In compliance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27^th, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and Section 19 par 1 of the Act 18/2018 Coll., TAJPAN s.r.o. (hereinafter only referred to as “the Operator” or “the Company“) provides information pertaining to the rules of personal data processing.

FUNDAMENTAL CONCEPTS AND BASIC INFORMATION

1. Identification data of information system operator:

Entity: TAJPAN s.r.o.

Office: Vážska 1, 821 07 Bratislava

ID No.: 35 910 828

Registration: Trade Register of the District Law Court Bratislava I, part: Sro, Insert No. 34109/B

e-mail: tajpan@tajpan.com

Our company has not appointed an authorised person. You and protection of your personal data is important to us. Therefore, should you have any questions or uncertainties concerning personal data protection, please contact us via email at: tajpan@tajpan.com or send regular mail addressed to our office: TAJPAN s.r.o., Vážska 1, 821 07 Bratislava.

Personal data processing is guided primarily by the EU General Data Protection Regulation (“GDPR”), which also governs your rights as a stakeholder, and thus provisions of the Personal Data Protection Act related to us (mainly Section 78). 

2. Who are the persons involved in data processing?

We shall process your personal data if you are participating in the event forming part of continuous training of healthcare professionals; a specialised event that is not related to the continuous training of healthcare professionals or if you are participating in other than specialised event /such as teambuilding, cycle meeting/, which is co-organised by our company (hereinafter also referred to as “the person concerned“).

3. What type of personal data will be processed by us and how do we acquire them?

When you apply for a specialised event, we require following data to be filled: title, first name, last name, home address, date of birth, medical profession, specialisation, registration number in the Slovak Medical Chamber, membership in a given chamber, form of participation /active or passive/, data concerning your workplace, possibly your office address if you are a health care provider (name of the workplace, street, number, city and postcode), email address and telephone contact.

This information can also be provided to us by a third party, which is the entity /partner of a specialised event / in case that they invite and register you for a specialised event.

Should you participate in other than a specialised event, we shall process your personal data in a following extent: name, surname, telephone number, email address, which can be provided to us by a third party, such as event contractor.

4. Purpose, legal basis and period of personal data storage

Below you will find out for what purpose, on what legal basis and how long we keep your personal data.

Purpose: Personal data processing in order to keep register of clients.

Legal basis set out in GDPR: processing is necessary for the performance of a contract to which the person concerned is a party based on the Article 6, par. 1 letter b) of the GDPR (Section 13, paragraph 1 letter b) of the Act 18/2018 Coll. on the personal data protection). Processing shall be necessary for the purposes of the legitimate interests pursued by the operator pursuant to the Article 6 (1), letter f) of the GDPR (Section 13 par. 1, letter f) of Act the 18/2018 Coll. on the personal data protection).

Shelf life: 10 years since termination of the cooperation

In case of failure to provide your personal data, you will not be registered as participant to the event organised by the company.

The extent of the personal data collected and the person providing the personal data is set out in par. 3 of the document herein.

Legal basis set out in GDPR: in case an account is being established for registration for individual events, personal data processing is necessary for the purposes of performance of the contract to which the person concerned is a party pursuant to the Article 6, par. 1, letter b) of the GDPR (Section 13, paragraph 1, letter b) of the Act 18/2018 Coll. on the personal data protection). The legal basis is also a legitimate interest of the Operator pursuant to the Article 6, par. 1, letter f) of the GDPR (Section 13, par. 1, letter f) of the Act 18/2018 Coll. on the personal data protection)

Shelf life: 10 years since termination of the cooperation

In case of failure to provide your personal data, you will not be registered as participant to the event organised by the company.

The extent of the personal data collected and the person providing the personal data is set out in par. 3 of the document herein.

Purpose: Sale support covering marketing offers, newsletter, information on specialised events, e-learning, products and news.

Legal basis set out in GDPR: personal data processing  concerning participants to specialised event or the clients who made use of any kind of services offered by the Operator, shall take place pursuant to the Article 6, par. 1, letter f) of the GDPR (Section 13, paragraph 1, letter f) of Act 18/2018 Coll. on the personal data protection) – legitimate interest of the Operator. Personal data processing of new clients who have not made use of the Operator’s services or with whom the Operator has not have a preceding relationship, requires consent of the concerned party pursuant to the Article 6, par. 1, letter c) of the GDPR (Section 13, par. 1, letter c) of the Act 18/2018 Coll. on Personal Data Protection).

Shelf life: 5 years since the last cooperation, but no later than a discontent with personal data processing for marketing purposes is expressed.

In case of failure to provide your personal data, it will not be possible to send you marketing offers, newsletter, information on specialised events, e-learning, products and news. If you have given your consent for this purpose, it can be revoked at any time.

The extent of the personal data collected and the entity providing the personal data is described in item 3 of this document.

Purpose: Evidence of participation in accredited specialised events and processing of credits assigned to the electronic credit system.

Legal basis set out in GDPR:  data processing is mandatory pursuant to the specific regulation, namely the Article 6, par. 1, letter c) of the GDPR (Section 13, par. 1, letter c) of the Act 18/2018 Coll. on personal data protection), mainly:

Act 578/2004 Coll. on healthcare providers, healthcare professionals, healthcare professional organizations and on amendments to certain acts.

Shelf life: 20 years

In case of failure to provide your personal data, it will not be possible to process your credits assigned to the electronic credit system (EKS CME).

The extent of the personal data collected and the entity providing the personal data is described in item 3 of this document.

Purpose: Organisation of specialised events related to ongoing training of healthcare professionals, organisation of specialised events non-related to ongoing training of healthcare professionals and organisation of other than specialised events.

Legal basis set out in GDPR: performance of the contract pursuant to the Article 6, par. 1b) of the GDPR (Section 13, par 1b) of the Act 18/2018 Coll. on the Personal Data Protection

Shelf life: 10 years since termination of cooperation

In case of failure to provide your personal data, it will not be possible to register you as a participant to the event organised by our company and it will not be possible to satisfy your order (fulfil the contract) concluded between our company and you as person concerned.

The extent of the personal data collected and the entity providing the personal data is described in item 3 of this document.

Purpose: Event promotion

Legal basis set out in GDPR: performance of the contract pursuant to the Article 6, par. 1b) of the GDPR (Section 13, par. 1, letter b) of the Act 18/2018 Coll. on the Personal Data Protection

Shelf life: 1 year

In case of failure to provide your personal data, it will not be possible to fulfil the contract concluded between our company and you as person concerned.

Purpose: Concluding copyright and licensing contracts for copyrighted work presented at specialised event and subsequent use of this work. Conclusion of contracts on consulting and duties deriving from fulfilment of commitments included in the contract.

Legal basis set out in GDPR: performance of the contract to which person concerned is a party pursuant to the Article 6, par. 1, letter b) of the GDPR (Section 13, par. 1, letter b) of the Act 18/2018 Coll. on the Personal Data Protection.

Shelf life: 10 years from termination of the contract

In case of failure to provide your personal data, it will not be possible to fulfil the contract concluded between our company and you as person concerned.

Purpose: Submission of a notification of monetary and non-monetary benefits by the entity providing monetary/non-monetary benefits. Notification of the amount of non-monetary benefits to the tax administrator. Notification of the amount of tax deducted and paid to the tax administrator. Notification of withholding and payment of tax collected by deduction from monetary performance to the tax administrator.

Legal basis set out in GDPR: fulfilment of our statutory duties is governed by special legal regulations, namely:

Act 362/2011 Coll. on Drugs and Medical Devices and amendments to certain acts

Act 595/2003 on Income Tax

Shelf life: 10 years from the last cooperation

In case of failure to provide your personal data, it will not be possible to provide you with monetary/non-monetary benefits.

The extent of the personal data collected and the entity providing the personal data is described in item 3 of this document.

Purpose: Organisation and registration of event participants to whom the operator provides accommodation during the event and facilitation and registration of event participants to whom the operator provides transport to events.

Legal basis set out in GDPR: performance of the contract pursuant to the Article 6, par. 1, letter b) of the GDPR (Section 13, par 1, letter b) of the Act 18/2018 Coll. on the Personal Data Protection

Shelf life: 10 years from termination of cooperation

Your personal data shall be processed in the information system only if we secured an accommodation for you during the event and transport to the event.

In case of failure to provide your personal data, it will not be possible to facilitate accommodation and transport for you.

The extent of the personal data collected and the entity providing the personal data is described in item 3 of this document.

Purpose: Provision of e-learning education of healthcare personnel, registration of participants and processing of assigned credits into electronic credit system.

Legal basis set out in GDPR: Processing is necessary for the purpose of performing a contract to which the person concerned is a party pursuant to the Article 6, part 1, letter b) GDPR (Section 13, par. 1, letter b) of the Act 18/2018 Coll. on the personal data protection) and according to a special regulation pursuant to the Article 6, par. 1, letter c) of the GDPR (Section 13 par. 1, letter c) of the Act 18/2018 Coll. on the personal data protection), in particular:

Act 578/2004 Coll. on healthcare providers, healthcare professionals, healthcare professional organizations and on amendments to certain acts.

Shelf life: 10 years from the last cooperation

Your personal data will be processed in this information system only in case you took part in e-learning.

In case of failure to provide your personal data, it will not be possible to process your credits assigned to the electronic credit system.

Purpose: Camera and photo recordings from organised events

Legal basis set out in GDPR: processing of the image of participants during the event in form of the publication of camera and photographic recordings of the event is a legitimate interest of the Operator within the meaning of Article 6, par. 1, letter f) GDPR (Section 13, par. 1, letter f) of the Act 18/2018 Coll. on the personal data protection). When making camera and photographic recordings of lecturers as persons concerned for the purpose of education on the website, the legal basis is the performance of the contract to which the person concerned is a party pursuant to the Article 6, par. 1, letter b) of the GDPR (Section 13, par. 1, letter b) of Act the 18/2018 Coll. on personal data protection). Where the person concerned is not a party to the contract, the legal basis for the processing shall be the consent of the person concerned pursuant to the Article 6, par. 1, letter a) of the GDPR (Section 13, par. 1, letter a) of the Act 18/2018 Coll. on personal data protection).

Shelf life: 10 years

Despite the fact that provision of abovementioned documentation does not require a consent given by the respective person, we respect that you might not wish to be recorded in any way. In such case, please inform our  admission personnel upon registration or send us your declaration of discontent to our e-mail address: tajpan@tajpan.com. In case you express your discontent, your image will be anonymized.

Purpose: Publication of camera and image recordings from events on internet pages in order to promote the Operator. Publication of camera and photographic recordings of lecturers from events on internet webpages for educational purposes.

Legal basis set out in GDPR: the processing of the image of participants during the event in form of the publication of camera and photographic recordings of the event is a legitimate interest of the Operator pursuant to the Article 6, par. 1, letter f) of the GDPR (Section 13, par. 1, letter f) of the Act 18/2018 Coll. on the personal data protection). When making camera and photographic recordings of lecturers as persons concerned for the purpose of education on the website, the legal basis is the performance of the contract to which the person concerned is a party within the meaning of Article 6 par. 1 letter b) of the GDPR (Section 13, par. 1, letter b) of the Act 18/2018 Coll. on personal data protection). Where the person concerned is not a party to the contract, the legal basis for the processing shall be the consent of the person concerned pursuant to the Article 6, par. 1, letter a) of the GDPR (Section 13, par. 1, letter a) of the Act 18/2018 Coll. on personal data protection).

Shelf life: 10 years

Your personal data shall be processed in this information system only in case that your image was recorded during our event.

In case of failure to provide your personal data, no recording or photograph of you at the event could be made.

Purpose: Archive of incoming and outgoing mail records

Legal basis set out in GDPR: fulfilment of our statutory obligations under specific legislation, in particular:

–    Act 395/2002 Coll. on Archives and Registries and amendments to certain laws

Shelf life: 10 years

Your personal data in this information system can be processed only in case that you communicated with us via e-mail or post.

In case you fail to provide your personal data, we shall not be able to communicate with you via email or post.

Purpose: Protection of assets, prevention and protection of rights and protection of the rights and legally protected interests of the operator through a camera system.

Legal basis set out in GDPR: Operator’s legitimate interest

Shelf life: 14 days

We shall process your personal data only in case that you visit our corporate premises.

Purpose: Register of complaints for the purpose of the settlement of complaint and application of claim procedure

Legal basis set out in GDPR: fulfilment of our statutory obligations under specific legislation, in particular:

Act 40/1964 Coll., Civil Code as amended

Act 250/2007 Coll. on Consumer Protection and on amendment of the Act of the Slovak National Council 372/1990 Coll. on Offences as amended, and other relevant generally binding legal regulations

Act 395/2002 Coll. on Archives and Registries as amended

Act 18/2018 Coll. on Personal Data Protection

Shelf life: 5 years

In case of failure to provide your personal data, we shall not be able to proceed with the claim procedure.

Purpose: Processing and registration of accounting documents

Legal basis set out in GDPR: fulfilment of our statutory obligations under specific legislation, in particular:

Act 431/2002 Coll. on Accounting as amended

Act 222/2004 Coll. on Value Added Tax as amended

Act 40/1964 Coll. Civil Code as amended

Act 152/1994 Coll. on the Social Fund and on the amendment of Act 286/1992 Coll. on Income Taxes, as amended

Shelf life: 10 to 20 years

In case of failure to provide your personal data, we shall not be able to fulfil our legal duties.

Purpose: proving, applying, advocating or defending legal claims in case of legal litigations.

Legal basis set out in GDPR: Operator’s legitimate interest

Shelf life: in case of participants to the event, a period during which legal claims deriving from contractual relations can be applied.

In case of failure to provide your personal data, we shall not be able to satisfy your claim.

Purpose: Exercising the rights of the person concerned

Legal basis set out in GDPR: processing is inevitable under a separate regulation pursuant to the Article 12, par. 1 and GDPR (Section 29, par. 1 and following Act 18/2018 Coll. on personal data protection).

Shelf life: 3 years

In case of failure to provide your personal data, we shall not be able to satisfy your claim.

5. Personal data provision

The Operator shall not provide personal data to third countries outside EU.

6. Recipients with access to personal data

Your personal data will be accessible only to the inevitable extent, while maintaining confidentiality of data recipients, mainly:

a) The Slovak Accreditation Commission for Continuous Medical Education, Dobšinského 12, 811 05 Bratislava;

b) Company LEKÁR a.s., Dobšinského 12, 811 05 Bratislava, ID No.: 35 947 349 as administrator of electronic credit system entrusted by the Slovak Medical Chamber and Slovak Medical Association;

c) An entity providing monetary/non-monetary benefits;

d) Partner of the specialised event;

e) Entity ordering a specialised event;

f) Respective medical chamber;

g) An entity facilitating accommodation;

h) An entity facilitating transport;

i) A company facilitating accounting services;

j) Company Allio s.r.o, Buková 27, Šamorín 93101, ID No.: 35 776 684;

k) Tax Authority;

l) The Slovak Trade Inspection;

m) Inspectors from the Office of Personal Data Protection of the Slovak Republic;

n) Law courts, law enforcement agencies; and

n) Other eligible entity.

Personal data shall be made accessible to other public administration bodies and other entities in order to fulfil the legal and contractual duties.

We would like to inform you that if we organise a specialised event, training or other service ordered by the customer of a specialised event or an event with support of business partners, personal data could be made accessible to some specialised partners or customers of the specialised event or other service, namely name, surname, email address and specialisation. We provide personal data in case we are contractually bound to do so and for the purpose of registering participants taking part in the event and in case we need to fulfil our legal duties and report to the Tax Authority and the National Centre for Medical Information to a broader extent.

Should you be interested in more detailed information about persons or tools utilised by third parties, to whom we provide our data, please, contact us.

7. Rights of the person concerned

1. The right to require access to personal data pursuant to the Article 15 of the Regulation

A person concerned has the right to request a confirmation from the Operator proving that the personal data are actually being processed. If so, the person concerned has the right to gain access to such data (a copy of processed personal data). A confirmation will be provided in written form via post of electronically.

2. The right to rectify personal data pursuant to the Article 16 of the Regulation

A person concerned has the right to have their respective incorrect personal data rectified without undue delay and missing personal data amended.

3. The right to delete personal data under Article 17 of the Regulation

A person concerned has the right to require that the Operator erases personal data related to them, e.g. in a situation where personal data are not inevitable for the purposes for which they were acquired or processed, or if the person concerned withdraws consent with personal data processing, objects against personal data processing pursuant to the Article 21, par. 1 of the Regulation or if personal data are being processed illegally. The Operator shall erase such personal data without undue delay. The Operator shall not erase the personal data in case that the duty to process the personal data persists, e.g. due to legal obligations, public interest in healthcare field or for the purposes of archiving in public interest, for the purposes of scientific or historic research or statistical purposes, should the enforcement of the right to erase significantly complicate pursuit of the objective for data processing (for more information, see Article 17 of the Regulation).

4. The right to limit processing pursuant to the Article 18 of the Regulation

Should a person concerned raise objections against the accuracy of personal data during a period enabling the Operator to verify accuracy of personal data, processing is illegal, and the person concerned shall object against the erasing of personal data and require a limitation of its use, instead. The Operator no longer needs personal data for processing purposes, however a person concerned needs them to prove, apply and advocate for legal claims or if a person concerned  objects against personal data processing pursuant to the Article 21, par. 1, up to the moment of verification whether legitimate reasons on the Operator’s side prevail over legitimate reasons of the person concerned, the person concerned has the right to require limitation of personal data processing.

5. The right to portability of the data pursuant to the Article 20 of the Regulation

A person concerned has the right to obtain personal data provided to the Operator in a structured, routinely used and machine-readable format, moreover a person concerned has the right to transfer such data to another Operator should the processing be based on consent of the person concerned with data processing or if the processing is inevitable in order to fulfil the contract, to which a person concerned is a party. By exercising this right, the right to erase personal data is not affected.

6. The right to object against personal data processing pursuant to the Article 21 of the Regulation

In case that personal data processing is based on legitimate interest of the Operator or if personal data are being processed by the Operator for direct marketing purposes, the person concerned has the right to object against processing of personal data related to them. In case the Operator fails to prove legitimate and valid interest, or if the person concerned submits an objection against personal data processing for direct marketing purposes, the Operator will no longer process such personal data.

7. The right to unenforceablity of automated individual decision-making including profiling pursuant to the Article 22 of the Regulation

While processing your personal data, our company shall not apply automated decision-making or profiling.

8. The right to file a motion to initiate the procedure for the personal data protection under Section 100 of the Act and Article 77 and 79 of the Regulation

Should concerned persons believe that their respective personal data are being processed in contradiction with the Act or the Regulation, they have a right to file a claim to the Office for Personal Data Protection of the Slovak Republic to initiate the procedure for personal data protection. Contact details: Office for Personal Data Protection, Hraničná 12, 820 07 Bratislava 27, Slovak Republic.

8. Amendments in privacy terms

Personal data protection is not a one-off issue for us. Information which we are obliged to provide you with regard to our personal data processing, may be amended or cease to be up to date. Consequently, we reserve the right to amend and extend these terms at any time. In case we amend these conditions in considerable manner, we shall notify you about such amendment e.g. via general announcement during a specialised event.

9. Website security and use of cookies

Our website uses encrypted TLS connection in relation to any user connection and data transmission to prevent third parties from accessing or altering data during their transmission via Internet by third parties. User login is protected by password encryption of the database.

Our website uses cookies. Cookies are small text files that put our websites on your computer or other devices with Internet access. Cookies provide us with information on how often you visit our site and  what do you look at, which allows us to constantly improve our services. Cookies are not dangerous. Cookies themselves carry no personal information, but if you provide us with personal information, they can be linked to data stored in cookies. We do not collect your personal data and information via cookies, nor do we provide them to personal data intermediaries or third parties (the only part, which is stored, is a unique identifier which allows repeated profile retrieving and use of preferences of the concerned person during the next visit). Receiving cookies can be declined by adjusting the setting in your internet browser.

If you wish to claim your rights listed above, you may do so at the e-mail address: tajpan@tajpan.com, or via post at the address of the Operator introduced in the initial part of the document herein.

The Personal Data Protection terms come into effect on May 25, 2018.