Personal Data Processing Policy
1. GENERAL PROVISIONS
This document provides information on how our company, MediaBrothers, s. r. o., with its registered office at Trnavská cesta 19375/8C, 821 08 Bratislava – Ružinov, Company ID No.: 51 876 655, Tax ID No.: 2120816170, VAT ID No.: SK2120816170, acting as the data controller (hereinafter referred to as “we”, “us” or the “Company”), processes the personal data of natural persons (hereinafter also referred to as the “data subject”) pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter referred to as the “GDPR”).
The purpose of this Personal Data Processing Policy (hereinafter referred to as the “Policy”) is to inform you, in particular, about the personal data we collect about you, the sources from which we obtain such data, the purposes for which we process them, the persons or entities to whom we may disclose your personal data, your rights, and the manner in which you may exercise those rights.
2. DATA CONTROLLER AND CONTACT DETAILS
The data controller is:
MediaBrothers, s. r. o.
Trnavská cesta 19375/8C
821 08 Bratislava – Ružinov
Company ID No.: 51 876 655
Tax ID No.: 2120816170
VAT ID No.: SK2120816170
Contact details of the data controller:
Email: info@simicekovska.com
Website: simicekovska.com
If you have any questions regarding this Policy, the use of your personal data, or if you wish to exercise any of the rights described in this Policy, you may contact the Company by email or in writing at the Company’s registered office address.
3. PURPOSES AND LEGAL BASES OF PROCESSING, CATEGORIES OF PERSONAL DATA AND RETENTION PERIODS
Applicable law permits us to process your personal data on several legal bases, and personal data may also be processed without the data subject’s consent. The categories of personal data we process and the periods for which we retain them vary depending on the purpose of processing and the nature of the relevant processing activity.
A) Responding to Contact Requests – Contact Form
Purpose of processing:
Processing a contact request submitted through the website contact form and responding to the person making the request.
Legal basis for processing:
The legitimate interests of the Company pursuant to Article 6(1)(f) GDPR. The processing of personal data is necessary in order for us to process your contact request submitted through the contact form available on our website simicekovska.com, to respond to you and to communicate with you regarding the matter in connection with which you contacted us.
Categories of personal data processed:
First name and surname, email address and, where provided, telephone number. We also process any other personal data that you choose to provide to us.
Retention period:
We will retain your personal data for the duration of our communication with you, but no longer than 12 months from our most recent contact with you.
B) Marketing Purposes
Purpose of processing:
Presentation and promotion of artistic works, paintings, art prints, limited-edition collections, exhibitions, events and other products or activities of the Company.
Legal basis for processing:
Where marketing communications are addressed to our existing customers and business partners, the legal basis for processing is the legitimate interests of the Company pursuant to Article 6(1)(f) GDPR.
In all other cases, the legal basis for processing is the data subject’s consent to the processing of personal data pursuant to Article 6(1)(a) GDPR.
Categories of personal data processed:
First name and surname, email address and telephone number.
Retention period:
Personal data will be retained for a period of three years from the date on which consent to the processing of personal data was granted, but in any event no longer than until such consent is withdrawn.
In relation to our existing customers, personal data will be retained for as long as the legitimate interests of the Company continue to apply. However, if you object to the processing of your personal data for marketing purposes or unsubscribe from our newsletter, we will cease processing your personal data for this purpose.
C) Performance of a Contract
Purpose of processing:
Performance of contracts with customers, business partners and suppliers of goods or services to the Company, as well as taking steps with a view to entering into such contracts.
This may include, in particular, the sale of paintings, art prints or other products, arranging delivery, cooperation with galleries, and cooperation with suppliers of printing, framing, photography, graphic design or marketing services.
Legal basis for processing:
Performance of a contract to which the data subject is a party and taking steps at the request of the data subject prior to entering into a contract pursuant to Article 6(1)(b) GDPR.
Categories of personal data processed:
Identification data of the data subject, in particular first name, surname, residential or delivery address and signature; contact details of the data subject, in particular email address and telephone number; payment details of the data subject, such as bank account number and identification of the relevant banking institution; order information; and any other personal data whose processing is necessary to achieve the relevant purpose.
Retention period:
Personal data will be retained for the duration of the contractual relationship.
After termination of the contractual relationship, we will continue to retain personal data for the purpose of complying with obligations imposed by applicable law, in particular statutory record-keeping and archiving obligations, as well as for the purpose of protecting the legitimate interests of the Company, including the protection and enforcement of our rights and legal claims.
D) Audio and Audiovisual Recordings
Purpose of processing:
Creating and publishing photographs, audio recordings, visual recordings and audiovisual recordings from exhibitions, exhibition openings, workshops, presentations and other events related to artistic activities.
Legal basis for processing:
Consent to the processing of personal data pursuant to Article 6(1)(a) GDPR.
For the purpose of publishing audio recordings, audiovisual recordings and visual recordings, we process your personal data in the form of your recorded voice and likeness only with your consent, unless another legal basis under applicable law applies in the particular case.
Categories of personal data processed:
The likeness and voice of the data subject captured in a photograph, audio recording or audiovisual recording.
Retention period:
Personal data will be processed for the period specified in the relevant consent to the processing of personal data or for as long as necessary to fulfil the relevant documentary, archival or promotional purpose.
E) Protection of Our Rights and Legally Protected Interests
Purpose of processing and legitimate interest:
Establishing, exercising or defending our legal claims; recording and monitoring contractual relationships, orders, payments and communications; and protecting copyright and other intellectual property rights.
Legal basis for processing:
The legitimate interests of the Company pursuant to Article 6(1)(f) GDPR.
Categories of personal data processed:
Identification data of the data subject, in particular first name, surname, residential address and signature; contact details of the data subject, in particular email address and telephone number; payment details of the data subject, such as bank account number and identification of the relevant banking institution; information relating to orders, contracts and communications; and any other personal data whose processing is necessary to achieve the relevant purpose.
Retention period:
Personal data will be processed for as long as necessary to settle obligations arising from the relevant legal relationship with the Company and, following termination of that legal relationship, for the duration of the applicable limitation periods, but no longer than ten years unless otherwise required by applicable law or unless, in justified circumstances, it becomes necessary to retain the personal data for a different period.
F) Compliance with Legal Obligations
Purpose of processing:
Accounting and tax records, archiving and compliance with other obligations imposed by applicable law.
Legal basis for processing:
Compliance with the legal obligations of the Company pursuant to Article 6(1)(c) GDPR.
Categories of personal data processed:
Relevant identification, payment and contact details contained in contractual, order-related, accounting and tax documents.
Retention period:
For a period of ten years from the end of the tax period in which the relevant transaction took place, unless otherwise required by applicable law.
4. SOURCES OF PERSONAL DATA AND WHETHER THEIR PROVISION IS OPTIONAL OR REQUIRED
We most commonly obtain personal data directly from you as the data subject, in particular through a contact form, email correspondence, an order, a contract, registration for an event, subscription to a newsletter or communication through social media platforms.
In certain cases, however, we may supplement the information provided with information obtained from publicly available sources, such as the Trade Register, Commercial Register or other public registers. We may also receive personal data from another third party, such as a business partner, supplier or a person acting on behalf of a customer or business partner.
Prior to entering into a contract with the Company, the provision of your personal data is voluntary. However, if you enter into negotiations with a view to concluding a contract and subsequently enter into a contract with us or place an order, the requirement to provide your personal data arises from the need to enter into and perform the relevant contract or from applicable law.
Without the necessary personal data, it may not be possible to validly enter into a contract, process an order, deliver the ordered product or comply with statutory obligations.
5. AUTOMATED PROCESSING AND PROFILING
Your personal data are not processed solely by automated means in a manner that produces legal effects concerning you or similarly significantly affects you.
We may carry out limited profiling using your personal data, particularly in connection with analytics or marketing tools, but only to the extent necessary to provide you with more relevant information about artistic works, collections, products or events.
Where consent is required for such processing, we carry it out only on the basis of your consent.
6. RECIPIENTS OF PERSONAL DATA
Recipients of personal data most commonly include service providers and external advisers to the Company, in particular providers of software systems, web hosting, IT services, email and cloud services, payment service providers, postal and courier service providers, printing companies, suppliers of framing and packaging services, photographers, graphic designers, marketing agencies, and legal, accounting and tax advisers.
Where necessary, personal data may also be disclosed to courts, public authorities and other competent bodies for the purpose of complying with the Company’s legal obligations, enabling supervision or inspection of the Company’s activities, resolving disputes and enforcing decisions, as well as to other external advisers and legal representatives who are subject to confidentiality obligations.
Personal data may also be shared with an acquiring entity where the personal data are transferred as part of the sale or other transfer of all or part of the Company’s assets to another company.
7. TRANSFERS TO THIRD COUNTRIES
We do not actively transfer your personal data to third countries outside the European Union or the European Economic Area.
However, when certain technological, analytical, marketing or cloud-based services are used, personal data may be processed in or transferred to third countries.
In such cases, we will ensure that any such transfer is carried out in accordance with the GDPR and subject to appropriate safeguards, such as an adequacy decision adopted by the European Commission or Standard Contractual Clauses.
8. DATA SECURITY
In accordance with applicable legal requirements, we have implemented, maintain and apply appropriate security, technical and organisational measures, internal controls and processes designed to protect your personal data in a manner proportionate to the potential risks to you as the data subject.
We also take into account the state of technological development in order to protect your personal data against accidental loss, destruction, alteration, unauthorised disclosure or unauthorised access.
Such measures may include, among other things, taking appropriate steps to ensure the accountability of persons who have access to your personal data, restricting access to personal data, securing information systems and ensuring that appropriate contractual safeguards are in place with suppliers and service providers.
If you would like further information about the security of your personal data, please contact us at info@simicekovska.com.
9. RIGHTS OF THE DATA SUBJECT
When processing personal data, we respect your rights as a data subject. Every data subject whose personal data we process has rights relating to the appropriate protection and lawful processing of their personal data. You have the following rights:
Right of Access
Where personal data concerning you are being processed, you have the right to obtain information within the scope of this Policy and to access your personal data. You have the right to obtain a copy of the personal data we hold about you, as well as information about how we use your personal data.
In most cases, your personal data will be provided to you in written form unless you request another method of delivery. If you requested the information electronically, it will be provided to you electronically where technically feasible. Where you repeatedly request copies of your personal data to the same extent, the Company may charge a reasonable fee based on the administrative costs involved.
Right to Rectification
You have the right to have your personal data corrected if they are processed incorrectly or inaccurately. It is important to us that the information we hold about you is accurate. If you discover that any information we hold about you is incorrect, inaccurate or incomplete, please inform us and request that your personal data be corrected or completed.
Right to Erasure
If we process your personal data unlawfully, retain them for longer than necessary or process them without a relevant legal basis, you have the right to request their erasure and thereby exercise your “right to be forgotten.” This right does not apply where we are required to retain the personal data in order to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
Right to Restriction of Processing
You may request the restriction of processing where you request the rectification of your personal data, object to their erasure in the case of unlawful processing, where we no longer require the personal data for the relevant purposes but you require them for the establishment, exercise or defence of legal claims, or where you have objected to the processing of your personal data. In such cases, you may request that processing be restricted for the period necessary to resolve the matter.
Right to Object
If you believe that we are not entitled to process your personal data on the basis of the Company’s legitimate interests, you may object to such processing. In such cases, we may continue processing your personal data only if we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. We may also continue processing your personal data where such processing is necessary for the establishment, exercise or defence of legal claims.
Right to Data Portability
You have the right to obtain the personal data you have provided to us and to request that we transmit such personal data to another third party in a structured, commonly used and machine-readable format. The right to obtain and transmit personal data applies only to personal data that we obtained from you on the basis of your consent or a contract and that we process by automated means. The right to data portability does not apply to personal data that we process about you on the basis of specific legal provisions.
Right to Withdraw Consent
You have the right to withdraw any consent you have provided to us at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Right to Object to Direct Marketing
If you object to the processing of your personal data for direct marketing purposes, we will cease processing your personal data for such purposes.
Right to Lodge a Complaint
If you believe that we process your personal data unfairly or unlawfully, you have the right to lodge a complaint with the competent supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12
820 07 Bratislava 27
Website: dataprotection.gov.sk
If you have any questions regarding the processing of your personal data, you may contact us:
In writing at:
MediaBrothers, s. r. o.
Trnavská cesta 19375/8C
821 08 Bratislava – Ružinov
By email at:
info@simicekovska.com
10. VALIDITY AND UPDATES TO THIS POLICY
The information that we are required to provide to you in connection with our processing of personal data may change or cease to be up to date. For this reason, we reserve the right to amend this Policy.
If we make material changes to this Policy, we will bring such changes to your attention in an appropriate manner.
The current version of this Policy will always be available on our website simicekovska.com.