Instruction of data subjects on the principles of personal data processing
The company july group, s.r.o., ID No.: 47 111 712, with its registered office at Rozvodná 1, 831 01 Bratislava, registered in the Commercial Register of the District Court Bratislava I, Section: Sro, file number: 88911/B (hereinafter also referred to as "the company"), as an entity that processes the personal data of certain data subjects, hereby provides detailed information on the processing of personal data, the reasons for their processing, and the rights of the data subject in relation to the processing of personal data.
The company processes personal data requested ad hoc from data subjects for the purpose of enabling the proper provision of the requested services of the company for the benefit of the data subject or other normal activities of the company. The legal basis for the processing of personal data may be the fulfillment of the company's legal obligations, the consent of the data subject, the performance of a contract or pre-contractual obligations, or the legitimate interest pursued by the company.
Taking into account the effectiveness of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "Regulation"), as well as the effectiveness of Act No. 18/2018 Coll. on the protection of personal data and on amendments to certain acts (hereinafter referred to as the "Act"), it is necessary to inform the data subject of their rights in relation to the processing of their personal data, or obtain consent from the data subject in accordance with the new requirements under current legislation.
The purpose of the following text is to provide the data subject with practical and clear information on the processing of personal data and the protection of privacy. If it is necessary to explain any part of the following statement to the data subject, advise or discuss further processing of the data subject's personal data, it is possible to contact the company at any time in writing at the following address: july group, s.r.o., with its registered office at: Rozvodná 1, 831 01 Bratislava, by telephone at 0905 77 8005, or by email at info@july.sk
This document will be updated regularly.
In the following text, you will learn in particular:
- Who is the controller/operator of the personal data of the data subject?
- What is personal data processing and what terms are associated with processing?
- What personal data of the data subject does the operator process?
- For what purposes and in what manner will the controller process the personal data of the data subject?
- To whom may the personal data of the data subject be transferred?
- How long will the controller process the personal data of the data subject?
- What rights does the data subject have in relation to the protection of personal data?
Ad 1.) Who is the controller/processor of the data subject's personal data?
Under the law, a controller is anyone who, alone or jointly with others, determines the purposes and means of personal data processing and processes personal data on their own behalf. The controller or specific requirements for its designation may be laid down in a special regulation or international treaty binding on the Slovak Republic, if such a regulation or treaty specifies the purpose and means of personal data processing.
In view of the above, the personal data controller and processor is the company to which the personal data has been provided and which determines the purpose and means of personal data processing.
In this case, it is our company july group, s.r.o., ID No.: 47 111 712, with its registered office at: Rozvodná 1, 831 01 Bratislava, registered in the Commercial Register of the District Court Bratislava I, Section: Sro, File No.: 88911/B.
Ad 2.) What is personal data processing and what terms are associated with processing?
According to the law, personal data processing is considered to be a processing operation or set of processing operations with personal data or sets of personal data, in particular the collection, recording, organization, structuring, storage, modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, regardless of whether it is carried out by automated means or non-automated means.
In view of the above, it is therefore necessary to define some of the terms used:
- personal data – any information relating to an identified or identifiable natural person, such as (but not limited to) name, surname, date of birth, birth number, telephone number, email address, IP address, etc.,
- data subject – a natural person to whom personal data relates,
- processing of personal data – an activity performed by a controller or processor with personal data,
- controller – a natural or legal person who determines the purpose and means of processing personal data; the controller may entrust the processing to a processor,
- processor – a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller,
- purpose – the reason why the controller processes personal data,
- special categories of personal data – sensitive personal data of a specific nature, such as health data or biometric data enabling the identification of a person;
- legitimate interest – the interest of the controller or another entity that gives rise to the need to process personal data, if it outweighs the interests of the data subject, for example when the data subject is a client of the controller,
- profiling – any automatic processing of personal data used to evaluate specific personal circumstances, such as the need to cover individual risks,
- geolocation data – data on the geographical location of, for example, a mobile device or computer,
- sociodemographic data – statistical information, such as age, gender, education,
- recipient – a natural person, legal entity, public authority, or other entity to which personal data is provided,
- performance – a product or service offered by the company within the scope of its business activities
Ad 3.) What personal data of the data subject does the controller process?
The controller processes only personal data that is necessary to provide services to the data subject, as well as for the purpose of complying with legal and contractual obligations, or for the purpose of protecting legitimate interests. The controller collects personal data about clients who are interested in the performance or who have given their consent to the processing of personal data for a specific, clearly defined purpose.
Specification of categories of personal data:
- Basic identification data: e.g., name and surname, date of birth, birth number, residential address, identity card number (ID card, passport), nationality, and signature (in the case of a natural person – entrepreneur, also ID number and place of business)
- Contact details: e.g., email, telephone number, contact address.
- Sociodemographic data: statistical data such as age, gender, marital status, education, employment, income and expenses, number of children, number of people in the household.
- Information about the service provided: for example, information about products and concluded contracts.
- Records of telephone calls or other interactions: email communication, records of personal conversations
- Geolocation data: this is geographical data from a computer's web browser or mobile applications
- Transaction data: information about payments (mandatory and executed, one-time and regular, etc.).
The company usually processes personal data to the extent of: name, surname, email, and telephone number, or other personal data necessary for the fulfillment of the controller's contractual or legal obligations.
Ad 4.) For what purposes and in what manner will the operator process the personal data of the data subject?
All personal data is processed in a lawful and transparent manner, and only data that is adequate, relevant, and necessary in relation to the purpose of processing is required. The company obtains personal data:
- directly from the data subject upon conclusion, during the term of, and in the performance of the contract,
- from other persons, if the data subject gives their consent, if it is necessary for the performance of obligations under the contract or if required by law,
- from publicly available registers, lists, records, etc.
The company processes the personal data of data subjects for the purpose of:
- fulfilling obligations under concluded contracts, orders, agreements, or other contractual relationships,
- fulfilling obligations arising from concluded supplier-customer relationships,
- fulfilling obligations arising from labor relations and human resources,
- fulfilling accounting and tax obligations,
- handling and recording complaints,
- statistical, registration, and archiving purposes in the public interest.
4.1. Processing without the need for consent
4.1.1. Processing based on the fulfillment of a legal obligation
The company also processes personal data based on requirements imposed on it by law. These include, in particular: the Commercial Code, the Civil Code, the Labor Code, the Accounting Act, the VAT Act, etc.
4.1.2. Processing based on a contract
The company may also process the personal data of the data subject for the purposes of performing a contract concluded between the data subject and the company, whereby such data is processed in particular when negotiating the conclusion of a contract, amending or managing a contract, performing under a contract, etc. In this case, personal data is processed only to the extent necessary for the conclusion and performance of the relevant contract.
For this purpose, the provision of personal data by the data subject is entirely voluntary, but at the same time necessary for the conclusion of the contract and subsequent performance under the contract. Without this data, it would not be objectively possible to conclude the contract and fulfill the obligations and rights arising from it.
4.1.3. Processing based on legitimate interests
The legitimate interests of the company include, for example:
- informing the data subject about news relating to the concluded contract
- processing personal data for the purposes of preventing and detecting criminal offenses
- defending the legal claims of the controller
4.1.4. Processing for the purpose of performing tasks in the public interest
4.1.5. Processing for the purpose of safeguarding the vital interests of the data subject
4.2. Processing based on consent
Consent for specific purposes is given by the data subject and must be freely given, specific, informed and unambiguous.
Consent to the processing of personal data is based on the principle of voluntariness, which means that it can be revoked at any time.
The revocation of consent must contain the following information:
- Who is submitting the withdrawal (name and surname, address of residence, and date of birth, so that the person can be identified)
- To whom the data subject is submitting the withdrawal
- Information that the data subject expressly does not want their data to continue to be processed
- The data subject's handwritten signature
Withdrawal of consent to the processing of personal data may only be sent in writing, in order to ensure that the data subject's wishes are clear and verifiable, to the following address: july group, s.r.o., Rozvodná 1, 831 01 Bratislava, or by email: inf@july.sk.
Ad 5.) To whom may the personal data of the data subject be transferred?
The personal data of the data subject will be processed by the company, its employees, or contractual partners (external accountants, lawyers, auditors, experts, IT service providers, state authorities, public authorities, etc.). Personal data may be transferred to subcontractors for the above purposes so that they can process it on behalf of the company.
Ad 6.) How long will the operator process the personal data of the data subject?
Personal data will be processed for the duration of the contractual relationship between the data subject and the company, as well as for the duration of the company's performance, or after the termination of the contractual relationship and the settlement of all obligations arising from or related to the contract, personal data will be stored for the necessary period of time, for up to 10 years, as required by applicable law (e.g., the Accounting Act, the Archives and Registries Act, or the Value Added Tax Act).
When handling personal data, the company applies the principle of minimization, which means that as soon as the period during which it is required to retain personal data expires, it anonymizes the personal data of the data subject from its databases and information systems. The company's internal policy on the storage of personal data ensures that the company does not store information for longer than it is authorized or required to do so.
Ad 7.) What rights does the data subject have in relation to personal data protection?
The company declares that it undertakes to process personal data properly, in accordance with applicable legislation, and to ensure compliance with the rules for their protection. The rights of the data subject are explained below in order to provide a clearer understanding of their content. When processing personal data, the data subject may exercise the following rights:
7.1. Information on the processing of personal data
This information includes, in particular, the identity and contact details of the controller, its representative and, where applicable, the person responsible for personal data protection, the purposes of the processing, the categories of personal data concerned, the recipient or categories of recipients of personal data, information on the transfer of personal data to third countries, the period of storage of personal data, authorized controllers, a list of the rights of the data subject, the possibility of contacting the Office for Personal Data Protection, the source of the personal data being processed, and information on whether and how automated decision-making and profiling take place.
7.2. Right of access to personal data
The data subject has the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients; the period for which the personal data will be stored; information about rights, the right to lodge a complaint with the Office for Personal Data Protection, information about the source of personal data, information about whether automated decision-making and profiling takes place, information and guarantees in the case of transfer of personal data to a third country or international organization. The data subject has the right to be provided with copies of the personal data being processed.
7.3. Right to rectification
If the controller processes data that has become outdated or inaccurate at the time of processing, the data subject also has the right to have the personal data being processed updated and rectified.
7.4. Right to erasure (right to be forgotten)
In certain cases specified by law, the controller is obliged to erase the personal data of the data subject at the request of the data subject. However, each such request is subject to individual assessment to determine whether the conditions are met, as there may be a reason for processing that is not subject to the data subject's right to request erasure, For example, in cases where the legitimate interest of the controller as the basis for processing personal data outweighs the interests and rights of the data subject. In such cases, the controller may continue to process the data to the extent necessary.
The company is obliged to erase the personal data of the data subject if
(i) they are no longer necessary for the purposes for which they were collected or otherwise processed,
(ii) the processing is unlawful,
(iii) the data subject objects to the processing and there are no legitimate grounds for the processing,
(iv) the controller is required to do so by law.
7.5. Right to restriction of processing
The data subject has the right to request that personal data be processed only for the most necessary legal reasons or to request that personal data be blocked. The right to restriction of processing also means the right of the data subject to restrict the processing of personal data for the period of resolution of any dispute regarding the processing of personal data, so that the controller only stores this data and may use it only for the purpose of determining, exercising, or defending legal claims.
7.6. Right to data portability
The data subject may request the controller to provide their personal data to another controller or another company, and the controller is obliged to transfer the personal data of the data subject in an appropriate format to the requested entity, unless there are any legal or other significant obstacles to doing so.
7.7. Right to object and automated individual decision-making
The right to object means that the data subject may object to the processing of their personal data by the company for certain purposes, e.g., direct marketing or legitimate interest. If the data subject objects to processing for direct marketing purposes, their personal data will not be processed for these purposes.
If the data subject discovers or merely suspects that the company is processing personal data in violation of the protection of private and personal life or in violation of legal regulations, they have the right to object to the controller.
The objection may also be raised directly against automated decision-making.
7.7. Right to lodge a complaint or report with the Office for Personal Data Protection
The data subject may at any time submit a complaint or objection regarding the processing of personal data to the supervisory authority, namely the Office for Personal Data Protection of the Slovak Republic, with its registered office at: Hraničná 12, 820 07 Bratislava 27, Slovak Republic, ID No.: 36 064 220, tel. no.: +421/2/3231 3220, website https://dataprotection.gov.sk/uoou/.
If the data subject wishes to exercise any of the above rights, or if they have any questions or comments regarding the information obligation, they may contact the company at any time by calling 0905 77 8005, e-mail address: info@july.sk or in writing at the address: july group, s.r.o., with its registered office at: Rozvodná 1, 831 01 Bratislava.
In Bratislava, on May 25, 2025
july group, s.r.o.
represented by: Ing. Júlia Ivanovičová, Managing Director
(Date of last update: May 25, 2025)
