Notifying data subjects – users of the www.milk.sk web page

of the information to be provided when personal data are collected from data subjects, including the information necessary to ensure the fair and transparent processing of personal data (the “Notice”), pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “Regulation”) and Act No. 18/2018 Coll. on the protection of personal data, as amended (the “Act”)

Folk & Milk Studios s.r.o. with its registered office at Klemensova 4, 811 09 Bratislava, ID No.: 36 768 138, registered in the Commercial Register of the District Court of Bratislava I, Section: Sro, File No.: 45599/B, tel.: +421 917 175 945, e-mail: office@milk.sk (the “Controller”), as the operator of information systems in which personal data are processed,

hereby notifies data subjects that it will process the following personal data provided to it by them:

a. name, surname;
b. email address;
c. online identifiers (cookies and IP address)
(the “PD”).

The controller will process the PD in the information systems (the “IS”) under the following terms and conditions:

1. www.milk.sk web page

purpose of PD processing:
- provision of information, preparation, implementation, presentation and promotion of projects, events and campaigns organised and/or implemented by the Controller (the “Projects”), activities and media outputs of the Controller, participation in the Projects, management of the agenda and communication in connection with the Projects, activities and media outputs of the Controller;
list of personal data which are processed: the PD referred to in points a. to c. hereof to the extent of data actually provided by the data subject;
legal basis for the processing: consent of the data subject;
recipients of PD:
- third parties which process the PD under the authority of the Controller or processor (e.g., persons providing bookkeeping, tax compliance, software and IT service providers, web hosting providers, carriers, legal advisors, auditors, etc.);
- judicial and public authorities in relation to which the controllers fulfil their obligations under generally binding legal regulations;
transfer of PD to third countries: not implemented.

2. Advertising and marketing

purpose of PD processing: advertising and marketing purposes – purposes of notifying data subjects of current service offers, activities and media outputs, other activities, Projects of the Controller, their presentation and promotion, conducting awareness-raising of the general public about the business activities of the Controller, market research, public opinion polls and data subjects’ satisfaction surveys and their analytical evaluation, including sending reports/presentations about the offered services, activities and media outputs, Projects and other activities of the Controller, notifications and information related to the activities of the Controller;
list of personal data which are processed: the PD referred to in points a. to c. hereof to the extent of data actually provided by the data subject;
legal basis for the processing: consent of the data subject;
recipients of PD:
- third parties which process the PD under the authority of the Controller or processor (e.g., software and IT service providers, web hosting providers, information output providers, legal advisors, etc.);
- judicial and public authorities in relation to which the controllers fulfil their obligations under generally binding legal regulations;
transfer of the PD to third countries: not implemented.

The Controller shall store the PD:

on the www.milk.sk IS Web page during the use of the www.milk.sk web page by the data subject and for a maximum period of ten (10) years from the date of its last use, and in the case of online identifiers, for a maximum period of four (4) years from the date on which they were obtained, provided that the consent has been granted;
in IS Advertising and marketing during the use of the www.milk.sk web page by the data subject and for a maximum period of five (5) years from the date of its last use, and in the case of online identifiers, for a maximum period of four (4) years from the date on which they were obtained, provided that the consent has been granted.

Data subjects have the following rights in relation to the processing of their PD by the Controller:

1. the right to request from the Controller access to their personal data

the right to request from the Controller confirmation as to whether or not personal data concerning him or her are being processed;
if the Controller processes such PD, the data subject has the right of access to such PD and the following information:
1. the purpose of the processing of the PD;
2. the categories of the processed PD;
3. the recipients or categories of recipients;
4. the period for which they will be stored and the criteria used to determine that period;
5. the existence of the right to request that the Controller rectify, erase or restrict the processing of the PD, the right to object to such processing;
6. the right to lodge a complaint/initiate proceedings with a supervisory authority – the Office for Personal Data Protection of the Slovak Republic;
7. if the PD are not collected from the data subject, any available information as to their source; and
8. the existence of automated decision-making, including profiling within the meaning of the Regulation and/or the Act.

2. the right to rectification of the PD, according to which the data subject has the right to:

request that the Controller rectify incorrect PD concerning the data subject without delay;
and
request that the Controller have incomplete PD completed.

3. the right to erasure (‘right to be forgotten’) according to which the data subject has the right to:

obtain from the Controller the erasure of the PD concerning him or her without undue delay; the Controller is only obliged to erase personal data without undue delay if some of the following grounds apply:
1. the PD are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. the data subject withdraws his/her consent on which the processing is based, and where there is no other legal ground for the processing;
3. the data subject objects to the processing under the Regulation and/or the Act and there are no overriding legitimate grounds for processing, or the data subject objects to the processing under the Regulation and/or the Act;
4. the PD have been unlawfully processed;
5. the PD have to be erased for compliance with a legal obligation in Union or applicable legal regulations in force in the Slovak Republic or an international treaty by which the Slovak Republic is bound;
6. the PD have been collected in relation to the offer of information society services referred to in the Regulation and/or the Act.

The right to erasure cannot apply if the processing of the PD is necessary for: (i) exercising the right of freedom of expression and information; (ii) compliance with a legal obligation which requires processing under Union law, legal regulations in force in the Slovak Republic or an international treaty by which the Slovak Republic is bound, or for the performance of a task carried out in the public interest or in the exercise of the official authority vested in the Controller; (iii) reasons of public interest in the area of public health in accordance with the Regulation and/or the Act; (iv) archiving purposes in the public interest, for scientific or historical research or statistical purposes of the Regulation and/or the Act, in so far as the right to erase the PD is likely to make impossible or seriously impair the achievement of the objectives of that processing; or (v) the establishment, exercise or defence of legal claims.

4. the right to the restriction of processing of PD, according to which the data subject has the right to:

the restriction of processing of PD by the Controller in one of the following cases:
1. the accuracy of the PD is contested/objected to by the data subject for a period enabling the Controller to verify their accuracy;
2. the processing is unlawful and the data subject opposes the erasure of the PD and requests the restriction of their use instead;
3. the Controller no longer needs the PD for the purposes of the processing but they are required by the data subject for the establishment, exercise or defence of legal claims;
4. the data subject has objected to processing under the Regulation and/or the Act, pending verification of whether the legitimate grounds of the Controller override those of the data subject.

5. the right to PD portability, according to which the data subject has the right to:

receive the PD concerning him or her, which he or she has provided to the Controller, in a structured, commonly used and machine-readable format; and
transmit those data to another controller without hindrance from the controller to which the PD have been provided, if
1. the processing is based on the data subject’s consent under the Regulation and/or the Act or the processing is necessary for the performance of a contract to which the data subject is a party or to carry out pre-contractual measures at the request of the data subject; and
2. where the processing is carried out by automated means.

In exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, insofar as this is technically feasible. The exercise of the data subject’s right to data accuracy shall not adversely affect the rights and freedoms of others.

6. the right to object to the processing of the PD and automated individual decision-making according to which the data subject has the right to:

object at any time, on grounds related to his or her particular situation, to the processing of PD concerning him or her which is carried out as necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller or is necessary for the purposes of the legitimate interests pursued by the Controller or a third party, including objecting to profiling based on these legal bases.
object at any time to the processing of the PD processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing;
The data subject may exercise his or her right to object by automated means using technical specifications;
not to be subject to a decision based solely on automated processing, including profiling, and which has legal effects concerning him or her or similarly significantly affects him or her;
This right shall not apply if the decision is: (i) necessary for entering into or performing a contract between the data subject and the Controller; (ii) permitted by Union law, by legal regulations in force in the Slovak Republic or by an international treaty by which the Slovak Republic is bound, which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or (iii) based on the data subject’s explicit consent.

Provision of the PD to the Controller for processing:

on the www.milk.sk IS Web page:

is a contractual requirement, the data subject is not obliged to provide them to the Controller; and
the consequence of their non-provision is that the data subject will be unable to make full use of the www.milk.sk web page;

in IS Advertising and marketing:

is a contractual requirement, the data subject is not obliged to provide them to the Controller; and
the consequence of their non-provision is that it will not be possible to notify the data subject of the current offers, services, activities and media outputs, other activities and Projects of the Controller and information related to the business activities of the Controller.

This Data Subject Notice is published and available for inspection on the www.milk.sk web page.

Folk & Milk Studios s.r.o.