Processing of Personal Data

Information on the processing of personal data

Information for the Data Subject Regarding the Processing of Personal Data

When using the website www.faktury-online.com (hereinafter referred to as the "Website"), the user's personal data and other data subjects' personal data are processed. The operator ISSET, s.r.o., with its registered office at Palárikova 3159/7, 811 05 Bratislava, Slovak Republic, Company ID: 47 544 813, registered in the Commercial Register of the Bratislava III District Court, Section Sro, Insert No. 94603/B, hereby provides the data subject with information about the processing of personal data in accordance with Articles 12 and 13 of the General Data Protection Regulation (hereinafter referred to as the "Regulation").

Data Processing by the operator

1.	When using the Website, the Website operator:
a)	stores cookies on the user's device (for more details, see Article 4 of the Terms of Use);
b)	processes the following personal data of the registered user (full name, address, email, telephone number (hereinafter referred to as "Operational Data"));
c)	processes personal data entered by the user into the Website's software;
d)	processes personal data of third parties (data subjects) entered by the user into the Website's software;
(the data specified in point 1, letters c) and d) above are hereinafter collectively referred to as "Data").

Operational Data

2.	The operator processes Operational Data for the purpose of fulfilling contractual obligations between the operator and the user. Specifically, this includes managing the user's account, processing payments, and handling any user inquiries.

Data

3.	The operator never requires the user to enter any Data into the Website. Documents created on the Website can be generated without entering any Data.
4.	It is likely that the user may intend to create a document on the Website containing Data, whether their own or that of their contractual partner (data subject).
5.	The user must not enter any data on the Website that falls under special categories of personal data, i.e., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.
6.	If the user enters their own Data on the Website, the operator will fulfill the obligations imposed on it as a operator by the Regulation.
7.	However, if the user enters Data related to a third party (data subject) on the Website, the operator will fulfill the obligations imposed on it as a processor by the Regulation, and the user is obligated to fulfill the obligations imposed on them as a operator by the Regulation.
8.	Purpose. The operator processes Data and Operational Data for the following purposes:

Purposes of Data Processing:		Condition:	Category of Data:
a)	fulfillment of obligations – tax administration	legal	ordinary
b)	fulfillment of obligations – state authorities	legal	ordinary
c)	contractual management	contractual	ordinary
d)	informing the data subject about goods and services provided by the operator (hereinafter referred to as "marketing")	none	ordinary

9.	Legal Basis for Processing. The operator processes data on the basis of:

a)	the data subject's consent (Article 6(1)(a) of the Regulation);
b)	law – the conclusion of a contract (preparation for the conclusion of a contract) with the data subject (Article 6(1)(b) of the Regulation);
c)	the legitimate interests of the operator (Article 6(1)(f) of the Regulation), namely: (i) protection of the operator's contractual/legal rights and obligations, (ii) informing about goods and services provided by the operator (marketing).

10.	Recipients/Categories of Recipients. The operator provides data to the following entities:

a)	state authorities;
b)	judicial authorities;
c)	representatives or agents of the operator (e.g., accountant, auditor, lawyer, etc.);
d)	representatives or agents of the contractual party who have a valid mandate to represent.
11.	Data Transfers to Third Countries. The operator anticipates data transfers to EU countries or OECD countries and to the USA under the EU/US Privacy Shield regime (a country deemed by the European Commission to ensure an adequate level of data protection).
12.	Data Retention Period. The operator retains data until (whichever occurs later):

a)	fulfillment of obligations – tax administration	according to law, at least 10 years
b)	fulfillment of obligations – state authorities	according to law, at least 10 years
c)	contractual management	for the duration of the contract, but not less than the period required to exercise liability claims (3 years, or 4 years)
d)	marketing	until the end of the marketing campaign, but not less than required by applicable regulations

13.	Right to Request Access to Data. You have the right to request the operator to inform you whether and what data it processes about you.
14.	Right to Request Correction and Supplementation of Data. You also have the right to request the operator to correct your data. Considering the purpose of processing, you also have the right to supplement the data.
15.	Right to Erasure of Data, Right to Restrict Processing. You have the right to request the operator to erase your data. You also have the right to request the operator to restrict the processing of your data (if legal conditions exist). None of these rights override the operator's legal obligation to process your data to the extent and for the purpose required by applicable legal regulations.
16.	Right to Data Portability. You have the right to request the operator to provide your data to another operator (or to another operator with the same level of legal obligation to protect confidential client information) in a structured, commonly used, and machine-readable format.
17.	Right to Lodge a Complaint. You have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07, Bratislava 27, Slovak Republic, Email: statny.dozor@pdp.gov.sk, Tel. +421 2 323 132 14.
18.	Profiling, Existence of Automated Decision-Making. The operator does not engage in automated decision-making or profiling when processing data.
19.	Providing Operational Data is a condition for the proper provision of services to you. Providing Data is not required for the proper provision of services.
20.	If a contractual relationship is established between you and the operator, providing data is a condition for the proper formation of the contractual relationship and the exercise of rights related to the contract.
21.	The operator does not provide your data to third parties, except in cases explicitly stated in this document and cases where such an obligation arises from applicable legal regulations.

SPECIAL NOTICE ON THE RIGHT TO OBJECT

22.

RIGHT TO OBJECT. IF THE OPERATOR PROCESSES YOUR DATA FOR THE PURPOSE OF PROTECTING ITS LEGITIMATE INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO SUCH PROCESSING AT ANY TIME, AND FROM THE MOMENT OF OBJECTION, THE OPERATOR MUST NOT PROCESS YOUR DATA FOR THIS PURPOSE. YOU HAVE THE RIGHT TO OBJECT WHENEVER THE OPERATOR PROCESSES YOUR DATA FOR DIRECT MARKETING PURPOSES. THE OPERATOR IS NOT OBLIGED TO STOP PROCESSING YOUR DATA FOR THIS PURPOSE IF IT DEMONSTRATES NECESSARY LEGITIMATE REASONS FOR PROCESSING THAT OUTWEIGH YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR REASONS FOR ESTABLISHING, EXERCISING, OR DEFENDING LEGAL CLAIMS.