Basic information
We approach your personal data responsibly and therefore, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "GDPR Regulation") and Act No. 18/2018 Coll. on the protection of personal data and on amending and supplementing certain acts (hereinafter referred to as the "Act"), we make available to you as the data subject (the natural person whose personal data is processed) on our website, in addition to your identification and contact details and the contact details of the responsible person, other necessary information.
Controller – SEDMA IVD Slovak Association of Manufacturers and Suppliers of “in vitro” Diagnostic Medical Devices SEDMA, an interest association of legal entities, registered office at Budatínska 16, 851 06 Bratislava 5, Company ID: 42053528, pursuant to Article 24 of the GDPR and the provisions of Section 31 of the Act, has adopted appropriate technical, organizational, personnel and security measures and guarantees, which take into account in particular:
- principles of personal data processing, which are lawfulness, fairness and transparency, limitation and compatibility of the purposes of personal data processing, as well as minimization of personal data, their pseudonymization and encryption, as well as integrity, confidentiality and availability,
- the principles of necessity and proportionality (also applies to the scope and amount of personal data processed, the retention period and access to the personal data of the data subject) of the processing of personal data with regard to the purpose of the processing operation,
- taking measures to immediately determine whether a personal data breach has occurred and promptly informing the supervisory authority and the responsible person
- the nature, scope, context and purpose of the processing operation,
- resilience and recovery of personal data processing systems,
- instructions to authorized persons of the operator,
- taking measures to ensure the correction or deletion of incorrect data, or the exercise of other rights of the data subject,
- risks of varying likelihood and severity for the rights and freedoms of natural persons (in particular accidental or unlawful destruction of personal data, loss or alteration of personal data, misuse of personal data - unauthorized access or unauthorized disclosure, risk assessment with regard to the origin, nature, likelihood and severity of the risk in connection with the processing and to identify the best practices for mitigating the risk).
Processing activities of the controller
Payroll and HR
Purpose of processing personal data - maintaining payroll and personnel records of employees working for the employer, who is the controller, in an employment relationship or other relationship (e.g. agreements on the performance of work, etc.).
Categories of processed personal data – name, surname, maiden name, previous surname, title, permanent/temporary residence, date of birth, place of birth, birth number, nationality, citizenship, gender, bank account of a natural person, marital status, education, experience, ID card number, signature, basic salary, personal evaluation, job and functional classification, date of commencement of work, salary classification, place of work, email address, telephone number, data for statistics, name of health insurance company, data from the supplementary pension savings bank contract, SDS saver data, data on hours worked, amounts affected by the execution of a decision ordered by a court or administrative authority, fines and penalties, as well as compensation imposed on an employee by an enforceable decision of the competent authorities, data on incapacity for work, data on important personal obstacles to work, data on changed work capacity, degree of disability, data from the certificate of employment, data on the employee's registration in the register of unemployed citizens, data on the use of maternity leave and parental leave, data on the award of a pension, the type of pension, the annual total of the pension paid, capacity to perform legal acts, data from a document of good repute, personal data processed on receipts, certificates of completed exams and educational activities, data provided in a CV or other data, if required by a special legal regulation or other legal basis for the processing of personal data.
Special categories of personal data processed – special categories of personal data are not processed.
Categories of data subjects – employees of the operator, former employees of the operator, job applicants, family members of employees of the operator.
Provision of personal data to third parties – courts, criminal law enforcement agencies, health insurance companies, Social Insurance Agency, supplementary pension savings banks, pension management companies, tax office, bailiffs, state administration and public authority bodies for the exercise of control and supervision (e.g. labor inspectorate), Central Office of Labor, Social Affairs and Family of the Slovak Republic, employee representatives, inspectors of the Personal Data Protection Office of the Slovak Republic, other authorized entity in accordance with the Personal Data Protection Act or other special legal regulation.
Deadlines for erasing personal data
- Fulfillment of employer obligations towards health insurance company – 10 years
- Fulfillment of employer obligations towards social insurance companies – 10 years
- Fulfillment of tax obligations – 10 years
- Executions – 20 years
- Attendance and vacation records – 5 years
- Employer's wage policy – 72 years
- Fulfillment of employer obligations in connection with an employment or similar relationship – 72 years
Legal basis for processing personal data – Council Regulation (EEC) No. 311/76 on the compilation of statistics on foreign workers, Council Regulation (EEC) No. 1612/68 on freedom of movement for workers within the Community, Act No. 18/2018 Coll. on the protection of personal data and on the amendment of certain acts, Act No. 311/2001 Coll. Labour Code, Act No. 552/2003 Coll. on the performance of work in the public interest, as amended, Act No. 553/2003 Coll. on the remuneration of certain employees performing work in the public interest and on the amendment of certain acts, as amended, Act No. 595/2003 Coll. on income tax, as amended, Act No. 563/2009 Coll. on tax administration (tax code) and on amendments and supplements to certain acts, as amended, Act No. 461/2003 Coll. on social insurance, as amended, Act No. 600/2003 Coll. on child allowance and on amendments and supplements to Act No. 461/2003 Coll. on social insurance, as amended, Act No. 462/2003 Coll. on income compensation in the event of temporary incapacity for work of an employee, as amended, Act No. 580/2004 Coll. on health insurance and on amendments and supplements to certain acts, as amended, Act No. 650/2004 Coll. on supplementary pension savings, as amended, Act No. on Social Services, as amended, Act No. 5/2004 Coll. on Employment Services, as amended, Act No. 82/2005 Coll. on Illegal Work and Illegal Employment, as amended, Act No. 152/1994 Coll. on the Social Fund and on Amendments to Act No. 286/1992 Coll. on Income Tax, as amended, Act No. 43/2004 Coll. on Old-Age Pension Savings, Act No. 570/2005 Coll. on Military Service, Act No. 42/1994 Coll. on Civil Protection of the Population, as amended, Act No. 314/2001 Coll. on fire protection, Act No. 124/2006 Coll. on safety and health protection at work, Act No. 355/2007 Coll. on the protection, promotion and development of public health and related legal regulations, Act No. 179/2011 Coll. on economic mobilization and amending Act No. 387/2002 Coll. on state management in crisis situations outside wartime and state of war, as amended, Act No. 215/2004 Coll. on the protection of classified information and amending certain acts, as amended, Act No. 233/1995 Coll. on bailiffs and enforcement activities (Execution Rules), Act No. 663/2007 Coll. on minimum wage, Act No. 317/2009 Coll. on teaching staff and professional staff and on amendments and supplements to certain acts, Act No. 283/2002 Coll. on travel allowances.
Accounting documents
Purpose of processing personal data – processing orders, incoming and outgoing invoices, contact with banks, cash management, ensuring cash receipts and expenditures, warehouse management, recording fixed assets (including automatic depreciation) and small assets, maintaining simple/double-entry bookkeeping of the organization.
Categories of processed personal data – title, first name, last name, address, telephone number, e-mail address, date of birth, type and number of identity document, ID number, signature, bank account number or other, if required by a specific legal regulation or other legal basis for processing personal data.
Special categories of personal data processed – special categories of personal data are not processed.
Categories of data subjects – employees of the controller, former employees of the controller, cooperating entities of the controller (e.g. suppliers or subcontractors).
Provision of personal data to third parties – courts, criminal law enforcement authorities, health insurance companies, Social Insurance Agency, tax office, inspectors of the Personal Data Protection Office of the Slovak Republic, other authorized entity in accordance with the Personal Data Protection Act or other special legal regulation.
Deadlines for erasing personal data
- Invoice books – 10 years
- List of receivables and payables – 10 years
- Invoices – 10 years
- Treasury agenda – 10 years
- Accounting documents – 10 years
- Bank statements – 10 years
- General ledgers – 20 years
- Financial statements – 10 years
- Financial statements – 10 years
- Annual tax settlement – 10 years
Legal basis for processing personal data – Act No. 431/2002 Coll. on accounting, as amended, Act No. 222/2004 Coll. on value added tax, as amended, Act No. 18/2018 Coll. on personal data protection and on amendments to certain acts, Act No. 145/1995 Coll. on administrative fees, as amended, Act No. 40/1964 Coll. Civil Code, as amended, Act No. 152/1994 Coll. on social fund and on amendments to Act No. 286/1992 Coll. on income taxes, as amended, Act No. 311/2001 Coll. Labor Code, Act No. on civil service and on amendments and supplements to certain acts, as amended, Act No. 513/1991 Coll. Commercial Code, as amended, Act No. 583/2004 Coll. on budgetary rules of local government and on amendments and supplements to certain acts, Act No. 283/2002 Coll. on travel allowances, Act No. 55/2017 Coll. on civil service and on amendments and supplements to certain acts, Act No. 595/2003 Coll. on income tax, as amended, Act No. 582/2004 Coll. on local taxes and local fees for municipal waste and small construction waste, as amended.
Health and safety
Purpose of processing personal data – fulfillment of the obligations of the controller as an employer related to employment, civil service or similar relationship, within which professional and advisory services are provided in the field of safety and protection and promotion of health at work, fire protection and occupational health services.
Categories of processed personal data – title, name, surname, place of residence, registered office, signature, specialization, field of study, or others, if required by a specific legal regulation or other legal basis for processing personal data.
Special categories of processed personal data – health status.
Categories of data subjects – employees of the operator, occupational health service providers, safety technicians, fire protection technicians.
Provision of personal data to third parties – courts, criminal justice authorities, Social Insurance Agency, labor inspectorates, other authorized entity in accordance with the Personal Data Protection Act or other special legal regulation.
Deadlines for erasing personal data
Records of work accidents – 5 years
Fulfillment of employer obligations in the field of health and safety protection – 5 years after the termination or termination of the obligation
Documentation of training and retraining in the field of OHS – 5 years
Legal basis for processing personal data – Article 9 point 2. letter b) of REGULATION (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Decree of the Ministry of Labour, Social Affairs and Family of the Slovak Republic No. 147/2013 Coll., which establishes details for ensuring safety and health protection during construction work and work related to them and details on professional competence for the performance of certain work activities, Decree of the Ministry of Labour, Social Affairs and Family of the Slovak Republic No. 356/2007 Coll., which establishes details on the requirements and scope of educational and training activities, on the education and training project, keeping prescribed documentation and verifying the knowledge of participants in educational and training activities, Decree of the Ministry of Labour, Social Affairs and Family of the Slovak Republic No. 45/2010 Coll., which establishes details for ensuring safety and health protection during agricultural work, Decree of the Ministry of Labour, Social Affairs and Family of the Slovak Republic No. 46/2010 Coll., which establishes details for ensuring safety and health protection during forestry work and details on professional competence for performing certain work activities and operating certain technical equipment, Decree of the Ministry of Labour, Social Affairs and Family of the Slovak Republic No. 500/2006 Coll., which establishes a model of a record of a registered occupational accident, Decree of the Ministry of Labour, Social Affairs and Family of the Slovak Republic No. 508/2009 Coll., which establishes details for ensuring safety and health protection during work with pressure, lifting, electrical and gas technical equipment and which establishes technical equipment that is considered to be reserved technical equipment, Act No. 124/2006 Coll. on safety and health protection at work and on amendments and supplements to certain acts, Act No. 311/2001 Coll., Labour Code, Act No. 355/2007 Coll., on the protection, promotion and development of public health, as amended.
Job applicant records
Purpose of processing personal data – keeping records of job applicants with the operator.
Categories of processed personal data – title, first name, last name, permanent residence, temporary residence, date of birth, telephone number, education, experience, e-mail address, other data within the scope of a CV, cover letter and application for employment.
Special categories of personal data processed – special categories of personal data are not processed.
Categories of data subjects – natural persons who apply for employment with the operator.
Provision of personal data to third parties – courts, criminal justice authorities, the Central Office of Labor, Social Affairs and Family of the Slovak Republic, other authorized entity in accordance with the Personal Data Protection Act or other special legal regulation.
Deadlines for erasing personal data
Job applications and responses to applications – 5 years
Legal basis for processing personal data – Article 6(1)(a) of REGULATION (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Article 13(1)(a) of Act No. 18/2018 Coll. on the protection of personal data and on the amendment and supplementation of certain acts, Act No. 311/2001 Coll. on the Labour Code, Act No. 5/2004 Coll. on employment services and on the amendment and supplementation of certain acts.
Records of contracts concluded by the operator
Purpose of processing personal data – recording of contracts concluded by the operator.
Categories of processed personal data – name, surname, title, date of birth, personal identification number, permanent or temporary residence, account number, bank name, identity card number, and other data related to the subject of the contract concluded by the operator.
Special categories of personal data processed – special categories of personal data are not processed.
Categories of data subjects – natural persons whose personal data are the content of a concluded contract.
Provision of personal data to third parties – courts, criminal law enforcement authorities, inspectors of the Personal Data Protection Office of the Slovak Republic, other authorized entity in accordance with the Personal Data Protection Act or other special legal regulation.
Deadlines for erasing personal data
Legal representation – 10 years
Credit agreements – 5 years after expiry
Property - legal contracts - 50 years
Legal basis for processing personal data – Art. 6 para. 1 letter b) OF REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Act No. 40/1964 Coll. Civil Code, Act No. 513/1991 Coll. Commercial Code, as amended, Act No. 311/2001 Coll. Labour Code.
Client records
Purpose of processing personal data – client registration.
Categories of processed personal data – name, surname, title, place of residence, date of birth, personal identification number, health insurance company, insured person's identification number.
Special categories of processed personal data – personal data relating to the client's health.
Categories of data subjects – clients, legal representatives of minor natural persons.
Provision of personal data to third parties – Health insurance companies, Social Insurance Company, Labor, Social Affairs and Family Offices, court, criminal prosecution authorities, Inspectors of the Personal Data Protection Office of the Slovak Republic, other authorized entity in accordance with the Personal Data Protection Act or other special legal regulation.
Deadlines for erasing personal data
Securing and preserving client documentation – 20 years after the death of an individual or 20 years from the last provision of services to the individual.
Legal basis for processing personal data – Act No. 580/2004 Coll. on health insurance and amending Act No. 95/2002 Coll. on insurance and amending certain acts, Act No. 581/2004 Coll. on health insurance companies, healthcare supervision and amending certain acts, Act No. 578/2004 Coll. on healthcare providers, healthcare professionals, professional organizations in healthcare and amending certain acts, as amended, Act No. 461/2003 Coll. on social insurance, Act No. 18/2018 Coll. on personal data protection, Act No. 153/2013 Coll. on the national healthcare information system and amending certain acts, Act No. on healthcare, services related to the provision of healthcare and on amendments and supplements to certain acts, Act No. 577/2004 Coll. on the scope of healthcare paid for under public health insurance and on payments for services related to the provision of healthcare.
Photos and videos
Purpose of processing personal data – creating an image for the purpose of transferring it to paper or other media.
Categories of processed personal data – characteristic features that constitute the physical identity of a person as a unique human being and other data further specifying the natural person depicted in the photograph.
Special categories of personal data processed – special categories of personal data are not processed.
Categories of data subjects – natural persons depicted in the photographs.
Provision of personal data to third parties – court, law enforcement agencies, other authorized entity in accordance with the Personal Data Protection Act or other special legal regulation.
Deadlines for erasing personal data
Photos and videos – 5 years
Legal basis for processing personal data – provisions of Sections 11 – 16 of Act No. 40/1964 Coll. of the Civil Code, Act No. 18/2018 Coll. on personal data and on amendments and supplements to certain acts.
Records of incoming and outgoing mail (paper or email)
Purpose of processing personal data – recording incoming and outgoing mail (letters, suggestions, complaints, etc.) in paper or electronic form.
Categories of processed personal data – name, surname, title, address, e-mail address, signature, guaranteed electronic signature and other data that may be the content of incoming or outgoing mail.
Special categories of personal data processed – special categories of personal data are not processed.
Categories of data subjects – natural persons whose personal data may be the content of incoming and outgoing mail.
Provision of personal data to third parties – courts, law enforcement agencies, other authorized entities in accordance with the Personal Data Protection Act or other specific legal regulations.
Deadlines for erasing personal data
correspondence – 3 years
Legal basis for processing personal data – Act No. 305/2013 Coll. on the electronic form of the exercise of powers of public authorities and on amendments and supplements to certain acts (e-Government Act), Act No. 272/2016 Coll. on trust services for electronic transactions in the internal market and on amendments and supplements to certain acts (Trust Services Act), Art. 6 (1) (f) of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Art. 13 (1) (f) of Act No. 18/2018 Coll. on the protection of personal data and on amendments and supplements to certain acts, as amended.
Marketing
Purpose of processing personal data - sales support - marketing offers, newsletter, information about products and news.
Categories of processed personal data – name, surname, address, e-mail, telephone number, date of birth
Special categories of personal data processed – special categories of personal data are not processed.
Categories of data subjects – clients
Provision of personal data to third parties – courts, law enforcement agencies.
Deadlines for erasing personal data
correspondence – 3 years
contracts – 10 years
Legal basis for processing personal data – Act No. 18/2018 Coll. on the protection of personal data and on amendments and supplements to certain acts.
Training and courses
Purpose of processing personal data – providing educational activities (training and courses).
Categories of processed personal data – title, first name, last name, address, email, telephone number, date of birth, signature, account number.
Special categories of personal data processed – special categories of personal data are not processed.
Categories of data subjects – clients, employees.
Provision of personal data to third parties – courts, law enforcement agencies.
Deadlines for erasing personal data
training and courses – 5 years
Legal basis for processing personal data – Act No. 18/2018 Coll. on the protection of personal data and on amendments and supplements to certain acts, Act No. 102/2014 Coll. on consumer protection in the sale of goods or provision of services based on a contract concluded at a distance or a contract concluded outside the seller's premises and on amendments and supplements to certain acts.
Cross-border transfer of personal data does not take place in any of the categories.