations concerning the personal data, starting the acquisition, collection, dissemination, recording, organizing, processing or modification, search, browsing, regrouping, combining, moving, using, storing, blocking , liquidation, their cross - border transmission, provision, making available or publication.

Disclosure of personal data is announcement of personal data or allowing access to them to a recipient who does not further process them.

An intermediary is a natural or legal person, public authority, agency or other entity that processes personal data on behalf of the controller.

CV or (curriculum vitae) is a document that states the personal data about the job seeker (client).

The consent of the person concerned is a freely given and explicit and comprehensible declaration of intention of the person concerned on basis of information provided that person express his or her consent to processing his or her personal data. The consent is proven particularly by audio or video recording or an audio-visual recording or declaration of that person who provided that personal information do the information system or in another plausible manner. The written consent is proved by a document, which confirms the provision of consent. The proof of the consent contains mainly entry about who provided the consent to whom, for what purpose, the list or scope of personal data and the period of validity of the consent.

Article 3

The principles of processing and security of personal data

The Company always:

• processes personal data in relation to the person concerned in a legally, fairly and transparently,
• obtains personal data for specifically intended, explicitly stated and legitimate purposes,
• processes personal data to a minimal extent, hence to the extent necessary for their use for the purpose of providing the service,
• updates personal data according to the information provided by its person concerned,
• retains personal data in a form that allows the identification of the concerned person until the moment it is necessary for the purposes for which the personal data are processed, unless the person concerned withdraws his / her consent earlier,
• processes personal data in a such way that guarantees adequate security of personal data, including protection against unauthorized or illegal processing and accidental loss, destruction or damage, in order of appropriate technical and organizational measures.

The Operator is responsible for processing of personal data in compliance with the above stated principles and with the legal regulations applicable and effective in the territory of the Slovak Republic that can demonstrate this compliance.

The processing of personal data is in accordance with the Act and other generally binding legal regulations applicable and effective in the territory of the Slovak Republic, if:

• the person concerned has indicate his/her consent to the processing of his or her personal data for a specific purpose or several specific purposes,
• it is necessary for the performance of the contract to which the person concerned is a party or that, at the request of the person concerned, measures be taken before the conclusion of the contract,
• it is necessary to fulfil the legal obligation of the operator,
• it is necessary to protect the vital interests of the person concerned or of another natural person,
• it is necessary for the performance of a task implemented in the public services exercise of its public powers trusted on the operator,
• it is necessary for the purposes of legitimate interests, which the operator or the third party pursued except for cases when under this interest are predominating the interests or fundament laws and freedom of the person concerned which require the protection of personal data, mainly if the person concerned is a child.

The Operator is with regard to the processing of personal data obligated in particular:

• before starting the processing of personal data define the purpose of the processing of personal data; the purpose of processing personal data must be clear and be in accordance with the Constitution of the Slovak Republic, constitutional laws, laws and international treaties by which the Slovak Republic is bound,
• define the conditions for the processing of personal data so as it does not restrict the right of the person concerned provided by the law to obtain personal data exclusively for a defined or established purpose (it is inadmissible to obtain personal data under the pretext of another purpose of processing or other activity),
• to ensure that only such personal data are processed which are consistent in scope and content, correspond to the purpose of their processing and are necessary for its achievement,
• to ensure that personal data are processed and used exclusively in a such way that is appropriate to the purpose for which these data were collected (it is not permissible to combine personal data that have been collected separately for different purposes),
• to ensure that the collected personal data which were processed in a form which enable identification of person concerned for no longer than is necessary to achieve the purpose of the processing,
• destroy or possibly anonymised these personal data whose purpose of processing has ended (after the end of the purpose which is processing, personal data may be further processed only to the extent necessary for historical research, scientific research and development or for statistical purposes),
• during the processing for the personal data for the purposes mentioned in the previous paragraph, is the controller obliged to mark and anonymised them.

Article 4

Processing of personal data in providing services on the Website

Personal data stated in CVs and in CV databases
The CV database is a collective database of the Company that creates this database and processes the personal data contained in it as the operator.
The Contact point for persons concerned is the headquarters of the Company.
The person concerned may use his or her rights under the Law and Regulation with the Company.
The company performs the obligations to provide information referred to in Articles 13 and 14 of the Regulation, and also performs the obligations and tasks related to the exercise of the rights of the persons concerned.

The Company is responsible for evaluating and reporting security incidents and adopt appropriate privacy measures.

CVs stored in the CV database contain data that are under the Regulation and the Act considered as personal data. Therefore, this personal data can only be processed with the consent of the person concerned. Before sending the CV to the Company the person concerned declares that that all personal data stated by this person are true and subsequently gives person consent to the Company to process her or his personal data.

The purpose of the processing the personal data is to provide Company's services to the person who is a job seeker to find a suitable job opportunity. The company is entitled on the base of the person concerned´s permission and for the purpose stated in the previous sentence to make available or provide to its partners the personal data of person concerned stated in the CV.

The personal data stated in the CV of person concerned are made available a provided to partners of the Company on the internet via the Company's Website or the Company's e-mail address for a period of 6 months from the date of granting consent to the processing of personal data. After the end date mentioned in the previous sentence, the personal data listed in the CV will be non-accessible and stored in the CV database in case they will be available again or provide by the person concerned.

After 3 years from the last act performed by person concerned in relation to the Company, which means any communication of the person concerned with the Company, will be the data in the CV database definitively anonymised and further used exclusively for statistical purposes. By virtue of person concerned decision, may be making available and providing the CV terminated and renewed at any time. In pursuance of written request of the person concerned is the Company obliged to permanently delete personal data.

CVs stored in the CV database include: at least one contact information (e-mail or telephone), highest educational attainment, identification of the working area and job position in which the person is interested in, identification of the location where the person is looking for a job, required type of employment relationship, gender (for statistical processing purposes only), an indication of the previous job positions and employers of the person concerned. Further additional information in the CV is a decision solely made by person concerned as a job-seeker; The Company does not require additional information. The Company will never and in any case require the job seeker to provide data falling into a special category of personal data defined in Article 9 of the Regulation or § 16 of the Act.

Notifications about the job offers and information related to selection processes and procedures by email
In relation to the fact that according to the Regulation and the Act, an e-mail address may be considered as personal data and it is necessary for the person concerned to provide consent to the processing of personal data. The processing of personal data in entirety of the e-mail address is technically necessary for the provision of this service. The consent is given for a 3 years from the provision of the e-mail address of the job seeker to the Company. The consent can be withdraw at any time.

Personal data of clients' employees
In using the services, clients have the opportunity to make available and publish the contact details of their employees in entirety off: name, surname, e-mail address, telephone number, job classification. Under the Regulation and the Act these are classified as data that the operator, who is the employer of the person concerned, is entitled to provide, if necessary in connection with the work performance duties, professional duties or functional obligations of the person concerned.

The providing the personal data or making the data available must not impair the seriousness, dignity and security of the person concerned. This data will be processed for a maximum of 10 years from the last act of the client, he or she provided or informed such data to the Company. Following the expiry of the period referred in the previous sentence the data on the client's employee will be permanently deleted.

Article 5

Rights of the persons concerned

The controller shall adopt measures necessary to provide person concerned all the information mention in the article 13 and 14 of the Regulation and all notifications under Articles 15 to 22 and Article 34 of the Regulation concerning processing, summarized in the transparent, comprehensible and easily accessible form. Clearly and simply, especially in the case of information specifically for the child. The information shall be provided in the written form or by other means including, where appropriate, by electronic means. If the person concerned has it requested, information may be provided by oral, provided that the identity of the person concerned has been established in another way.

The person concerned has a right to obtain confirmation from the controller as to whether him or her personal data are being processed and, if so, has the right to obtain access to such personal data and the following information:

• purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data have been or will be provided, particularly the recipients in third countries or international organizations;
• when it is possible the envisaged period for storage of person data or if this is not possible, the criteria for determining it;
• the existence of the right to require from the controller to correct or delete or restrict the processing of personal data concerning the person concerned, or the right to object to such processing;
• the right to make a complaint to the supervisory authority;
• when personal data have not been obtained from the person concerned, any available information regarding to their source;
• the existence of automated decision-making, including profiling.

The person concerned has the right to ask the controller to correct incorrect personal data concerning him or her without undue delay. With regard to the purposes of processing, the person concerned has the right to supplement incomplete personal data, including by providing a supplementary declaration.

The person concerned is eligible to request the Company to delete his or her personal data. All consents concerning the processing of personal data provided to the Company are revocable. The person concerned has a right to request the deletion of the personal data and the withdrawal of consent to the Company in the written form or on the following email address: info@v5consulting.sk

Supervisory authority is The Office for Personal Data Protection of the Slovak Republic. The person concerned has the right to make a complaint to the supervisory authority.

In case of any question may the person concerned or any other person contact the person responsible for the processing of personal data: Mgr. et Mgr. Viktor Dutko, PhD, company director.

In Bratislava on 06.07.2020