The purpose of this document is to avoid any ambiguity, to demonstrate the fulfillment of obligations in accordance with § 29 of the new WIPO, and in particular to easily enforce the rights of the persons concerned, as conferred by the new legislation on the protection of personal data.

OPERATOR:

Business Name: Bluefin Century, s. r. o.
Address Kremnická 3576/24, Bratislava 851 01, Slovak Republic
Legal Form: Limited Liability Company
ID : 46 019 138
Registration: Company registered in the Commercial Register of the District Court Bratislava I., Section: Sro, Insert 70421 / B
Statutory body: Roland Rozsi, Managing Director

(hereinafter referred to as the "Operator")

1. Contact details of the person in charge of handling requests and providing information for exercising the rights of the person concerned:

   Name: Alex Vernyik
   Delivery Address: Kremnická 3576/24, Bratislava 851 01, Slovak Republic
   Email Address: av@bluefin.sk
   Phone Number: +421 220 633 178

2. Method and Form of Reaction:

   Responses to requests and information will be provided in the form in which the application was submitted (in writing / electronically / orally), unless the person concerned has requested a different form. Oral provision of information may be subject to the identity of the person concerned. If the operator has reasonable doubts as to the identity of the natural person making the request, he may request additional information to confirm his / her identity. In order to ensure the security of personal data, the operator reserves the right not to respond electronically to messages without a qualified electronic signature. For this reason, it is more appropriate to make requests in which personal data are made available in writing, in order to avoid the situation where an anonymous person may request protected data about another person.

3. Time limit for request handling:

   Under Section 29 (3) of the new OCT the time limit for processing the application of the persons concerned is one month after the receipt of the application. The time limit may be extended in justified cases with regard to the complexity and the number of applications for a further two months, even repeatedly. Any such extensions must be informed by the person concerned together with the reasons for the extension of the time limit. The objective of extending the time limit may, for example, be considered as a situation where the employer requires the person concerned to add some information to assess and process his application, and the addition of the required information will not be provided with a turnover.

   Similarly, the occurrence of security incidents that have been paralyzed for some time by the employer's information systems.

4. Transparent information on the introduction and amount of fees:

   For the handling of requests and the provision of information, the operator is entitled to require the applicant to pay the associated fees. The requests of the person concerned and the information are primarily addressed, respectively. free of charge. A reasonable charge for administrative costs may be required for a second and a further copy of the documents by which the employer receives the request from the person concerned. The same charge may also be introduced for the administrative costs of handling the application, which is manifestly unjustified or inappropriate, in particular for its recurrent nature. The operator demonstrates that the application is inoperative or inappropriate. The recurring nature of the request is that which concerns the same personal data and the same applicable law. The recurring nature of the request does not, for example, have a request for a right of access to personal data, and then a request for the right to delete the data processed by a right of access request.

5. Appropriate measures for the exercise of the rights of the person concerned and measures facilitating the exercise of his rights.

   The operator reserves the right to process requests online, as long as this option is considered the most appropriate.

6. Calculation of rights. which the new legislation on the protection of personal data confers on the persons concerned:

   This calculation of rights is applicable and the person concerned may apply these rights to the operator only if the legal conditions are specified below, which are further specified in the text.

1. Right of access

   The person concerned has the right to obtain from the operator a confirmation of the processing of personal data concerning him / her and, if so, he / she has the right to access such personal data and the information given in the information obligation.

   An operator shall provide a copy of the personal data being processed. For any further copies requested by the person concerned, the operator may charge an appropriate fee corresponding to the administrative cost. Where the person concerned has made the request by electronic means, the information shall be provided in a commonly used electronic form, unless the person concerned has requested a different means. The right to obtain a copy of personal data shall not have an adverse effect on the rights and freedoms of others.

2. Right to correct

   The person concerned shall have the right to correct the incorrect personal data relating to him without undue delay. With regard to processing purposes, the person concerned is entitled to supplement incomplete personal data, including by providing a supplementary statement.

3. Right of deletion (right to be forgotten)

   The operator is obliged to erase personal data without undue delay if the person concerned has exercised the right of cancellation and if:

   • personal data are no longer needed for the purpose for which they were acquired or otherwise processed,
   • the person concerned shall withdraw consent pursuant to Article 13 (1) (a) or Section 16 (2) (a) on the basis of which the processing of personal data is carried out and there is no other legal basis for the processing of personal data,
   • the person concerned objects to the processing of personal data pursuant to Article 27, paragraph 1 and does not preclude any legitimate reason for the processing of personal data, or the person concerned objects to the processing of personal data pursuant to Article 27 (2)
   • personal data is processed unlawfully,
   • is the reason for the deletion of the obligation under this Act, a special regulation or an international treaty binding on the Slovak Republic; or
   • personal data were obtained in connection with the offer of information society services pursuant to § 15 par. 1.

   The operator is not obliged to erase the processed personal data about the person concerned if the processing of personal data is necessary:

   • to exercise the right to freedom of expression or the right to information,
   • to fulfill an obligation under this Act, a special regulation or an international treaty which the Slovak Republic is bound to fulfill, or to carry out a task carried out in the public interest or in the exercise of public authority entrusted to the operator,
   • on grounds of public interest in the field of public health in accordance with § 16 par. Article 2 h) to j),
   • for the purpose of archiving, for scientific purposes, for the purpose of historical research or for statistical purposes pursuant to Section 78 (8) where it is likely that the law referred to in paragraph 1 will prevent or seriously impair the attainment of the objectives of such processing,
   • to claim a legal claim.

4. Right to limit processing

   The person concerned has the right to limit the processing of the operator to one of the following cases:

   • the person concerned asserts the accuracy of the personal data during a period allowing the operator to verify the accuracy of the personal data;
   • processing is unlawful and the person concerned objects to the deletion of personal data and asks for restrictions on their use instead;
   • the operator no longer needs personal data for processing but needs the personal data concerned to prove, apply or defend legal claims;
   • the person concerned has objected to the processing, pending verification that the legitimate reasons on the part of the operator outweigh the legitimate reasons for the person concerned.

5. The right to portability

   The person concerned has the right to obtain personal data relating to him / her which he has provided to the operator in a structured, commonly used and machine readable format and has the right to transfer this data to another operator without the provider of the personal data being prevented from doing so.

   The data subject shall, in exercising his right to data portability under paragraph 1, have the right to transfer personal data directly from one operator to the other operator, as far as technically possible.

   The right referred to in paragraph 1 shall not have an adverse effect on the rights and freedoms of others.

6. The right to object to the processing of personal data

   The person concerned shall have the right at any time to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which is carried out on the basis of a legitimate interest or public interest, including objection to profiling. An operator may not further process personal data unless it establishes the necessary legitimate reasons for processing that outweigh the interests, rights and freedoms of the person concerned or the grounds for proving, applying or defending legal claims.

7. The right to ineffectiveness of automated individual decision making, including profiling

   The person concerned shall have the right not to be covered by a decision which is based solely on automated processing, including profiling, and which has legal effects which affect him or are of such a significant effect.

   Paragraph 1 shall not apply if the decision is:

   • necessary for the conclusion or performance of a contract between the person concerned and the operator,
   • authorized by Union law or by the law of the Member State to which the operator is subject and which also provides for appropriate measures guaranteeing the protection of the rights and freedoms and the legitimate interests of the person concerned;
   • based on the explicit consent of the person concerned.

8. Right to withdraw consent to the processing of personal data.

   When an operator processes personal data about the person concerned only on the legal basis of consent, he / she is obliged to ensure the right of the persons concerned to withdraw their consent at any time in the simple form in which the consent was given. Where an operator processes personal data on a legal basis other than that of the person concerned, that person shall not have the right to withdraw consent as it has not been granted.