GDPR
information on the protection and processing of personal data

SPA - treatment institute of the Ministry of the Interior of the Slovak Republic ARCO (hereinafter referred to as KLÚ ARCO) ulica 17.novembra no. 6/2, 91451 Trenčianske Teplice, ID: 00735256 processes the personal data of the natural persons concerned as the operator (hereinafter the "operator"), in accordance with the principles of personal data processing and pursuant to Art. 13 Regulation of the European Parliament and of the Council (EU) 2016/679 of April 27, 2016 on the protection of natural persons in the processing of personal data and on the free movement of such data, (hereinafter referred to as the "General Data Protection Regulation") provides the following information on the processing of personal data concerned persons.

Responsible person of the operator: Stanislava Václavová

Contact: marketing@kluarco.sk

KLÚ ARCO processes personal data legally, transparently and fairly to the relevant and reasonable extent necessary above all to achieve the following processing purposes:

• providing health (spa) care,
• providing accommodation services,
• monitoring of publicly accessible spaces with a camera system,
• business-marketing communication,
• customer and supplier contractual relations.

KLÚ ARCO, as part of its processing activities, also processes the personal data of the affected persons through verified intermediaries, who process the personal data of the affected persons on behalf of the operator and under his responsibility within the scope of concluded contractual relations.

As part of the provision of health (spa) care, KLÚ ARCO processes ordinary personal data of the person concerned (in particular: identification data, contact data, health insurance data) as well as personal data from a special category of personal data, namely data about health (in particular: diagnosis, medical history, data obtained in connection with the provision of health care) and in rare cases also genetic data to the extent necessary for the provision of adequate health care. Provision of personal data by legal requirement, i.e. the person concerned is obliged to provide the data to KLÚ ARCO. If the person does not provide personal data, it will not be possible to provide him with adequate health care.

Personal data are processed on the basis of special legal regulations (in particular Act No. 576/2004 Coll. on health care, services related to the provision of health care) primarily for the purposes of:

• processing proposals for spa care, which are sent by health insurance companies,
• provision of health care in accordance with the proposal for spa care,
• providing health care for self-payers within the agreed scope,
• reports to the National Center for Health Information,
• solutions to suggestions and complaints of affected persons related to the provided health care,
• reports of early termination of spa treatment to health insurance companies.

Personal data are mainly provided to the following third parties from the KLÚ ARCO systems in connection with the provision of health care:

• To the National Center for Health Information on the basis of a special law,
• to the relevant health insurance companies based on their legitimate interest,
• Office for the supervision of health care within the scope of supervision,
• courts and law enforcement authorities to the extent of the required cooperation,
• and other third parties to whom KLÚ ARCO is obliged to provide data based on a special legal regulation.

As part of the provision of accommodation services, KLÚ ARCO processes ordinary personal data necessary for the identification of the person concerned and the provision of related services. Provision of personal data is a contractual and legal requirement, i.e. j. the person is obliged to provide the data to the operator. If the person does not provide personal data, it will not be possible to provide them with accommodation services.

On the basis of special legal regulations and contractual relations with the person concerned, personal data are processed primarily for the purposes of:

• accommodation reservations within the scope of pre-contractual relations with the person concerned,
• providing accommodation and catering services within the contractually agreed scope,
• solutions to suggestions and complaints of affected persons related to the contractual relationship,
• residence records of SR citizens based on Act no. 253/1998 Coll. on reporting the residence of citizens of the Slovak Republic and the register of residents of the Slovak Republic,
• registration of the residence of foreigners based on Act no. 404/2011 Coll. on the residence of foreigners and on the amendment of certain laws,
• collection of local taxes and fees in accordance with the VZN of the city of Trenčianske Teplice on local taxes and fees.

Personal data are provided from KLÚ ARCO systems in connection with the provision of accommodation services to the following third parties:

• To the Municipal Office of Trenčianske Teplice as a tax administrator within the scope of control,
• to the relevant health insurance companies to the extent of their legitimate interest in the case of a prematurely terminated spa stay based on a proposal for spa care,
• The Office for the Supervision of Health Care as part of the exercise of supervision in the case of a spa stay with the provision of health care,
• courts and law enforcement authorities to the extent of the required cooperation,
• and other third parties to whom KLÚ ARCO is obliged to provide data based on a special legal regulation.

• Processing of personal data within the monitoring of publicly accessible spaces with a camera system.

  As part of the monitoring of publicly accessible spaces with the camera system, KLÚ ARCO processes the personal data of the persons concerned, which may also contain a special category of personal data recorded in connection with the monitoring of the spaces. The affected person is informed about the monitoring of the public space through KLÚ ARCO notifications. In view of the above, the affected person can usually decide whether to be recorded by a camera system or not (except for cameras recording publicly accessible spaces within buildings). We monitor publicly accessible spaces for the purpose of safety and protection of property and persons, while it is not the intention of KLÚ ARCO to obtain a special category of personal data. The recorded record is kept for a maximum of 5 days, in the event that the record is not used for the purposes of criminal proceedings or resolution of offenses, or legitimate interests of KLÚ ARCO (e.g. resolution of damage events). If the record is used for the stated purposes, the storage period is extended by the period corresponding to the provision of the record by the court and/or law enforcement authorities.

• Personal data from the contact form https://www.kluarco.sk/en/contact/




KLÚ ARCO processes the contact data listed in the contact form for the purposes of communicating with those interested in information.

Personal data are provided from the KLÚ ARCO systems in connection with the monitoring of publicly accessible spaces to the following third parties:




• courts and law enforcement agencies, the Police Force of the Slovak Republic to the extent of the required cooperation.

You can object to the processing of personal data based on a legitimate interest by email at the address marketing@kluarco.sk or in writing at the operator's address.

Within customer and supplier contractual relations, KLÚ ARCO processes personal data necessary for the performance of contracts with suppliers of goods and services, or with customers. The provision of personal data is a contractual requirement, only to the extent necessary for the performance of the contract in question or a requirement that is necessary for the conclusion of the contract. In the event that the person concerned does not provide his personal data, this may result in not concluding a contractual relationship (e.g. in the case of SZČO) or it may have an impact on the fulfillment of the subject of the contract (e.g. if the contact person for the contractual party who will communicate and take over the subject of performance).

Personal data are processed primarily for the purposes of:

• establishment of pre-contractual relations,
• performance of the contract,
• solutions to suggestions and complaints related to the contractual relationship
• records of contact persons of contractual partners.

KLÚ ARCO maintains a database of representatives, employees of suppliers and customers for the purpose of fulfilling their work, official and functional duties and ensuring smooth supplier-customer relations. Personal data are provided from the KLÚ ARCO systems to the following third parties within the framework of the relevant pre-contractual and contractual relationships:

• law firms for the purpose of providing legal services,
• courts and law enforcement authorities to the extent of the required cooperation,
• partners of the contracting parties to the extent necessary for the performance of the contract,
• and others to third parties to whom the operator is obliged to provide data on the basis of a special legal regulation.
• entities participating in the fulfillment of the subject of the contract (in particular: postal company);

Other information systems in which we process personal data are listed in the following table:

Information system	Purpose	Legal basis (according to Article 6 GDPR)< /strong>
Accounting	Processing of the accounting agenda.	Evidence of economic and safe driving of the driver. Art. 6 par. 1 letter c) GDPR - fulfillment of legal obligation
Administration of the registry	Records of incoming and outgoing mail (letters, suggestions, complaints and others) in paper or electronic form and records of records in the registry center of the operator.	Art. . 6 par. 1 letter c) GDPR - fulfillment of a legal obligation Art. 89 - processing for the purposes of archiving in the public interest, for the purposes of scientific or historical research or for statistical purposes
Rights of affected persons	Record of security incidents related to leakage of personal data and requests of affected persons.	Art. 6 par. 1 letter c) GDPR - fulfillment of a legal obligation Art. 34 GDPR, Art. 15 GDPR
Insurance and damage events	Resolution of insurance events.	Art. 6 par. 1 letter c) GDPR - fulfillment of legal obligation
Wages and HR	CV of rejected job applicants	Art. 6 par. 1 letter a) GDPR consent to the processing of personal data
Legal agenda	Solving legal cases, debt collection, lawsuits, criminal acts,	execution of art. 6 par. 1 letter c) GDPR - fulfillment of legal obligation

Due to the subject of our activity, our company is obliged to appoint a responsible person. In case of any questions regarding the processing of your personal data, you can contact us in writing, electronically or by phone at: marketing@kluarco.sk

When you visit our website, for security reasons, our web servers always store the connection data of the computer connecting to our website, the list of websites you visit within our website, the date and duration of your visit, the identification data of the type of browser used and the operating system system as well as the website through which you connect to our site.

In the case of consent to the processing of personal data, the person concerned gives consent to the processing of personal data freely, without coercion and coercion, as well as without being conditioned by the threat of rejection of the contractual relationship, services provided or obligations arising for the operator.

The affected person can revoke consent at any time electronically at the address marketing@kluarco.sk or in writing at the operator's address.

Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

In the case of a request to make your personal data available from a public authority, we examine whether the conditions for making them available are set by legislation. Without proper verification of the legislative claim, your data is not made available.

• State authorities

In case of enforcement of our rights, your personal data may be transferred to a third party (e.g. a lawyer). If the legal order or a state authority (e.g. PZ SR) imposes an obligation on us to hand over your personal data, we must do so.

In the case of cross-border transfer to third countries, we only carry it out to countries that guarantee adequate protection of personal data according to the decision of the EU Commission.

For the purposes of processing personal data, the storage period is set in accordance with the legal deadlines and the deadlines according to the registry plan.

The affected person has the right:

• for information about the processing of her personal data;
• get access to personal data that is processed and stored about her;
• request correction of your incorrect, inaccurate or incomplete personal data;
• request the deletion of your personal data when they are no longer needed or if the processing is illegal;
• object to the processing of your personal data for marketing purposes or on a basis related to a specific situation;
• request to limit the processing of your personal data in special cases;
• receive your personal data in a machine-readable format and/or request their transfer to another operator;
• revoke your consent at any time without this affecting the lawfulness of processing based on consent granted before its withdrawal, if such consent was granted by the person concerned;
• request that decisions based on automated processing that concern or significantly affect her, based on her personal data, are carried out by natural persons and not by automated technical means, if personal data are processed in this way by KLÚ ARCO. The affected person has the right to express his opinion and object to the decision of KLÚ ARCO;
• file a complaint with a supervisory authority, especially in the Member State of your habitual residence, place of work or in the place of the alleged violation and the right to an effective judicial remedy if you believe that the processing of your personal data is in violation of the law. The supervisory authority in the territory of the Slovak Republic is the Personal Data Protection Office of the Slovak Republic, Hraničná 12 Bratislava;
• submit a request or complaint to KLÚ ARCO and the responsible person authorized by him in connection with the protection and processing of personal data.
Any affected person who wants to file a request or complaint and exercise their rights can do so:
• in writing at the address: Spa - Medical Institute of the Ministry of the Interior of the Slovak Republic ARCO, Street 17.novembra No. 6/2, 91451 Trenčianske Teplice
• electronically at the address: marketing@kluarco.sk.

If the person concerned does not have legal capacity, his rights may be represented by a legal representative.

According to the Act on the Protection of Personal Data, the company will handle the request of the person concerned free of charge, except for payment in an amount that cannot exceed the amount of material costs incurred for the purpose of making copies, importing technical media and sending information to the person concerned, unless a special law provides otherwise.

KLÚ ARCO is obliged to:

• process the request of the affected person no later than 30 days from the date of delivery of the request or inform about the reasons why the verification did not take place and the possibility of exercising the right of the affected person to file a motion to initiate proceedings according to § 100 and for other legal protection according to a special regulation.< /li>
• notify the person concerned of a breach of personal data protection without undue delay, if such a breach of personal data protection may lead to a high risk for the rights of the person concerned.

In connection with the processing of personal data, you have the right to file a complaint with the Office for the Protection of Personal Data, which is a national supervisory authority. Contact information can be found on the website https://dataprotection.gov.sk/uoou/.