Personal data protection

Personal data protection

INFORMATION FOR THE DATA SUBJECT

For the company AIVIL sro, Nádražná 2491/66, 900 28 Ivanka pri Dunaji, Company ID: 36800368, Tax ID: 2022409873 , it is a priority to protect personal data in accordance with applicable legislation, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR) and Act No. 18/2018 Coll. on the protection of personal data and on the amendment of certain acts (ZoOOÚ).

We comply with all necessary standards and rules, and therefore, in accordance with the relevant provisions of the Personal Data Protection Act, we provide the data subject with the information below.

1. DEFINITIONS OF TERMS

  • Personal data – any information relating to a natural person who can be identified directly or indirectly (e.g. name, surname, location data, online identifier, etc.).

  • Data subject – any natural person whose personal data are processed (e.g. customer, potential customer, employee).

  • Controller – a person or organization that determines the purpose and means of processing personal data and processes it on its own behalf.

  • Processor – an entity processing personal data on behalf of the Controller.

  • Processing of personal data – any operations with personal data (e.g. collection, storage, organisation, retrieval, deletion).

  • Recipient of personal data – anyone to whom personal data is provided, regardless of whether they are a third party.

  • Third Party – an entity other than the Data Subject, the Controller, the Processor and their authorized persons.

  • Profiling – automated processing of personal data in order to evaluate certain personal aspects or characteristics of a natural person.

  • Purpose of processing personal data – the reason why personal data is processed.

  • Special categories of personal data – sensitive data that is of a specific nature (e.g. health data).

  • Restriction of processing of personal data – marking of stored personal data in order to restrict its processing.

  • Responsible Person – a person authorized by the Controller or Processor to supervise the processing of personal data.

2. IDENTIFICATION AND CONTACT DATA ABOUT THE OPERATOR

Operator: AIVIL sro
Headquarters: Nádražná 2491/66, 900 28 Ivanka pri Dunaji
ID: 51038081
VAT number: 2120573862
VAT ID: SK2120573862
Name and address of the business: SERENITY – BODY & SOUL & MIND, Nádražná 66, Ivanka pri Dunaji
Responsible person: Ing. arch. Jana Szokolayová
E-mail: jszokolayova@serenitybsm.sk

3. PURPOSES OF PROCESSING PERSONAL DATA

The operator processes personal data for the following purposes:

  1. Providing Ayurvedic center services (massages, therapies, rituals, exercises, doctor consultations).

  2. Organization of health consultations, including blood sampling and provision of laboratory results in cooperation with UniLab.

  3. Marketing activities (informing about news, special offers, promotions).

  4. Providing administrative and accounting needs.

  5. Customer records and ensuring service quality.

  6. Fulfillment of obligations arising from the law.

4. CATEGORIES OF PROCESSED PERSONAL DATA

The operator processes in particular the following categories of personal data:

  • Identification data : name, surname, title, date of birth.

  • Contact details : phone number, email, address.

  • Health data : medical history, diagnoses, results of examinations and laboratory tests (including blood tests).

  • Payment data : information about transactions, invoicing.

  • History of services provided : dates, types of massages and procedures.

5. LEGAL BASIS FOR PROCESSING PERSONAL DATA

  • Contractual relationship : Data processing is necessary to provide the ordered services.

  • Legal basis : Obligations arising from law (e.g. in the field of healthcare and accounting).

  • Data subject consent : Consent is required when processing special categories of data, such as health records.

6. RECIPIENTS OF PERSONAL DATA

Personal data may be provided to the following entities:

  1. UniLab company : laboratory tests and analyses.

  2. Contractual partners : IT service providers, marketing agencies.

  3. Medical staff : collaborating doctors.

  4. State administration bodies : based on the law (e.g. health insurance companies, public health authorities).

7. RIGHTS OF THE DATA SUBJECT

The data subject has the right to:

  • To access personal data : You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to obtain access to that data.

  • To rectify : You have the right to request the correction of incorrect or incomplete personal data.

  • To be erased (right to be forgotten) : You can request the erasure of personal data if it is no longer necessary for the purposes for which it was collected or if you withdraw your consent.

  • To restrict processing : You have the right to request restriction of processing of your personal data if you object to its accuracy or the lawfulness of the processing.

  • Object to processing : You have the right to object to the processing of personal data based on the legitimate interest of the controller or for direct marketing purposes.

  • Data portability : You have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format and to transmit it to another controller.

  • Withdraw consent : If the processing is based on your consent, you may withdraw it at any time, and the withdrawal of consent does not affect the lawfulness of the processing before its withdrawal.

8. PERSONAL DATA RETENTION PERIOD

Personal data will be retained for the period of:

  1. Duration of the contractual relationship.

  2. Necessary to fulfill legal obligations (e.g. accounting documents for 10 years).

  3. Until consent is withdrawn (in the case of marketing purposes).

9. LEGITIMATE INTERESTS OF THE OPERATOR

The Controller may process personal data for the purpose of its legitimate interests or the legitimate interests of a third party. This legitimate interest must prevail over the interests of the Data Subject. The Controller's legitimate interests are, for example:

  • Providing information regarding contract management.

  • Direct marketing, unless consent is required by law.

  • Enforcement of legal claims.

  • Ensuring network security and information security.

  • Ensuring the safety of operating premises.

  • Customer satisfaction survey to improve center services.


10. PERSONAL DATA RETENTION PERIOD

Personal data will be retained for the period of:

  • necessary to fulfil the purpose of the processing;

  • in the case of accounting and tax documents for the period specified by law (at least 10 years);

  • in the case of marketing purposes until the data subject withdraws their consent.

11. CONTACT DETAILS OF THE SUPERVISORY AUTHORITY

Personal Data Protection Office of the Slovak Republic
Hraničná 12, 820 07 Bratislava 27
Slovak Republic
E-mail: statny.dozor@pdp.gov.sk
Web: www.dataprotection.gov.sk

12. VOLUNTARILY PROVIDING PERSONAL DATA

The reason for providing personal data by the Data Subject is primarily the performance of a contract, or pre-contractual relationships or the performance of obligations stipulated by law, or the provision of information related to the Operator's products and services.

The provision of personal data by the Data Subject is exclusively voluntary.

In the event that the Data Subject (customer/potential customer) does not provide personal data necessary for concluding an order or contract, or for any other purpose, this will be considered as the Customer's lack of interest in using the services offered by it.

13. AUTOMATED INDIVIDUAL DECISION-MAKING

When providing its services, the Operator uses automatic processing of personal data - issued without human intervention, i.e. not by manual means (e.g. profiling, granting discounts based on meeting specified conditions, camera systems, automated sending of newsletters, etc.). Automatic processing serves to provide the Operator with better quality, more accurate and faster services.

The data subject shall have the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. The data subject shall therefore have the right to request the Controller to review the decision by a method other than automated processing. The Controller shall inform the Data Subject of the method of review and the outcome of the finding within 30 days of receipt of the request.

The aforementioned right of the Data Subject does not apply to cases where processing is necessary for the conclusion or performance of a contract, carried out on the basis of a specific regulation or based on the explicit consent of the Data Subject.

14. FINAL PROVISIONS

This information is intended primarily for the Operator's customers or potential customers, or other Data Subjects.

This information is published on the Operator's website and is also available in paper form at its registered office, as well as in individual operations.

The Operator provides this clearly formulated information in a concise, transparent, understandable and easily accessible form. If the Data Subject, or a third party, has any questions regarding this information document, he or she may contact the Operator by telephone, e-mail, in person at the registered office or by correspondence, using the contact details provided in point 2 of this information.

This information will be updated regularly. The above text is valid and effective from 15.1.2025