ORIWIN, s.r.o.

as the controller of the information system, publishes the following data protection statement under the title

PRIVACY POLICY

pursuant to Article 13 and the relevant recitals of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation") and Act No. 18/2018 Coll. on the protection of personal data and on amendments and supplements to certain acts (hereinafter referred to as the "Act on the protection of personal data")

The purposes of the processing of personal data are the reasons for which the personal data of data subjects (employees, clients) are processed in our information systems on precisely defined legal grounds. The purposes are specifically identified, explicitly stated and legitimate, and we comply with the principle of lawfulness under Articles 6 and 9 of the Regulation when processing the personal data of data subjects.

Data subjects about whom personal data are processed in our information systems for specified purposes may exercise the following rights in writing or electronically:

a) Right of access to personal data - the right to obtain confirmation as to whether your personal data are being processed, as well as the right to obtain access to these data, in the scope of the purposes and duration of processing, the category of personal data concerned, the range of recipients, the procedure of any automated processing, or the consequences of such processing. As a controller, we have the right to use all reasonable measures to verify the identity of the data subject who requests access to the data, in particular in relation to online services and identifiers (Article 15, recitals 63, 64 of the Regulation).

b) Right to rectification of incorrect and completion of incomplete personal data (Article 16, recital 65 of the Regulation).

c) Right to erasure - "oblivion" those personal data which are no longer necessary for the purposes for which they were collected and processed; on withdrawal of the consent on the basis of which the processing is carried out; on unlawful processing; where the personal data were collected in connection with an offer of information society (in the case of children), subject to the conditions set out in Article 17, recitals 65, 66 of the Regulation.

d) Right to restriction of processing can be invoked if you, as a data subject, challenge the correctness of the personal data and other particulars within the meaning of Article 18, recital 67 of the Regulation, in the form of a temporary transfer of the personal data selected to another processing system, the prevention of user access to the personal data selected or the temporary removal of the processing.

e) Right to portability of personal data is the right to transfer the personal data provided by you to our information systems on the basis of your consent or the performance of a contract to another controller in a structured, commonly used and machine-readable format, insofar as this is technically feasible, also under the conditions of Article 20, recital 68 of the Regulation in the case where the processing is carried out by automated means. By applying

This right is without prejudice to Article 17 of the Regulation. The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us as controller.

f) Without prejudice to any other administrative or judicial remedies, you, as the data subject the right to file within the meaning of Article 77 of the Regulation Complaint to the Office for Personal Data Protection of the Slovak Republic if you believe that the processing of personal data concerning you is in breach of the Regulation or the Personal Data Protection Act.

As a data subject, you also have the right to object at any time, on grounds relating to a particular situation, to the processing of your personal data, including where the processing is necessary for the purposes of the legitimate interests pursued by us as a controller or a third party (excluding processing carried out by public authorities in the performance of their duties), except where such interests are overridden by your interests or fundamental rights and freedoms as a data subject which require the protection of personal data (in particular where the data subject is a child).

ORIWIN, s.r.o., Hálková 2753/13, 010 01 Žilina, as the operator of the information system, has taken all appropriate personal, organizational and technical measures for the purpose of maximum protection of your personal data in order to reduce the risk of their misuse, leakage, etc. to the greatest extent possible. Pursuant to our obligation under Article 34 of the Regulation, we hereby notify you as data subjects that if a situation arises in which we, as the controller, breach the protection of your personal data in a way that is likely to result in a high risk to the rights and freedoms of natural persons, we will notify you without undue delay of this fact.

NOTICE:

In order to comply with the principle of minimisation, any personal data provided by you is a necessary legal or contractual requirement for the fulfilment of the purpose of its processing. Failure to provide the mandatory data necessary for the conclusion of a contract may result in the contractual relationship not being concluded.

In case of any questions related to the protection of your personal data, including the exercise of your rights under the Regulation and the Personal Data Protection Act, please contact us at the following email address:

e-mail address:                     info@oriwin.eu