NOTICE OF PERSONAL DATA PROCESSING
(the “Notice”)
BALÍLK PLUS, s.r.o., with registered office Ľ. Fullu 9A, Bratislava – Karlova Ves 841 05, Slovak Republic, Company ID No: 50 086 375, registered in the Commercial Register at Bratislava III District Court, section: Sro, file no.: 108115/B (the “Company“), is the data controller of the personal data you provide to the Company when using this Website (the “Portal“) or which is provided to the Company in connection with the services provided by the Company through the Portal.
In this Notice, the Company provides information about:
- how it obtains and processes the personal data of contact persons of the Company’s contractual partners,
- how it obtains and processes the personal data of Portal visitors,
- how it obtains and processes the personal data of job applicants, and
- what the rights are of data subjects in relation to the processing of their personal data and how they can exercise those rights.
The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or the “GDPR“) and with the relevant legislation on the protection of personal data, including Slovak Act No. 18/2018 Coll., on the protection of personal data and on amending and supplementing certain Acts (“Legislation“).
Capitalised terms have the same meanings as ascribed to them in the General Terms and Conditions for Clients and Partners.
I. HOW YOU CAN CONTACT THE COMPANY
You may contact the Company with any questions regarding the processing of your personal data by email at info@balikplus.sk or via the contact form available on the Portal in the contact section. You can also contact the Data Protection Officer by e-mail to: gdpr@balikplus.sk.
II. PURPOSE, LEGAL BASIS, CATEGORIES OF PERSONAL DATA AND RETENTION PERIOD
| PURPOSE OF PROCESSING | LEGAL GROUNDS FOR PROCESSING | PERSONAL DATA CATEGORY | RETENTION PERIOD |
| Registration of the Mail Order Partner on the Portal for the purpose of entering into and performing the Contract. | Necessity for the performance of the Contract or the implementation of measures taken prior to the entry into the Contract based on a registration request pursuant to Article 6(1)(b) of the GDPR (business natural persons).
Legitimate interest under Article 6(1)(f) of the GDPR (legal entities). |
Given name, surname, email, mobile phone, business name, place of business. | For the duration of the contractual relationship. |
| Entry into and performance of the Contract with Clients. | Necessity for the performance of the Contract or the implementation of measures taken prior to the entry into the Contract based on a registration request pursuant to Article 6(1)(b) of the GDPR (business natural persons).
Legitimate interest under Article 6(1)(f) of the GDPR (legal entities). |
Given name, surname, email, mobile phone, business name, place of business. | For the duration of the contractual relationship. |
| Distribution of the Company’s service offers and marketing communications. | Legitimate interest under Article 6(1)(f) of the GDPR. | Email. | For a period of 5 years from the date of consent or until its revocation. |
| Answering an enquiry in the contact form | Legitimate interest under Article 6(1)(f) of the GDPR. | Given name, surname, telephone contact, email, company, personal data in the text of the message. | Until resolution of the request. |
| Resolving complaints | Compliance with a legal obligation under Article 6(1)(b) of the GDPR. | Given name and surname, email, personal data provided in a complaint. | Until resolution of the complaint. |
| Exercising the rights of data subjects (submissions). | Compliance with a legal obligation under Article 6(1)(b) of the GDPR. | Given name, surname, place of residence, date of birth or other data for proper verification of the identification of the data subject. | 2 years after the processing of the data subject’s request. |
| Records of breaches of personal data protection. | Compliance with a legal obligation under Article 6(1)(b) of the GDPR. | Personal data affected by a data breach. | Throughout the Company’s existence. |
| Proving, exercising and defending the Company’s legal claims. | Legitimate interest under Article 6(1)(f) of the GDPR. | Common personal data. | Until the final termination of the claim being proved, exercised or defended. |
| Creation and maintenance of a database with profiles of job seekers. | Consent of the data subject within the meaning of Article 6(1)(a) of the GDPR. | Ordinary personal data provided by a job applicant to the Company. | For a period of 3 years from the date of consent or until its revocation. |
| External promotion of the Company (social networks, website, presentations for clients) | Consent of the data subject within the meaning of Article 6(1)(a) of the GDPR. | Common personal data (photo, video recording from an external or corporate event). | Until the withdrawal of the data subject’s consent. |
III. WHAT LEGITIMATE INTERESTS ARE USED BY THE COMPANY?
The Company relies on legitimate interests in the event of legal or out-of-court disputes or in proceedings with public authorities in which it asserts or defends its legal claims.
The Company also processes personal data of contact persons or other persons authorised to act for or on behalf of business partners on the basis of legitimate interest (i.e. Clients of Mail Order Partners), or when answering questions in a contact form.
The Company also relies on legitimate interest when sending marketing communications for which consent is not required under applicable law, in particular to users to whom the Company has provided services, business partners or other persons with whom the Company already has a relevant relationship.
IV. DISCLOSURE OF PERSONAL DATA
| Area/Service | Receiver of personal data | Transfer outside the EEA |
| IT services | An IT service provider providing the operation of the Company Website and its IT systems. Search engine extension service provider. | No |
| Marketing services | Marketing communication mailing service provider | No |
| Accounting and tax consulting | Provider of payroll, accounting and tax consultancy services | No |
| CRM system operation | CRM system service provider | No |
| Website analytics and marketing | Google Ireland Ltd. | Yes (USA)
Transmission based on the Data Processing Agreement (DPA) and on the adequacy decision on the EU-US Privacy Shield Framework. |
| Social networks – Facebook, Instagram | Meta Platforms Ireland Ltd. | Yes (USA)
Transmission based on the Data Processing Agreement (DPA) and on the adequacy decision on the EU-US Privacy Shield Framework. |
V. TRANSMISSION OF PERSONA DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANIZATIONS
When processing personal data, the Company seeks to minimise any transmission of personal data outside the European Economic Area (EEA). However, in operating the Portal and providing services, the Company also uses global service providers who may transfer personal data outside the EEA. In these cases, the Company will ensure that the GDPR conditions for such processing are met and will only transfer on the basis of the existence of a European Commission adequacy decision under Article 45 of the GDPR (e.g. an adequacy decision relating to the EU-US Privacy Shield Framework) or on the basis of standard data safeguard clauses under Article 46(2) of the GDPR.
VI. AUTOMATED INDIVIDUAL DECISION-MAKING
In the operation of the Portal and the provision of services related thereto, there will be no automated individual decision-making within the meaning of Article 22 of the GDPR.
VII. OBTAINING PERSONAL DATA
In particular, the Company processes personal data provided directly by users of the Portal or the Company’s business partners. However, the Company may also collect personal data from your device or browser, if its settings do so allow, when you visit and use the Portal (e.g. IP address, analytical information about your visit to the Portal).
The provision of personal data is necessary for the full use of the Portal and the provision of services by the Company.
VIII. RIGHTS OF PERSONS AFFECTED
If the Company processes personal data based on your consent, you have the right to withdraw your consent at any time by sending an email to: info@balikplus.sk or in the manner specified in the consent. The withdrawal of consent has no effect on the legality of processing based on the consent given prior to the withdrawal.
In addition to the aforementioned rights, you have the right under the conditions set out in the GDPR:
- Right of access to personal data: You have the right to obtain access to the personal data concerning you that the Company processes and a copy of the processed personal data.
- Right to the rectification of personal data: You have the right to have your inaccurate or incomplete data rectified or completed.
- Right to the erasure of personal data: The data subject has the right to obtain from the Company without undue delay the erasure of personal data concerning the data subject if:
a) the personal data are no longer needed for the purposes for which they were collected or otherwise processed;
b) the data subject withdraws their consent on the basis of which the personal data were processed and there is no other legal ground for the processing;
c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
d) the personal data have been processed unlawfully;
e) the personal data must be erased for compliance with a legal obligation set forth in European Union or Member State law;
f) the personal data were collected in connection with an offer of information society services.
The right to erasure will not apply to the extent processing is necessary for compliance with legal obligations or for the establishment, exercise, or defence of legal claims, or in other cases provided for in the GDPR.
- Right to restriction of processing: The data subject has the right to obtain from the Company restriction of processing in any of the following cases:
a) the data subject contests the accuracy of the personal data, for a period enabling the Company to verify the accuracy of the personal data;
b) the processing of personal data is unlawful, and the data subject refuses the erasure of the personal data and requests the restriction of their use instead;
c) the Company no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise, or defence of legal claims;
d) the data subject has objected to processing pending the verification whether the legitimate grounds of the Company override those of the data subject
- Right to object to processing: The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning the data subject which the Company processes on the basis of its legitimate interest. In such case, the Company will no longer process the personal data unless the Company demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defence of legal claims.
If the data subject objects to processing for direct marketing purposes, the Company must no longer process the personal data for such purposes.
- Right to data portability: The data subject has the right to obtain personally identifiable data relating to the data subject which they have provided to the Company in a structured, commonly used and machine readable format and the right to transmit those data to another controller without hindrance from the Company if:
a) the processing is based on consent; and
b) the processing is carried out by automated means.
- Right to lodge a complaint: The data subject may lodge a complaint with the Personal Data Protection Office of the Slovak Republic at Úrad na ochranu osobných údajov Slovenskej republiky, Námestie 1. mája, 811 06 Bratislava, e-mail: dozor@pdp.gov.sk, or the supervisory authority in the Member State of their habitual residence.
You can exercise your rights by using the contact details of the Company set out in Part II of this Notice. The Company hereby informs that it is entitled to ask the data subject to verify his or her identity before sending a reply to his or her request.
IX. CHANGES TO THE NOTICE
The Company reserves the right to modify and amend the Notice. Any changes to this Notice will become effective upon posting on the Portal.
Last updated May 1, 2025