ICEP s.r.o. — GDPR
Personal Data Processing Notice
English version / Anglická verzia / Versione inglese
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and with Slovak Act No. 18/2018 Coll. on the Protection of Personal Data, as amended (the “Act”), we, as controller, hereby provide you with the following information on the processing of your personal data in connection with our qualification and certification services and the use of our websites.
1Controller
ICEP s.r.o.
Registered office: Vysoká 26, Bratislava, Slovenská republika
Company ID (IČO): 45 288 402
E-mail: icep@iceponline.com
The controller has not appointed a Data Protection Officer (DPO), as no such obligation arises under Article 37 GDPR. For any matter concerning the processing of personal data, you may contact us at the e-mail address indicated above.
2Categories of personal data processed
We process, in particular, the following categories of personal data:
- identification and contact details of the Applicant and of the contact persons of qualified organisations (first name, surname, role, e-mail address, telephone number), provided when submitting the Qualification Request or in the course of service delivery;
- data contained in the Qualification Request and in the documentation required to provide qualification and/or certification services, including any subsequent additions;
- invoicing and payment data required for the performance of the contract and compliance with legal obligations;
- technical data relating to visits to our websites (IP address, browser type, cookies, logs).
3Purposes and legal bases of processing
We process your personal data for the following purposes and on the following legal bases:
| Purpose of processing | Legal basis |
|---|---|
| Handling the Qualification Request and pre-contractual communication | Art. 6(1)(b) GDPR (pre-contractual measures) |
| Provision of qualification and/or certification services and performance of the contract | Art. 6(1)(b) GDPR |
| Compliance with legal obligations (accounting, tax, archiving) | Art. 6(1)(c) GDPR |
| Sending information on ICEP initiatives and promotions (newsletter, SMS, etc.) | Art. 6(1)(a) GDPR (consent) |
| Administrative purposes, statistics and service quality assessment | Art. 6(1)(f) GDPR (legitimate interest) |
| Operation and security of the website and access to restricted areas | Art. 6(1)(f) GDPR (legitimate interest) |
| Establishment, exercise or defence of legal claims; cooperation with public authorities | Art. 6(1)(f) and (c) GDPR |
Where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
4Obligation to provide data
The personal data requested are of two kinds: mandatory and optional. The provision of mandatory data is strictly necessary for the delivery of ICEP qualification and/or certification services; failure to provide such data will make it impossible to provide those services. Optional data (e.g. for satisfaction surveys or marketing purposes) may be provided on a voluntary basis, and their non-provision has no effect on the provision of the services.
5Retention period
Personal data are retained only for as long as necessary to achieve the purposes of the processing: for the duration of the contractual relationship and thereafter for the period required by specific legal provisions (e.g. Slovak Act No. 431/2002 Coll. on Accounting — as a rule, 10 years for accounting records). Data processed on the basis of consent are retained until such consent is withdrawn. Website technical logs are retained for a reasonable, limited period.
6Recipients of personal data
Your personal data may be disclosed to:
- processors providing technical and professional services on our behalf (e.g. web hosting, IT services, accounting), exclusively under a contract pursuant to Article 28 GDPR and subject to a confidentiality undertaking;
- persons entrusted with the performance of activities necessary for the delivery of ICEP services, exclusively within the scope of such purposes;
- public authorities (courts, law-enforcement bodies, supervisory authorities) where required by law.
We do not publish personal data, nor do we disclose them to third parties for their own marketing purposes.
7Transfers to third countries
We do not transfer personal data to third countries outside the EU/EEA. Should such a transfer become necessary in the future, it will take place only subject to appropriate safeguards under Chapter V GDPR (adequacy decision, standard contractual clauses, etc.).
8Automated decision-making and profiling
The processing of your personal data does not involve automated individual decision-making or profiling within the meaning of Article 22 GDPR.
9Your rights
As a data subject, under the GDPR and the Act you have the right:
- to access your personal data (Art. 15 GDPR);
- to rectification of inaccurate or incomplete data (Art. 16 GDPR);
- to erasure of data (“right to be forgotten”, Art. 17 GDPR);
- to restriction of processing (Art. 18 GDPR);
- to data portability (Art. 20 GDPR);
- to object to processing based on legitimate interest, including processing for direct marketing purposes (Art. 21 GDPR);
- to withdraw consent to processing at any time, where the processing is based on consent (Art. 7(3) GDPR).
You may exercise your rights in writing at the controller’s registered office or by e-mail at icep@iceponline.com. We will respond to your request without undue delay and in any event within one month of receipt.
You also have the right to lodge a complaint (a proposal to initiate proceedings under Section 100 of the Act) with the supervisory authority, namely the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk.
10Cookies
Our websites use cookies that are strictly necessary for their operation. Non-essential cookies (analytics, marketing) are used only with your consent, in accordance with Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications; you may change or withdraw your consent at any time in the cookie settings.
11Persons under 18 years of age
No Qualification Request may be submitted to ICEP on behalf of any organisation by a person under 18 years of age without the consent of a parent or legal guardian. In relation to information society services, we process the personal data of a person under 16 years of age only with the consent of their legal guardian (Section 15 of the Act).
12Changes to this notice
We may update this notice from time to time, in particular in the event of changes to the applicable legislation or to our processing operations. The current version is always published on our website and available at the controller’s registered office.