Privacy Policy

Information obligation 

on the protection of personal data 

pursuant to Article 13 of the GDPR Regulation and § 19 of Act No. 18/2018 Coll. on the protection of personal data

1. Identification and contact details of the operator:

BASTA MACHINES s. r. o., Gen. M. R. Štefánika 384/69, Trenčín 911 01, ID No.: 50 794 779, registered in the Commercial Register of the District Court of Trenčín, Section: Sro, File: 38247/R, represented by: Peter Balaj - Managing Director, contact details: email peter@bastamachines.com, (hereinafter also referred to as the "Controller") informs the data subject about the fulfilment of information obligations pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as the "Regulation") and Section 19 of Act No. 18/2018 Coll. on the protection of personal data (hereinafter also referred to as the "Personal Data Protection Act") by sharing the information below.

2. The purpose of the processing of personal data, the purpose for which the personal data are intended, as well as the legal basis for the processing of personal data:

2.1 Purpose: conclusion of the contract and pre-contractual relations

Legal basis:

Article 6(1)(b) of the Regulation or Article 13(1)(b) of the Data Protection Act: the processing of personal data is necessary for the performance of a contract to which the data subject is a party or for the performance of a pre-contractual measure at the request of the data subject. 

The controller hereby notifies the customer as a data subject that in the process of concluding a contract, it will process personal data without the consent of the data subject, since the processing of personal data will be carried out by the controller within the framework of pre-contractual relations and the processing of personal data is necessary for the conclusion of a contract (in particular, a purchase contract, a contract for work, etc.).

2.2 Purpose: to fulfil a legal obligation

Legal basis:

Article 6(1)(c) of the Regulation and Article 13(1)(c) of the Personal Data Protection Act: the processing of personal data is necessary pursuant to a special regulation - the controller is obliged to provide the personal data of the data subject to state institutions, e.g. for tax purposes, etc.

2.3 Purpose: to send news, information about supplements and new assortments for purchased or manufactured goods 

Legal basis:

Article 6(1)(f) of the Regulation or Article 13(1)(f) of the Data Protection Act: the processing of personal data is necessary for the purpose of the legitimate interests of the controller or of a third party, except where those interests are overridden by the interests or rights of the data subject requiring the protection of personal data.

The legitimate interest of the operator is to inform its customers by means of notifications about news, information, supplements and new assortment to the purchased or manufactured goods. The operator has provided the customer with the goods, for this reason it is the legitimate interest of the operator and the customer to be informed of facts, features, guarantees, new offers of goods of the same range. In accordance with the principle of proportionality, the operator concludes that informing customers by means of notifications outweighs the interest of protecting the privacy of the data subject, since the data subject's privacy is minimally affected by receiving a notification to the email address used in the contractual communication with the operator. The controller has taken appropriate technical and organisational measures to protect the processing of the email address for this purpose.

2.4 Purpose: to send news, information about supplements and new assortments for purchased or manufactured goods

Article 6(1)(a) of the Regulation or Article 13(1)(a) of the Data Protection Act: the data subject has consented to the processing of his or her personal data for at least one specific purpose.

The controller hereby informs the customer as a data subject that, if he/she expresses an interest in receiving notifications without entering into a contract with the controller, the controller will process his/her email address to which the requested information will be sent for a period of 60 months. The controller declares that it will process the personal data in accordance with good manners and will act in a manner that does not contravene the DPA Act and the GDPR Regulation.

3. Identification of the recipient or category of recipient:

The categories of recipients who process personal data for the purpose of concluding a contract and fulfilling a legal obligation are:

Law firm, Postal carrier, state institutions for the purpose of fulfilling the obligations of the controller: tax office, state administration and public authority for the exercise of control and supervision (Slovak Trade Inspection, Office for Personal Data Protection), bailiff, court, law enforcement agency, etc.

The categories of recipients who process personal data for the purpose of sending news, information about accessories and new assortment of purchased or manufactured goods are: marking agencies, IT technician

4. Retention period of personal data 

In the case of processing personal data for the purpose of a concluded contract and the fulfilment of a legal obligation, the retention period of personal data is determined by law for the exercise of rights and obligations arising from the concluded contract - the retention of personal data is therefore necessary for the identification of the contracting party and the fulfilment of a legal obligation; longer processing of personal data is only possible on the basis of the law and for the purpose of archiving accounting documents on the basis of a special regulation. The general limitation period under the Civil Code is 3 years; the controller is therefore entitled to process personal data up to 3 years after the termination of the contractual relationship for the purpose of fulfilling the rights and obligations arising from the concluded contract.

In the case of processing of personal data for the purpose of sending newsletters, information about supplements and new assortments for purchased or manufactured goods, the retention period is 60 months.

5. Rights of the data subject

The person concerned has the right to:

request access to personal data relating to the user (hereinafter also referred to as the "data subject")

The data subject has the right to know the list of personal data we process.

to correct personal data

The controller has taken measures to keep personal data accurate, complete and up-to-date. 

to erasure of personal data (the so-called right to be forgotten)

The data subject may request the erasure of his or her personal data if the grounds specified by law are met, in particular: 

- the personal data is no longer necessary for the purpose for which it was collected,

- consent has been withdrawn, 

- personal data have been processed unlawfully, etc.

A request for erasure of personal data may not be granted if the processing of personal data is necessary for: 

- compliance with a legal obligation, 

- for archiving, historical research or statistical purposes, unless the right to erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing.

to restrict the processing of personal data

The data subject may, subject to the fulfilment of the legal conditions, request that the personal data are no longer used, in particular

- during the period of verification of the accuracy of personal data, in case of objection to the accuracy of personal data, 

 - during the period of verification that the controller has a relevant processing purpose, 

- during the period of verification that legitimate interests outweigh the legitimate interests.

object to the processing of personal data

The data subject shall have the right to object to the processing of personal data in case of doubt as to whether there is a legal basis for the processing of personal data, or to object to the processing of personal data relating to direct marketing, including profiling to the extent that it is related to direct marketing.

for the portability of personal data 

The data subject has the right to request the transfer of personal data that he or she has provided to the controller in certain circumstances. This right of portability applies only to personal data which have been provided on the basis of consent or on the basis of a contract to which the data subject is a party.

withdraw consent

The data subject shall have the right to withdraw consent at any time where personal data are processed on the basis of consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. 

lodge a complaint with the supervisory authority

The data subject has the right to file a petition or complaint with the Office for Personal Data Protection of the Slovak Republic, https://dataprotection.gov.sk , Hraničná 12, 820 07 Bratislava 27; tel. no.: +421 /2/ 3231 3214; E-mail: statny.dozor@pdp.gov.sk. 

The buyer and the interested party as a data subject may request the exercise of the above-mentioned rights at any time, by email perer@bastamachines.com or in writing to the postal address of the registered office of the operator. The controller shall process the data subject's request in relation to the above rights within the statutory time limits.   

6. Legal or contractual requirement 

The person concerned is obliged to provide personal data only for the purpose of concluding a contract and pre-contractual relations and fulfilling a legal obligation, otherwise it is not possible to conclude a contract in which the buyer has expressed an interest and subsequently fulfill the rights and obligations arising from the concluded contract for the seller and the buyer.