Article I. Introductory provisions

1) This document sets out the principles of personal data protection at EUROPUR s.r.o., registered office at Novonosická 503/5, 020 01 Púchov, Company ID (IČO) 36305383 (hereinafter the “Controller”), in particular the rules for obtaining, collecting, storing, using, disseminating, retaining and securing personal data.

2) This document is intended for all natural persons whose personal data the Controller processes:
a) employees and former employees,
b) job applicants,
c) suppliers and customers,
d) visitors to the website www.europur.net and persons who contact the Controller via the form on the website.

3) The Controller accepts questions, comments and requests concerning this document and the information in it at the e-mail address europur@europur.sk.

4) The Controller has not appointed a data protection officer.

5) “Personal data” means any information relating to an identified or identifiable natural person (hereinafter the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

6) The current version is permanently published at www.europur.net.

Article II. Protection of personal data

1) The Controller consistently ensures the protection of personal data. For this purpose, it has adopted appropriate technical, organisational and security measures that take into account the risk involved, the nature of the processing, the state of the art and the costs of implementing these measures.

2) The Controller protects personal data against misuse by suitable and available means. Above all, it keeps personal data in premises, places, environments or systems to which only a limited, predetermined and at all times controlled group of persons, the so-called authorised persons, has access.

3) The company deals immediately with every security incident concerning personal data. If the incident is likely to result in a high risk to the rights and freedoms of natural persons, it always informs the data subject and tells them what measures it has taken to remedy it. A record is made of every incident. The company must report every serious incident to the Office for Personal Data Protection of the Slovak Republic.

Article III. Purposes of processing, legal bases, categories of data subjects, retention period, recipients

III.I Job applicants

1) The Controller processes personal data of job applicants for the purpose of the selection procedure. Scope: personal data that job applicants provide in their CVs, cover letters, certificates of education, certificates and other documents made available by the applicants themselves. The legal basis for the processing of personal data is the pre-contractual relationship between the job applicant and the Controller as their potential employer.

2) The Controller also obtains this data via the application form on the website, in the following scope: first name and surname, e-mail, telephone number, cover letter, CV and other data that the applicant provides.

III.II Suppliers

1) The Controller processes personal data of suppliers for the purpose of:

a) Processing and retaining accounting documents. Scope: business name, registered office or, for natural persons, place of residence and place of business, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH) if assigned, contact details and signature of the person who issued the accounting document, transaction data. The legal basis for the processing of personal data is the law.

b) Concluding and performing contracts. Scope: business name, registered office or, for natural persons, place of residence and place of business, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH) if assigned, title, first name, surname and signature of the statutory representative or another authorised representative, contact details of the supplier’s employees where necessary for the performance of the contract, transaction data. The legal basis for the processing of personal data is the conclusion and performance of the contract between the Controller and its supplier.

c) Communication with suppliers. Scope: title, first name and surname of the supplier’s employee, job position, name of the employer, telephone number, e-mail address. The legal basis for the processing of personal data is the legitimate interest in ensuring communication between the Controller and its suppliers.

2) The Controller obtains personal data:
a) directly from the supplier when a contract is concluded or performed,
b) directly from the supplier when accounting documents are issued,
c) directly from the supplier by using the contact details provided for communication.

3) The Controller retains personal data:
a) for the purpose of processing and retaining accounting documents for 10 years,
b) for the purpose of concluding and performing contracts for 10 years,
c) for the purpose of communication with suppliers for 3 years.

4) After the retention period ends, personal data are disposed of in a secure and lawful manner.

III.III Customers

1) The Controller processes personal data of customers for the purpose of:

a) Processing and retaining accounting documents. Scope: business name, registered office or, for natural persons, place of residence and place of business, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH) if assigned, contact details and signature of the person who issued the accounting document, transaction data. The legal basis for the processing of personal data is the law.

b) Concluding and performing contracts. Scope: business name, registered office or, for natural persons, place of residence and place of business, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH) if assigned, title, first name, surname and signature of the statutory representative or another authorised representative, contact details of the customer’s employees where necessary for the performance of the contract, transaction data. The legal basis for the processing of personal data is the conclusion and performance of the contract between the Controller and its customer.

c) Communication with customers. Scope: title, first name and surname of the customer’s employee, job position, name of the employer, telephone number, e-mail address. The legal basis for the processing of personal data is the legitimate interest in ensuring communication between the Controller and its customers.

d) Marketing, sending newsletters about the Controller’s promotions, discounts and news. Scope: first name and surname, e-mail. The legal basis for the processing of personal data is the consent of the data subject.

e) Marketing, sending informational e-mails and news to customers, presenting the Controller’s products. Scope: first name and surname, job position, name of the employer, telephone number, e-mail address. The legal basis for the processing of personal data is legitimate interest.

2) The Controller obtains personal data:
a) directly from the customer when a service is ordered and the ordered service is performed,
b) directly from the customer when accounting documents are issued,
c) directly from the customer in mutual communication,
d) directly from the customer when they subscribe to the newsletter.

3) The Controller retains personal data:
a) for the purpose of processing and retaining accounting documents for 10 years,
b) for the purpose of concluding and performing contracts for 10 years,
c) for the purpose of communication with customers for 3 years,
d) for the purpose of marketing and sending newsletters about promotions, discounts and news, for as long as consent lasts,
e) for the purpose of marketing, sending informational e-mails and news to customers and presenting the Controller’s products, for 5 years after the end of the contractual relationship with the customer, or for as long as consent lasts.

4) After the retention period ends, personal data are disposed of in a secure and lawful manner.

III.IV Contact form on the website

1) The Controller processes personal data of persons who contact it via the contact form on the website for the purpose of handling the enquiry, answering the question and preparing a price quote. Scope: first name and surname, e-mail, telephone number (optional), subject of the message, text of the message and attached file (e.g. a drawing of the part).

2) The legal basis is the taking of steps prior to entering into a contract at the request of the data subject pursuant to Art. 6(1)(b) GDPR and the Controller’s legitimate interest in responding to the messages received pursuant to Art. 6(1)(f) GDPR.

3) A sequential number is stored with each message sent.

4) The Controller retains this data for 3 years from the last communication, as with communication with customers. If a contractual relationship arises from the enquiry, Part III.III applies from then on.

III.V Website visitors and cookies

1) The Controller processes data of website visitors by means of cookies and similar technologies. Details are in Article IV.

2) The Controller uses strictly necessary cookies, which make the website work and remember the choice made on the consent bar, on the basis of its legitimate interest in the proper functioning of the website pursuant to Art. 6(1)(f) GDPR.

3) The Controller uses analytics and marketing cookies only with the visitor’s consent pursuant to Art. 6(1)(a) GDPR and the regulations on electronic communications. The visitor gives or refuses consent on the bar during the first visit and can change or withdraw it at any time via the “Cookie settings” link in the footer of the website.

Article IV. Cookies

1) A cookie is a small text file that is stored on the visitor’s device when they visit a website. The Controller’s website uses cookies and similar technologies to make the website work, to measure traffic and to measure and display advertising.

2) The Controller uses the following categories of cookies:
a) Strictly necessary: they provide the basic functions of the website, e.g. remembering the language and the choice made on the consent bar. Without them the website does not work properly, so no consent is needed for them.
b) Analytics (statistics): they help the Controller understand how visitors use the website (Google Analytics, Microsoft Clarity). They are used only with consent.
c) Marketing: they are used to measure and display advertising (Google Ads, Meta Pixel, LinkedIn Insight Tag). They are used only with consent.

3) A list of the tools and cookies with their provider, purpose and storage period is in the Cookie Policy.

4) The visitor can change or withdraw consent at any time via “Cookie settings” in the footer of the website. They can also delete or block cookies in the settings of their browser.

Article V. Rights of the data subject

1) The Controller places emphasis on respecting the rights of data subjects. Data subjects have the following rights:

a) Right to information. Every data subject has the right to information about the processing of their personal data. To this end, appropriate measures have been taken to ensure that this information is duly provided to data subjects. The Controller fulfils its information obligation through this document, which is permanently published at www.europur.net.

b) Right to withdraw consent. If the data subject has given consent to the processing of their personal data (e.g. to analytics or marketing cookies, to receiving the newsletter, to inclusion in the applicant database or to the taking of photographs at company events), they can withdraw it at any time. Consent to cookies is withdrawn via “Cookie settings” in the footer of the website, other consents by e-mail to europur@europur.sk. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

c) Right of access to data. At the request of the data subject, the Controller issues a confirmation of the processing of their personal data, together with all information required by applicable legislation.

d) Right to rectification. The data subject has the right to the processing of correct and up-to-date data. The Controller updates data at the request of the data subject or after verifying the data in the course of communication with the data subject.

e) Right to erasure. Under certain conditions, the data subject may request the erasure of personal data. The Controller will comply with the request or inform the data subject why it cannot erase the data.

f) Right to restriction of processing. Under certain conditions, the data subject may request the restriction of the processing of personal data. The Controller will comply with the request or inform the data subject why it cannot restrict the processing of their data.

g) Right to data portability. The Controller transfers personal data to another controller exclusively at the request of the data subject.

h) Right to object. In certain circumstances, the data subject has the right to object to the processing of their data, in particular processing based on legitimate interest, including direct marketing.

i) Right to lodge a petition or complaint with the Office for Personal Data Protection. The data subject may at any time turn with a petition or complaint concerning the processing of personal data to the supervisory authority, namely the Office for Personal Data Protection of the Slovak Republic.

2) The data subject may exercise their rights in writing at the Controller’s correspondence address Kočovská 14, 915 01 Nové Mesto nad Váhom, or by e-mail to europur@europur.sk.

3) The Controller records every request and handles it without undue delay, but no later than within one month. Within this period, it informs the data subject who submitted the request of the measures it has taken on the basis of the request. This period may be extended by a further two months where necessary, taking into account the complexity and the number of requests. The Controller informs the data subject of the extension within one month of receipt of the request, together with the reasons.

4) Notice of how the request has been handled is given in the same way in which the request was submitted, unless the data subject asks for another way.

5) The Controller handles the requests of data subjects free of charge. However, if a request of a data subject is manifestly unfounded or repetitive, the Controller may charge a reasonable fee for handling it that takes into account the administrative costs, or may refuse to act.

6) The following may have access to personal data processed by the Controller:
a) providers of accounting and payroll services,
b) providers of IT services, including administration and development of the website,
c) the web hosting provider,
d) the e-mail service provider Microsoft Ireland Operations Limited (Microsoft 365),
e) providers of traffic and advertising measurement tools: Google Ireland Limited (Google Tag Manager, Google Analytics, Google Ads), Microsoft Ireland Operations Limited (Microsoft Clarity), Meta Platforms Ireland Limited (Meta Pixel) and LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag); analytics and marketing tools store cookies only with consent, details are in the Cookie Policy,
f) the provider of the cookie consent management tool,
g) the marketing agency that manages measurement and advertising for the Controller,
h) providers of occupational health and safety and fire protection services,
i) providers of legal, consulting and training services,
j) public authorities,
k) law enforcement authorities.

7) When tools of Google, Microsoft, Meta and LinkedIn are used, personal data may be transferred to third countries, in particular to the USA. Such transfers take place on the basis of the European Commission’s adequacy decision (the EU-U.S. Data Privacy Framework) or on the basis of standard contractual clauses approved by the European Commission. In all other processing, no data are transferred to third countries or to an international organisation.