Personal Data Protection

INFORMATION ON THE PERSONAL DATA PROCESSING

1.GENERAL INFORMATION

Information about the controller

The company Benefit Systems Slovakia s.r.o., with the registered office Prievozská 14, 821 09 Bratislava, Company ID: 48 059 528, registered in the Commercial Register administered by the District Court Bratislava I, Section: Sro, Insert No. 102826/B (hereinafter referred to as ”Benefit Systems, ”we , “Company” or “controller”) is the controller of personal data. Benefit Systems attaches great importance to the personal data protection and therefore endeavor to ensure that your personal data are processed in compliance with the applicable Slovak law, including Act No. 18/2018 Coll., on the Protection of Personal Data, as amended (hereinafter referred to as “Act”), and EU regulation, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and on repealing Directive 95/46/EC (General Regulation on the protection of personal data) (hereinafter referred to as ”Directive“) and, where applicable, other relevant laws and regulations if they apply to a specific area of processing.

How can you contact us to get more information on processing of your personal data?

If this Privacy Policy does not provide answers to your questions about the protection of your personal data, you may contact us using any of the following ways:

By a letter sent to the address Benefit Systems Slovakia s.r.o., Prievozská 14, 821 09 Bratislava, mark an envelope with “Personal Data”
By phone +421 949 516 152
Or you can contact data protection officer (DPO) of our Company via e-mail dpo@multi-sport.sk.

The above contact details can also be used for the exercise of your rights as a personal data subject vis-à-vis our company and further if you wish to withdraw your consent to the processing of your personal data granted to our Company.

What is the purpose of this Information?

In the following we inform about the processing of your personal data by the Company as the controller (hereinafter referred to as ”Privacy Policy“ or “Information”), mainly about categories of data subjects, of whom the Company processes personal data, what is the legal basis for processing, for what purposes do we process personal data, what are the recipients of data etc. The purpose of this Information is also to inform data subject about the rights of data subjects.

This Privacy Policy is divided into General information and specific information for each category of data subjects. Please, take into account, besides specific information, General information also apply to you, as data subject.

Categories of data subjects listed below are not all categories whose data are processed by the Company nor all purposes of processing.

For more information about personal data processing, please contact us. Contact details are at the end of this part General information.

Who is the information in this document for?

This document is determined mainly for the following persons:

our clients, partners and other natural or legal persons cooperating with us, including cases when cooperation has not yet been formally established (potential clients, partners and other contractual parties) and in the event when cooperation has already been terminated (former clients, partners and other contractual parties), as well as person acting on behalf of this persons (statutory bodies, employees and other representatives);
job applicants in our Company;
MultiSport card users;
visitors to our websites and profiles on social media network.

What do the terms defined in this document mean?

In this document:

“MultiSport Program“ meansa summary of products and services provided by third parties – Partners, which Benefit Systems enables to Card Users to use for the duration of a contract with the Client. The current review of products and services included in the MultiSport Program can be found on the website https://www.multi-sport.sk in the part Locations.
“Card“ or “MultiSport Card” means a MultiSport card issued by the company Benefit Systems authorizing its holders, Users to use the products and services within the MultiSport Program.
“Client“means a company that provides its Employees and close persons, the benefit, to use products and services within the MultiSport Program.
“Partner“means a person operating the Partner Facility, and who cooperate with Benefit Systems and provides the agreed scope of services in this facilities or enables Card users to use these services.
”Partner Facility“means sports and relax facilities operated by a Partner whose services the User is entitled to use by means of the Card. The current review of Partner Facilities can be found on the website https://www.multi-sport.sk in the part Locations.
“User“means an Employee, Accompanying Person, or a Child using the Card who are authorized to use the products and services within the MultiSport Program.
“Employee“means a natural person performing works for the Client on the basis of employment relationship or an agreement on work performed outside the employment relationship or under another similar contract, and who is the holder of so-called “Employee Card”.
“Accompanying Person“ means a close person to an Employee within the meaning of the definition contained in Act No. 40/1964 Coll., the Civil Code, or partner of the Employee, and who is the holder of the Card of the Accompanying Person (hereinafter referred to as so-called “Accompanying Card”).
“Child“means a child of the Employee of less than 15 years of age, who is the holder of so-called Children´s Card.

What does the term personal data mean?

Personal data are any information relating to an identified or identifiable natural person (e.g., name and surname, address, e-mail address, MultiSport card number and data related to its usage, IP address).

What does the term personal data processing mean?

Personal data processing means any activities and operations which are performed on personal data (e.g., collection, storage, transfer, erasure or analysis). Our objective is to maintain transparency of the grounds and method of processing of personal data. It is our policy to collect and process personal data only when it is necessary to achieve specific purposes. We ask to provide personal data only when necessary.

Is the provision of personal data obligatory? What are the consequences of not providing it?

In general, providing personal data is not obligatory, but may be necessary to use the services provided by our Company, e.g. if legal basis for data processing is performance of contract, providing of data is a contractual condition for performance of the contract. There is no possibility to enter into an agreement, and performance of it, without providing data. Also, if you are interested in using services of the Company as User, it is not possible without providing your data.

If personal data are provided to us by person different from data subject, the person providing data confirms that she (he) has the data subject´s consent to data processing according to Article 78 par. 6 Act.

Who are the recipients of personal data?

The recipients of your personal data, to whom may be your personal data disclosed, are:

Partners,who, according to terms of using of the MultiSport Card (https://multi-sport.sk/en/terms-of-use-multisport-card/), mainly verify if you are legitimate holder of MultiSport Card through the seeing of your personal document and via our devices (or written forms) register the data related to the use of your MultiSport Card. We use these data primarily for billing purposes (that is accounting agenda).
Clients, with whom we share data about employees and potentially other persons who are supposed to be members of the MultiSport Program. We do not share the details about the usage of MultiSport card with our Clients.
External consultants which are companies providing us with legal, consulting, audit and other similar services.
External suppliers who provide some of the services for us, mainly accounting, marketing and IT services.
Subject, to which we have the obligation to provide data according to relevant legislation (state administration bodies and other public authorities).

As we act as one group, the recipients of your personal data are also following companies:

The direct business partners of the Company, which are: MultiSport Benefit, s.r.o., so sídlom Lomnického 1705/9, 140 00 Praha 4, Czech republic, Benefit Systems International spółka z ograniczoną odpowiedzialnością, 00-844 Warsaw, Ul. Młynarska 8/12, POLAND, Benefit Systems S.A., 00-844 Warszaw, Plac Europejski 2, Poland (hereinafter referred to as “Direct business partners” and the companies in this group also hereinafter referred to as the “Group”)
Pre-approved sub-processors of the Company, which are: BMS sp. z o.o., Al. Słowiańska 10B, 01-695 Warsaw, Poland, Primaris Sp. z o.o. Sp. k., ul. Bukowińska 22B, 02-703 Warsaw, POLAND, Betacom S.A., ul. Połczyńska 31 A, 01-377 Warsaw, Poland, Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, IRELAND, Sii Sp. z o.o., Al. Niepodległości 69, 02-626 Warsaw, Poland (hereinafter referred to as “Pre-approved sub-processors”)
The companies with the registered offices in third countries:

Generally, the Company does not transfer personal to the third countries (that is outside European Union and European Economic Area-EEA), however, some entities we work with, have their registered offices in the third countries. In such case, we transfer data under the conditions set by the Directive, where the Commission have decided that the third country ensures an adequate level of protection, or when providing appropriate safeguards, e.g. by using standard contractual clauses approved by the Commission. Such companies are:

Formstack, LLC, 11671 Lantern Rd., Ste. 300, Fishers, Indiana 46038, United states (hereinafter referred to as “Formstack”),
Twilio Inc., 375 Beale Street, Suite 300, San Francisco, California 94105, United states (hereinafter referred to as “Twilio”),
The Rocket Science Group LLC d/b/a MailChimp, Ponce City Market, 675 Ponce De Leon Ave NE E178, Atlanta, GA 30308, United states,

and other, if they are listed in specific purposes of processing in this Information, or, if we have informed you in another way.

Other recipients listed in specific purposes of processing in this Information, or, if we have informed you in another way.

DO WE PERFORM AUTOMATED DECISION-MAKING AND PROFILING?

The Company does not process personal data based on individual decision-making, does not perform profiling, does not provide information society services according to Article 8 Directive and § 15 par 1 of Act.

WHAT RIGHTS DO YOU HAVE IN RELATION TO YOUR PERSONAL DATA WE PROCESS?

Data subjects have mainly the following rights to the processing of personal data:

Right to access to personal data

You have the right to request the confirmation as to whether or not personal data concerning you are being processed. If our Company processes your personal data, you have the right to obtain the following information about its processing in particular: the categories of processed personal data, the purpose of the processing, the envisaged period for which the personal data will be stored (or, if not possible, the criteria used to determine that period), the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations, and where personal data are not collected from the data subject, any available information as to their source.

Right to rectification

You have the right to request the correction of inaccurate or nonactual personal data, or update incomplete personal data about you.

Right to erasure

You have the right to erase your personal if:

Personal data are no longer necessary to the purposes for which they were collected or otherwise processed;
You withdraw your consent on which the processing is based and there is no other legal ground for processing;
You make a legitimate objection to the processing based on a legitimate interest of our Company;
Personal data have been processed unlawfully or
Personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

Right to restriction of processing

You have the right to restriction the processing of your personal data if:

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
you object that the processing is unlawful and oppose the erasure of the personal data and requests the restriction of their use instead;
we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
you object to processing based on legitimate interest until we verify that the legitimate reasons on our side as the controller outweigh your legitimate reasons.

In this case, we will no longer process your personal data or restrict our processing until we are able to demonstrate reasonable grounds for processing or the necessity of processing for the purpose of exercise or defense of legal claims, protection of human or general public interest.

Right to data portability

If our Company processes your personal data under your consent or for the purpose of performing the contract, and if the processing is automated you are entitled to obtain our personal data in a structured, commonly used and machine-readable format, and transmit it to another controller (where technically feasible). Exercise of right to data portability shall not affect the right to deletion of personal data.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on the legal ground, which is the legitimate interest of the controller. The controller shall no longer process the personal data unless he demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

You have the right to object the processing of personal data for direct marketing purposes. If you object to processing for direct marketing purposes, we shall no longer process your data for such purposes.

Right to withdraw consent to the processing of personal data

If your personal data is processed upon your consent, you have the right to withdraw this consent at any time. If you want to withdraw your consent to the processing of your personal data, simply contact us in one of the ways listed in the Privacy Policy below.

To unsubscribe from the newsletter, click on the unsubscribe link in the e-mail message we sent to you.

If we process your personal data upon your consent, withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to file a complaint

You have the right to lodge a complaint to Office for the personal data protection of Slovak republic, if you believe that during the personal data processing there has been a breach of the obligations set by the legislation on the protection of personal data (in particular Directive and Act).

The authority performing supervision of the personal data processing carried out by Benefit Systems is the Office for Personal Data Protection of Slovak republic with the registered office at Hraničná 12, 820 07 Bratislava, https://www.dataprotection.gov.sk. Act in its par. 100 stipulates the essentials of such complaint and the procedure of the Office for the Personal Data Protection in its investigation.

2.SPECIFIC INFORMATION FOR CLIENTS, PARTNERS, SUPPLIERS AND OTHER BUSINESS PARTNERS

How do we obtain personal data?

We have obtained your personal data through various communication channels, depending on the type of cooperation with our Benefit Systems company. If you have not provided us with your personal data directly, we have received it in one of the following ways:

From the Partner, the Client, or other contractual party (hereinafter referred to as “Contractual party” or “Business partner”) for whom you are active (i.e. you are a statutory body, employee or a different representative);
From the websites of the Business partner for whom you are active and from other publicly available sources (e.g. the Commercial Register, ARES application, FinStat).

What is the purpose, legal basis of such processing and the period of retention of personal data? Who are the recipients of personal data?

Purpose of processing: communication with a Business partner, who is a contractual party

Legal basis of processing: performance of a contact (Article 6, par. 1, letter b) of Directive)

Data subjects: natural person, who is the contractual party to the Company

Retention period: 5 years after termination of cooperation

a) smartsupp (CZ) and the sub-processor- Mailgun Technologies Inc (USA), Amazon Web Services, Luxembourg, if you contact us through the live chat,
b) Formstack, if you contact us through the contact forms on our website

Purpose of processing: communication with Business partners and potential Business partners

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive) or the consent (Article 6, par. 1, letter a) of Directive).

Legitimate interest is processing of data of natural person acting on behalf of Business partners in order to enter into contract and ensure proper and efficient performance Consent (Article 6, par. 1, letter a) of Directive)

Data subjects: person acting on behalf of Business partner (mainly statutory body, employee)

Retention period: 5 years following the year in which the communication has ended

3 years from granting consent or until it is revoked

a) smartsupp (CZ) and the sub-processor- Mailgun Technologies Inc (USA), Amazon Web Services, Luxembourg, if you contact us through the live chat,
b) Formstack, if you contact us through the contact forms on our website

Purpose of processing: satisfaction and requirements survey

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive).

The legitimate interest is assessment of satisfaction of the Business partner, improvement of the Company´s reputation and thus strengthening of economic results and improving of the services.

Data subjects: Business partner, person acting on behalf of Business partner

Retention period: 3 years after the survey executing

Recipients: Direct business partners, the processor providing relevant survey

Purpose of processing: accounting agenda

Legal basis of processing: Article 6, par. 1, letter c) of Directive - processing is necessary for compliance with a legal obligation to which the controller is subject (Act No. 431/2002 Coll. on Accounting, Act No. 222/2004 Coll. on value added tax, Act No. 595/2003 Coll. Income tax, and related legislation)

Data subjects: Business partner, person acting on behalf of Business partner, in some cases Users (mainly in order to settlement the entries listed on paper forms) and other subjects, whose personal data are part of the accountant documents

Retention period: period stated by relevant legislation for keeping the documents (10 years following the respective year)

Purpose of processing: registry administration and archiving

Legal basis of processing: Article 6, par. 1, letter c) of Directive - processing is necessary for compliance with a legal obligation to which the controller is subject (Act No. 395/2002 Coll. On archives and registries, Act No. 305/2013 Coll. on the Electronic Form of Governance Conducted by Public Authorities, and related legislation)

Data subjects: subjects, whose personal data are part of the records (natural person – recipients and senders of correspondence, Business partners and other person listed on the documents)

Retention period: for the period necessary to fulfill the purpose of processing, or period set by relevant legislation (in case of daily correspondence 10 years following the year in which was the record created)

Recipients: subject, to which the controller have the obligation to provide data according to relevant legislation, Direct business partners and Pre-approved sub-processors, External consultants

Purpose of processing: exercise or defense of legal claims of the Company

Legal basis of processing: Article 6, par. 1, letter c) of Directive - processing is necessary for compliance with a legal obligation to which the controller is subject (Act no. 162/2015 Coll Administrative Procedure Code, Act no. 160/2015 Coll Civil Dispute Code, Code of Criminal Procedure No. 301/2005, Act no. 233/1995 Coll, Act No. 7/2005 Coll. Bankruptcy and Restructuralization Act, and related legislation)

Data subjects: parties of the dispute, parties of the lawsuit and other interested parties (who can be also the Users, if the Client fails to pay the agreed remuneration)

Retention period: for the period set in legislation for limitation of rights, or pending the settlement of a legal claim enforced in relevant proceeding, up to 10 years after termination of the proceeding

Purpose of processing: marketing activities towards Business partners

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive). The legitimate interest is processing of data of natural person acting on behalf of Business partners in order to informed them about the activities of the Company, in particular sending the brochures, newsletters, information about news, discounts, offers, etc. and also Article 6, par. 1, letter c) of Directive (§ 62 par 3 of Act No. 305/2013 Coll. on electronic communication)

Data subjects: Business partner, person acting on behalf of Business partner

Retention period: until the objection is raised (unsubscribe) until the termination of cooperation at latest

Purpose of processing: internal administrative purposes within the Group

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive). The legitimate interest is providing personal data within the Group in which the Company operates, for internal administrative purposes and in order to improve effectivity of internal procedures

Data subjects: Business partner, person acting on behalf of Business partner.

Retention period: for the period of operation of the Company within the Group

Recipients: subject, to which the controller have the obligation to provide data according to relevant legislation, Direct business partners, Pre-approved sub-processors

Purpose of processing: exercising of rights of data subjects

Legal basis of processing: Article 6, par. 1, letter c) of Directive - processing is necessary for compliance with a legal obligation to which the controller is subject, rising from Directive and Act and related legislation

Data subjects: subjects exercising their rights of data subjects

Retention period: 5 years following the year in which the exercising of right has been finished

a) smartsupp (CZ) and the sub-processor- Mailgun Technologies Inc (USA), Amazon Web Services, Luxembourg, if you contact us through the live chat,
b) Formstack, if you contact us through the contact forms on our website

In which cases do we transfer personal data to third countries?

The Company transfers personal data within processing of personal data for the purpose:

i) accounting agenda, in the scope of e-mail, to which the Company send to Client the invoice for remuneration for the MultiSport Program, to USA, due to using the services of the company Twilio Inc. seated in USA,
ii) communication with a Business partner, who is a contractual party,
iii) communication with Business partners and potential Business partners,
iv) exercising of rights of data subjects,

ii), iii) and iv) if you contact us through the live chat available at website of our Company, to USA, as we use the services of the company smartsupp (CZ), which also cooperates with the company with the registered office in USA (Mailgun Technologies), or if you contact us through the contact forms on our website, to USA, as we use the services of the company Formstack with the registered office in USA.

3.SPECIFIC INFORMATION FOR JOB APPLICANTS

How do we obtain personal data?

We have obtained your personal data through various communication channels, depending on the type of contact with our Company. If you have not provided us with your personal data directly (for example, by sending us a CV), we have received it through the personnel agency to which you provided your personal data.

If we process your personal data upon your consent, withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

What is the purpose, legal basis of such processing and the period of retention of personal data? Who are the recipients of personal data?

Purpose of processing: recruiting of the employees

Legal basis of processing: Article 6, par. 1, letter b) of Directive - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Data subjects: job applicants, person who apply for a job upon agreement on work performed outside the employment contract

Retention period: duration of recruiting process and if the applicant is successful, during the process of entering into contract

3 years from granting consent or until it is revoked

Purpose of processing: exercising of rights of data subjects

Data subjects: subjects exercising their rights of data subjects

Retention period: 5 years following the year in which the exercising of right has been finished

a) smartsupp (CZ) and the sub-processor- Mailgun Technologies Inc (USA), Amazon Web Services, Luxembourg, if you contact us through the live chat,
b) Formstack, if you contact us through the contact forms on our website

We do not process and do not require from you special categories of personal data nor the personal identification number. We also do not request to send us your photo.

In which cases do we transfer personal data to third countries?

The Company transfers personal data within processing of personal data for the purpose exercising of rights of data subjects, if you contact us through the live chat available at website of our Company, to USA, as we use the services of the company smartsupp (CZ), which also cooperates with the company with the registered office in USA (Mailgun Technologies), or if you contact us through the contact forms on our website, to USA, as we use the services of the company Formstack with the registered office in USA.

4.SPECIFIC INFORMATION FOR MULTISPORT CARD USERS

Benefit Systems hereby, also through this Privacy Policy, informs you as a User of the MultiSport Card about the processing of your personal data by us as a controller.

How do we obtain personal data?

We have obtained your personal data through various communication channels, depending on the type of cooperation with our Company. We have received your personal data in one of the following ways:

From the Client who has concluded a contract with us on the basis of which its employees are entitled to participate in the MultiSport Program through Cards. If you are a holder of an Employee Card holder, your personal data has been provided to us by your employer who has agreed with you on your participation in the Multisport Program. If you are the holder of an Accompanying Card, your personal data has been given to us by the employer of the person who has agreed with you on your participation in the Multisport Program (that is the holder of the Employee Card). If you are a holder of a Children's Card, your personal data has been given to us by your parent's employer or other legal representative (the holder of the Employee Card).
You have provided us with your personal data directly or it has been provided by a person who agreed with you on your participation in the MultiSport Program (in the case of the Accompanying Card) or your parent or other legal guardian (in the case of the Children's Card) through the registration on our website (through My MultiSport) or our mobile app My MultiSport or using the services of the company Microsoft or Formstack, LLC, in connection with a contract concluded with us by the Client on the basis of which its employees and close persons are entitled to participate in the MultiSport Program.
From our Partners in the scope of data of the use of the MultiSport card.

In connection to using of the MultiSport Virtual Card, the user of the Virtual card is also the data subject according to Virtual Card Privacy Policy available in the process of registration in My MultiSport mobile app and in My MultiSport platform on website www.multi-sport.sk in section Consents (Privacy policy – mobile app).

What is the purpose, legal basis of such processing and the period of retention of personal data? Who are the recipients of personal data?

Purpose of processing: Enable the implementation of the MultiSport Program, the use of negotiated non-cash sports benefits, the MultiSport Card issuance and life cycle management, the use of the MultiSport Card, including the use of services made available exclusively by the MultiSport Card holder

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive). The legitimate interest of the Company is to properly provide its services, the MultiSport Program.

Data subjects: employees of Client, Accompanying person and Children of employee, and other person to whom is the MultiSport Program provided (hereinafter referred to as “Users”)

Retention period: 18 months after termination the membership of User in the MultiSport Program

Recipients: subject, to which the controller have the obligation to provide data according to relevant legislation, Direct business partners and Pre-approved sub-processors, Partners, Client as the employer of employee of the Employee card holder, Eternal consultants, the company Formstack (USA), if the User uses the service of this company for the registering into MultiSport Program, or another act (change, termination, etc.)

Purpose of processing: accounting agenda

Legal basis of processing: Article 6, par. 1, letter c) of Directive - processing is necessary for compliance with a legal obligation to which the controller is subject (Act No. 431/2002 Coll. on Accounting, Act No. 222/2004 Coll. on value added tax, Act No. 595/2003 Coll. Income tax, and related legislation)

Retention period: period stated by relevant legislation for keeping the documents (10 years following the respective year)

Purpose of processing: exercise or defense of legal claims of the Company

Data subjects: parties of the dispute, parties of the lawsuit and other interested parties (who can be also the Users, if the Client fails to pay the agreed remuneration)

Purpose of processing: internal administrative purposes within the Group

Data subjects: Business partner, person acting on behalf of Business partner.

Retention period: for the period of operation of the Company within the Group

Recipients: subject, to which the controller have the obligation to provide data according to relevant legislation, Direct business partners, Pre-approved sub-processors

Purpose of processing: fraud prevention

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive). The legitimate interest is processing of personal data necessary for the purposes of fraud prevention (par. 47 Recital of Directive)

Data subjects: Users, person acting on behalf of Partner

Retention period: for the period of solving of suspected fraud, and for the duration of claims recovery.

Recipients: subject, to which the controller have the obligation to provide data according to relevant legislation, Direct business partners and Pre-approved sub-processors

Purpose of processing: communication with Users and potential Users

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive). The legitimate interest is to answer the questions and solve the requests of Users and potential Users

Data subjects: person initiating the communication with the Company

Retention period: depends on your selected method of communication: i) if you contact us via e-mail it is the duration of communication and maximum of 18 months from the end of communication and if there is a need to store data for the purpose of defending legal claims, for the duration according to purpose exercise or defense of legal claims of the Company, ii) if you contact us through the live chat it is the duration of communication and maximum of 1 year and if there is a need to store data for the purpose of defending legal claims, for the duration according to purpose exercise or defense of legal claims of the Company, iii) if you contact through the contact forms on our website it is it is the duration of communication and maximum of 6 months and if there is a need to store data for the purpose of defending legal claims, for the duration according to purpose exercise or defense of legal claims of the Company, iv) if you contact us through Facebook (messenger) it is it is the duration of communication and further according to the conditions of the service provider and if there is a need to store data for the purpose of defending legal claims, for the duration according to purpose exercise or defense of legal claims of the Company.

a) smartsupp (CZ) and the sub-processor- Mailgun Technologies Inc (USA), Amazon Web Services, Luxembourg, if you contact us through the live chat,
b) Formstack, if you contact us through the contact forms on our website,

Purpose of processing: exercising of rights of data subjects

Legal basis of processing: legitimate interest (Article 6, par. 1, letter c) of Directive - processing is necessary for compliance with a legal obligation to which the controller is subject, rising from Directive and Act and related legislation

Data subjects: subjects exercising their rights of data subjects

Retention period: 5 years following the year in which the exercising of right has been finished

a) smartsupp (CZ) and the sub-processor- Mailgun Technologies Inc (USA), Amazon Web Services, Luxembourg, if you contact us through the live chat,
b) Formstack, if you contact us through the contact forms on our website

Purpose of processing: marketing activities towards the Users (note: only if you gave us your consent)

Legal basis of processing: consent (Article 6, par. 1, letter a) of Directive)

Data subjects: person who granted the consent, mainly Users

Retention period: 18 months after termination of the membership in the MultiSport Program or until its withdrawal

In which cases do we transfer personal data to third countries?

The Company transfers personal data within processing of personal data for the purpose:

i) MultiSport Program - enable the implementation of the MultiSport Program, the use of negotiated non-cash sports benefits, the MultiSport Card issuance and life cycle management, the use of the MultiSport Card, including the use of services made available exclusively by the MultiSport Card holder, if the User uses the service of the company Formstack for the registering into MultiSport Program, or another act (change, termination, etc.), to USA, as we use the services of this company seated in USA for stated purpose,
ii) communication with Users and potential Users
iii) exercising of rights of data subjects,

ii) and iii) if you contact us through the live chat available at website of our Company, to USA, as we use the services of the company smartsupp (CZ), which also cooperates with the company with the registered office in USA (Mailgun Technologies), or if you contact us through the contact forms on our website, to USA, as we use the services of the company Formstack with the registered office in USA.

5.SPECIFIC INFORMATION FOR VISITORS OF OUR WEB SITES AND OUR SOCIAL MEDIA PROFILES

If you are a visitors of our websites (https://www.multi-sport.sk) and use one of the method of communication with us, we process of your personal data as follows:

Purpose of processing: communication with Users and potential Users

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive). The legitimate interest is to answer the questions and solve the requests of Users and potential Users

Data subjects: person initiating the communication with the Company

a) smartsupp (CZ) and the sub-processor- Mailgun Technologies Inc (USA), Amazon Web Services, Luxembourg, if you contact us through the live chat,
b) Formstack, if you contact us through the contact forms on our website,

Purpose of processing: exercising of rights of data subjects

Data subjects: subjects exercising their rights of data subjects

Retention period: 5 years following the year in which the exercising of right has been finished

a) smartsupp (CZ) and the sub-processor- Mailgun Technologies Inc (USA), Amazon Web Services, Luxembourg, if you contact us through the live chat,
b) Formstack, if you contact us through the contact forms on our website,

In which cases do we transfer personal data to third countries?

The Company transfers personal data within processing of personal data for the purpose:

i) communication with Users and potential Users
ii) exercising of rights of data subjects,
i) and ii) if you contact us through the live chat available at website of our Company, to USA, as we use the services of the company smartsupp (CZ), which also cooperates with the company with the registered office in USA (Mailgun Technologies), or if you contact us through the contact forms on our website, to USA, as we use the services of the company Formstack with the registered office in USA.

The Company have profiles on some social networks; when processing personal data through its profiles, Company has only typical administrator rights. When using social networks, personal data are also processed by the providers of these social networks (e.g. Facebook, Instagram), whereas, the Company generally has no control over such processing, further providing, transfer to third countries (provided by these providers of social networks) and is not responsible for it. We recommend you become familiar with the privacy policy of these providers of social networks.

More detailed information on processing of personal data by these providers of social networks and other possibilities of exercising of your rights (right to revoke the consent, right to object), please find in privacy policies of relevant providers of social networks:

Facebook: https://www.facebook.com/privacy/explanation
Instagram: https://help.instagram.com/519522125107875
Youtube: https://policies.google.com/privacy?hl=sk
LinkedIn: https://privacy.linkedin.com/

or on websites replacing above stated websites in future.

The Company is responsible of the processing of your personal data if it has status of joint controller (social network – statistic purpose – Facebook) or as controller using the services of the processor.

Purpose of processing: social media profiles managing including communication and discussion with users (“Fanpages” on Facebook, Instagram, youtube and other social media sites) -purpose is promotion and offer of the Company´s services on social media sites, communication with users, promotion of contests and accompanying activities through the social media sites, providing information to the public

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive). The legitimate interest is creation of profile of the Company on social media sites; promotion and presentation of services provided by the Company on social media sites, communication with users, organization of contests and accompanying activities through the social media sites, providing information to the public

Data subjects: visitor of Company´s profile on social media site (user of relevant social media site)

Retention period: Retention period depends on the specific case, e.g. the nature of the data, the reason why they are collected and processed, the relevant legislation or the operational storage needs. Data is stored: a) for the period of operation of the Company´s profile on relevant social media site, or b) until they are no longer needed to provide services or product of operator of the relevant social media network, or c) until you delete your profile (account); whichever comes first.

Special retention period for Youtube please see: https://policies.google. com/technologies/rete ntion?hl=sk- othwerwise the Company will remove as soon as you request it.

Special retention period for Instagram - until they are no longer needed to provide services or product of Facebook, until you delete your profile (account); whichever comes first - https://help.instagram. com/519522125107875

Recipients: subject, to which the controller have the obligation to provide data according to relevant legislation, processor providing Company´s social media networks administration.

In data file custom audiences“ and „measurement and analytics“ services, the operator of Facebook has the status of processor towards the Company (in this case following legal guaranties shall apply on personal data processing: https://www.facebook.com/legal/terms/businesstools , https://www.facebook.com/legal/terms/dataprocessing).

Purpose of processing: LinkedIn profile managing including communication and discussion with users – the purpose is promotion and offer of the Company´s services on social media sites, communication with users, promotion of contests and accompanying activities through LinkedIn, providing information to the public

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive). The legitimate interest is creation of profile of the Company on LinkedIn; promotion and presentation of services provided by the Company on LinkedIn, communication with users, organization of contests and accompanying activities through LinkedIn, providing information to the public

Data subjects: visitor of Company´s profile on social media site (LinkedIn user)

Retention period: Retention period depends on the specific case, e.g. the nature of the data, the reason why they are collected and processed, the relevant legislation or the operational storage needs. Data is stored: a) for the period of operation of the Company´s profile on LinkedIn, or b) until they are no longer needed to provide services or product of operator of LinkedIn, or c) until you delete your profile (account); whichever comes first.

Special retention period for LinkedIn please see: https://www.linkedin.com/legal/privacy-policy

Recipients: subject, to which the controller have the obligation to provide data according to relevant legislation, processor providing Company´s profile on LinkedIn administration

Purpose of processing: Social media sites – statistical purposes (joint controllers with the company Facebook)

Legal basis of processing: legitimate interest (Article 6, par. 1, letter f) of Directive), which is obtaining of personal data on the basis of legal base of the original purpose and their further processing for statistical purposes for using Facebook network according to Article 89 of Directive. The legitimate interest is obtaining, that is the processing of multiple data, mostly demographic data of the target group such as data relating to age, gender, marital status, occupation, lifestyle and interests of visitors of fanpage. The Company has set the parameters also according to target group as well as the goals of managing or supporting its activities, which has an impact on the personal data processing for the purpose of compiling the statistics obtained from the site visits. In the case of Facebook, the Company may, using the filters providing by Facebook, define the criteria on the basis of which these statistic are to be compiled, as well as the categories of persons whose data will be used by Facebook. The Company, as the owner and administrator of the fanpage on Facebook, therefore, contributes to the processing of personal data of visitors. All this information allows to the Company e.g. find out the profile of visitors who positively rate the fanpage, in order to offer more relevant content and develop features that visitors might be more interested.

Data subjects: visitor of Company´s profile on social media site (user of relevant social media site)

Recipients: subject, to which the controller have the obligation to provide data according to relevant legislation, processor providing Company´s social media networks administration

We use cookies on our websites and social media sites. Find out more information here.

6.AMENDMENTS TO THIS PRIVACY POLICY

We periodically control and update this Privacy Policy in connection with amendments to the applicable legal regulations, changes in the scope of our processing of personal data, and our efforts to improve the level of security of your personal data and the quality of our services.

Please note following most important changes to this Privacy policy:

September 2021 – amendment of retention period of Users in the purpose “Enable the implementation of the MultiSport Program, the use of negotiated non-cash sports benefits, the MultiSport Card issuance and life cycle management, the use of the MultiSport Card, including the use of services made available exclusively by the MultiSport Card holder” to 18 months after termination the membership of User in the MultiSport Program.

This Privacy Policy is executed in Slovak and English version. In case of discrepancy, Slovak version shall prevail.