Company:

Olvio s.r.o.   Námestie gen. Štefánika 534/9, Stará Ľubovňa 064 01, Slovakia
ID: 46 900 608

tel.: +421-948 015 991
e-mail: sleepingelephant@gmail.com
(hereinafter referred to as “OLVIO” or “the Company”)

in accordance with Articles 13 and 14 of REGULATION (EU) 2016/679 of the EUROPEAN PARLIAMENT and of the COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “GDPR Regulation“), hereby provides information on the processing of personal data by OLVIO nutraceutics in selected areas of personal data processing.

BASIC TERMS:

For the purposes of this information, the Data Subject is an identified or identifiable natural person whose personal data is processed by OLVIO in the framework of the relevant processing activity (hereinafter referred to as the “Data Subject“).

Personal data means any information relating to an identified or identifiable natural person (Data Subject); an identifiable natural person is a person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing of personal data means an operation or set of operations concerning personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise disclosing, rearranging or combining, restricting, deleting or disposing of, whether or not by automated or non-automated means.

The Controller is OLVIO, which, within the framework of the processing of personal data in its terms and conditions, determines the purposes and means of the processing of personal data.

The processor is a natural or legal person, public authority, agency or other entity that processes personal data on behalf of the Controller (OLVIO).

The recipient is a natural or legal person, public authority, agency or other entity whose personal data OLVIO provides (third parties, processors).

HOW WILL PERSONAL DATA BE PROCESSED?

Personal data are also processed through contractual partners (processors), who are verified and authorized in accordance with Article 28 of the GDPR. OLVIO supervises their activities in order to protect personal data and ensure their legitimate processing in accordance with the GDPR.

In OLVIO’s terms and conditions, the personal data of the Data Subjects are primarily processed for the following purposes:

 

1)    Processing of personal data within the framework of pre-contractual and contractual relationships:

The conditions for the processing of personal data depend on the stage of the contractual relationship (pre-contractual/contractual relationship, storage of contracts, etc.) as well as on the Data Subjects to whom the processing pertains (e.g. statutory representatives, contact, authorized and authorized persons, natural persons who are directly parties to the contract, data on the employees of the party, etc.).

In the terms and conditions of the company, contractual relations were identified in particular with the following categories of contracting parties:

1.1 natural persons (except for employment relationships) and natural persons – entrepreneurs,
If the parties are natural persons/natural person entrepreneurs, their personal data are processed about these parties as Data Subjects. Within the framework of the contractual relationships in question, the personal data of other natural persons whose data are part of the contract (e.g. contact, authorized, empowered persons) may also be processed.

1.2 legal entities, institutions, organizations, public administration entities (e.g. self-government entities, especially cities and municipalities, producers, collection companies – waste collection, suppliers of goods and services and other business and contractual partners).
If the contracting parties are legal entities, institutions, organizations, public administration entities, the personal data of natural persons are also processed under these contractual relationships. As a rule, these are persons authorized to act on behalf of the contracting party or their personal data are processed in connection with the performance of the subject of a specific contract (e.g. contact, authorized, empowered persons, statutory representatives, employees of the contracting parties, professional guarantors, etc.).

2)    Processing of accounting documents and supporting documents – OLVIO’s bookkeeping:

The legal basis for the processing:

Personal data are processed on the basis of Article 6 (c) of the GDPR: processing is necessary to fulfill the legal obligation of the company, particularly resulting from the following legal regulations:

• Act No. 431/2002 Coll. on Accounting, as amended.
• Act No. 595/2003 Coll. on Income Tax, as amended.
• Act No. 222/2004 Coll. on Value Added Tax, as amended.
• Act No. 563/2009 Coll. on Tax Administration (Tax Code) and on changes and additions to certain laws, as amended.

The provision of personal data by the Data Subject necessary for the proper management of the accounting agenda is a legal requirement. In the event that the Data Subject does not provide personal data, this may result in, for example, the non-conclusion of a contractual relationship, the refusal to sell goods and services, etc.

Scope of the processed data:

For this purpose, ordinary personal data are usually processed in the scope of accounting documents and supporting documents for accounting documents, in particular the identification and contact details of the Data Subject necessary for the performance of the accounting operation, and demonstrating its authority and legitimacy to the supervisory authority.

Recipients of personal data:

Personal data that are part of the company’s accounting agenda may be provided to auditors to conduct audits and provide relevant consulting activities. In the case of the protection of financial or legally protected data, the necessary personal data will be provided to the law enforcement authorities or the court.

Period of personal data storage:

Personal data is stored for a defined purpose for a period of 10 years following the end of the accounting period.

3)  Data processing within the agenda of the statutory company OLVIO:

The legal basis for the processing:

Personal data are processed on the basis of Article 6 (c) of the GDPR: processing is necessary to fulfill the legal obligation of the company (joint-stock company), resulting in particular from the following legal regulations:

• Act No. 40/1964 Coll. of the Civil Code, as amended.
• Act No. 513/1991 Coll. of the Commercial Code, as amended.
• Act No. 566/2001 Coll. on Securities and Investment Services (Securities Act), as amended.

The provision of personal data by the Data Subject is a legal requirement resulting from special legal regulations and the Data Subject is obliged to provide these personal data.

Scope of the processed data:

For this purpose, ordinary personal data are usually processed in the scope of identification and contact data of the Data Subjects, in particular: name and surname, date of birth, birth number, residence address and other data necessary to fulfill the defined purpose (e.g. to the extent of authorizations, data on registered events and their nominal value).

Recipients of personal data:

Personal data that are part of the agenda of the statutory and supervisory body may be provided by a lawyer for the purpose of providing legal services pursuant to Act No. 586/2003 Coll. on Advocacy. Personal data is provided only in cases where it is necessary within the framework of fulfilling a legal obligation arising from a special legal regulation (the National Central Securities Depository, the competent court, law enforcement authorities, the supervisory authority and other central authorities and the state administration), as part of fulfilling a legal obligation, providing cooperation, and in connection with the application of the legally protected interests of the company.

Period of personal data storage:

Personal data is stored for a defined purpose during the existence of the company and subsequently for 10 years after its termination.

 

4)   Processing of personal data as part of the litigation agenda:

The legal basis for the processing:

Personal data are processed on the basis of Article 6 (c) of the GDPR: processing is necessary to fulfill the legal obligation of the company, particularly resulting from the following legal regulations:

• Act No. 757/2004 Coll. on Courts and on Amendments and Addenda to certain laws.
• Act No. 160/2015 Coll. on Civil Dispute Rules.
• Act No. 301/2005 Coll. on the Criminal Code.

Personal data may be processed under the protection of the company’s legitimate interest on the basis of authorized interests pursuant to Article 6 (f) of the GDPR.

The Data Subject is obliged to tolerate the purpose of the adequate processing of personal data. The consent of the Data Subject is not required for the processing of personal data in the framework of the application of legally protected interests.

Scope of the processed data:

For this purpose, ordinary personal data are usually processed in the scope of identification and contact data of the Data Subjects, in particular: name, surname, address of permanent residence of a natural person, e-mail, telephone, signature and other personal data obtained during the resolution of a specific court dispute, or during the application of the legally protected interests of the company.

Recipients of personal data:

Personal data that are part of the litigation agenda may be provided by a lawyer for the purpose of providing legal services pursuant to Act No. 586/2003 Coll. on Advocacy. Personal data are provided to courts and law enforcement authorities in the framework of providing cooperation and in connection with the application of the legally protected interests of the company.

Period of personal data storage:

Personal data are stored for a defined purpose, particularly taking into account subjective and objective limitation periods and periods related to the company’s interests protected by law even after the end of the court dispute.

5)  Processing of personal data in the framework of selection procedures:

The conditions for the processing of personal data depend on the stage of the contractual relationship (selection procedure, pre-contractual/contractual relationship, storage of contracts, etc.) as well as on the Data Subjects to whom the processing pertains (e.g. candidates in the announced selection procedure, etc.).

5.1 candidates in the announced selection procedure whose personal data are processed as part of the establishment of pre-contractual relationships pursuant to Article 6 (b) of the GDPR: processing is conducted at the request of the Data Subject prior to the closing of the contract

6)  Processing of personal data as part of the promotion of OLVIO, its activities and mission:

OLVIO

Promotion is carried out by the company mainly through the following:

6.1 website (web presentation)

The website processes personal data:

• • to the extent of the Data Subject’s consent pursuant to Article 6 (a) of the GDPR.
    

    More information about the processing of personal data is provided in the relevant consent to the processing of personal data related to the specific situation (related in particular to the disclosure of personal data of vulnerable Data Subjects and other Data Subjects, if the obtaining of consent is required by the specific situation).

  • within the framework of contractual relations pursuant to Article 6 (b) of the GDPR: the processing is necessary for the performance of the Contract to which the Data Subject is a party.

    More detailed information on the processing of personal data is defined by the relevant contractual relationship with the Data Subject.

  • within the legitimate interests of the company pursuant to Article 6 (f) of the GDPR: processing is necessary for the purposes of the legitimate interests pursued by the company, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require the protection of personal data, in particular if the Data Subject is a child.
    

    The legitimate interest of the company is:

    • • building the company’s reputation, promoting its activities and mission, educating clients and the public in order to protect the environment through waste sorting and recycling.
        Within the defined legitimate interest, personal data are processed, in particular during preparation and publishing of promotional articles, photos and videos, within which the personal data of the Data Subjects are also published (in particular their likenesses, opinions and statements, in selected cases also their name, surname and job title/area of activity, or other data under the agreement with a specific Data Subject).
        Personal data is published through the website without a time limit (unless the Data Subject objects), or unless the photos and videos are deleted by the company.
      • Building relationships with clients and the public.
        

        Within the defined legitimate interest, personal data are processed in particular as part of the publication of the photos and identification and contact data of selected employees on the website (for contact employees: title, name, surname, job position, work contact data, and for the company’s top management: photo, title, name, surname and job position).

        Personal data is published through the website during the duration of the employment relationship of the selected employee, or unless the employee objects), or unless the photos and videos are deleted by the company.

      • Security and proper operation of the website.
        

        Within the defined legitimate interest, the personal data of website visitors may be processed, in particular, as part of the processing of data and cookies necessary for the operation of the website (IP address, MAC address of the device with which the visitor views the page and data related to logging in to the client areas (login and password, IP address, MAC address of the device).

        Personal data are processed for the period necessary to achieve the defined legitimate interest, possibly during the contractual relationship with the client (logging into the client area).

        More information on the processing of cookies is published on www.sleepingelephantresort.com

 

6.2 Social media platforms (presenting the company’s profile and mission, running a fanpage and media channels).

Within the framework of social media platforms, personal data is processed:

• • to the extent of the Data Subject’s consent pursuant to Article 6 (a) of the GDPR.
    

    More information about the processing of personal data is provided in the relevant consent to the processing of personal data related to the specific situation (related in particular to the disclosure of personal data of vulnerable Data Subjects and other Data Subjects, if the obtaining of consent is required by the specific situation).

  • within the framework of contractual relations pursuant to Article 6 (b) of the GDPR: the processing is necessary for the performance of the Contract to which the Data Subject is a party
    More information about the processing of personal data is defined by the relevant contractual relationship with the Data Subject.
    
    
  • within the legitimate interests of the company pursuant to Article 6 (f) of the GDPR: processing is necessary for the purposes of the legitimate interests pursued by the company, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject that require the protection of personal data, in particular if the Data Subject is a child.
    

    The legitimate interest of the company is:

    • building the company’s reputation, promoting its activities and mission, educating clients and the public in order to protect the environment through waste sorting and recycling. Within the defined legitimate interest, personal data are processed in particular when preparing and publishing promotional articles, photos and videos, within which the personal data of the Data Subjects (in particular their images, opinions and statements, in selected cases also their name, surname and job title/area of activity, or other data under the agreement with a specific Data Subject) are also published.
      
      
    • Building relationships with clients and the public.
      

      Within the defined legitimate interest, personal data may be processed in particular as part of the publication of photos and identification and contact data of selected employees within social media platforms (for contact employees: title, name, surname, job position, work contact data, and for the company’s top management: photo, title, name, surname and job position).

      Personal data are published through social media platforms during the duration of the employment relationship of the selected employee, or unless the employee objects), or unless the photos and videos are deleted by the company.

WHAT RIGHTS DOES THE DATA SUBJECT HAVE WHEN PROCESSING HIS/HER PERSONAL DATA?

The Data Subject has the right to:

• to information on the processing of his/her personal data,
• gain access to the personal data processed and stored about him/her,
• request the correction of incorrect, inaccurate or incomplete personal data,
• request the deletion of his/her personal data when they are no longer necessary or when the processing is unlawful,
• object to the processing of his/her personal data for marketing purposes or on grounds relating to a particular situation,
• request the restriction of the processing of his/her personal data in special cases,
• receive his/her personal data in a machine-readable format and/or request their transfer to another controller,
• withdraw his/her consent at any time without affecting the lawfulness of processing based on consent granted before its withdrawal, if such consent has been granted by the Data Subject,
• request that decisions based on automated processing relating to him/her or significantly affecting him/her, based on his/her personal data, be made by natural persons and not by automated technical means, if personal data are processed in this manner. The Data Subject has the right to express his/her opinion and object to the decision of OLVIO,
• lodge a complaint with the supervisory authority, in particular in the Member State of its habitual residence, place of work or place of the alleged infringement, and the right to an effective judicial remedy if he/she considers that the processing of his/her personal data is contrary to the law.
  
  The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12
  Bratislava; www.dataprotection.gov.sk, e-mail: statny.dozor@pdp.gov.sk, tel.: +421232313214

• submit a request or complaint to OLVIO in connection with the protection and processing of his/her personal data. Any Data Subject wishing to make a request or complaint and to exercise his/her rights may do so:
  • in writing /in person at: Olvio s.r.o. Námestie gen. Štefánika 534/9, Stará Ľubovňa 064 01, Slovakia
  • electronically at: sleepingelephant@gmail.com

Validity of information on the processing of personal data as of: 16 January 2024