1. General Provisions
The controller for the processing of personal data is ROHEXPO s.r.o., with its registered office at Na Podskalku 2577, 066 01 Humenné, Slovak Republic, Company ID: 50234731, Tax ID: 2120231520, VAT ID: SK2120231520, phone: +421 910 333 436, e-mail: support@rohexpo.com

We process the following categories of personal data:
company name, first name, last name, date of birth, address, email, phone number.

2. Purpose, Legal Basis for Processing, and Retention Period

a) Careers
Purposes and legal bases:
Recruitment: Personal data for the purpose of recruitment are processed based on your job application (pre-contractual relationships). Maintaining a candidate database: If you provide us with consent to process your personal data for inclusion in our candidate database when submitting your job application, we will include you in our database for the purpose of future contact. Personal data for inclusion in the candidate database are processed based on your consent.

Retention period:
We retain personal data until the end of the recruitment process. If you have given us consent to be included in the candidate database, we will retain your personal data for one year from the date your consent was given.

b) Contractual Relationships
Purposes and legal bases:
Performance of the contract: If you are a party to a contract concluded with us, the processing of your personal data is necessary for the performance of the subject matter of this contract and the related liability relationships (complaints, liability for defects). This processing is carried out based on the contract and specific legal regulations, in particular Act No. 250/2007 Coll. on Consumer Protection, as amended, Act No. 40/1964 Coll., Civil Code, as amended, and Act No. 513/1991 Coll., Commercial Code, as amended.

The processing of your personal data for the purpose of contract performance may also occur if you are not a party to the contract, but the contract is otherwise related to you, e.g., you are a contact person (employee) for our contractual partner (your employer) listed in the contract, or you are interested in a property that is the subject of a contract with our client. In such cases, we will process your personal data based on our legitimate interest.

Retention period:
We retain your personal data until the purpose of processing is fulfilled (proper performance of the contract) and the period for asserting any claims has expired, but no longer than 3 years from the fulfillment of the contractual obligations. Accounting documents related to contracts are retained for 10 years after the year to which they pertain for the purpose of accounting and record-keeping of financial and economic documents.

c) Communication

Purpose and legal basis:
Mutual communication: If you contact us regarding any matter through any communication channel (by mail, email, or telephone), we process your personal data for the purpose of maintaining contact with you. Personal data for communication with you are processed based on your request. Records of incoming and outgoing mail are processed in accordance with specific legal regulations.

Retention period:
We will retain your personal data for one year after the conclusion of each individual communication. Records of incoming and outgoing mail are retained for 5 years after the year to which they pertain.

d) Debt Collection and Legal Proceedings
Purposes and legal basis:
We may process your personal data for the purpose of debt collection and conducting legal proceedings. The legal basis for such processing is our legitimate interest in defending and asserting our legal claims.

Retention period:
Personal data for this purpose are retained for a maximum of 10 years after the final conclusion of the court proceedings or until the debt is recovered.

e) Marketing

Purpose and legal basis:
Sending information about company news, events, and special offers: Newsletters and marketing information will be sent only to the extent and at intervals that are not intrusive for you. Personal data for direct marketing purposes are processed based on your consent or, in the case of our customers, also based on our legitimate interest.

Retention period:
Your personal data processed for marketing purposes are retained for a maximum of 3 years.

f) Protection of Property, Safety, and Health
Purpose and legal basis:
The legal basis for processing personal data is our legitimate interest, which consists of protecting public order and safety, preventing crime, and protecting property or health. This includes processing personal data for the purpose of protecting our legitimate interests: protection of public order and safety, crime prevention, and protection of property or health, which includes, for example, the use of a CCTV system to monitor our premises.

Retention period:
CCTV recordings are retained for a maximum of 28 days from the date of creation. After the retention period, we ensure the immediate destruction of your personal data.

3. Fulfillment of Our Legal Obligations

When processing personal data for specific purposes, your personal data may also be processed based on various special regulations that impose different obligations on us, e.g., processing of accounting, accounting and financial documents, registry management, disclosure or provision of data to state and other authorities that supervise our activities or handle disputes, or in the execution of decisions. Such special regulations include, for example, Act No. 40/1964 Coll. Civil Code, Act No. 102/2014 Coll. on Consumer Protection, Act No. 222/2004 Coll. on Value Added Tax, Act No. 431/2002 Coll. on Accounting, Act No. 395/2002 Coll. on Archives and Registries.

Retention period:
It will depend on the obligation we are required to fulfill under the specific regulation.

4. Necessity of Providing Personal Data
If providing personal data is a legal or contractual requirement, or a requirement necessary to conclude a contract, the data subject is obliged to provide personal data. Otherwise, the purpose of processing intended by the controller in case the personal data were provided cannot be fulfilled.

5. Provision and Disclosure of Personal Data

In general, we may disclose and/or provide your personal data to other entities such as tax authorities, state administration and public authorities for supervision and control (e.g., labor inspectorates), courts, law enforcement authorities, accountants, auditors, lawyers, IT system and support providers, and other external professional advisors, as well as to other companies that provide us with products and services. We are responsible for ensuring the proper protection of your personal data that is provided and/or disclosed to other entities acting as processors. The current list of specific recipients of personal data can be provided upon request via our email address.

6. Transfer of Personal Data to a Third Country or International Organization
The controller does not transfer and does not intend to transfer personal data to a third country or an international organization.

7. Automated Decision-Making, Including Profiling
When processing personal data for the purposes described above, no automated decision-making or profiling is carried out.

8. Rights of the Data Subject in the Processing of Personal Data

a) Right of Access
Simply put, you have the right to know what data we process about you, for what purpose, for how long, where we obtain your personal data, to whom we provide it, who else processes it besides us, and what other rights you have related to the processing of your personal data. However, if you are unsure which personal data we process about you, you may request confirmation from us as to whether personal data concerning you is being processed by us, and if so, you have the right to access this personal data. Under the right of access, you may request a copy of the personal data being processed, with the first copy provided free of charge and any subsequent copies subject to a fee. Rights of third
however, the rights of third parties cannot be restricted by this.

b) Right to Rectification
Personal data must be accurate, up-to-date, and truthful. If you find that the personal data we process about you is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay. By exercising this right, you help us keep your personal data accurate and current.

c) Right to Erasure
In certain cases, you have the right to have your personal data erased. We will erase your personal data without undue delay if any of the following grounds apply:
– your personal data is no longer necessary for the purposes for which we processed it;
– you withdraw your consent to the processing of personal data, in cases where the processing is based on your consent and we have no other legal basis or reason to continue processing it;
– you exercise your right to object to the processing of personal data that we carry out based on our legitimate interests, and we find that there are no overriding legitimate grounds on our part that prevail over your legitimate reasons; or
– you believe that the processing of personal data carried out by us was unlawful.

However, please keep in mind that even if one of these grounds applies, it does not mean that we will immediately delete all your personal data. This right is not granted if the processing of your personal data is still necessary for compliance with a legal obligation or for establishing, exercising, or defending our legal claims.

9. Right to Restriction of Processing
In certain cases, in addition to the right to erasure, you may exercise the right to restriction of the processing of personal data. This right allows you, in certain situations, to request that your personal data be marked and not subject to any further processing – however, in this case, not permanently (as with the right to erasure), but for a limited period. We must restrict the processing of personal data when:
– you contest the accuracy of the personal data, for the period allowing us to verify the accuracy of your personal data;
– we process your personal data unlawfully, but you prefer restriction over erasure of such data;
– we no longer need your personal data for the purposes of processing, but you require them for the establishment, exercise, or defense of your legal claims; or
– you object to the processing, for the period during which we verify whether your objection is justified.

10. Right to Data Portability
You have the right to receive from us all your personal data that you have provided to us and that we process. We will provide your personal data in a structured, commonly used, and machine-readable format, and in this context, you may exercise your right to transfer these data to another controller, provided that such transfer is technically feasible. To facilitate the transfer of data upon your request, this applies only to data that we process automatically in our electronic databases. The rights of third parties, however, cannot be restricted by this.

11. Right to Object to Processing
You have the right to object at any time to the processing of personal data carried out on the basis of our legitimate interest. We must cease processing these personal data unless there are compelling legitimate grounds for such processing that override your interests, rights, and freedoms, or grounds for the establishment, exercise, or defense of legal claims. You also always have the right to object to the processing of your personal data if such
are processed for the purposes of direct marketing. In such a case, we will immediately cease processing your personal data for direct marketing purposes.

12. Right to Lodge a Complaint
If you believe that we are processing your personal data unlawfully or in violation of generally binding legal regulations, you have the right to lodge a complaint regarding our processing of personal data with the Office for Personal Data Protection of the Slovak Republic.

13. Right to Withdraw Consent
You have the right to withdraw your consent to the processing of personal data at any time if the personal data are processed on this legal basis.
How and where you can exercise your rights: If you have any questions regarding this document or the use of your personal data,
or if you wish to exercise your rights described in this document, you may do so by email, in writing, or in person at the address of our company’s registered office. We will respond to your request concerning the processing of personal data without undue delay and, in any case, within one month of its receipt. In special cases, the period may be extended by an additional two months, but in any case, we will inform you of the reasons for the extension within one month of receiving the request. Information is provided free of charge. However, if your requests are excessive or frequently repeated, we may require a reasonable administrative fee for handling them.

14. Security
We have implemented the necessary legal, organizational, material, and technical measures to protect personal data, in accordance with data security and privacy standards. If we provide and/or make personal data available to a third party that provides services necessary to achieve any of the purposes of personal data processing, such a third party, in the capacity of a processor, has also implemented appropriate measures to protect the confidentiality, integrity, and security of personal data. We have also taken the necessary steps to ensure that the personal data we process are reliable, accurate, and complete for the purpose of their use.

If you have any questions regarding data protection, please contact us at +421 910 333 436 or at support@rohexpo.com.