Under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "GDPR Regulation") and the Act on the Protection of Personal Data and the amendment and supplementation of specific laws (hereinafter referred to as the "Act"), the Data Controller processes your personal data to the extent and under the conditions set out in the GDPR Regulation and the relevant special regulations.

 

This privacy statement provides background information about your rights when processing personal data and information about access to personal data.

 

The Slovak National Theatre, located at Pribinova 17, 819 01 Bratislava, ID 00164763 (hereinafter referred to as "SND" or the "Data Controller"), is the data controller for the processing of your personal data.

 

We only process your personal data based on the legal terms set out in the GDPR or the Data Protection Act.

 

The data controller has a legal obligation to provide your personal data in the course of inspections, supervisory activities or at the request of authorised public authorities or institutions if specific regulations require this.

 

If you believe that the processing of your personal data for these purposes is not lawful or that we are unreasonably interfering with your rights and freedoms, you may object to such processing at any time by contacting the person responsible.

 

The data controller may also disclose your personal data to recipients, agents or third parties necessary for fulfilling the purpose. The Data Controller declares that they have properly concluded contracts with their agents who ensure an adequate level of personal data protection in accordance with the applicable legislation on data protection.

 

Your personal data will be kept securely, in accordance with the data controller's and data processor's security policy and only for as long as necessary to fulfil the purpose of the processing. Access to your personal data will only be granted to persons authorised by the Data Controller to process your personal data, who process it based on the Data Controller's instructions in accordance with the Data Controller's security policy.

 

Your personal data is not subject to automated decision-making, including profiling, and we do not share your personal data with third countries. If your personal data will be subject to such processing, or if we disclose your personal data and transfer your personal data to third countries or international organisations, we are obliged to inform you of these developments without delay.

 

When the data controller processes personal data, you are the data subject, i.e. the person about whom the personal data relating to them are processed.

 

We may process your personal data as provided for by generally applicable law (legal basis: Article 6(1)(c) of the GDPR).

 

Such processing does not usually require the consent of the data subject, and the provision of personal data is a legal or contractual obligation. If the data subject does not provide the personal data necessary for the purposes under the legislation, the data controller is entitled to refuse to carry out the acts that cannot be carried out without the personal data provided.

 

We retain your personal data for this purpose for the period required by a specific regulation or, if this period is not stipulated in the law, for the period required by the archiving regulations, as a rule, for ten years from the expiry of the contract (accounting cases).

 

We may process your general personal data based on the conclusion and execution of a contract (sales contract, lease contract), the delivery of goods/services, making a payment, ordering and controlling a ticket and the performance of other contractual obligations (legal basis: Article 6(1)(b) of the GDPR Regulation). For user convenience and the ability to notify you that a performance is cancelled or rescheduled, we may require additional contact information from you to inform you of this change; such information is only retained for thirty days from the end of the performance, or twenty-four months from the unperformed or interrupted performance to protect your and SND's financial interests.

 

We retain your personal data for this purpose for the period required by a specific regulation or, if this period is not stipulated in the law, for the period required by the archiving regulations, as a rule, for ten years from the expiry of the contract (accounting cases).

 

We may process your personal data based on a pre-contractual and contractual relationship to which you are one of the contracting parties within the meaning of Article 6(1)(b) of the GDPR and also based on public interest within the meaning of Article 6(1)(e) of the GDPR, for the purposes of purchase, registration and administration of your account on the e-shop.

 

If you register, we will process your identification and contact details, preferences, and order details to provide you with other portal services to manage your purchases. If you fill in your contact details, we will be able to notify you that the performance is cancelled or rescheduled.

 

We keep your personal data for the duration of the contractual relationship and subsequently for three years after the termination or cancellation of your registration. Registration will automatically expire if you have not logged into your account for five years. In the case of a purchase made irrespective of registration or a quick purchase for archiving purposes according to the Accounting Act for ten years after the purchase was made.

 

 

We may also process your personal contact data based on your consent, in particular for the purpose of sending you marketing information, newsletters and newsletters (legal basis: Article 6(1)(a) GDPR). Providing consent is voluntary, and consent can be withdrawn at any time.

 

If you indicate your consent to the provision and processing of the above personal data (in particular name and surname, telephone number and e-mail address, preferred subscriptions) for marketing purposes, we will send you newsletters and promotional announcements about performances, services and other activities of the SND via the channel of your choice.

 

You provide your consent voluntarily for a period of five years from the date of your consent, and you can withdraw it at any time by sending a notice of withdrawal to the address of the Data Controller's registered office or by clicking on the "Unsubscribe" link in the newsletter or advertising communication sent to you.

 

We may process your personal contact data for various competitions and events only based on your consent, either by entering the competition directly or by other separate consent for activities related to the competition or event (e.g. for the publication of photographs and videos) (legal basis: Article 6(1)(a) of the GDPR). You may withdraw such consent at any time, but this may defeat the purpose of entering the competition.

 

We keep your personal data for as long as you give us specific consent in a separate document.

 

We may process your personal data in specific cases in the course of carrying out tasks of public interest or in the exercise of official authority (legal basis: Article 6(1)(e) of the GDPR). This includes exercising services under Act No. 385/1997 on the Slovak National Theatre, as amended, and the Statute of the Slovak National Theatre. This information system includes all activities related to the fulfilment of the SND's mission, in particular:

a) develops national theatre culture, which is also presented abroad,

b) organises and publicly performs music, drama and dance works,

c) publishes and distributes periodical and non-periodical publications, promotional materials and organises exhibitions to promote its activities,

d) carries out its own intermediary activity,

e) carries out its own intermediary activity,

f) develops other important cultural activities.

 

We may also process your personal contact data based on our public interest (legal basis: Article 6(1)(e) of the GDPR), in particular in the context of supplier and customer contracts. We obtain your personal data either directly from you, if you are the person authorised to act on behalf of the company with which we enter into a contractual relationship, or from your employer, as data necessary to ensure contact in connection with the performance of the subject matter of the contract.

 

We store your personal data for the duration of the contractual relationship and subsequently to fulfil the Data Controller's accounting obligations, in the case of accounting records/invoices for ten years following the year to which they relate. After the expiration of these periods, the personal data will be disposed of (deleted) unless there is no further legal basis for their processing (assertion of legal claims, litigation, administrative proceedings, etc.). Your personal data will not be used for other purposes.

 

We may also process your personal data based on public interest (legal basis: Article 6(1)(e) of the GDPR), in particular in the context of informing the public about actions and events or about the activities of the Data Controller's representatives through photographs, videos, articles in the mass media or on the Internet (website and social networks)

 

We keep your personal data for the necessary period of time. After the expiration of these periods, the personal data will be destroyed (deleted) unless there is no further legal basis for processing them (assertion of legal claims, litigation, administrative proceedings, etc.). Your personal data will not be used for other purposes.

 

When you view one of our pages or newsgroups, the data controller may record specific data on your computer. This data may take the form of a "cookie" or similar file that allows us to customise the site or discussion to your specific interests and preferences. Most web browsers can delete these files from your hard drive. Please remember that deleting or blocking cookies may interfere with the full use of our site.

 

Secure processing of personal data and compliance with the Regulation and the Personal Data Protection Act is supervised by the Data Protection Officer, to whom you can turn to exercise your rights.

 

 

The Regulation or the Personal Data Protection Act contains detailed information on your rights as a data subject to the protection of personal data, the available means of application and the limitations thereof (in particular Articles 13-22, 77, 79, 82 of the Regulation, Sections 21-28, 38 of the Personal Data Protection Act). At any time, you can request information about the processing of personal data concerning you, and you can request the correction or deletion of your personal data or the restriction of its processing. You can object to processing personal data based on legitimate interest and sending direct marketing messages; you have the right to data portability. The most important provisions are summarised below.

 

If the data controller processes your personal data, they must provide you with information about the data relating to you, even without your specific request, including the main characteristics of the processing of the personal data, such as the purpose, the legal basis and the storage (processing) period, the identity and contact details of the data controller and, where applicable, of their representative, the recipients of the personal data (in the case of transfers of personal data to third countries, also an indication of adequate and appropriate guarantees), the legitimate interests of the data controller and/or third parties in the case of processing of personal data based on legitimate interest, as well as your data protection rights and your means of redress (including the right to file a complaint with a supervisory authority). In the case of automated decision-making, including profiling, the data subject shall be informed in a comprehensible manner of the procedure used and the significance and foreseeable consequences of such processing for the data subject. The data controller will provide you with the above information by making the Personal Data Processing Statement available to you. The aforesaid does not apply to the extent that you already have the information as a data subject.

 

You have the right to obtain confirmation from the data controller as to whether or not the personal data relating to you is being processed and, if so, to obtain access to that personal data and that information: the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations, the envisaged period of retention of the personal data, if this is not possible the criteria for determining it, the data subject's rights to the protection of their personal data and their means of redress (including the right to file a complaint with a supervisory authority), and information regarding the source of the personal data if the personal data have not been obtained from you as the data subject. Upon your request, the data controller will provide you with a copy of your personal data that is being processed. For any additional copies you request, the data controller may charge a reasonable fee corresponding to the administrative costs. The right to obtain a copy shall not result in adverse effects on the rights and freedoms of others. The data controller will provide you with information about the options, the procedure used, the possible costs and other details about providing the copy after receiving your request.

 

If you have requested electronically, the information will be provided in a commonly used electronic format unless you request otherwise.

 

In the case of automated decision-making, including profiling, the data subject shall have access to the following information: on the procedure used and the significance and foreseeable consequences of such processing for the data subject.

 

You have the right to have the data controller rectify incorrect personal data concerning you without undue delay. Concerning the purposes of the data processing, you have the right to have your incomplete personal data completed, including by providing a supplementary declaration.

 

You also have the right to obtain from the data controller the erasure of personal data concerning you without undue delay. The data controller is obliged to erase the personal data without undue delay if specific grounds are met. The reasons for which the controller is obliged to erase your personal data at your request are, for example, the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; you withdraw the consent based on which the processing is carried out, and there is no other lawful basis for the processing; the personal data have been unlawfully processed, or you object to the processing, and there are no overriding legitimate grounds for the processing; the personal data must be erased in order to comply with a legal obligation under Union law or the law of a Member State to which the data controller is subject; or the personal data were collected in connection with the offering of information society services.

 

In some cases, the data controller will not be able to comply with your request, for example, where the processing of personal data is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation which requires processing under Union law or the law of a Member State to which the controller is subject, or for the performance of a task carried out in the public interest, for reasons of public interest in the field of public health, for archiving purposes in the public interest, or the establishment, exercise or defence of legal claims.

 

You have the right to have the data controller restrict processing in one of the following cases:

a) you object to the accuracy of the personal data during a period allowing the data controller to verify the accuracy of the personal data;

b) the processing is unlawful, and you object to the erasure of your personal data and request instead a restriction on its use;

c) the data controller no longer needs the personal data for the purposes of the processing, but you need it to establish, exercise or defend legal claims;

d) you have objected to the processing, pending verification that the legitimate grounds on the part of the data controller outweigh your legitimate grounds.

If the processing has been restricted on the grounds set out above, such personal data shall, with the exception of retention, be processed only with your consent or for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or of a Member State.

 

The data controller will inform you before the restriction on processing is removed.

 

You have the right to obtain the personal data concerning you which you have provided to the data controller in a structured, commonly used and machine-readable format, and you have the right to transfer those data to another data controller without being prevented from doing so by the data controller to whom you have provided the data:

a) the processing is based on your consent or on a contract (to which you are a party),

b) the processing is carried out by automated means.

 

When exercising your right to data portability, you have the right to have your personal data transferred directly from one data controller to another data controller as far as technically possible.

 

The exercise of the right to data portability is without prejudice to the provisions regulating the right to erasure. The right to data portability must not adversely affect the rights and freedoms of others.

 

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which is carried out based on the legitimate interests of the data controller, including objections to profiling based on the above provisions. The data controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

 

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing, including profiling, to the extent that it is related to such direct marketing. If you have already objected to processing for direct marketing purposes, personal data may no longer be processed for such purposes.

 

In cases where the data controller processes your personal data based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. Withdrawing consent must be as simple as giving it.

 

You can withdraw your consent by post to the address of the data controller's registered office, to the e-mail address of the Responsible Person, or in the manner specified in the consent granted.

 

If you believe that the processing of personal data concerning you is in breach of the Regulation or the Personal Data Protection Act, you have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; phone no: +421 / 2 / 3231 3214; email: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk.

 

If you have any questions regarding processing your personal data, you can contact us via our Data Protection Officer.

 

Changes to the terms and conditions of processing and protection of personal data are published on the websites of the Data Controller in the form of updates to this Declaration. In this way, we will ensure that you always have up-to-date information on the conditions under which we process your personal data.