Information obligation Art. 13 GDPR

3 M, SPOL. s ro, Bodice 41, 031 01 Liptovský Mikuláš, ID: 36441511
contact details: marketing@penzionmaie.eu

______________________________________________________________
as an information system operator for the purpose of fairness
and transparency vis-à-vis data subjects, this privacy statement is entitled

PRINCIPLES OF PERSONAL DATA PROTECTION

pursuant to Article 13 and the relevant recitals of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection
individuals with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation")

and the Act of the National Council of the Slovak Republic no. 18/2018 Coll. on the protection of personal data

and on the amendment of certain laws (hereinafter referred to as the "Personal Data Protection Act")
The purposes of the processing of personal data are the reasons for which the personal data of the data subjects are processed
persons (employees, clients) in our information systems on precisely defined legal
basics. The purposes are specifically specified, explicitly stated and justified, while processing
personal data of the data subjects, we respect the principle of legality under Articles 6 and 9 of the Regulation
(The individual purposes and legal bases are set out in the Annex to this Privacy Policy).
Affected persons about whom personal data are processed in our information systems
for specific defined purposes, they may exercise the following rights in writing or electronically:
a) Right of access to personal data - this is the right to obtain confirmation that they are being processed
Your personal data as well as the right to access this data, to the extent necessary
and processing times, the categories of personal data concerned, the range of recipients, the procedure
in each automatic processing, or on the consequences of such processing. How
operator we have the right to use all reasonable measures to verify identity
the data subject requesting access to the data, in particular in relation to online services
and identifiers (Article 15, Recital 63, 64 of the Regulation).
(b) Right to correct incorrect and incomplete personal data (Article 16, Recital
65 Regulations).
c) Right of erasure - "forgetting" of personal data which are no longer needed for the purposes
obtained and processed, upon revocation of the consent under which the processing
illegal processing, if personal data were obtained in connection with the offer
information society (for children), subject to the conditions set out in Article 17,
recital 65, 66 Regulations.
d) The right to restrict processing can be exercised if you challenge the person concerned
the accuracy of personal data and other particulars within the meaning of Article 18, Recital 67
Regulations, in the form of a temporary transfer of selected personal data to another
processing system, preventing users from accessing selected personal data
or temporary removal of processing.
e) The right to the transfer of personal data is the right of the personal data provided by you to ours
information systems on the basis of consent or performance of the contract
to the operator in a structured, commonly used and machine-readable format,
as far as technically possible, even under the conditions of Article 20, recital 68 of the Regulation
in the case of processing by automated means. Applying
this right is without prejudice to Article 17 of the Regulation. The right to data portability is

does not apply to processing necessary for the performance of a task carried out in the public interest
or in the exercise of public authority entrusted to us as the operator.
f) Without prejudice to any other administrative or judicial remedy, you have
as the person concerned, the right to lodge a complaint with the Office within the meaning of Article 77 of the Regulation
for the protection of personal data of the Slovak Republic, if you believe that the processing of personal data
concern you is contrary to the Regulation or the Personal Data Protection Act.
As an affected person, you also have the right to object at any time for specific reasons
situations against the processing of your personal data, even if the processing is necessary for the purposes
legitimate interests we pursue as an operator or third party (excluding processing)
performed by public authorities in the performance of their tasks), except in cases where such
interests outweigh your interests or the fundamental rights and freedoms of the person you are
require the protection of personal data (especially if the data subject is a child).
If personal data is processed for direct marketing purposes, as a data subject you have the right
object at any time to the processing of your personal data, for the purposes of such direct
marketing, including profiling, to the extent that it relates to such direct marketing.
3 M, SPOL. s ro, Bodice 41, 031 01 Liptovský Mikuláš accepted as an information operator
system all appropriate personnel, organizational and technical measures in order to maximize
protection of your personal data in order to reduce as far as possible the risk of their misuse, leakage and
Similarly. In accordance with our obligation under Article 34 of the Regulation to you as affected
We inform persons that if a situation arises that, as the operator, we violate the protection of you
personal data in a way that is likely to lead to a high risk to rights
and freedoms of natural persons, we will inform you of this fact without undue delay.
WARNING: due to the observance of the principle of minimization, all of you are provided personally
data is a necessary legal or contractual requirement to fulfill the purpose of their processing.
Failure to provide the mandatory data necessary to conclude the contract may result
failure to enter into a contractual relationship.
In case of any questions related to the protection of your personal data, including the application
We ask you to make your rights in accordance with the Regulation and the Personal Data Protection Act
contact us or contact our responsible person (if designated):
Contact information:
email address marketing@penzionmaria.eu or number 0911897011

Annex to the Privacy Policy
PERSONNEL AND PAYROLL AGENDA OF EMPLOYEES
The purpose of personal data processing is the fulfillment of the employer 's work - related obligations
relationship or similar relationship (for example, on the basis of
out-of-work agreements)
including pre-contractual relations.

Name of the information system Personnel and payroll of employees
Legal basis Constitution of the Slovak Republic, Act of the National Council of the Slovak Republic no. 311/2001 Coll.
Labor Code as amended, Act of the National Council of the Slovak Republic
no. 552/2003 Coll. on the performance of works in the public interest
as amended, Act of the National Council of the Slovak Republic no. 312/2001
Z. z. on the civil service and on the amendment of certain
laws, Act of the National Council of the Slovak Republic no. 553/2003 Coll. on remuneration
certain employees in the performance of their duties in public
interest and amending certain laws as amended
later regulations, Act of the National Council of the Slovak Republic No. 595/2003 Coll. about the day
from income as amended, Act of the National Council of the Slovak Republic
no. 563/2009 Coll. on tax administration (tax code)
and amending certain laws, as amended
regulations, Act of the National Council of the Slovak Republic no. 461/2003 Coll. on social
insurance as amended, Act of the National Council of the Slovak Republic
no. 600/2003 Coll. on child allowance and on amendment
Act of the National Council of the Slovak Republic no. 461/2003 Coll. on social insurance
as amended, from. NRSR No. 462/2003 Coll.
on income compensation in the event of temporary incapacity for work
employee and amending certain laws
as amended, Act of the National Council of the Slovak Republic no. 580/2004
Z. z. on health insurance and amending certain
laws as amended, Act of the National Council of the Slovak Republic
no. 650/2004 Coll. on supplementary pension savings
as amended, Act of the National Council of the Slovak Republic no. 448/2008
Z. z. on social services, as amended,
Act of the National Council of the Slovak Republic no. 5/2004 Coll. on employment services
as amended, Act of the National Council of the Slovak Republic no. 82/2005 Coll.
on illegal work and illegal employment, as amended
later regulations, Act of the National Council of the Slovak Republic no. 245/2008 Coll.
on upbringing and education (School Act) and on change
and amendments to certain laws as amended,
Act of the National Council of the Slovak Republic 18/2018 Coll. on the protection of personal data
and on the amendment of certain laws as amended
NR SR no. 84/2014 Coll., Act of the National Council of the Slovak Republic no. 317/2009 Coll.
on teaching and professional staff
employees and amending certain laws,
Act of the National Council of the Slovak Republic no. 152/1994 Coll. on the social fund and on change
and amendment of the Act of the National Council of the Slovak Republic no. 286/1992 Coll. about taxes
from income as amended, Act of the National Council of the Slovak Republic
no. 43/2004 Coll. on old-age pension savings, law
NR SR no. 124/2006 Coll. on safety and health at
and amending certain laws. Processing
personal data is permitted by Act no. 577/2004 Coll.
on the extent of healthcare reimbursed on the basis of
public health insurance and reimbursement for services
related to the provision of healthcare as amended
later regulations, Act no. 578/2004 Coll.
on health care providers, medical
workers, professional organizations in health care
and amending certain laws, as amended
regulations, Decree of the Ministry of Health of Slovakia
Republic No. 448/2007 Coll. on the details of the factors
work and the work environment in relation to categorization
work in terms of health risks and the requirements of the proposal
for the classification of works into categories, Act no. 355/2007 Coll.
on the protection, promotion and development of public health and on change
and amendments to certain laws as amended
and related legal regulations, Act no. 204/2014 Coll. which

Act no. 355/2007 Coll. on protection,
promotion and development of public health and amending
certain laws as amended and amending
and amendments to some laws, Act no. 124/2006 Coll.
on safety and health at work and on change
and amendments to certain laws as amended,
Act no. 470/2011 Coll., Which amends the Act
no. 124/2006 Coll. on safety and health at work
and amending certain laws as amended
later regulations and supplementing the law
no. 355/2007 Coll. on the protection, promotion and development of the public
health and amending certain laws as amended
later regulations, Decree of the Ministry of Health
Of the Slovak Republic on details of scope and content
performance of occupational health service, on the composition of the team
experts who carry it out and the requirements for them
professional competence.

Recipient categories Human Resources Processing Broker,
payroll intermediary,
mediator - health and safety technician, mediator
to process the occupational health service agenda, authorities
public authority in accordance with the relevant legislation,
Health insurance companies, supplementary pension savings banks,
ancillary management companies.

Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data
(deadlines are after
employment relationship)

 5 -10 years, personal files - up to 70 years of age
employee

Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned, jobseekers, employees, spouses or
employees' wives, dependent children of employees,
parents of dependent children of employees, close persons,
former employees

2 ECONOMIC-ACCOUNTING AGENDA
Purpose of personal data processing The purpose of personal data processing is processing
orders, received invoices and invoicing to customers, contact
with the bank, cash management, securing cash
income and expenditure, warehousing, records
fixed assets (including automatic depreciation)
and small assets, simple / double management
organization 's accounting.
Name of the information system Economic-accounting
Legal basis Act no. 431/2002 Coll. on accounting, as amended
regulations, Act no. 222/2004 Coll. on value added tax
values as amended, Act no. 18/2018
Z. z. on the protection of personal data and on the amendment
certain laws, Act no. 145/1995 Coll. about correct
fees as amended, Act no. 40/1964
Zb. Civil Code as amended, Act
no. 152/1994 Coll. on the Social Fund and on the amendment
Act no. 286/1992 Coll. on income taxes as amended
later regulations, Act no. 311/2001 Coll. Code
work as amended, Act no. 400/2009 Coll.
on Civil Service and on Amendments to Certain Acts in
wording of later regulations, Act no. 513/1991 Coll.
Commercial Code as amended, Act no.
583/2004 Coll. on territorial budgetary rules
self-government and amending certain laws.

Categories of beneficiaries - public authorities according to the relevant legal

regulations,
- intermediary.
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data
(the deadlines are according to
registry order)

 10 years

Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned natural persons - employees of the operator, suppliers
and customers - individuals, employees of suppliers
and customers, suppliers 'and customers' representatives

3 OPERATOR PROMOTION
Purpose of personal data processing Disclosure of photos of employees with the intention to build
reputation of the operator, to promote the operator
on its website, in the internal administrative
on social networks or intranets.

Name of the IS information system Operator promotion
Legal basis Consent of the person concerned pursuant to Article 6 para. 1 letter a)
Regulations and the Personal Data Protection Act, whereby
the person concerned has the right to withdraw his or her consent at any time.
Withdrawal of consent does not affect the lawfulness of the processing
prior to its withdrawal.

Recipient categories None.
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data 2 years after publication
Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned anci employees of the IS operator.
PUBLIC ACCESSIBLE CAMERA MONITORING SYSTEM
Purpose of personal data processing The purpose of personal data processing within the scope of the
The agenda is to monitor areas accessible to the public
for reasons of property and health protection.

Name of the IS information system Camera system monitoring the accessible areas

public

Legal basis A legitimate interest within the meaning of Article 6 (1) 1 letter f)
Regulations. The main legitimate interest is protection
property and safety of the operator and the persons concerned
Categories of beneficiaries Public authorities under the relevant legislation
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data for 15 days from the day following the day on which the alert was issued

made out

Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned  natural persons who have entered the premises
available to the public
 the public itself

5 EMPLOYEE MONITORING
The purpose of personal data processing is to monitor employees for tracking purposes

and adherence to work discipline in accordance with the Code
work through: camera system

Name of the IS information system Employee monitoring
Legal basis § 13 par. 4 of Act no. 311/2001 Coll. Labour Code

as amended

Categories of beneficiaries Public authorities under the relevant legislation
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data 15 days after the end of the employment relationship
Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned by the operator 's staff
6 ADMINISTRATION OF THE REGISTRATION
Purpose of personal data processing The purpose of personal data processing within the scope of the
agenda is the administration of the registry as a proper record
records (keeping complete and accurate records of records
in the registry diary, keeping registers and indices
records), proper disposal of files (records),
ensuring the planned disposal of files (records),
which are not necessary for further activity and their deadlines have expired
saved, records of incoming and outgoing mail.

Name of the IS information system Registry administration
Legal basis Act of the National Council of the Slovak Republic no. 395/2002 Coll. on archives and registries,
305/2013 Coll. on the electronic form of the exercise of the scope
public authorities and amending certain
laws (e-Government Act).

Categories of beneficiaries by public authorities according to the relevant legislation
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data From 30 days to the employee's 70th year of life
Existence information
automated decision-making
including profiling

Not taking place

Categories of data subjects data subjects for all processing purposes
personal data defined by the controller

7 SZČO RECORDS
Purpose of personal data processing The purpose of personal data processing within the scope of the
agenda is the preparation and management of supplier-customer
relations with self-employed persons. Within
of the subject agenda are contractual relations, invoices
and orders, records of deliveries and purchases of goods, services
etc.
Name of the information system SZČO records
Legal basis Contract between the operator and SZČO permitted by the Constitution
Of the Slovak Republic, the Civil Code, the Commercial Code
Code, Act no. 455/1991 Coll., Act
on Trade Licensing (Trade Licensing Act)
and related legislation.

Categories of beneficiaries state administration, public administration and public administration

in accordance with the relevant legislation

Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data 10 years after the end of the contractual relationship due to registration

within the accounting agenda

Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned customer / supplier - self-employed person

8 REGISTRATION OF SUPPLIERS AND CUSTOMERS 'REPRESENTATIVES
Purpose of personal data processing The purpose of personal data processing within the scope of the
agenda is the management of a database of representatives, respectively
employees of suppliers and customers due to performance
their duties, duties and functions
and ensuring continuous supply and demand
relationships.

Name of the information system Records of suppliers 'and customers' representatives
Legal basis § 78 od. 3 of the Act of the National Council of the Slovak Republic no. 18/2018 Coll. about protection
personal data and amending certain laws

Recipient categories None
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data Within 30 days from the date of termination of supplier-customer

relationships

Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned natural person - representative (employee) of the supplier,

customer
9 EXERCISE OF THE RIGHTS OF THE PERSONS CONCERNED
Purpose of personal data processing The purpose of personal data processing within the scope of the
agenda is to process requests from natural persons directing
to exercise their rights as data subjects within the meaning of
Regulation (EU) 2016/679 of the European Parliament and of the Council
on the protection of individuals with regard to the processing of personal data
and on the free movement of such data.
Name of the IS information system Exercising the rights of the persons concerned
Legal basis Art. 6, par. 1, letter a), in accordance with Art. 15 to 22 and 34
Regulation (EU) 2016/679 of the European Parliament and of the Council
on the protection of individuals with regard to the processing of personal data
and on the free movement of such data

Categories of beneficiaries  state administration, public administration and public administration bodies

in accordance with the relevant legislation

Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data 1 year from the date of processing the application
Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned a natural person who, as a data subject, within the

operators defined for the purposes
to the operator with a request to exercise his rights

10 COMPETITIONS
The purpose of personal data processing is the processing of personal data of participants in the competition for the purpose

evaluation of its course and announcement of results

The name of the IS Competition information system
Legal basis Consent of the person concerned pursuant to Article 6 para. 1 letter a)
Regulations and the Personal Data Protection Act, whereby
the person concerned has the right to withdraw his or her consent at any time.
Withdrawal of consent does not affect the lawfulness of the processing
prior to its withdrawal.

Recipient categories None
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data 3 months after the evaluation of the competition, withdrawal of consent
Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned natural persons - participants in competitions

11 PUBLISHING PHOTOS OF CLIENTS
The purpose of personal data processing is to publish photos of clients on social networks,

in magazines, on the website
Name of the information system IS Publication of client photographs
Legal basis Consent of the person concerned pursuant to Article 6 para. 1 letter a)
Regulations and the Personal Data Protection Act, whereby
the person concerned has the right to withdraw his or her consent at any time.
Withdrawal of consent does not affect the lawfulness of the processing
prior to its withdrawal.

Recipient categories None
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data throughout the operation of social networks, web

pages and archives of magazines

Existence information
automated decision-making
including profiling

Not taking place
Categories of affected persons natural persons - clients
12 MARKETING
Purpose of personal data processing Conducting marketing research and provisioning
information on the operator of the person concerned. It is
on the provision of information relating to the supply of goods, and
the services of the operator or its business partners,
including the sending of information on special offers,
products and other activities, as well as the sending of business
notification by electronic means -
by postal / e-mail / or telephone
contact details of the person concerned
person.
Name of the information system IS Marketing
Legal basis Consent of the person concerned pursuant to Article 6 para. 1 letter a)
Regulations and the Personal Data Protection Act, whereby
the person concerned has the right to withdraw his or her consent at any time.
Withdrawal of consent does not affect the lawfulness of the processing
prior to its withdrawal.

Recipient categories None.
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data 2 years after fulfilling the purpose of processing, resp. 30 days after

withdrawal of consent

Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned  natural person - candidate who has expressed an interest

about marketing information

13 REGISTRATION OF ACCOMMODATED GUESTS AND REGISTRATION OF FOREIGNERS
Purpose of personal data processing In this IS Register of accommodated guests operator
provides accommodation services. Within its
subject of activity performs the function of accommodation facility
for individual passengers whose purpose of the journey is
private or business as well as tour groups.
The main purpose in the subject IS is the registration of accommodated
guests as well as sending reports on the stay of foreigners.
Name of the IS information system Records of accommodated guests, records of foreigners
Legal basis The processing of personal data is permitted by the law of the National Council of the Slovak Republic
no. 253/1998 Coll. on reporting the residence of Slovak citizens
Republic and the population register of the Slovak Republic,
Act of the National Council of the Slovak Republic no. 404/2011 on the stay of aliens and on the change
and amendments to certain laws

Categories of beneficiaries - bodies active in criminal proceedings in accordance with Act no.
301/2005 Coll. Criminal procedure, as amended
regulations,
- Control bodies, state administration bodies, bodies
public authorities and other persons, within
provided, possibly and other justified
entities
- Alien Police Department

Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data
Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned - accommodated guests
14 SOCIAL NETWORK COMPETITIONS
Purpose of personal data processing Within the subject IS, personal data are processed on
the purpose of organizing and evaluating the various competitions
organized by the IS operator within its profile
on the social network Facebook. He can participate in these competitions
any natural person over the age of 18, through
social networks. The main purpose of this IS is
keeping records of competitors, mutual communication
with them.

Name of the information system IS Competitions on the social network
Legal basis Consent of the person concerned pursuant to Article 6 para. 1 letter a)
Regulations and the Personal Data Protection Act, whereby
the person concerned has the right to withdraw his or her consent at any time.
Withdrawal of consent does not affect the lawfulness of the processing
prior to its withdrawal.

Recipient categories None
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data 3 months after the evaluation of the competition, withdrawal of consent
Existence information
automated decision-making
including profiling

Not taking place

Categories of persons concerned natural persons - participants in competitions

15 LOYALTY PROGRAM
Purpose of personal data processing The subject of the information system is database management

clients, in order to provide discounts and benefits
for individuals - loyal customers.

Name of the information system IS Loyalty program
Legal basis Consent of the person concerned pursuant to Article 6 para. 1 letter a)
Regulations and the Personal Data Protection Act, whereby
the person concerned has the right to withdraw his or her consent at any time.
Withdrawal of consent does not affect the lawfulness of the processing
prior to its withdrawal.

Recipient categories None.
Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data 2 years from the end of membership
Existence information
automated decision-making
including profiling

Not taking place
Categories of persons concerned - natural persons - customers.
16 STRUCTURAL FUNDS PROJECTS
Purpose of personal data processing The purpose of personal data processing within the scope of the

agenda is the processing of documentation necessary
for the accounting of internal staff costs
employees of the organization as well as employees outside
employment relationship.

Name of the information system IS Projects from the Structural Funds
Legal basis The processing and storage of personal data follows

from the general conditions of financial contracts
contribution under the individual grant schemes
and operational programs of the EU Structural Funds.
Beneficiary categories European Commission and its authorized representatives, Managing Director
and control bodies of individual operational programs
and their delegated persons, Project Partners (especially the main
partners / beneficiaries who cover the project towards the managers
program authorities), the Financial Control Units, the SAO,
Certification bodies, audit bodies and persons authorized by them,
public authorities in accordance with the relevant legislation.

Cross-border transmission of axes. data Not applicable
Deadlines for deleting axes. data
Categories of persons concerned All natural persons participating in the project:
 internal staff of the operator
 persons out of work