Data Protection Directive & Privacy Policy

1. Company Details & Supervisory Authority

This organizational directive sets out the technical and organizational measures our company has undertaken to comply with, as under Article 24 of the GDPR, taking into account the nature, scope, context, and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller is responsible for implementing appropriate measures to ensure and be able to demonstrate that processing is performed in compliance with the GDPR and Slovak Act No. 18/2018 Coll.

Controller

EMMA International s.r.o.

Registered Office: Muškátová 39, 974 01 Banská Bystrica, Slovakia
Company ID (IČO): 36825263
VAT ID (IČ DPH): SK2022436295
Commercial Register: District Court Banská Bystrica, Section Sro, Insert 13537/S
E-mail: ponuky@emmainternational.eu
Phone: +421 907 813 351
(hereinafter referred to as the “Controller”)

Supervisory Authority

Office for Personal Data Protection of the Slovak Republic

Address: Hraničná 12, 820 07 Bratislava 27, Slovakia
Phone: +421 2 3231 3214
E-mail: statny.dozor@pdp.gov.sk
Website: dataprotection.gov.sk
(hereinafter referred to as the “Supervisory Authority”)

2. Definition of Core Terms

Data Subject: any natural person whose personal data is processed.
Controller: any entity that alone or jointly with others determines the purposes and means of the processing of personal data and processes personal data in its own name.
Processor: any entity that processes personal data on behalf of the controller under written authorization or contract.
Processing of Personal Data: any operation or set of operations performed on personal data (in particular collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, restriction, erasure, or destruction).
Consent of the Data Subject: any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
Information System (IS): any structured set of personal data accessible according to determined criteria (whether centralized, decentralized, or dispersed).
Biometric Data: personal data resulting from specific technical processing relating to the physical, physiological, or behavioral characteristics of a natural person allowing their unique identification.
Genetic Data: personal data relating to inherited or acquired genetic characteristics of a natural person.
Data Concerning Health: personal data related to the physical or mental health of a natural person, including the provision of health care services.
Profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.
Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

3. Mapping Personal Data and Information Systems (IS)

The Controller has mapped all categories of personal data processed across its consulting, diagnostic, educational, and business activities. The respective data flows are defined in the following information systems:

Information System 1

IS Payroll and HR

Processed Data: data of employees, contractors, and job applicants (full name, academic title, permanent address, date of birth, national ID / birth number, IBAN, health and social insurance providers, ID card number, contact details, educational attainment, wage/salary details, attendance, sick leave, holidays, medical fitness certificates, occupational safety training records), family members' data to the legally required extent.

Purpose: conclusion and performance of employment contracts, fulfillment of statutory tax and social security obligations of the employer, recruitment procedures.

Legal Basis: Art. 6(1)(b) GDPR Art. 6(1)(c) GDPR

Information System 2

IS Cookies and Online Tools

Processed Data: online identifiers, cookie files, user website preference settings.

Purpose: ensuring correct and secure website operation, remembering user preferences (e.g. light/dark mode selection), anonymized technical traffic analytics.

Collection Method: automatically via the web browser of the website visitor.

Legal Basis: Art. 6(1)(a) GDPR Art. 6(1)(f) GDPR

Information System 3

IS Marketing and Inquiries

Processed Data: contact information (full name, email address, phone number, organization name, subject and message text of contact/inquiry forms).

Purpose: responding to inquiries, preparing proposals for development and MAP4Y diagnostics, scheduling consultations, targeted professional communication.

Collection Method: data subjects provide information voluntarily by submitting a contact form or sending an email.

Legal Basis: Art. 6(1)(b) GDPR Art. 6(1)(f) GDPR

Information System 4

IS Attendance Lists and Training

Processed Data: full name, email address, signature; optionally year of birth (strictly for statistical and project eligibility verification if mandated by grant or funding rules).

Purpose: tracking attendance at trainings, workshops, and MAP4Y diagnostic sessions; verifying delivery of activities to commissioning clients or project audit authorities.

Legal Basis:

Art. 6(1)(b) GDPR – Contract performance
Art. 6(1)(c) GDPR – Statutory project obligations
Art. 6(1)(f) GDPR – Legitimate interests

Recipients: project funding bodies / contracting authorities, accounting and administrative staff of the Controller, authorized external project auditors.

Retention Period: for the duration of the project and subsequently throughout the mandatory archiving period (5 years, or typically 10 years for EU-funded projects).

4. Principles of Personal Data Processing (Article 5 GDPR)

The Controller strictly complies with the fundamental principles set out in Article 5 of the GDPR:

Lawfulness, Fairness, and Transparency (Art. 5(1)(a)): we process personal data lawfully, fairly, and in a transparent manner in relation to the data subject. Processing is grounded in a legitimate legal basis under Article 6 of the GDPR (consent, performance of a contract, legal obligation, protection of vital interests, public interest, or legitimate interests).
Purpose Limitation (Art. 5(1)(b)): data is collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
Data Minimization (Art. 5(1)(c)): processed personal data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
Accuracy (Art. 5(1)(d)): we ensure that data is accurate and kept up to date where necessary. Inaccurate data is promptly erased or rectified. The data subject is obligated to provide truthful and accurate information.
Storage Limitation (Art. 5(1)(e)): personal data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed, or as prescribed by statutory archiving regulations.
Integrity and Confidentiality (Art. 5(1)(f)): data is processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures.
Accountability (Art. 5(2)): the Controller is responsible for, and able to demonstrate compliance with, all the aforementioned principles.

5. Technical and Organizational Security Measures

In accordance with Article 32 of the GDPR, EMMA International s.r.o. has implemented appropriate security measures taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk:

Electronic Security

Digital Safeguards

Firewall and Antivirus: we deploy enterprise security solutions from Apple and ESET with automatic and regular antivirus definition updates.
Network Protection: internal Wi-Fi networks are secured with WPA encryption protocols and strong, periodically rotated access credentials.
Access Control: computers, workstations, and digital repositories containing personal data are safeguarded with strong credentials accessible exclusively by authorized personnel.
Encrypted Backups: critical datasets are backed up in encrypted form with strictly partitioned physical and software access controls.

Physical Security

Paper Document Safeguards

Physical Storage: physical documentation, contracts, and attendance sheets are stored in folders and binders protected against physical damage.
Locked Facilities: documentation binders are kept in locked offices within the company headquarters.
Access Restriction: physical access to records containing personal data is restricted exclusively to authorized personnel.
Secure Shredding: upon expiration of the mandatory retention periods, physical materials are shredded in compliance with data disposal standards.

6. Conditions for Granting and Withdrawing Consent (Article 7 GDPR)

Where processing is based on the consent of the data subject, the Controller guarantees compliance with the following requirements:

Consent is given freely, specifically, informedly, and by an unambiguous indication of wishes.
Requests for consent are presented in an intelligible and easily accessible form, using clear and plain language, distinct from other contractual terms.
Right to Withdraw Consent at Any Time: the data subject has the right to withdraw consent at any time as easily as it was given (for instance by sending an email to the Controller). Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

7. Special Categories of Data and Protection of Minors

Special Categories of Personal Data (Art. 9 GDPR): The company does not process sensitive personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data for unique identification, or data concerning health or sex life. The only exceptions are strictly statutory employment law and social security requirements (such as sick leave certificates or occupational health assessments).

Information Society Services and Child Consent (Art. 8 GDPR): Services provided by EMMA International s.r.o. are not directed at children under the age of 16. Should the processing of personal data of a child under 16 occur on the basis of consent, such consent is lawful only if and to the extent given or authorized by the holder of parental responsibility over the child.

8. Rights of Data Subjects (Chapter 3 GDPR)

Data subjects enjoy the following guaranteed statutory rights regarding their personal data, which they may exercise free of charge with the Controller:

Overview of Data Subject Rights

Right of Access (Art. 15 GDPR): the right to obtain confirmation as to whether or not personal data concerning them is being processed, and where that is the case, access to the personal data along with information on purposes, categories, recipients, and retention periods.
Right to Rectification (Art. 16 GDPR): the right to obtain without undue delay the rectification of inaccurate personal data or completion of incomplete personal data.
Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR): the right to obtain the erasure of personal data without undue delay when data is no longer necessary for the original purposes, consent has been withdrawn, an objection is lodged, or data was unlawfully processed (unless processing is necessary for compliance with a legal obligation or the establishment, exercise, or defense of legal claims).
Right to Restriction of Processing (Art. 18 GDPR): the right to obtain restriction of processing where the accuracy of the personal data is contested, the processing is unlawful, or an objection is pending verification.
Right to Data Portability (Art. 20 GDPR): the right to receive personal data provided on the basis of consent or contract in a structured, commonly used, and machine-readable format and transmit it to another controller.
Right to Object (Art. 21 GDPR): the right to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, including profiling and direct marketing.
Automated Decision-Making and Profiling (Art. 22 GDPR): the right not to be subject to a decision based solely on automated processing which produces legal effects. MAP4Y diagnostic assessments are always evaluated and interpreted by qualified humans – certified experts, consultants, or executive coaches.

Exercising Your Rights

How to Submit a Request?

You may exercise your rights in writing at our registered office address or electronically by sending an email to ponuky@emmainternational.eu.

The Controller shall handle your request without undue delay and at the latest within one month of receipt. In complex cases, this period may be extended by two further months, of which you will be informed in advance.

If you believe that the processing of your personal data infringes applicable data protection regulations, you have the right to lodge a complaint with a supervisory authority – in particular the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).

9. Controller Responsibilities and Processors

EMMA International s.r.o. engages only processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of data subjects.

Processing by a processor is governed by a binding written contract under Article 28 of the GDPR. We identify the following categories of partners and processors:

IT & Hosting Partners: providers of web hosting services, server administration, secure cloud repositories, and enterprise applications.
Accounting and Payroll Services: external tax, payroll, and bookkeeping consultants bound by statutory and contractual confidentiality.
Postal and Courier Services: delivery partners ensuring safe transit of training materials, certificates, and physical correspondence.
Project Partners and Auditors: certified bodies participating in project implementation reviews and grant fund verifications (strictly within the scope required by grant agreements).

10. Records of Processing Activities and Security Incidents

Records of Processing Activities (Art. 30 GDPR): The company maintains written and electronic records of processing activities under its responsibility and makes them available to the supervisory authority upon request. Records include processing purposes, descriptions of categories of data subjects and personal data, categories of recipients, retention time limits, and general descriptions of technical and organizational security measures.

Employee Instruction and Authorization: Any person acting under the authority of the Controller who has access to personal data processes such data strictly on documented instructions from the Controller.

Personal Data Breach Notification (Arts. 33 & 34 GDPR): In the event of a personal data breach, the Controller notifies the competent supervisory authority (ÚOOÚ SR) without undue delay and, where feasible, not later than 72 hours after becoming aware of it. When the breach is likely to result in a high risk to the rights and freedoms of natural persons, the Controller promptly communicates the breach to the affected data subjects and undertakes immediate remediating safeguards.

11. Data Protection Impact Assessment (DPIA), DPO and International Transfers

Data Protection Impact Assessment (DPIA, Art. 35 GDPR): The processing activities of the company do not involve systematic and extensive evaluations of personal aspects based on automated decision-making, large-scale processing of special categories of data, or systematic monitoring of publicly accessible areas. A formal DPIA is therefore not required.
Data Protection Officer (DPO, Art. 37 GDPR): The company is not a public authority or body, nor do its core activities consist of processing operations that require regular and systematic monitoring of data subjects on a large scale. The company is therefore not obligated to designate a Data Protection Officer. Data protection matters are directly managed by the statutory representative of the Controller.
Transfers of Data to Third Countries (Chapter V GDPR): Personal data is primarily processed within the territory of the Slovak Republic and member states of the European Union / European Economic Area. Any cross-border transfer to third countries occurs exclusively to jurisdictions with an adequacy decision from the European Commission or based on Standard Contractual Clauses (SCC) ensuring enforceable data subject rights.

12. Confidentiality and Proportionality Test

Confidentiality (§ 79 of Slovak Act No. 18/2018 Coll.): EMMA International s.r.o. and all natural persons who come into contact with personal data at the Controller or Processor are legally bound to maintain strict confidentiality regarding personal data. This duty of confidentiality persists indefinitely, even after termination of employment, civil service, or contractual collaboration.

Proportionality Test for Legitimate Interests: Where the legal basis for processing is the legitimate interest pursued by the Controller (Art. 6(1)(f) GDPR), the Controller performs a three-part balancing test (purpose test, necessity test, and balancing test). Processing on this ground is permissible only where legitimate organizational interests override the fundamental rights and freedoms of the data subjects.

This organizational directive entered into force and took effect on the date of its issuance by the executive management of EMMA International s.r.o. and is regularly reviewed and updated.

Organizational Directive on Personal Data Protection