Under Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council – (hereinafter referred to as the “GDPR”) in conjunction with Section 19 of Act No. 18/2018 Coll. on the Protection of Personal Data and on alterations and amendments to certain acts, as amended (hereinafter referred to as the “Information:

1.1.     Identity and contact details of the controller (RPC):

Regional Card Processing Centre, s.r.o., having its registered office at Námestie Mateja Korvína 1, 811 07 Bratislava, Company Reg. No.: 44 548 605.

Email: rpc_gdpr@ri-rpc.sk.

1.2.     Data subjects: employees

1.3.    Categories of concerned personal data:

1.3.1.    identification data including without limitation name, surname, title, birth number (if assigned), identity card number, date of birth, permanent address information, gender, etc.;

1.3.2.    contact details including without limitation telephone number, e-mail address; etc.;

1.3.3.   data relating to remuneration including without limitation bank code, bank number, salary conditions, remuneration, data related to pension, etc;

1.3.4.   data relating to personal life and about your family members including without limitation marital status, first name, last name, date of birth, birth number, etc. (in the extent required by applicable laws);

1.3.5.   data relating to professional life including without limitation employment start date, employment type, business e-mail address, position, etc;

1.3.6.   security and system information including without limitation, your system log-in data, access card number, identification data of items and devices you have been entrusted with (e.g. computer, mobile phone, car), etc.;

1.3.7.    special categories of data including without limitation data concerning your health;

1.3.8.   a photograph, visual and audio recording, and expressions of a natural person particularly his/her photographs and audiovisual and video recording

1.4.    The purposes of personal data processing:

1.4.1.    processing is necessary for the performance of employment contract concluded by and between the controller as the employer and data subject as employee (C01);

1.4.2.   processing is necessary for employees training in order to deepen their qualification for the performance of work and processing necessary for evaluation of their job performance (C15);

1.4.3.   processing is necessary for fulfilment of legal obligations arising from laws and regulations of controller as employer such as (C01, C02):

1.4.3.1.    Act. No. 311/2001 Coll. Labour Act as amended;

1.4.3.2.    Act No. 461/2003 Coll. on Social Insurance as amended;

1.4.3.3.   Act No. 43/2004 Coll. on the Old Age Pension Scheme as amended;

1.4.3.4.   Act. No. 650/2004 Coll. on the Supplementary Pension Scheme and on Amendments and Supplements to Certain Acts, as amended;

1.4.3.5.    Act No. 580/2004 Coll. on Health Insurance and on Amendments and Supplements to Act No. 95/2002 Coll. on Insurance and on Amendments and Supplements to Certain Acts, as amended,

1.4.3.6.   Act No. 146/2006 Coll. on Occupational Safety and Health Protection and on Amendments and Supplements to Certain Acts, as amended,

1.4.3.7.    Act No. 431/2002 Coll. on Accounting as amended, etc..

1.4.4.   processing is necessary for the legitimate interests of the controller for the purposes of:

1.4.4.1.    protecting intruders from accessing entrance and sensitive locations at RPC premises (C13);

1.4.4.2.   processing of employee complaints and feedbacks in RBI surveys (C14);

1.4.4.3.   exercising and defending legal claims of RPC (C08, C09),

1.4.4.4.   displaying photographs of RPC employees in digital communication and messaging systems used by RPC and for sharing internal newsletters (C06);

1.4.4.5.   use of photographs to a reasonable extent for the purposes of promoting the controller and strengthening the brand on social media (C04);

1.4.4.6.   placement of RPC employees photographs on the physical company ID cards (C03).

1.5.     Legal basis for personal data processing:

1.5.1.    Art. 6(1) (b) of the GDPR – processing is necessary for the performance of the employment contract concluded by and between data controller as the employer and data subject as the employee under subparagraph 1.4.1.;

1.5.2.    Art. 6(1) (c) of the GDPR – processing is necessary for fulfilment of legal obligations arising from relevant legal obligations;

1.5.3.   Art. 6(1) (f) of the GDPR – processing based on the legitimate interest of the controller;

1.5.4.   Art. 9(2) (b) of the GDPR – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment and social protection law.

1.6.    Recipients or categories of recipients of the personal data:

The controller provides your personal data to the following recipients/categories of recipients:

1.6.1.    the parent company Raiffeisen Bank International AG, having its registered office at Am Stadtpark 9, 1030 Vienna, Austria, registered with the Commercial Register of the Commercial Court in Vienna under the number FN 122119m (RBI);

1.6.2.    external financial audit;

1.6.3.   the provider of banking services;

1.6.4.   the provider of HR tool for employees evaluation;

1.6.5.   providers of services, professional occupational safety trainings on the processing of identification data in respect of retraining in occupational health and safety, fire protection and occupational health service;

1.6.6.   law enforcement authorities.

1.7.     Information that the controller intends to transfer the personal data to a third country or international organisation:

There is transfer of personal data to third countries or international organisations.

When transferring personal data outside the European Economic Area, the controller will take appropriate measures to ensure that this transfer takes place under the conditions and standards set by the GDPR and the Personal Data Protection Act.

1.8.    Period for which the personal data will be stored (criteria used to determine that period):

The controller may store the personal data during the following period:

1.8.1.    for the duration of your employment, and after termination of your employment for the period indicated by statutory provisions of laws;

1.8.2.    for the duration of any judicial, administrative or other proceedings to the extent necessary and for the entire duration of such proceedings and the remaining part of the limitation or extinction period after their termination;

1.8.3.   photographs of data subject used for promotional and marketing purposes of the RPC for a period of 10 years from the day the contractual relationship with the data subject was terminated;

1.8.4.   digital video recordings are being deleted at the end of the retention period which is set at 72 hours to 30 days;

1.8.5.   to the remaining extent, your personal data will be retained for as long as we, as a controller, need it for a purpose for which we are allowed to use it, or as long as you or us may pursue legal claims towards each other.

1.9.    Identification of the data subject’s rights:

1.9.1.      the right of access to the personal data related to the data subject;

1.9.2.     the right to the rectification of the data subject’s personal data;

1.9.3.     the right to the erasure of the data subject’s personal data;

1.9.4.     the right to the restriction of the processing of the data subject’s personal data;

1.9.5.     the right to object to the processing of the data subject’s personal data, including without limitation, the right to object to the processing under subparagraph 1.4 of this Information; in that case, we will no longer be processing your personal data for such purpose, unless we have the necessary legitimate reasons to continue with such processing;

1.9.6.     the right to the portability of the data subject’s personal data;

1.9.7.     the right to file a complaint with the Office for Personal Data Protection, having its registered office at: Budova Park one, Námestie 1. mája 18, 811 06 Bratislava, Slovak Republic, https://dataprotection.gov.sk/uoou/sk.

1.10.  Information on whether the provision of the personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract (including information whether the data subject is obliged to provide the personal data and of the possible consequences of the failure to provide such data):

1.10.1.  in the case of the personal data processing for the purpose under subparagraph 1.4 of this Information, the data subject is not obliged to provide his/her personal data and is entitled to object to the processing of his/her personal data (if you exercise your right to object to the processing of your personal data under subparagraph 1.4. of this Information, we will no longer be processing your personal data in that case, unless we have the necessary legitimate reasons to continue with such processing).

1.11.   From which sources do we obtain the personal data?

We obtain the most personal data directly from you when you indicate them in the relevant forms and contractual documents, both before and upon concluding the contract, and when reporting any changes.