PERSONAL DATA PROTECTION POLICY
of alfIT s.r.o., with its registered office at: Svätoplukova 2, 984 01 Lučenec, Slovak Republic, Company ID No. (IČO): 46 659 129, registration: company entered in the Commercial Register of the District Court of Banská Bystrica, Section: Sro, Insert No.: 22231/S (hereinafter referred to as the “Controller”)
PREAMBLE
The Controller has adopted this Personal Data Protection Policy (hereinafter also referred to as the “Policy”) in order to establish and maintain an appropriate level of protection of personal data and to inform data subjects about the purposes and methods of processing their personal data and about their rights arising from legislation governing personal data protection. This Policy applies to the processing of personal data that the Controller obtains and processes itself in the course of its business activities from its clients and customers located in the European Union.
The Controller respects every natural person’s right to privacy and therefore takes all necessary measures and makes every effort to ensure the security of all information and personal data obtained by the Controller. The Controller shall at all times endeavour to act in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter also referred to as the “GDPR”) and Act No. 18/2018 Coll. on Personal Data Protection, as amended (hereinafter also referred to as the “Act”).
This Policy sets out the personal data processing procedures carried out by the Controller. The Controller shall provide specific information and details concerning each instance of personal data processing whenever personal data are collected, where required by the GDPR or the Act. If specific information or details differ from the information contained in this document, such specific information or details shall prevail over this Personal Data Protection Policy.
This Policy consists of the following five parts:
1. Protection of personal data obtained when booking accommodation at the Controller’s accommodation facilities;
2. Protection of personal data in the records of accommodated guests;
3. Protection of personal data in the records of accommodated foreign nationals;
4. Protection of personal data obtained through CCTV monitoring of the Controller’s premises;
5. Common provisions for Parts One to Four. Parts One to Four constitute separate units which, for ease of reference, are combined into a single document; at the beginning of each part, you, as the data subject, are informed of the circumstances in which that particular part of the Policy applies to you. The final fifth part contains common provisions that apply to all the other parts (i.e. Parts One to Four) of this Policy unless an individual part provides otherwise.
PART ONE – Protection of Personal Data Obtained when Entering into an Accommodation Agreement
I.
Basic Provisions
1.1 This part of the Policy applies to you as a data subject if you enter into an agreement with the Controller for accommodation and the provision of services related to accommodation via the website www.novohradapartments.com and/or in another manner, such as arranging accommodation by e-mail, etc.
1.2 The Controller collects your personal data for the purposes specified in this part of the Policy and independently determines the means of processing your personal data (including determining the purposes for which your personal data are collected and processed).
1.3 By using the web interface on www.novohradapartments.com, an agreement for accommodation and the provision of services related to accommodation is concluded between you, as the data subject, and the Controller, the subject matter of which is the provision of accommodation and services related to accommodation to you as the data subject and to other persons (hereinafter also referred to as the “Agreement”). For the purposes of entering into and performing this Agreement, you therefore provide your personal data to the Controller.
1.4 The Controller’s contact details are set out in Article I of Part Five of this Policy.
II.
Purpose and Legal Basis of Personal Data Processing
1.5 The Controller collects and processes your personal data only where necessary and only to the extent necessary to fulfil the purpose for which the personal data are collected. The Controller processes your personal data under this part of the Policy only for the following purpose:
• performance of the agreement entered into between you as the data subject and the Controller for accommodation and the provision of services related to accommodation (hereinafter also referred to as the “Service”),
1.6 The legal basis on which the Controller processes your personal data for the purpose specified in point 1.5 of this Article is Article 6(1)(b) of the GDPR, i.e.:
• processing of your personal data is necessary for the performance of the Agreement (for accommodation) to which you, as the data subject, are a party.
III.
Sources and Categories of Personal Data Processed
1.7 The Controller may collect your personal data for the purpose specified in this part of the Policy only from the following source – directly from you when entering into the Accommodation Agreement with the Controller.
1.8 For the purpose specified in this part of the Policy, the Controller collects in particular the following categories of personal data: first name and surname, date of birth, permanent residence address, e-mail address and telephone number.
IV.
Information on Sharing Your Personal Data under this Part
1.9 The Controller does not disclose your personal data to any third party for the purpose specified in this part of the Policy.
V.
Personal Data Retention Period
1.10 The Controller shall retain your personal data obtained for the purpose specified in this part of the Policy only for the period strictly necessary and subject to compliance with all legislation applicable in the territory of the Slovak Republic. For the purpose specified in this part of the Policy, the Controller therefore retains your personal data for 3 months from the provision of accommodation and services related to accommodation under the Agreement in order to resolve any potential ticket complaint. After this period, the Controller shall erase your personal data.
1.11 The Controller retains your personal data for 3 months in order to handle a possible complaint concerning the performance provided (i.e. so that the Controller is able to identify a defect in the performance provided during this period), and also because, for technical reasons, a certain amount of time is required to erase the data.
PART TWO – Protection of Personal Data in the Records of Accommodated Guests
I.
Basic Provisions
2.1 This part of the Policy applies to you as a data subject if you stay at the Controller’s accommodation facility, since the Controller is legally obliged to maintain detailed records of natural persons who have been provided with temporary accommodation for consideration.
2.2 The Controller collects your personal data for the purposes specified in this part of the Policy and independently determines the means of processing your personal data (including determining the purposes for which your personal data are collected and processed).
2.3 The Controller’s contact details are set out in Article I, and your rights as a data subject in Article II, of Part Five of this Policy.
II.
Purpose and Legal Basis of Personal Data Processing
2.4 The Controller collects and processes your personal data only where necessary and only to the extent necessary to fulfil the purpose for which the personal data are collected. The Controller processes your personal data under this part of the Policy only for the following purpose:
• compliance with its legal obligation in the field of local tax administration
2.5 The legal basis on which the Controller processes your personal data for the purpose specified in point 2.4 of this Article is Article 6(1)(c) of the GDPR, i.e.:
• processing is necessary for compliance with a legal obligation to which the Controller is subject, namely the legal obligation under Section 41a(2) of Act No. 582/2004 Coll. on Local Taxes and the Local Fee for Municipal Waste and Minor Construction Waste, i.e. the obligation to maintain detailed records of natural persons who have been provided with temporary accommodation for consideration.
III.
Sources and Categories of Personal Data Processed
2.6 The Controller may collect your personal data for the purpose specified in this part of the Policy only from the following sources:
• from you during your stay, when you provide the Controller with the personal data that the Controller requests from you;
2.7 For the purpose specified in this part of the Policy, the Controller collects in particular the following categories:
• identification data consisting of first name, surname, date of birth and permanent residence address; the number and type of identity document, which may be an identity card, passport or another document proving your identity
IV.
Information on Sharing Your Personal Data under this Part
2.8 The Controller discloses your personal data obtained for this purpose – compliance with its legal obligation – exclusively to the competent local tax administrator, i.e. the municipality/town in which the accommodation is located.
V.
Personal Data Retention Period
2.9 The Controller shall retain your personal data obtained for the purpose specified in this part of the Policy only for the period strictly necessary and subject to compliance with all legislation applicable in the territory of the Slovak Republic. For the purpose specified in this part of the Policy, the Controller retains your personal data for 10 years from the date on which they were provided in order to comply with its statutory archiving obligation. Thereafter, the Controller shall erase your personal data.
PART THREE – Protection of Personal Data in the Records of Accommodated Foreign Nationals;
I.
Basic Provisions
3.1 This part of the Policy applies to you as a data subject if you stay at the Controller’s accommodation facility and are a foreign national, since the Controller is legally obliged to maintain detailed records of natural persons who have been provided with temporary accommodation for consideration and, where foreign nationals are accommodated, the Controller has additional statutory obligations relating to accommodation records, including the obligation to record the foreign national’s nationality.
3.2 The Controller’s contact details are set out in Article I, and your rights as a data subject in Article II, of Part Five of this Policy.
II.
Purpose and Legal Basis of Personal Data Processing
3.3 The Controller collects and processes your personal data only where necessary and only to the extent necessary to fulfil the purpose for which the personal data are collected. The Controller processes your personal data under this part of the Policy only for the following purpose:
• compliance with its statutory obligation under the legislation governing records of the residence of foreign nationals who have been provided with temporary accommodation for consideration.
3.4 The legal basis on which the Controller processes your personal data for the purpose specified in point 3.3 of this Article is Article 6(1)(c) of the GDPR, i.e.:
• processing is necessary for compliance with a legal obligation to which the Controller is subject, namely the legal obligation under Section 113 of Act No. 404/2011 Coll. on the Residence of Foreigners, as amended, i.e. the obligation, when recording a foreign national’s stay, to maintain specific data concerning that foreign national (information on his or her nationality).
III.
Sources and Categories of Personal Data Processed
3.5 The Controller may collect your personal data for the purposes specified in this part of the Policy only from the following sources:
• from you during your stay, when you provide the Controller with the personal data that the Controller requests from you
3.6 For the purpose specified in this part of the Policy, the Controller collects only the following categories of personal data:
• identification data consisting of first name, surname, date of birth and permanent residence address; the number and type of identity document, which may be an identity card, passport or another document proving your identity; and your nationality
IV.
Information on Sharing Your Personal Data under this Part
3.7 The Controller discloses your personal data for the purpose specified in this part of the Policy, i.e. compliance with its legal obligation, exclusively to the competent public authorities.
V.
Personal Data Retention Period
3.8 The Controller shall retain your personal data obtained for the purpose specified in this part of the Policy only for the period strictly necessary and subject to compliance with all legislation applicable in the territory of the Slovak Republic. For the purpose specified in this part of the Policy, the Controller retains your personal data for 10 years from the date on which they were provided in order to comply with its statutory archiving obligation. Thereafter, the Controller shall erase your personal data.
PART FOUR – Protection of Personal Data Obtained through CCTV Monitoring of the Controller’s Premises
4.1 This part of the Policy applies to you as a data subject if you stay at the Controller’s accommodation facility, the entrance areas of which are monitored by the Controller using a CCTV system.
4.2 The Controller collects your personal data – your image captured in CCTV footage, including an image of your face – for the purposes specified in this part of the Policy and independently determines the means of processing your personal data (including determining the purposes for which your personal data are collected and processed).
4.3 The Controller’s contact details are set out in Article I, and your rights as a data subject in Article II, of Part Five of this Policy.
II.
Purpose and Legal Basis of Personal Data Processing
4.4 The Controller collects and processes your personal data only where necessary and only to the extent necessary to fulfil the purpose for which the personal data are collected. The Controller processes your personal data under this part of the Policy only for the following purpose:
• monitoring the entrance to the Controller’s accommodation facility for the purpose of protecting the Controller’s property and the life, health and safety of data subjects present on the premises of the accommodation facility.
4.5 The legal basis on which the Controller processes your personal data for the purpose specified in point 4.4 of this Article is Article 6(1)(f) of the GDPR, i.e.:
• processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child; the Controller’s legitimate interest is the protection of its property and of the life, health and safety of persons present at the accommodation facility.
III.
Sources and Categories of Personal Data Processed
4.6 The Controller may collect your personal data for the purposes specified in this part of the Policy only from the following sources:
• from CCTV footage generated when the data subject enters the monitored entrance areas of the Controller’s accommodation facility
4.7 For the purpose specified in this part of the Policy, the Controller collects only the following categories of personal data:
• the data subject’s image, including an image of the data subject’s face where captured, recorded by the Controller’s CCTV system.
IV.
Information on Sharing Your Personal Data under this Part
4.8 The Controller does not disclose your personal data to any other persons for the purpose specified in this part of the Policy for which your personal data are collected; under this part of the Policy, your personal data are processed exclusively by the Controller. However, in the event of an incident, the Controller is entitled to provide such CCTV footage to the competent law-enforcement authorities.
V.
Personal Data Retention Period
4.9 The Controller shall retain your personal data obtained for the purpose specified in this part of the Policy (on the basis of the Controller’s legitimate interest in protecting the Controller’s property and the life and health of persons present at the accommodation facility) only for the period strictly necessary and subject to compliance with all legislation applicable in the territory of the Slovak Republic. For the purpose specified in this part of the Policy, the Controller retains your personal data only for 30 calendar days from the date on which your personal data were obtained by monitoring at the Controller’s accommodation facility, or until the storage capacity of the storage device on which the recording is kept is exhausted, whichever occurs first. Thereafter, the Controller shall erase your personal data.
PART FIVE – Common Provisions for Parts One to Four
5.1 The provisions of this part of the Policy apply to each of the preceding parts (Parts One to Four), unless an individual part provides otherwise.
I.
Controller’s Contact Details and Information on the Data Protection Officer
5.2 The Controller may be contacted using the following contact details:
address: Svätoplukova 2, 984 01 Lučenec, Slovak Republic Personal data processed by the Controller means any information relating to an identified or identifiable natural person. An identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as first name and surname, maiden name, date of birth, place of birth, personal identification number, data concerning sex, nationality or permanent residence, identity card number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
5.3 The Controller’s Data Protection Officer is – Ing. Patrik Stieranka, tel.: +421948528311, e-mail: info@novohradapartments.com
II.
Rights of Data Subjects
5.4 As a data subject under the Regulation and the Act, where your personal data are processed under any of Parts One to Four of this Policy, and after verification of your identity in accordance with point
5.5 of this Article, you have the following rights:
• the right to withdraw consent to the processing of personal data – after giving consent to the processing of personal data, including explicit consent to the processing of personal data for the period for which that consent was given, you have the right to withdraw that consent at any time in the same manner in which it was given or, in expressly specified cases where explicit consent to the processing of personal data was provided electronically, by sending an e-mail informing the Controller that the data subject withdraws such explicit consent to the processing of personal data, followed by verification of the data subject in accordance with this Personal Data Protection Policy, which the Controller follows when processing personal data;
• the right to request access to your personal data from the Controller and to obtain confirmation from the Controller as to whether it processes your personal data – under the right of access to personal data, you are entitled to have the Controller provide you, free of charge, with one copy of the personal data processed by the Controller. For any further copies requested by you, the Controller may charge a reasonable fee based on administrative costs. If you submit a request by electronic means, the Controller shall provide the information in a commonly used electronic form unless you request that it be provided in another manner;
• the right to rectification of personal data – you have the right to have the Controller rectify inaccurate personal data concerning you without undue delay or have the Controller complete any incomplete personal data;
• the right to erasure of personal data – you have the right to require the Controller to erase your personal data without undue delay if (A) the personal data are no longer necessary for the purpose for which they were collected or processed on the basis of consent; (B) you withdraw the consent on which the Controller bases the processing of the personal data; or (C) the personal data have been unlawfully processed;
• the right to restriction of processing of personal data – if (A) you contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of your personal data; (B) processing of the personal data on the basis of consent is unlawful and you oppose the erasure of the personal data and request restriction of their use instead; or (C) the Controller no longer needs the personal data for the purpose for which consent was given, but you, as the data subject, require them for the establishment, exercise or defence of legal claims. Where processing of personal data has been restricted, with the exception of processing by storage, the Controller may process your personal data in any other manner only with your consent;
• the right to data portability – the right to receive the personal data concerning you which you have provided to the Controller in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the Controller. You have the right to have personal data transmitted directly from the Controller to another controller where technically feasible;
• the right to object, on grounds relating to your particular situation, to the processing of personal data – where processing is carried out for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller, or where processing is necessary for the purposes of legitimate interests pursued by the Controller or by a third party, except where those interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data;
• the right to lodge a complaint with a supervisory authority – in the Slovak Republic, this is the Office for Personal Data Protection of the Slovak Republic, with its registered office in Bratislava, if you believe that the processing of your personal data is contrary to the applicable legislation of the Slovak Republic governing personal data protection.
5.5 If you wish to exercise any of your rights under point 5.4 of this Article and submit the request for the exercise of such right to the Controller by electronic means without an advanced electronic signature, in paper form without your officially certified signature, or by telephone, and the Controller has reasonable doubts concerning the identity of the natural person making the request, the Controller is entitled, pursuant to Article 12(6) of the GDPR, to request additional information from you or require you to take a specific action aimed at verifying your identity. Accordingly, the Controller is entitled to require you to submit a request to exercise any of the rights under point 5.4 of this Article electronically with an advanced electronic signature, in paper form bearing your officially certified signature, or to appear in person at the Controller’s registered place of business for verification of your identity.
III.
Information on Automated Decision-Making
5.6 The Controller does not carry out automated individual decision-making within the meaning of Article 22 of the GDPR.
IV.
Recipients of Your Personal Data
5.7 The Controller shall never share your personal data obtained for any purpose under this Policy with any third party (unless an individual part of this Policy provides otherwise) that intends to use them for its own marketing purposes independently of the Controller, unless the Controller has informed you of this in advance and you have also given the Controller your explicit consent. The Controller may share your personal data with third parties only in expressly agreed cases.
5.8 In processing your personal data for any of the purposes specified in this Policy, the Controller may use processors, i.e. third parties such as companies or sole traders that have a long-term relationship with the Controller and process your personal data on its behalf under a separate written data processing agreement. These third parties are bound by the data processing agreement and, in accordance with that agreement and the applicable legislation, shall keep your personal data private and secure and process them only on the Controller’s explicit instructions. These third parties must also provide the same level of security for your personal data as that provided by the Controller.
5.9 The Controller does not transfer your personal data to third countries (outside the EU).
V.
Security of Personal Data
5.10 Under the GDPR and the Act, the Controller is obliged to implement appropriate technical and organisational measures to ensure the security of personal data and to demonstrate that personal data are processed in compliance with the GDPR and the Act. The Controller has implemented several technical and organisational measures, including:
• securing the operating environment, whereby the Controller collects your personal data in a secure environment accessible only to authorised persons such as the Controller’s employees;
• physical security of the premises in which personal data are located;
• access controls (i.e. implementation of access passwords) for storage systems containing personal data;
• securing data storage systems containing personal data by means of antivirus software and similar measures;
• regularly backing up data containing your personal data;
5.11 The Controller declares that only the persons specified in this Policy have access to your personal data.
Lučenec, 1 August 2026