Privacy Policy

in SHEVA company

I.

Introductory provisions

SHEVA company limited, resident Ventúrska 1, Bratislava – Staré mesto 811 01, IČO: 51 276 721, registered in the Commercial Register of the District Court Bratislava I, section: Ltd, file no .: 124712 / B (hereinafter “SHEVA” or “operator”) is a business company that has long been operating the EL GAUCHO restaurant, the Argentinian Steakhouse and provides catering services.

Given that, by providing services, that are being processed by SHEVA company, the personal data of the persons concerned are processed, and that SHEVA takes care of their protection and the personal data of natural persons and processes it in accordance with REGULATION OF EUROPEAN PARLIAMENT AND COUNCIL (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR Regulation”) and Act No. 18/2018 Z. z. on the protection of personal data and on amendments to certain acts.

SHEVA company is aware that every processing of personal data should be legal and fair. It should be transparent for natural persons, that personal data concerning them are processed. The Transparency Principle requires all information and communications related to the processing of such personal data to be easily accessible and easily understandable and formulated in a clear and simple manner. This principle concerns mainly information for the persons concerned about the identity of the operator and the purposes of the processing, and other information to ensure fair and transparent processing. In order to meet the above mentioned information obligation to the persons concerned, SHEVA issues this document entitled “Privacy Policy of SHEVA company”.

The terms used in this document have the meaning as outlined in the GDPR Regulation.

II. Principles of processing the personal data of the persons concerned SHEVA company strictly respects the principles of processing the personal data of the individuals concerned and their privacy. SHEVA company cooperates with several intermediaries who process personal data on behalf of SHEVA company.

SHEVA company only uses intermediaries who have stated that they have taken reasonable technical and organizational measures to ensure that the processing complies with the requirements of the GDPR Regulation and other legislation and to ensure the protection of the rights of the person concerned.

In the case of a breach of personal data protection that is likely to result in a high risk to the rights and freedoms of natural persons, SHEVA company shall without undue delay notify the data subject in breach of personal data protection unless any of the conditions for waiving the disclosure obligation is met. SHEVA company does not intend to transfer the personal data of the persons concerned to a third country or international organization. SHEVA company does not accept decisions based solely on automated processing, including profiling. Information on the use of cookies by SHEVA can be found on our website at www.elgaucho.eu

III. Purpose of the processing of personal data in SHEVA company and the legal bases of processing SHEVA company processes personal data to achieve the below described purposes and on the basis of the following legal bases: 1. Closing and fulfilling the subject matter of the contract

The purpose of the processing of personal data is to conclude and implementing the subject of the contracts to which the concerned party is a concerned person and to record such contracts and orders (eg service orders, reservations, supplier contracts, service contracts, purchase contracts, lease agreements etc.).

The legal basis for the processing is the performance of the contract to which the person concerned is a concerned party or, if requested by the person concerned, to take measures prior to the conclusion of the contract as well as the fulfillment of the legal obligations relating to the conclusion of the contract. The provision of personal data of the person concerned is legal and the contractual requirement, and if SHEVA does not grant them, the relevant contractual relationship will not arise.

The personal data of the person concerned can be provided mainly to the following beneficiaries: tax and accounting advisors, lawyers, financial authorities, banks and foreign bank branches, executors, courts, law enforcement agencies, health insurance companies, social insurance companies,

2. Promotion and advertising

The purpose of the processing of personal data is the promotion and advertising of SHEVA company and the services provided by SHEVA company, notably but not limited to: • Information on the provision of SHEVA’s services through advertising; • Sending newsletters about news, events, information, as well as sending invitations and festive greetings; • Marketing and Satisfaction Surveys; • Disclosure of information about provided services, including client references; • Providing personal data as part of the evaluation or rankings; • Targeted online advertising and evaluation of it’s success.

The legal basis for the processing is the consent of the person concerned and the legitimate interests of SHEVA company as an operator. Where the legal basis for the processing is the free consent of the data subject to the processing of personal data, the person concerned shall be entitled to withdraw consent at any time. The provision of personal data is voluntary. The period of retention of the personal data of the persons concerned is 10 years. The personal data of the person concerned can be provided mainly to the following recipients: advertising and marketing agencies, IT companies, courts, law enforcement agencies, lawyers.

3. Organization of winning competitions

The purpose of processing personal data is to organize winning competitions and to register contestants and winners.

The legal basis for the processing is the free consent of the data subject to the processing of personal data. The person concerned is entitled to withdraw given consent at any time. The provision of personal data is voluntary. The retention period of the personal data of the persons concerned is 2 years from the end of the competition. The personal data of the person concerned can be provided mainly to the following recipients: courts, law enforcement agencies, lawyers, notaries, travel agencies, transport companies.

4. Evidence of job seekers

The purpose of processing personal data is to keep records of jobseekers who have voluntarily sent to SHEVA company their resume, motivation letter, application for admission to employment or other similar documentation; received CVs, motivation sheets, applications for recruitment or other similar documentation SHEVA company keeps in the established database of jobseekers and, if necessary, contacts the selected job seekers, from the database in question, about the job vacancies.

The legal basis for the processing is the free consent of the data subject to the processing of personal data. The person concerned is entitled to withdraw given consent at any time. The provision of personal data is voluntary. If the person concerned did not express their consent to the processing of personal data for his or her subsequent registration in the job seeker’s database, or withdraws their consent, their personal data will be destroyed. The personal data of the person concerned can be provided mainly to the following beneficiaries: Labor Inspectorate, lawyers, courts, law enforcement agencies, etc.

5. Managing Personnel and Payroll Agenda

The purpose of the processing of personal data is to conclude and perform the subject matter of an employment contract or agreement on work performed outside the employment relationship, other legal acts relating to the adjustment of rights and obligations under the employment relationship and their registration, as well as the fulfillment of legal obligations related to the employment relationship or similar relationship, including pre-contractual relationships.

The legal basis for processing is the performance of a contract of employment or one of the agreements on work performed outside the employment relationship concluded under Act no. 311/2001 Coll. Labor Code as amended (hereinafter referred to as the “Labor Code”) and the fulfillment of the legal obligations of SHEVA company, in particular according to the following regulations:

Labor Code, Act no. 580/2004 Coll. on health insurance to amend Act no. 95/2002 Coll. on Insurance and on Amendments to Certain Laws as amended, Act no. 461/2003 Coll. on Social Insurance as amended, Act No. 595/2003 Coll. on Income Tax, as amended, Act No. 43/2004 Coll. on old-age pension savings as amended, Act no. 650/2004 Coll. on supplementary retirement savings and on the amendment and supplementation of certain acts as amended, Act no. 5/2004 Coll. on Employment Services and on Amendments to Certain Laws as amended, Act No. 462/2003 Coll. on the replacement of income in case of temporary incapacity for work of the employee and on the amendment and supplement of some acts as amended, Act no. 152/1994 Coll. on the Social Fund and on the amendment of Act no. 286/1992 Coll. on Income Taxes as amended, Act No. 355/2007 Coll. on the Protection, Promotion and Development of Public Health and on Amendments to Certain Acts, as amended, Act no. 125/2006 Coll. on Labor Inspection as amended, Act no. 8/2008 Coll. on Insurance and on Amendments to Certain Laws as amended, Act no. 283/2002 Coll. on travel allowances as amended, Act no. 18/2018 Z. z. on the Protection of Personal Data and on Amendments to Certain Acts.

The provision of personal data of the person concerned is legal or a contractual requirement and, in the event of failure to do so, SHEVA company can not fulfill its legal obligations under the relevant labor legislation and the legislation related to it, respectively, there will not be a creation of employment relationship between the employee and the employer.

Personal data of the person concerned may be provided mainly to the following recipients: Social insurance, health insurance, Financial regulatory authorities of the Slovak Republic, supplementary pension savings banks, pension fund management companies, representatives of employees, Labor inspectorate, IT company, an entity providing Occupational Health Services, auditors, providers of catering services , tax and accounting consultants, auditors, lawyers, executors, courts and law enforcement authorities, SHEVA’s customers, SHEVA’s suppliers.

Personal data of employees in the scope of title, name, surname, job classification, staff classification, functional classification, employee’s personal number or employee’s work number, professional department, place of work, telephone number, fax number, e-mail address of the workplace and employer identification, SHEVA company is authorized to provide or disclose if necessary in connection with the performance of the employee’s work, staff or functional duties as the person concerned. The provision of personal data or the disclosure of personal data must not interfere with the seriousness, dignity and security of the person concerned.

6. Safety and health protection at work

The purpose of the processing of personal data is the fulfillment of the legal obligations of SHEVA company related to safety and health protection at work, including evidence of training, work injuries and medical examinations.

The legal basis of the processing is the fulfillment of legal obligations of SHEVA company pursuant to Act no. 124/2006 Coll. on Safety and Health Protection at Work and on amendments to certain acts as amended by later regulations and other related legislations.

The provision of personal data to the person concerned is a legal requirement and SHEVA can not fulfill its legal obligations under the relevant legislation in the field of occupational safety and health protection in the event of non-disclosure. The personal data of the person concerned may be provided in particular to the following beneficiaries: Social Insurance Company, Health Insurance Company, Employees’ Representatives, Labor Inspectorate, Health Service Provider, IT Companies, Accountants and Tax Advisors, Auditors, Lawyers, Executors, Court and Law Enforcement Bodies.

7. Bookkeeping

The purpose of processing personal data is to process accounting documents. The legal basis of processing is the fulfillment of legal obligations under Act no. 431/2002 Coll. on accounting as amended, Act No. 595/2003 Coll. on Income Tax, as amended, Act No. 563/2009 on tax administration (Tax Code), as amended and other related legislation.

The provision of the person’s personal data is a legal requirement and, if not provided, SHEVA can not fulfill its legal obligations under the Accounting Act and other relevant legislation.

The personal data of the person concerned can be provided in particular to the following beneficiaries: tax and accounting advisors, auditors, financial administration authorities of SR, courts, law enforcement agencies, lawyers, IT companies, etc.

8. Operation of a camera system monitoring accommodation accessible to the public

The purpose of processing personal data is to monitor the SHEVA’s accommodation available to the public to protect SHEVA’s property, property and health of its customers and employees.

The legal basis for the processing is the legitimate interest of SHEVA as an operator, which primarily monitors the security and protection of its assets as well as the property and health of its customers and employees.
The personal data of the person concerned may be provided, in particular, to the following beneficiaries: members of the private security service providing protection for SHEVA’s property, courts, law enforcement agencies, IT companies, lawyers.

9. Operation of the camera system monitoring employees

The purpose of processing personal data is to monitor employees in labor relations based on the special nature of SHEVA’s activities in order to protect SHEVA’s property, property and health of its customers and employees and ensure compliance with the work discipline.

The legal basis for processing is set. § 13 par. 4 of the Labor Code and SHEVA’s legitimate interest as an operator, in particular with regard to the protection of its property, as well as the property and health of its customers and employees and the ensuring of compliance of the work discipline. The person concerned is required to undergo transparent monitoring, about which is properly informed, and thus to provide his or her personal data.

The personal data of the person concerned can be provided mainly to the following recipients: courts, law enforcement agencies, labor inspectorate, private security service, IT companies, lawyers.

10. Photographs of the persons concerned

The purpose of creating and processing photographs of the persons concerned is to support better internal and external communication of SHEVA company. Photographs can be located at SHEVA’s accommodation, Intranet, magazines, or other SHEVA publications, social networks, and SHEVA’s web site. The legal basis for the processing is the free consent of the data subject to the processing of personal data. The person concerned is entitled to withdraw given consent at any time. The provision of personal data is voluntary.

Photographs of the persons concerned are published with the consent of the person concerned.SHEVA takes care to ensure that the photo does not interfere with the seriousness, dignity and security of the person concerned.

11. Records of natural persons – members of the bodies, representatives and employees of the contractual partners

The purpose of the processing of personal data is to keep records of the members of the statutory and supervisory bodies of the contractual partners, representatives and employees of the contractual partners, or their authorized or empowered persons and other similar entities in order to communicate effectively with the other contracting party and to perform the object of the contract concluded with the contractual party.

The legal basis for the processing are the legitimate interests of SHEVA company as an operator in pursuit of effective communication with the other contracting party, as well as fulfillment of the subject matter of the contract concluded with the contractual partner. Personal data are not obtained from the person concerned but predominantly from the contractor on whose behalf or for whom the person concerned is acting. The personal data of the person concerned can be provided to the following recipients: lawyers, accountant and tax advisers, auditors.

12. Litigation and other legal procedures

The purpose of processing personal data is to keep records and to settle litigation and other legal procedures.

The legal basis of the processing are the legitimate interests of the operator in pursuit of the demonstration, application or defense of their legal claims.

The personal data of the person concerned may be provided in particular to the following beneficiaries: tax and account consultants, courts, lawyers, executors, auditors, experts, administrators, law enforcement authorities.

13. “Whistleblowing”

The purpose of the processing of personal data is to handle the complaints received by SHEVA in connection with the reporting of the anti-social activity and the keeping of their records.

The legal basis of processing is the fulfillment of a legal obligation under Act no. 307/2014 Coll. on certain measures relating to the reporting of anti-social activities and on the amendment of certain laws, as amended.

The provision of personal data of the person concerned is a legal requirement and, in the event of non-disclosure, SHEVA can not fulfill its legal obligations under the relevant legislation.

The personal data of the person concerned can be provided mainly to the following beneficiaries: Labor Inspectorate, Court, law enforcement agencies, Ministry of Justice of Slovakia, lawyers.

14. Handling requests from the persons concerned

The purpose of the processing of personal data is to handle the requests of the persons concerned addressed to SHEVA.
The legal basis for processing is the fulfillment of a legal obligation within the meaning of Articles 12 to 22 of the GDPR Regulation and Articles 33 and 34 of the GDPR Regulation.

The provision of the person’s personal data is a legal requirement and, in the event of non-disclosure, SHEVA can not fulfill its legal obligations under the GDPR Regulation and provide the person concerned with the request.

The personal data of the person concerned may, to the extent necessary, be provided primarily to the following recipients: the Data Protection Authority and other supervisory authorities, the operator, the intermediary, courts and law enforcement authorities, lawyers.

15. Evidence of received and sent mail

The purpose of processing personal data is to keep a record of received and sent mail.

The legal basis for the processing is the legitimate interest of SHEVA company as an operator for tracking mail.

The person concerned is obliged to provide his or her personal data, otherwise there can be no postal communication and registration.

The personal data of the person concerned are not provided to the recipient.

16. Archiving in the public interest, scientific and historical research and statistical purposes

The purpose of processing personal data is to properly administer and manage the registry, to carry out scientific, historical research and statistical purposes.

The legal basis of processing is the fulfillment of a legal obligation under Act no. 395/2002 Coll. on archives and registers and on the amendment of some laws as amended by later regulations and other related regulation and set Article 89 of the GDPR Regulation.

The provision of personal data of the person concerned is a legal requirement and, in the event of non-disclosure, SHEVA can not fulfill its legal obligations under the relevant legislation.

The personal data of the person concerned can be provided mainly to the following beneficiaries: the Ministry of the Interior of the Slovak Republic and other state administration bodies in the archives and registry offices, the courts and law enforcement agencies, lawyers.

    17. Electronic mailbox

The purpose of the processing of personal data is to provide SHEVA’s proper electronic communication with the public authorities in order to carry out the exercise of their actions in electronic form. The legal basis of processing is the fulfillment of a legal obligation under Act no. 305/2013 Coll. on the electronic form of performance of the powers of public authorities and on the amendment and supplementation of some laws (the e-Government Act), as amended.

The provision of personal data of the person concerned is a legal requirement and, in the event of non-disclosure, SHEVA can not fulfill its legal obligations under the relevant legislation.

The personal data of the person concerned are provided to the following beneficiaries: National Agency for Network and Electronic Services (NASES), IT companies, lawyers.

IV.

Time of retention of personal data

SHEVA keeps the personal data of the persons concerned for various lengths of time depending on the purpose and purpose of their processing. In general, SHEVA processes personal information:
• for the time required by applicable, generally binding law, to process personal data for the performance of its legal duties;
• for the duration of the contractual relationship established by the contract or the duration of pre-contractual relationships if the processing of personal data is necessary for the performance of the contract;
• for the duration of legitimate interest pursued by SHEVA if the processing of personal data for that purpose is necessary;
• for a period explicitly stated in the consent or until withdrawal, when processing personal data on the basis of consent.

Upon expiry of the above retention period, SHEVA is authorized to process the personal data of the person concerned only on the so-called privileged purposes, that GDPR automatically deems compatible with original purposes. This is for purposes of archiving in the public interest, for purposes of scientific or historical research and for statistical purposes

V.
Rights of the persons concerned

The person concerned has the right to request from SHEVA access to the personal data concerning him / her. The person concerned also has the right to correct, erase or restrict the processing of personal data, as well as the right to object to the processing of personal data and the right for their portability. The person concerned also has the right to withdraw consent to the processing of personal data as well as the right to file a complaint with the supervisory authority.

1. Right for access (Article 15 of the GDPR Regulation)

The person concerned has the right to obtain from SHEVA a confirmation of the processing of his / her personal data and, if so, has the right to access this personal data. The person concerned also has the right to obtain a copy of the processed personal data and additional information resulting from Article 15 of the GDPR Regulation, in particular the processing purposes, the category of personal data concerned, the time of retention of personal data, etc.

2. Right for correction (Article 16 of the GDPR Regulation)

The person concerned has the right to request a lawyer to correct incorrect personal data concerning them and has the right to amend incomplete personal data, including by providing a supplementary statement.

3. Right for erasing- the right to “forfeit” (Article 17 of the GDPR Regulation)
The person concerned has the right to have SHEVA erase without undue delay the personal data concerning them if one of the reasons of Article 17 of the GDPR Regulation is met. The reason for the deletion may be, for example, if the person concerned withdraws consent to the processing if the personal data are no longer necessary for the purposes for which they were acquired or otherwise processed, or if the person concerned objects to the processing, if the personal data were processed illegally and the like.

4. Right to limit processing (Article 18 of the GDPR Regulation)

The person concerned has the right to attain that SHEVA restrict the processing of personal data if one of the cases referred to in Article 18 of the GDPR Regulation arises. For example, if the person concerned contests the correctness of the personal data (during a period allowing SHEVA to verify the accuracy of personal data), or if the processing is illegal, the person concerned opposes the deletion of personal data and requests instead to limit their use.

5. Right to data portability (Article 20 of the GDPR Regulation)
Where the processing of personal data is done by automated means and the legal basis of the processing of personal data is the consent of the person concerned or the performance of the contract, the person concerned shall have the right to obtain personal data relating to him and provided to SHEVA in a structured, commonly used and machine readable format and has the right to transfer these data to another operator. In case of interest of the person concerned, and if it is technically possible, SHEVA transfers the relevant personal data directly to another operator.

6. Right to contest and automated individual decision-making (Articles 21 and 22 of the GDPR Regulation)

The person concerned shall at any time have the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them, which is carried out for the purposes of the legitimate interests pursued by the operator, including the objection against any subsequent profiling. SHEVA company may not further process personal data unless it demonstrates the necessary legitimate reasons for processing that outweigh the interests, rights and freedoms of the person concerned, or reasons for proving, enforcing or defending legal claims. If the person’s personal data are processed for the purposes of direct marketing, the person concerned has the right at any time to object to the processing of personal data concerning them for the purpose of such marketing, including profiling, to the extent related to such direct marketing. If the person concerned opposes processing for direct marketing, personal data may no longer be processed for such purposes. The person concerned has the right not to be affected by decision of SHEVA company, which is based solely on automated processing, including profiling, and which has legal effects that concerns them or otherwise significantly affect them.

7. Right to file a complaint (Article 77 of the GDPR Regulation)If the person concerned suspects that SHEVA processes personal data in violation with the GDPR Regulation, or that it’s illegal, they are entitled to file a complaint with the Supervisory Authority. For the territory of the Slovak Republic, the supervisor is Office for the Protection of Personal Data of the Slovak Republic, headquartered: Hraničná 12, 820 07 Bratislava, Slovak Republic, tel.: +421/2/3231 3214, web: www.dataprotection.gov.sk, e-mail: statny.dozor@pdp.gov.sk.

8. Right to withdraw consent (Article 7 (3) of the GDPR Regulation)

For the purposes of the processing of personal data, SHEVA requires the person concerned to consent to the processing of their personal data, which is a clear expression of will and is a free, specific, informed and unambiguous expression of consent to the processing of personal data relating to him. If the person concerned has consented to the processing of their personal data for a particular purpose, they are entitled to withdraw their consent at any time. Such withdrawal of consent will not affect the legality of the enforced

If the person concerned wishes to exercise any of their rights, they can do so:
• electronically at the following e-mail address: privacy@elgaucho.eu
• by phone at +421 918 700 200
• By posting the application to SHEVA: Ventúrska 1, 811 01 Bratislava
• personally in the restaurant EL GAUCHO, Argentinian Steakhouse

VI.
Final provisions
SHEVA company is authorized to modify this Privacy Policy, particularly as a result of changing the relevant legislation. SHEVA company by the possible change of these Privacy Policies will not restrict the rights and freedoms of the person concerned that arise from the GDPR Regulation and related legislation.