Privacy Notice

The protection of our clients’ and other individuals’ personal data is important to us. These terms explain how we process personal data when providing advisory, consultancy and other services, and when operating our website.

When processing personal data, we are primarily guided by Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the „Regulation“), Act No. 18/2018 Z. z. on the protection of personal data and amending certain acts (hereinafter referred to as the “Personal Data Protection Act”) and other generally binding legal regulations applicable to our activities.

ASTELLAR ADVISORY s. r. o., with its registered office at Gunduličova 4, 811 05 Bratislava, Slovak Republic, Company ID No.: 35 880 554, registered in the Business Register of the Municipal Court Bratislava III, Section: Sro, Insert No.: 31174/B, telephone contact: +421 914 334 300, email contact: blanar@astellaradvisory.com (hereinafter referred to as the “Controller”) hereby provides data subjects with basic information on the conditions for the processing of their personal data in accordance with Articles 13 and 14 of the Regulation:

I. Why do we process personal data?

The processing of personal data is necessary on our part, in particular, so that we can:

provide our clients with advisory, consultancy and other services,
enter into and fulfil contractual relationships and communicate with clients, prospective clients and contractual partners,
fulfil statutory and contractual obligations,
conduct recruitment processes to fill job vacancies, and
protect the legitimate interests of ourselves, our clients and other individuals.

II. For what purposes and on what legal grounds do we process personal data?

A. Provision of advisory and consultancy services

Legal basis: Performance of a contract or taking steps prior to entering into a contract pursuant to Article 6(1)(b) of the Regulation, where the data subject is a party to the contract, and the Controller’s legitimate interest pursuant to Article 6(1)(f) of the Regulation for the proper provision of services and fulfilment of contractual relationships, where we process the data of contact persons, client representatives or other persons associated with the service provided.

Categories of data subjects: Clients, prospective clients, members of clients’ statutory bodies, clients’ employees, persons authorised by clients and other data subjects whose personal data must be processed in connection with the provision of services.

Retention period for personal data: For the duration of the contractual relationship and subsequently for the period necessary to protect and enforce the legal claims of the Controller or the client, or for a longer period if such retention is required by the relevant legislation or ongoing proceedings.

Categories of personal data: General personal data: identification data, contact details, data relating to the contractual relationship and other data necessary to achieve the stated purpose of processing.

B. Provision of other services in accordance with the Controller’s scope of business

Legal basis: Performance of a contract or taking steps prior to entering into a contract pursuant to Article 6(1)(b) of the Regulation, and the Controller’s legitimate interest pursuant to Article 6(1)(f) of the Regulation in the proper performance of contractual relationships and communication with contractual partners.

Categories of data subjects: Clients, prospective clients, members of the statutory bodies of clients and contractual partners, employees of clients and contractual partners, persons authorised by them, and other data subjects whose personal data must be processed to achieve the stated purpose.

Retention period for personal data: For the duration of the contractual relationship and subsequently for the period necessary to protect and enforce legal claims, or for a longer period if required by the relevant legislation.

Categories of personal data: General personal data: identification details, contact details, data relating to the contractual relationship and other data necessary to achieve the stated purpose of processing.

C. Ensuring compliance with legal regulations

Legal basis: Fulfilment of a legal obligation pursuant to Article 6(1)(c) of the Regulation, in particular under legislation relating to accounting, taxation, commercial law, data protection and other legislation applicable to the Controller.

D. Keeping records of job applicants

Legal basis: Performance of a contract or taking steps prior to entering into a contract pursuant to Article 6(1)(b) of the Regulation.

Categories of data subjects: Job applicants.

Retention period for personal data: 1 month after the end of the selection process for a specific vacancy.

Categories of personal data: General personal data: identification and contact details, details of work experience, details of education or qualifications, details of interests and leisure activities, and other information contained in a CV, cover letter or reference letter.

E. Keeping records of contractual partners who are natural persons

Legal basis: Performance of a contract pursuant to Article 6(1)(b) of the Regulation (contracts and pre-contractual relationships).

Categories of data subjects: Contractual partners who are natural persons.

Retention period for personal data: For the duration of the contractual relationship and subsequently for the relevant limitation periods. Data forming part of the accounting records are retained for the period stipulated by the relevant legislation.

Categories of personal data: General personal data: identification and contact details, bank details and other data necessary to achieve the stated purpose of processing.

F. Keeping records of members of the statutory bodies of contractual partners, employees of contractual partners and persons authorised by a contractual partner

Legal basis: The Controller’s legitimate interest in ensuring proper communication and the fulfilment of contractual relationships with contractual partners pursuant to Article 6(1)(f) of the Regulation.

Categories of data subjects: Members of the statutory bodies of contractual partners, employees of contractual partners and persons authorised by a contractual partner.

Retention period for personal data: For the duration of the contractual relationship and subsequently for the period necessary to protect and enforce the Controller’s legal claims.

Categories of personal data: General personal data: identification and contact details and other data necessary to achieve the stated purpose of processing.

G. Accounting management

Legal basis: Compliance with the legal obligation under Article 6(1)(c) of the Regulation, in particular pursuant to:

Act No. 431/2002 Coll. on Accounting, as amended,
Act No. 222/2004 Coll. on Value Added Tax, as amended,
Act No. 595/2003 Coll. on Income Tax, as amended,
Act No. 311/2001 Coll., the Labour Code, as amended, where relevant,
Act No. 152/1994 Coll. on the Social Fund and on the amendment and supplementation of Act No. 286/1992 Coll. on income taxes, as amended, where relevant.

Categories of data subjects: Contractual partners who are natural persons, members of the statutory bodies of contractual partners, employees of contractual partners, persons authorised by a contractual partner, clients, customers and employees.

Retention period for personal data: For the periods laid down by the relevant legislation; accounting records are generally retained for ten years following the year to which they relate, to the extent required by law.

Categories of personal data: General personal data: identification and contact details, bank details, data contained in accounting and tax documents, and other data necessary to achieve the stated purpose of processing.

H. The Controller’s website

Legal basis: The Controller’s legitimate interest in ensuring the proper, secure and stable operation of the website in accordance with Article 6(1)(f) of the Regulation.

Categories of data subjects: Natural persons who have visited the Controller’s website.

Retention period for personal data: 2 years from the date the data was collected.

Categories of personal data: General personal data: IP address, domain name, browser and operating system version, operational and technical data, and web logs.

I. Records management

Legal basis: Compliance with a legal obligation pursuant to Article 6(1)(c) of the Regulation, in particular under Act No. 395/2002 Coll. on archives and records management and amending certain acts, as amended.

Retention period for personal data: For the retention periods determined by the nature of the relevant record, the Controller’s internal rules and the relevant legislation.

Categories of personal data: General personal data: identification data, contact details and other data necessary to achieve the stated purpose of processing.

III. To whom do we disclose your personal data?

We disclose the personal data of our clients and other individuals only to the extent necessary and to those who require it to perform their duties or provide services to the Controller. These include, in particular, our employees and associates, external advisers and suppliers, accountancy and tax advisers, providers of IT, software, hosting and technical support, and, where applicable, other intermediaries and contractual partners. These parties are obliged to maintain the confidentiality of the data and to process it only to the extent necessary for the relevant purpose.

We may also disclose your personal data to the tax office, the relevant court, law enforcement agencies and other competent public authorities if we are required to do so by law or if it is necessary to assert, prove or defend our legal claims.

IV. To which countries do we transfer your personal data?

When processing your personal data, there is no transfer of such personal data to third countries within the meaning of Article 44 of the Regulation, nor is there any automated individual decision-making, including profiling, within the meaning of Article 22 of the Regulation.

V. What are the basic principles for determining the retention period for your personal data?

We always retain your personal data in accordance with the principle of data minimisation. This means that we process personal data only for as long as is necessary for the relevant purpose. Once this period has elapsed, we erase or anonymise the personal data, unless relevant legislation provides for or justifies its further retention.

When determining the specific retention period, we take into account, in particular, the duration of the contractual or other relationship, statutory retention periods for documentation, relevant limitation periods, and the need to establish, exercise or defend legal claims. If personal data is contained in several documents or information systems with different retention periods, it may be retained for the longest of the applicable periods.

We retain accounting records for the periods stipulated by Act No. 431/2002 Coll. on Accounting, as amended, and related regulations. We retain data held within our records management system in accordance with the retention periods specified for the relevant type of record. We retain job applicants’ details and technical data from the website for the periods specified in Article II of these terms and conditions.

VI. How do we obtain your personal data?

If you are our client, a prospective client or a contractual partner, we most often obtain your personal data directly from you. Depending on the purpose of processing, the provision of personal data may be voluntary, a contractual requirement or a legal requirement. Failure to provide data necessary for the conclusion or performance of a contract or for the fulfilment of a legal obligation may result in the relevant service or contractual relationship not being able to be carried out.

We may also obtain personal data from our clients and contractual partners, from persons authorised by them, from publicly available sources and registers, or from public authorities, where this is necessary for the relevant purpose of processing and there is a legal basis for doing so. If we do not obtain personal data directly from you, we fulfil our duty to inform you to the extent and under the conditions set out in Article 14 of the Regulation.

VII. What rights do you have as a data subject?

The individual rights of the data subject apply to the extent and under the conditions set out in the Regulation. As a data subject, you have, in particular, the following rights:

Right of access to data – Under Article 15 of the Regulation, data subjects have the right to obtain from the Controller confirmation as to whether their personal data are being processed and, where that is the case, the right of access to such data, to information on how their personal data is being processed, and to be provided with a copy of the personal data held by the Controller.
Right to rectification – The Controller shall take reasonable steps to ensure that the personal data of data subjects held by it is accurate, complete and up to date. Under Article 16 of the Regulation, data subjects have the right to have the Controller rectify or complete, without undue delay, any personal data that is inaccurate, incomplete or out of date.
Right to erasure (‘right to be forgotten’) – Under Article 17 of the Regulation, subject to the conditions set out therein, data subjects have the right to request that the Controller erase their personal data.
Right to restriction of processing – Under Article 18 of the Regulation, and subject to the conditions set out therein, data subjects have the right to request that the Controller restrict the processing of their personal data.
Right to data portability – Under Article 20 of the Regulation, subject to the conditions set out therein, data subjects have the right to receive the personal data concerning them which they have provided to the Controller, and the right to have such data transmitted to another controller without the Controller hindering such transmission.
Right to object – Under Article 21 of the Regulation, subject to the conditions set out therein, data subjects have the right to object to the processing of their personal data by the Controller, in particular where the processing is based on a legitimate interest pursuant to Article 6(1)(f) of the Regulation.
The right to lodge a complaint with a supervisory authority – In the event of a suspected unauthorised processing of personal data, data subjects have the right, pursuant to Article 77 of the Regulation, to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centre II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic; tel.: +421 2 32 31 32 14; email: statny.dozor@pdp.gov.sk.

VIII. Processing of cookies

Cookies are small text files that can improve the user experience on a website, for example by enabling the recognition of previous visitors when logging into the user interface, remember a visitor’s choice when opening a new window, or measure website traffic and how it is used in order to improve the user experience. However, we do not process cookies on our website.

IX. Changes to the Privacy Policy

For us, the protection of personal data is not a one-off matter. The information we are obliged to provide to you in relation to our processing of personal data may change or become out of date. For this reason, we reserve the right to amend and change these terms at any time and to any extent. In the event of a material change to these terms and conditions, we will bring the change to your attention, for example, by means of a general notice on this website or a specific notice by email, if this is appropriate given the nature of the change.

← Back to homepage