MultiSport - personal data protection

Personal Data Protection

1. GENERAL INFORMATION

Information about us

The company Benefit Systems Slovakia s.r.o., with the registered office Ružová dolina 6, Bratislava, Post Code 821 08, Company ID: 48 059 528, registered in the Commercial Register administered by the District Court Bratislava I, Section: Sro, Insert No. 102826/B (hereinafter "Benefit Systems" or "we" or "us") takes personal data protection very seriously. We therefore take all care to ensure that your personal data is processed in accordance with the applicable law, in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and on repealing Directive 95/46/EC (General Regulation on the protection of personal data) (hereinafter "GDPR") and by Act No. 18/2018 Coll., on the Protection of Personal Data and on Amendments to Certain Acts, as amended (the "Data Protection Act").

What is the purpose of this document?

This document (hereinafter the "Privacy Policy") provides the legal basis for our processing of personal data, rules on the collection, use and other processing operations performed. The intent of the Privacy Policy is also to inform you of your rights in relation to the personal data we process. Benefit Systems uses your personal data for the purposes set out in this Privacy Policy and, if applicable, for other purposes not listed here, which will be disclosed to you in individual cases.

Whom is the information contained in this document provided?

This document is determined for the following persons:

  • Our clients, partners and other natural or legal persons cooperating with us, including cases when cooperation has not yet been formally established (potential clients, partners and other collaborators) and in the event when cooperation has already been terminated (former clients, partners and other cooperating persons), as well as for members of the statutory bodies, employees and other representatives of these persons;
  • Job applicants in our company;
  • MULTISPORT card users;
  • Visitors to our websites;
  • Other persons not listed above whose personal data will be processed by our company.

What are personal data?

Personal data means any information about an identified or identifiable natural person (e.g., name and surname, address, e-mail address, MULTISPORT card number and data related to its usage, IP address of visitors to our websites). Benefit Systems processes personal data for various purposes. The legal basis for the processing of personal data, the processing time and the retention of personal data may vary depending on the purpose of the transactions.

What is personal data processing?

Processing is any operation or set of operations with personal data (e.g., collection, storage, use, analysis, transfer, deletion). Our intention is to maintain transparency as regards the legal basis and the method of the personal data processing. In accordance with our policies, we collect and process personal data only when it is necessary for specific purposes and for the required time, and we ask you to provide us with your personal data only in the necessary cases.

Who is the controller of your personal data and what does it mean for you?

Benefit Systems itself determines the purposes and means of your personal data processing, and therefore it is the controller of your personal data in the relationship with you. So, we decide what type of your personal data will be processed, what means will be used and why do we process your personal data (for what purposes).

Within the extent of our processing, we are therefore responsible for the legality of your personal data processing and you may contact us regarding the exercise of your rights in this area.

How is your personal data processed?

All personal data is processed by Benefit Systems in an automated or manual manner. Automated processing takes place in our information systems, or in the information systems of our processors, i.e. third parties, which we have entrusted with specific processing operations.

Our company has taken steps to ensure that only our employees and processors with whom we have concluded a written agreement on the processing of personal data have access to your personal data. These persons are bound by the obligation of confidentiality in relation to all personal data they have come into contact with when performing their activities.

Based on your personal data, is automated decision taken or profiling made in a way that affects your rights?

There is no automated decision making in our company, i.e. no decision-making is based solely on automated processing (including profiling) that would have legal effects for you, or otherwise have a significant impact on you.

What does security of personal data mean for us?

Benefit Systems approaches security of the data it retains, very conscientiously and seriously. To that end, we have put in place the appropriate organizational and technical procedures, and we train our staff to protect privacy, confidentiality and security of personal data. In addition, we conduct regular inspections of established security procedures as to their sufficiency in relation to the nature and extent of personal data we process.

Whom do we share your personal data with?

Benefit Systems may share your personal data with third parties as recipients or may transfer them to such third parties if any of the legal bases under GDPR is given for such disclosure (transfer). These recipients also include processors who carry out processing operations with your personal data on behalf of our company.

Specifically, our company may share your personal data with the following recipients (the recipients of the following categories):

  • Our partners who are operators of sports and relax facilities listed on sk https://www.multi-sport.sk and whose services are used on the basis of the MULTISPORT card. Partners especially verify your identity in their centres according to the information printed on the MULTISPORT card and through our facilities (or written forms) they record the data related to the use of your MULTISPORT card. We use these data primarily for billing purposes.
  • Our clients who are your employers (or the employers of a person who, in agreement with you, has joined you in the MultiSport program). We share data with our clients about who of their specific employees and potentially other persons are supposed to be members of the MULTISPORT Program. We do not share with our clients the details about the use of your MULTISPORT card.
  • External consultants which are companies providing us with legal, consulting, auditing and other similar services.
  • External suppliers who, based on our mandate, carry out processing operations with your personal data. Specifically, these are companies that provide accounting, debt management, marketing and IT services. Furthermore, companies that print MULTISPORT cards, providers of other services available under the MultiSport Program, entities providing electronic payment services, companies providing user support services and promoting our marketing activities.
  • State administration bodies and other public authorities with whom we may share your personal data under certain circumstances stipulated by the legal regulations (e.g. tax offices, police).

As we act as one group, your personal data may be transferred to the following companies:

  • Benefit Systems spólka akcyjna, with the registered office at the address: 00-844 Warsaw, Plac Europejski 2, Poland, reg. no. 750721670
  • MultiSport Benefit, s.r.o., with the registered office Lomnického 1705/9, Prague 4, Post Code 140 00, Company ID: 24715298
  • Benefit Systems International spółka z ograniczoną odpowiedzialnością, with the registered office at the address: 00-844 Warsaw, Plac Europejski 2, Poland, reg. no. 0000538050

All of the above entities are located within the European Economic Area. Therefore, we do not transfer your personal data to countries outside the European Economic Area.

How can you contact us to get more information about your personal data processing?

If this Privacy Policy does not provide answers to your questions about the protection of your personal data, you may contact us using any of the following ways:

  • By a letter sent to the address Benefit Systems Slovakia s.r.o., Ružová dolina 6, 821 08 Bratislava, mark an envelope with “Personal Data”
  • By e-mail sent to the address dpo@multi-sport.sk
  • By phone +421 949 516 152

The above contact details can also be used for the potential exercise of your rights as a personal data subject vis-à-vis our company and further if you wish to withdraw your consent to the processing of your personal data granted to our company.

2. SPECIFIC INFORMATION ON PROCESSED PERSONAL DATA FOR CLIENTS, PARTNERS AND OTHER COOPERATING PERSONS

Benefit Systems hereby informs you as clients, partners and other cooperating persons about the processing of your personal data by us as a controller.

In Privacy Policy, we further work with the following terms:

  • “MultiSport Program“ means a summary of products and services provided by third parties - Partners that Benefit Systems enables card users to use for the duration of a contract with the Client. The current list of products and services included in the MultiSport program is published on the website https://www.multi-sport.sk.
  • “Card“ means a MULTISPORT card issued by Benefit Systems company authorizing users to use MultiSport products and services.
  • “Client“ means a company that provides its employees with benefits in the form of using products and services within the MultiSport Program via Cards.
  • “Partner“ means a person operating sports and relax facilities that cooperate with Benefit Systems and provides the said facilities for the agreed scope of services or enables Card users to use these services.

How have we obtained your personal data?

We have obtained your personal data through various communication channels, depending on the type of cooperation with our Benefit Systems company. If you have not provided us with your personal data directly, we have received it in one of the following ways:

  • From the Partner, the Client, and other cooperating persons for whom you are active (i.e. you are a statutory body, employee or a different representative);
  • From the websites of the Partner, the Client and other cooperating persons for whom you are active and from other publicly available sources (e.g. the Commercial Register, ARES application).

What personal data do we process? What is the purpose and legal basis of such processing and the period of retention of personal data?

The following table lists the personal data we process, together with the purpose and legal basis of such processing. We also provide information on how long personal data is retained.

Categories of personal data Personal data Purpose of processing Legal basis of processing

(in relation to the particular purpose)

Retention period
  • Identification details
  • Contact details
  • Business data
  • Name and surname
  • Date of birth
  • Address of the registered office
  • Position with the Partner, the Client or other cooperating persons or relationship with these persons
  • Telephone contact
  • E-mail address
  • Information on existing business cooperation and communication
  • Contacting and negotiating a contract
  • Conclusion and performance of the contract and related communication
  • Execution of billing and invoicing under the contract
  • Processing is necessary for the conclusion and performance of the contract
  • During the negotiation of the contract and for the duration of the contract
  • Recording and recovery of possible claims
  • Keeping of concluded contracts and related documentation and communication in electronic and physical forms
  • Processing is necessary for the purposes of our legitimate interest in the recovery of claims and the defence of our rights
  • From the termination of the contract for the duration of the applicable limitation period and then for one year
  • Processing of personal data in accounting and tax documents
  • Keeping accounting and tax documents in electronic and physical forms
  • Processing is necessary to meet our legal obligations on the basis of tax and accounting legislation
  • For the period provided for by the relevant legislation
  • Direct marketing, which consists of promoting and offering new products or services of our company
  • Sending information about new services and products
  • Improving service quality by conducting user satisfaction surveys through your chosen channel
  • Processing is necessary for the purposes of our legitimate interest in conducting direct marketing
  • For the duration of the contract and for a period of three years after the termination of the contract
  • Management of identification and contact details in the database for the purpose of contacting a potential Partner, the Client or other third parties in order to establish co-operation
  • Management of identification and contact details in the database for the purpose of contacting a potential Partner, Client or other third party for the purpose of resuming cooperation after termination of the contract
  • Processing based on consent (including, for example, providing contact details by e-mail, handing over a business card with contact details)
  • For the period for which consent was given, otherwise for a period of three years or until the consent was withdrawn
  • sProcessing is necessary for the purposes of our legitimate interest in maintaining the obtained basic identification and contact information
  • For the period of three years from the conclusion of the contract
  • For the period of three years after termination of the contract

3. SPECIFIC INFORMATION FOR JOB APPLICANTS ON PERSONAL DATA PROCESSING

Benefit Systems hereby informs you as a person applying for a job in our company about the processing of your personal data by us as a controller.

How have we obtained your personal data?

We have obtained your personal data through various communication channels, depending on the type of contact with our company. If you have not provided us with your personal data directly (for example, by sending a CV, filling in the form on our website), we have received it through the personnel agency to which you provided your personal data.

What personal data do we process? What is the purpose and legal basis of such processing and the period of retention of personal data?

The table below provides an overview of the personal data we process, together with the purpose and legal basis of such processing. We also provide information on how long personal data is retained.

Categories of
personal data
Personal data Purpose of processing Legal basis of processing

(in relation to the particular purpose)

Retention period
  • Identification details
  • Contact details

  • Name and surname
  • Date of birth
  • Address of residence
  • E-mail address
  • Telephone contact
  • Contacting you to address you with a job offer and participation in a job interview
  • informing you about the outcome of the job interview
  • Negotiations on the conclusion of an employment contract or other similar contract
  • Processing is necessary for the conclusion and performance of the contract
  • During the negotiations on the conclusion of the contract
  • Processing based on consent (including, for example, the provision of contact details within CV)
  • For the period for which consent was granted, otherwise three years or until the consent was withdrawn
  • Keeping basic identification and contact details in the database of rejected job applicants in order to avoid repeating the recruitment procedure
  • Maintaining basic identification and contact details in the database of rejected applicants in order to address them in the future
  • Processing is necessary for the purposes of our legitimate interest in ensuring the efficiency of the recruitment procedure
  • Three years from the receipt of the data
  • Processing based on consent given by an unsuccessful job applicant to be able to address him/her in future
  • For the period for which consent was granted, otherwise for three years or until the consent was withdrawn
  • Data about the applicant listed in the CV or other document provided to our company
  • Data about the applicant communicated by the applicant during a job interview or by other means
  • Achieved education
  • Work experience
  • Further information about the applicant’s qualification
  • Assessment of whether the company has recruited job applicant for the employment or similar relationship
  • Processing is necessary for the conclusion and performance of the contract
  • During the negotiation of the contract
  • Data regarding evaluation of the applicant prepared by us
  • Basic information on assessing the suitability of an applicant for a given job position
  • Maintaining basic information on the outcome of the recruitment procedure for negotiation on the conclusion and content of the employment contract
  • Processing is necessary for the conclusion and performance of the contract
  • During the negotiation of the contract

  • Basic information on why the applicant was assessed as inappropriate for the job
  • Information on whether a company may be interested in further cooperation with a rejected job applicant
  • Maintaining basic information on the reasons for the refusal of the applicant in the database of rejected applicants in order to avoid repeating the recruitment procedure
  • Processing is necessary for the purposes of our legitimate interest in ensuring the efficiency of the recruitment procedure
  • Three years from the receipt of the data
  • Maintaining basic identification and contact details in the database of the rejected applicants in order to be able to address them in future
  • Processing based on consent given by an unsuccessful job applicant to be able to address him/her in future
  • For the period for which consent was granted, otherwise for three years or until the consent was withdrawn

4. SPECIFIC INFORMATION FOR MULTISPORT CARD USERS ON PERSONAL DATA PROCESSING

Benefit Systems hereby informs you as a user of the MULTISPORT card about the processing of your personal data by us as a controller.

In the Privacy Policy, we also work with the following terms:

  • “MultiSport Program“ a summary of products and services provided by third parties - Partners that Benefit Systems enables card users to use for the duration of a contract with the Client. The current list of products and services included in the MultiSport program is published on the website https://www.multi-sport.sk.
    • “Client“ means a company that provides its employees with benefit in the form of receiving products and services within the MultiSport Program via Cards.
    • “Partner“ means a person operating sports and relax facilities that cooperate with Benefit Systems and provides the said facilities for the agreed scope of services (Partner facilities) or enables Card Users to use these services.
    • “Partner Facilities“ means sports and relax facilities operated by a Partner whose services the User is entitled to use by means of the Card. The current list of Partner Facilities is published on the website https://www.multi-sport.sk.
    • “Card“ means a MULTISPORT card issued by Benefit Systems authorizing Card Users to use Benefit Systems products and services within the MultiSport Program, i.e. to use services in Partner Facilities.
    • “List“ means the list of names of the Users delivered to the Benefit Systems by the Client.
    • “User“ means an Employee, Accompanying Person, or a Child using the Card who are authorized to use Benefit Systems products and services.
    • “Employee“ means a natural person performing works for the Client on the basis of employment relationship or an agreement on work done outside the employment relationship or under another similar contract, in particular a contract for the provision of services.
    • Employee Card“ means the MULTISPORT Card issued to the Employee.
    • “Accompanying Person“ means a close person of an Employee within the meaning of the definition contained in Act No. 40/1964 Coll., the Civil Code, listed on the List, and a partner of the Employee included in the list is also considered the Accompanying Person.
    • “Card of the Accompanying Person“ means a MULTISPORT Card issued to the Accompanying Person.
    • “Child“ means a child of the Employee of less than 15 years of age listed on the List; and a "Children's card" means the MULTISPORT Card issued to the Child.
    • „Test Card“ means the MULTISPORT Card issued either directly to the User as part of a Benefit Systems promotional event or to a potential Client for the purpose of its acquisition.

    How have we obtained your personal data?

    We have obtained your personal data through various communication channels, depending on the type of cooperation with our Benefit Systems company. We have received your personal data in one of the following ways:

    • From the Client who has concluded a contract with us on the basis of which his employees are entitled to participate in the MultiSport Program through Cards or has expressed an interest in joining the program through Test Cards. If you are an Employee Card holder, your personal data has been provided to us by your employer who has agreed with you on your participation in the Multisport Program. If you are the Accompanying Person Card holder, your personal data has been given to us by the employer of the person who has agreed with you on your participation in the Multisport Program. If you hold a Children's Card, your personal data has been given to us by your parent's employer or other legal representative.
    • You have provided us with your personal data directly or it has been provided by a person who agreed with you on your participation in the MultiSport Program (in the case of the Accompanying Card) or your parent or other legal guardian (in the case of a Child Card) through the IT systems proposed (for example, Formstack) in connection with a contract concluded with us by the Client on the basis of which its employees are entitled to participate in the MultiSport Program or the Client has expressed an interest to test this program through Test Cards.
      • You have provided us with your personal data directly upon agreement between you and us about your participation in the Multisport Program via the Test Card.

      What personal data do we process? What is the purpose and legal basis of such processing and the period of retention of personal data?

      The following table lists the personal data we process, together with the purpose and legal basis of such processing. We also provide information on how long personal data is retained.

      Categories of personal data Personal data Purpose of processing Legal basis of processing

      (in relation to the particular purpose)

      Retention period
      • Identification details
      • Contact details
      • Data for indirect identification
      • Data related to the use of the Card
      • Name and surname
      • Date of birth (for a Child)
      • Card number
      • Name of the Client (your Employer)
      • Frequency of use of the Card (Data and time of use), Visited Partner facilities, selected services
      • Implementation of the MultiSport Program, the use of negotiated non-monetary sports benefits, issue of the Card and its lifecycle management
      • Financial statements and invoicing of services used by the Card User in Partner Facilities
      • Accounting and performance of a contract concluded with the Client
      • Need to verify the User's identity in Partner Facilities
      • Maintaining an account in the online platform
      • Sending information to the User regarding the terms of use of the Card
      • Processing is necessary for the conclusion and performance of a contract under which the User is involved in the MultiSport Program

      • Throughout the duration of the contract (User's membership in the MultiSport Program)
      • Analysis and collection of statistical data to expand our services and improve availability of Partner Facilities
      • Implementation of direct marketing by offering new products or services by our company
      • Improvement of service quality by conducting user satisfaction surveys through your chosen communication channel;
      • The need to avoid fraud and misuse of the Card (especially with regard to its non-transferability)
      • Processing is necessary for the purposes of our legitimate interests
      • For the duration of the User's membership in the Multisport Program
      • Financial statements and invoicing of services used by the Card User in Partner Facilities
      • Compliance with legal obligations imposed by tax and accounting regulations
      • For the period and to the extent specified by applicable legal regulations
      • Recording and recovery of possible claims
      • Recording of data associated with the use of Cards
      • Processing is necessary for the purposes of our legitimate interest in the recovery of claims and the defence of our rights
      • From termination of performance of the contract (User's membership in the MultiSport Program) for the duration of the respective limitation period and for one year
      • Identification details
      • Contact details
      • Name and surname
      • Card number
      • Name of the Client (your employer)
      • E-mail address
      • Telephone contact
      • Organization of competitions and promotional campaigns you can take part in
      • Information about the events we organise, offer of other services, reminding you of important information that affects the provision of our services (newsletters)
      • Provision of services related to the use of the MultiSport Program (including customer support, notifications, and complaints)
      • Processing based on your consent for marketing purposes
      • For the period for which consent was granted, otherwise for three years or until the consent was withdrawn

      5. SPECIFIC INFORMATION FOR VISITORS OF OUR WEB SITES ON PERSONAL DATA PROCESSING

      Benefit Systems hereby informs you as visitors of our websites at https://www.multi-sport.sk about processing of your personal data performed by us as a controller.

      How do we collect your personal data?

      We collect your personal data through our websites (e.g. through tracking pixels) and cookies stored in your devices (especially computers and mobile phones). Benefit Systems cookies are subject to the privacy policy available on our websites at www.multi-sport.sk/zasady-cookies.

      What personal data do we process? What is the purpose and legal basis of such processing and the period of retention of personal data?

      The following table lists the personal data we process, together with the purpose and legal basis of such processing. We also provide information on how long personal data is retained.

      Categories of personal data Personal data Purpose of processing Legal basis of processing

      (in relation to the particular purpose)

      Retention period
      • Information about visits to our websites
      • Visitor's IP address of the device
      • Visitor's mobile devices IDs
      • Personal data contained in cookies stored in end-user devices (visitors) intended to use our website
      • Obtaining information about visitors to our websites to improve and optimize and customize content by user preferences
      • Obtaining information about visitors to our websites to improve our services
      • Records of visits to our websites for statistical and analytical purposes
      • Marketing and promotion of our services
      • Processing is necessary for the purposes of our legitimate interest in achieving the stated purposes
      • Up to one year from the date of receipt of the data
      • Processing based on permission given by a visitor to the site (if required)
      • For the period for which consent was granted, otherwise for three years or until the consent was withdrawn

      6. COMMON INFORMATION ON YOUR RIGHTS IN RELATION TO PERSONAL DATA PROCESSING

      What rights do you have in relation to your personal data we process?

      The processing of your personal data is governed by the following rights under the applicable legal regulations (especially GDPR) that you may exercise under the determined terms and conditions at any time by contacting us in any of the ways listed in Part 1 (General Information) of this Privacy Policy. The specific conditions under which the following rights may be exercised are further set out in GDPR.

      We will respond to your requests for the exercise of the rights listed below within the statutory time limits.

      The right to clear, transparent and comprehensible information on how your personal data is used and what your rights are

      Obligations corresponding to your rights are performed through this Privacy Policy, or through other information and communication channels.

      Right to access the personal data

      You have the right to access your personal data that we retain as a data controller.

      You have the right to ask our company to inform you whether it processes your personal data. If our company processes your personal data, you have the right to obtain the following information about its processing in particular: the categories of processed personal data, the purpose of the processing, the period for which the personal data will be retained, the recipients or the categories of recipients to whom the personal data will be made available.

      Upon your request, we will provide you with a copy of the processed personal data.

      The right to request correction of the personal data

      You have the right to request the correction and completion of your personal data if our company processes incorrect or incomplete personal data about you.

      You can update the personal data you have provided us at any time. Depending on the purpose of the processing, the changes may be made in accordance with the terms of the services you use or the method outlined above.

      If we receive a notification from you that some of your personal data we process is no longer up to date, we will correct your personal data based on your information, provided that the change can be made. Data update can take up to 48 hours, which is connected with the technical conditions of our systems.

      Right to withdraw consent to the processing of personal data

      If your personal data is processed upon your consent, you have the right to withdraw this consent at any time. If you want to withdraw your consent to the processing of your personal data, simply contact us in one of the ways listed in the Privacy Policy above.

      To unsubscribe from the newsletter, click on the unsubscribe link in the e-mail message we sent to you. Withdrawal of consent is without prejudice to the lawfulness of processing of your personal data prior to such withdrawal.

      Right to object to the processing of personal data. In which cases you may object to the processing of your personal data?

      You have the right to object to the processing of your personal data, if:

      • Your personal data is processed on the basis of legitimate interest and you object to such processing for reasons related to your particular situation or
      • Your personal data is processed for the purposes of direct marketing (e.g. when sending business messages).

      Right to limit processing

      You have the right to request from our company that we restrict the processing of your personal data in the following instances:

      • Processed personal data is not accurate;
      • Processing is unlawful;
      • Processed personal data is not needed for the purposes for which they were collected or otherwise processed;
      • You object to the processing.

      In this case, we will no longer process your personal data or restrict our processing until we are able to demonstrate reasonable grounds for processing or the necessity of processing to determine, exercise or defend our rights.

      Right to data portability

      If our company processes your personal data under your consent or for the purpose of performing the contract, and if the processing is automated you are entitled to obtain our personal data in a structured, commonly used and machine-readable format. You may also transfer your personal data to a different data controller or request that we transfer it to a different data controller. However, we can only do so if the transfer of data is technically feasible and the other controller agrees to accept it.

      Right to deletion of personal data

      We will delete your personal data upon request if:

      • Personal data are no longer needed for the purposes for which they were collected or otherwise processed;
      • You withdraw your consent under which we process personal data and there is no other legal reason for processing;
      • You make a legitimate objection to the processing based on a legitimate interest of our company;
      • Personal data was processed illegally or
      • Personal data must be deleted according to the legal regulations.

      Right to file a complaint with the Office for Personal Data Protection

      If you believe that during the personal data processing there has been a breach of the obligations set by the legislation on the protection of personal data (in particular GDPR and Data Protection Act) you have the right to file a complaint with the Office for Personal Data Protection or a different competent supervisory authority of a member state of the European Union that is responsible for supervising of adherence to the obligations laid down by the GDPR (in particular the supervisory authority in the member state of your residence, the location of employment or the place of the alleged violation).

      The authority performing supervision of the personal data processing carried out by Benefit Systems is the Office for Personal Data Protection of Slovak republic with the registered office at Hraničná 12, 820 07 Bratislava, https://www.dataprotection.gov.sk.

      7. AMENDMENTS TO THIS PRIVACY POLICY

      We will periodically review and update this Privacy Policy in connection with amendments to the applicable legal regulations, changes in the scope of our processing of personal data, and our efforts to improve the level of security of your personal data and the quality of our services.

      The latest update of this document was on May 25, 2018.