under Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council – (hereinafter referred to as the “GDPR”) in conjunction with Section 19 of Act No. 18/2018 Coll. on the Protection of Personal Data and on alterations and amendments to certain acts, as amended (hereinafter referred to as the “Information”):

1.1.            Identity and contact details of the controller (RPC):

Regional Card Processing Centre, s.r.o., having its registered office at Námestie Mateja Korvína 1, 811 07 Bratislava, Company Reg. No.: 44 548 605.

Email: rpc_gdpr@ri-rpc.sk

1.2.           Data subjects:

natural person – whistleblower;

natural person – close person of the whistleblower, who is employed by controller,

another natural persons, which personal data are necessary for handling the notification and to whom the notification relates,

protected employee or protected whistleblower.

1.3.           Categories of personal data concerned:

1.3.1.         Common personal data – name, surname and address of permanent and temporary residence of the whistleblower, date of birth, e-mail address of the whistleblower, job position, other personal data found or submitted during the processing of the notification,

1.3.2.        special category of personal data according to Art. 9 GDPR regulations,

1.3.3.        data provided in report, if report is made from outside sources.

1.4.           The purposes of personal data processing:

1.4.1.         Internal system of whistleblowing verification – Act No. 54/2019 Coll. on the Protection of Whistleblowers of Anti-Social Activities and on the Amendment and Supplementation of Certain Acts, as amended.

1.4.2.        Evidence and protection of protected employees – Act No. 54/2019 Coll. on the Protection of Whistleblowers of Anti-Social Activities and on the Amendment and Supplementation of Certain Acts, as amended.

1.5.           Legal basis for personal data processing:

1.5.1.         Internal system of whistleblowing verification – art 6 (1) (c) of the GDPR – processing based on the special act – Act No. 54/2019 Coll. on the Protection of Whistleblowers of Anti-Social Activities and on the Amendment and Supplementation of Certain Acts, as amended – necessary to fulfill the LEGAL OBLIGATIONS of the controller resulting from the Act no. 54/2019 Coll.

1.5.2.        Evidence and protection of protected employees – art 6 (1) (c) of the GDPR – processing based on the special act – Act No. 54/2019 Coll. on the Protection of Whistleblowers of Anti-Social Activities and on the Amendment and Supplementation of Certain Acts, as amended – necessary to fulfill the LEGAL OBLIGATIONS of the controller resulting from the Act no. 54/2019 Coll.

1.6.           Recipients or categories of recipients of the personal data:

The controller provides your personal data the following recipients or categories of recipients:

1.5.1.         state and public administration bodies,

1.5.2.        following processors:

Raiffeisen Bank International AG.

1.7.           Information if the controller intends to transfer the personal data to a third country or international organisation:

There is no transfer of personal data to third countries or international organisations.

1.8.           Period for which the personal data will be stored (criteria used to determine the period):

The controller may store the personal data for the following period:

1.8.1.         Internal system of whistleblowing verification – data is kept for 3 years.

1.8.2.        Evidence and protection of protected employees – data is kept for the period of protection of protected whistleblower.

1.9.           Identification of the data subject’s rights:

1.9.1.         the right of access to the personal data related to the data subject;

1.9.2.         the right to the rectification of the data subject’s personal data;

1.9.3.         the right to the erasure of the data subject’s personal data;

1.9.4.        the right to the restriction of the processing of the data subject’s personal data;

1.9.5.         the right to withdraw the given consent at any time upon your request by contacting Data protection officer in RPC or writing to the following email address: rpc_gdpr@ri-rpc.sk;

1.9.6.         the right to the portability of the data subject’s personal data;

1.9.7.         the right to file a complaint with the Office for Personal Data Protection, having its registered office at: Hraničná 4826/12, 820 07 Bratislava, Slovak Republic, https://dataprotection.gov.sk/uoou/sk.

1.10.         Information on whether the provision of the personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract (including information whether the data subject is obliged to provide the personal data and of the possible consequences of the failure to provide such data):

1.10.1.       Data processing is necessary to fulfill the LEGAL OBLIGATIONS of the controller resulting from the Act no. 54/2019 Coll.

1.11.          From which sources do we obtain personal data?

We obtain personal data directly from whistleblower or from delivered report.