Personal Data Processing Policy – Parking facilities

(INFORMATION ON THE PROCESSING OF PERSONAL DATA)

For Saba Parking SK s.r.o., it is extremely important to provide you transparently with all relevant information concerning the processing of your personal data. For this purpose, we have prepared an overview of the most important information which you have the right to be informed about.

1. Data controller

The controller processing your personal data is Saba Parking SK s.r.o., with its registered office at Grösslingova 4, Bratislava 811 09, Slovak Republic, Company ID No.: 35 844 256 (hereinafter referred to as “Saba Parking SK s.r.o.” or “we”). As the controller, Saba Parking SK s.r.o. determines the purposes and means of processing personal data, which in practice means that it decides how your personal data will be processed within the frameworks set out below.

Contact details

1.1 Saba Parking SK s.r.o. as a Processor

Saba Parking SK s.r.o. processes personal data at all parking facilities and garages exclusively as a controller (i.e. it independently determines the legitimate purpose, scope, manner and retention period of the processing), with the following exceptions:

• the garage located in the AUPARK shopping centre at Einsteinova 3541/18, 851 01 Bratislava – Petržalka district, where the controller is AUPARK, a.s., with its registered office at Einsteinova 18, 851 01 Bratislava, Slovak Republic, Company ID No.: 47 240 377 (hereinafter “AUPARK, a.s.”). Pursuant to the data processing agreement concluded with AUPARK, a.s., Saba Parking SK s.r.o. is authorised to process personal data from the CCTV system solely to the extent of viewing such data for the purpose of monitoring the operation of the parking facility;

• the garage located in the CITY ARENA TRNAVA shopping centre at Kollárova 20, 917 01 Trnava, where the controller is City-Arena PLUS a.s., with its registered office at Kollárova 20, Trnava 917 01, Slovak Republic, Company ID No.: 47 009 616 (hereinafter “City-Arena PLUS a.s.”). Pursuant to the data processing agreement concluded with City-Arena PLUS a.s., Saba Parking SK s.r.o. is authorised to process personal data from the CCTV system solely to the extent of viewing such data for the purpose of monitoring the operation of the parking facility;

• (i) the parking facility located at Antolská 11, 851 07 Bratislava – St. Cyril and Methodius Hospital, and (ii) the parking facility located at Ružinovská 4810/6, 821 01 Bratislava, UNB – Ružinov Hospital, where the controller is ZIPP-S, s.r.o., with its registered office at Slávičie údolie 31, 811 02 Bratislava, Slovak Republic, Company ID No.: 35 693 568 (hereinafter “ZIPP-S, s.r.o.”). Pursuant to the data processing agreement concluded with ZIPP-S, s.r.o., Saba Parking SK s.r.o. is authorised to process personal data from the CCTV system solely to the extent of viewing such data for the purpose of monitoring the operation of the parking facilities;

• the garage located in the MAMUT premises at Cintorínska 32, 811 08 Bratislava, where the controller is MAMUT s.r.o., with its registered office at Cintorínska 32, 811 08 Bratislava, Slovak Republic, Company ID No.: 31 336 09 (hereinafter “MAMUT s.r.o.”). Pursuant to the data processing agreement concluded with MAMUT s.r.o., Saba Parking SK s.r.o. is authorised to process personal data from the CCTV system solely to the extent of viewing such data for the purpose of monitoring the operation of the parking facility;

• the IPP PARK-HRAD garage located at Námestie Alexandra Dubčeka, 811 01 Bratislava, where the controller is IPP Services, s. r. o., with its registered office at Slávičie údolie 31, 811 02 Bratislava, Slovak Republic, Company ID No.: 44 140 215 (hereinafter “IPP Services, s. r. o.”). Pursuant to the data processing agreement concluded with IPP Services, s. r. o., Saba Parking SK s.r.o. is authorised to process personal data from the CCTV system solely to the extent of viewing such data for the purpose of monitoring the operation of the parking facility.

2. Personal data processed by the CCTV system

Saba Parking SK s.r.o. processes your personal data as a data subject who has decided to use parking services at parking facilities operated by Saba Parking SK s.r.o. A list of parking facilities and garages operated by Saba Parking SK s.r.o. can be found at: https://www.sabaparking.com/sk/web/sk/locate-your-parking.

CCTV monitoring is installed at parking facilities where parking systems managed by our company are installed. CCTV devices may record your image and behaviour or performance of activities within the parking facilities, as well as vehicle registration numbers when entering and leaving parking facilities or garages.

Only employees who have been given written instructions by Saba Parking SK s.r.o. pursuant to Sections 36 and 39(4) of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (the “Personal Data Protection Act”) are authorised to process personal data from the CCTV system.

2.1 Exclusion of the processing of biometric data

Saba Parking SK s.r.o. points out that the CCTV system at the parking facilities does not process biometric data within the meaning of Section 5(c) of the Personal Data Protection Act and therefore does not involve “personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person which allow or confirm the unique identification of that natural person”. The CCTV system at the parking facilities does not use technology that would enable processing operations involving biometric data resulting in the unique identification of a natural person. CCTV recordings are used exclusively in a manner that does not result in any disadvantage based on the specific characteristics of the data subject.

For example, Saba Parking SK s.r.o. identifies a recording in which a person is caught committing a criminal offence irrespective of that person's nationality, race, ethnicity, religion, health condition or biometric characteristics. Processing of sensitive data could be described as cases where certain biometric characteristics of the data subject were stored or processed (facial features, biometric characteristics of gait, human face identification/facial recognition systems, etc.).

3. Legitimate (lawful) purposes and legal bases for processing personal data

The legal basis for processing is Section 13(1)(f) of the Personal Data Protection Act and Act No. 301/2005 Coll., the Code of Criminal Procedure.

The legitimate purpose of Saba Parking SK s.r.o. when processing personal data through the CCTV system is to ensure the protection of property, public order and the health of persons moving within parking facilities, to detect crime, and to continuously monitor the parking system and traffic within parking facilities and garages.

4. Retention period of personal data

Saba Parking SK s.r.o. stores personal data (visual recordings) from the CCTV system on the relevant server and automatically deletes them no later than within 3 days from the day following the day on which the recording was made, unless a specific law provides otherwise, except where the recording is used as evidence by law enforcement authorities or administrative authorities in proceedings concerning an offence.

5. Recipients of personal data

Personal data obtained from the CCTV system may be provided to:

• entities to which Saba Parking SK s.r.o. is legally obliged to provide CCTV recordings, in particular law enforcement authorities and administrative authorities conducting offence proceedings;

• the data subject or, where applicable, their legal representative, but only indirectly on the basis of a request addressed to the law enforcement authorities or administrative authorities conducting offence proceedings;

• the CCTV system supplier.

6. Processors

Saba Parking SK s.r.o. does not have a processor that would process personal data on its behalf and under the conditions specified in a data processing agreement in connection with the CCTV system.

7. Automated decision-making, including profiling

No automated decision-making, including profiling, is carried out as part of the processing of personal data.

8. Transfer of personal data to a third country or international organisation

Within the territory of the EU Member States, the free movement of personal data applies. Personal data are not transferred to a third country outside the EU or to an international organisation.

9. Rights of the data subject

9.A Right of access to personal data

The data subject has the right to obtain from the controller confirmation as to whether personal data concerning them are being processed and, if so, has the right to access those personal data and the following information:

• the purposes of the processing of personal data;

• the name of the relevant category of personal data, as well as whether these are special categories of personal data, data concerning children and/or data relating to convictions for criminal offences and misdemeanours;

• the recipients or categories of recipients, in particular recipients in countries outside the European Union and/or international organisations;

• the envisaged period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;

• the existence and scope of the right to rectification, erasure and restriction of processing of personal data, as well as the right to object set out below;

• the right to lodge a complaint with a supervisory authority;

• the existence of automated decisionmaking and, in such cases, meaningful information about the procedure used, as well as the significance and envisaged consequences of such processing for the data subject;

• appropriate safeguards where personal data are transferred to countries outside the European Union and/or to an international organisation.

The controller shall provide the data subject with a copy of the personal data being processed in relation to that person. For any further copies requested by the data subject, the controller may charge a reasonable fee corresponding to administrative costs. If the data subject submits a request electronically, the information shall be provided in a commonly used electronic form unless the data subject requests another method; where providing the information incurs material costs for the controller, the controller may charge a reasonable fee corresponding to such appropriately incurred material costs.

9.B Right to rectification of personal data

Every data subject has the right to have the controller rectify, without undue delay, personal data concerning them. Having regard to the purposes of processing personal data, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

At the request of the data subject, the controller shall inform the data subject that the relevant personal data have been rectified by issuing a confirmation of rectification and, where appropriate, shall notify the recipients of the relevant personal data in the appropriate manner, unless this proves impossible or involves disproportionate effort.

9.C Right to erasure of personal data (right to be forgotten)

The data subject has the right to request the controller, without undue delay, to erase personal data concerning them, and the controller is obliged to erase such data without undue delay where one of the following grounds applies:

• the relevant personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

• the data subject withdraws their consent to the processing of such personal data and there is no other legal basis for the processing;

• the data subject has exercised the right to object set out below in accordance with the provisions of the GDPR, Act No. 18/2018 Coll. on the Protection of Personal Data and the personal data protection policy, and there are no overriding legitimate grounds for processing the personal data;

• the personal data have been processed unlawfully;

• the personal data must be erased to comply with a legal obligation under generally binding legal regulations to which the controller is subject;

• the personal data were collected in connection with the offer of information society services to a child.

Where the controller has made personal data public and is obliged to erase them, taking account of available technology and the cost of implementation, the controller shall take reasonable measures, including technical measures, to inform controllers processing such personal data that the data subject has requested the erasure of any links to, or copies or replications of, those personal data.

The controller is not obliged to erase personal data where their processing is necessary:

• for exercising the right to freedom of expression and information;

• for compliance with a legal obligation requiring processing under generally binding legal regulations, and/or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

• for scientific, historical or statistical purposes subject to appropriate safeguards, for archiving purposes in the public interest, or where providing such information is likely to make it impossible or seriously impair the achievement of the objectives of processing for such purposes; or

• for the establishment, exercise or defence of legal claims.

The controller shall, without undue delay, inform the data subject of the erasure of the relevant personal data by issuing a confirmation of erasure.

9.D Right to restriction of processing of personal data

The data subject has the right to obtain restriction of processing of personal data where one of the following applies:

• the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;

• the processing of personal data is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the controller no longer needs the personal data for the purposes of processing, but the data subject needs them for the establishment, exercise or defence of legal claims; and/or

• the data subject has exercised the right to object set out below, pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Where processing of personal data has been restricted, such personal data may, with the exception of storage, be processed only with the consent of the relevant data subject or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person and/or for reasons of important public interest of the European Union or its Member State.

The controller shall inform the data subject that the restriction of processing is to be lifted before the restriction is lifted, by issuing a confirmation of the restriction of processing.

9.E Right to data portability

The data subject has the right to receive personal data concerning them which they have provided to the controller in a structured, commonly used and machine-readable format and has the right to transmit those personal data to another controller without hindrance from the controller to whom the personal data were provided, where:

• the processing of personal data is based on the data subject's consent, or is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract; and/or

• the processing is carried out by automated means.

When exercising the right to data portability, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of the right to data portability does not affect the right to erasure of personal data (right to be forgotten). The right to data portability must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The controller shall inform the data subject that the personal data have been transferred by issuing a confirmation of the transfer.

9.F Right to withdraw consent to the processing of personal data

The data subject has the right to withdraw their consent to the processing of personal data at any time, and such withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.

9.G Right to object

The data subject has the right, at any time and on grounds relating to their particular situation, to object to the processing of personal data concerning them which is carried out:

• for the performance of a task carried out in the public interest and/or in the exercise of official authority vested in the controller under the relevant generally binding legal regulations; and/or

• for the purposes of the legitimate interests pursued by the controller and/or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child,

including objection to profiling based on those provisions.

The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to such processing, including profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

In connection with the use of information society services, the data subject may exercise their right to object by automated means using technical specifications.

Where personal data are processed for scientific, historical or statistical purposes subject to appropriate safeguards, or for archiving purposes in the public interest, the data subject has the right, on grounds relating to their particular situation, to object to processing concerning them, except where processing is necessary for the performance of a task carried out for reasons of public interest.

9.H Rights relating to automated decision-making

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, unless one of the following applies:

• the automated decision-making is demonstrably necessary for entering into or performing a contract between the data subject and the controller;

• the automated decision-making is demonstrably authorised by generally binding legal regulations to which the controller is subject and which also lay down suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject; or

• the automated decision-making is demonstrably based on the data subject's explicit consent.

Where automated decision-making is demonstrably necessary for entering into or performing a contract between the data subject and the controller and/or is based on the data subject's explicit consent, the controller shall implement suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject, including at least:

• the right to obtain human intervention on the part of the controller;

• the right to express their point of view; and

• the right to contest the decision resulting from automated decision-making.

Automated decision-making based on special categories of personal data is prohibited, including where it is demonstrably necessary for entering into or performing a contract between the data subject and the controller and/or is based on the data subject's explicit consent, except where:

• the data subject has given explicit consent to automated decision-making concerning any special category of personal data; and/or

• automated decision-making concerning the relevant special category of personal data is necessary for reasons of substantial public interest, on the basis of generally binding legal regulations, provided that such reasons are proportionate to the objective pursued, respect the principles and essence of data protection and provide suitable and specific measures to safeguard the fundamental rights and interests of the data subject.

9.I Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement of data protection, if they consider that the processing of personal data concerning them infringes the GDPR. The data subject also has the right to an effective judicial remedy under the relevant generally binding legal regulations if they consider that their rights have been infringed as a result of the processing of personal data concerning them in violation of the GDPR and/or Act No. 18/2018 Coll. on the Protection of Personal Data.

The supervisory authority for the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic. The procedure for proceedings concerning personal data protection is governed by Sections 99 et seq. of Act No. 18/2018 Coll. on the Protection of Personal Data.