Spoločnosť Ci investment, s.r.o. ako Prevádzkovateľ spracúva o Vás osobné údaje v rámci viacerých účelov spracovania, ktoré sú nižšie uvedené. V prvom rade by sme Vám však chceli objasniť, čo sa rozumie pod pojmom „osobný údaj“ v podmienkach týkajúcich sa našej spoločnosti.
Personal data
Personal data is data relating to an identified or identifiable natural person who can be identified directly or indirectly, in particular data provided by clients and/or potential clients in their capacity as a requestor for the provision of a particular service/contract (hereinafter referred to as "client"), personal data processed for the purpose of contacting you with new product and service offers, however, personal data may also be your data that you have provided to us when giving your consent to the processing of your personal data or that we process in the performance of our legal obligations (i.e. in particular identification, contact, biometric personal data, data necessary for the verification of your identity, etc.).
Purposes, legal basis for processing, retention period and recipients of personal data
1. Information on the processing of personal data for the purpose of establishing and verifying the identity of the client, preventing fraud and fulfilling other obligations pursuant to Act No. 297/2008 Coll. on the Protection against the Legalization of the Proceeds from Crime and on the Protection against the Financing of Terrorism
Within the scope of this purpose, we process personal data about you for the purpose of fulfilling our legal obligation under Act No. 297/2008 Coll. on the Protection against the Legalization of the Proceeds from Crime and on the Protection against the Financing of Terrorism, as amended, and thus in accordance with Art. 6(1)(c) of the Regulation. The Act in question sets out exactly what data we must verify about you before a transaction is concluded. For this purpose, we also process personal data about you on the legal basis of legitimate interest in accordance with Art. 6(1)(f) of the Regulation, our legitimate interest being the protection of our company's legitimate interests and the interests and property of our clients.
We process this data about you in accordance with Section 19 of the aforementioned Act for a period of 5 years from the end of the contractual relationship with the client, the data and written documents obtained in the course of due diligence for a period of 5 years from the execution of the transaction, or longer than five years if requested in writing by the financial intelligence unit; the financial intelligence unit shall specify in the request the period, which may not exceed a further five years, and the scope of the retention of the data and written documents.
For this purpose, we also process so-called biometric data about you for the purpose of verifying your identity (this is personal data which is the result of specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person and which enables or confirms the unique identification of that natural person), namely. biometric characteristics of your face based on a photograph of your face taken by you and an image-sound recording of the identification process for the purpose of establishing and verifying identity, preventing fraud and fulfilling other obligations under Act No. 297/2008 Coll. on the Protection against the Legalization of the Proceeds from Crime and on the Protection against the Financing of Terrorism, whereby the personal data thus obtained will be compared with the personal data provided by you (first name, surname, identity document number, date of birth) and the documents taken and sent by you, in particular the photograph of your face on the identity document, through Veriff OÜ as an intermediary.
We inform you that biometric data are classified as special category personal data and we process them only on the legal basis of your consent in accordance with Art. 9(2)(a) and Article 6(1)(a) of the Regulation. We consider the processing of this category of personal data to be necessary to ensure an adequate level of security for the unambiguous identification of the data subject in cases where it is not possible to sufficiently ensure the identification and verification of the identity of the client in accordance with the requirements of Act No. 297/2008 Coll. on the Protection against the Legalization of the Proceeds from Crime and on the Protection against the Financing of Terrorism, and thus where a distance contract is concluded. Giving this consent is voluntary and if you do not agree with the processing of your biometric data, you have the possibility to use other ways of establishing and verifying your identity for the purpose of concluding a contract, which are the verification of your identity through electronic communication using video-call, which will not be recorded.
Tieto osobné údaje budeme o Vás spracúvať po dobu trvania zmluvného vzťahu s našou spoločnosťou a v prípade, ak nedôjde k uzavretiu zmluvy s Prevádzkovateľom, po dobu 12 mesiacov od jeho udelenia. Viac informácií o spracovaní osobných údajov v rámci procesu identifikácie a verifikácie osôb prostredníctvom spoločnosti Veriff nájdete na stránke spoločnosti Veriff, časti Veriff´s Privacy Policy).
2. Information on the processing of personal data for the purpose of registration in Invest Club
For this purpose, we process personal data about you that is necessary for registration in Invest Club and the associated enjoyment of certain benefits (email address). We process your personal data on the legal basis of your consent in accordance with Art. 6(1)(a) of the Regulation, which you can revoke at any time by sending it to the address of our registered office or by e-mail to the address of our responsible person. However, in this case, you must also note that the withdrawal of consent does not affect the lawfulness of the processing based on the consent prior to its withdrawal. We will retain your personal data for the duration of your registration with Invest Club, up to a maximum of 5 years from the date of consent.
3. Information on the processing of personal data for the purpose of concluding, performing and administering the contract
We process your personal data for the purpose of concluding, executing and administering the contract on the legal basis of Art. 6(1)(b) of the Regulation, as this is processing which is necessary for the performance of the Investment Agency Framework Agreement which you have concluded with us and the subsequent investment order. We retain your personal data under this processing purpose for a period of 10 years from the date of termination of the contracts or the execution of the contractual documents to which it relates. Within this purpose, we also process your personal data in connection with the maintenance of your online investor account to which you have gained access by concluding the Investment Agency Framework Agreement.
4. Information on the processing of personal data for the purpose of marketing to investors or potential investors
MARKETING OUTREACH WITHOUT THE CONSENT OF THE DATA SUBJECT
Clients (investors) of our company are contacted with the current offer of our investment products via e-mail. For this purpose, we process the personal data of our clients without their consent, on the basis of so-called legitimate interest in accordance with Art. 6(1)(f) of the Regulation. Our legitimate interest in this case is the promotion of our products, and for this purpose we use your contact details that you have provided to us in connection with your participation in the implementation of investment plans. We retain your personal data for this purpose for a maximum period of 5 years from the date of termination of the contractual relationship with us as Controller.
MARKETING OUTREACH BASED ON THE CONSENT OF THE DATA SUBJECT
If you are not yet a client - investor of our company, i.e. you have never used our product or services, but you are interested in being informed about our current investment plans (products), you can ask us to send you promotional offers. In this case, however, we will require your consent to the processing of your personal data. You grant us such consent for a period of 5 years from the date of its provision. However, you may revoke this consent at any time by written request delivered by post or through our office, by email or by telephone. Please note, however, that withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
5. Information on the processing of personal data for the purpose of registry management
Under Act No. 3952002 Coll. on archives and registers and on the amendment of certain acts as amended, we are obliged to keep records of the registers arising from our activities. For this purpose, we process correspondence data about you if you send correspondence to us or we send correspondence to you. The legal basis for the processing of your personal data for this purpose is therefore the aforementioned law in accordance with Art. 6(1)(c) of the Regulation. We keep this correspondence in our company for a period of 10 years.
6. Information in relation to the personal data we process about you for the purpose of registering and handling litigation and related enforcement or insolvency proceedings
In the event that, as a result of your non-performance of contractual obligations, our company is forced to enforce its claims in court and subsequently in enforcement proceedings, or to register its claim in bankruptcy proceedings, we must process personal data about you to the extent necessary for the enforcement of our claims. For these purposes, however, we process only the usual category of your personal data on the basis of Act No. 160/2015 Coll. on Civil Procedure Code as amended, Act No. 233/1995 Coll. on the Execution Code as amended, Act No. 7/2005 Coll. on Bankruptcy and Restructuring as amended, i.e. in accordance with Art. 6(1)(c) of the Regulation. We then keep this data about you for 10 years after the final conclusion of the proceedings.
7. Information on the processing of personal data for the purpose of processing and handling requests made electronically/by telephone
EMAIL/PHONE CALL/CHAT
If you contact us with your request or question or suggestion via e-mail, telephone call or directly on our website via chat (instant message), in which you provide us with your personal data, we will process this personal data confidentially for the sole purpose of dealing with your request. Your e-mail address is only considered personal data if it is not general and you are identifiable on the basis of it, in particular in relation to your first and last name.
THE PURPOSE OF THE PROCESSING OF PERSONAL DATA
The purpose of the processing of this personal data is to process and evaluate your request sent via chat on our website, via email or communicated during a telephone call, which may include pre-contractual communication for the purpose of concluding the Investment Mediation Framework Agreement or may include other information you request from us or the performance of a legal transaction in the context of the performance of a contract.
LEGAL BASIS FOR PROCESSING PERSONAL DATA
In this context, the legal basis for the processing of your personal data may therefore be either Art. 6(1)(b) of the Regulation (if necessary for the performance of a contract or in the context of a so-called pre-contractual relationship) or Art. 6(1)(f) of the Regulation, i.e. the legitimate interest of our company, if you ask us to provide information without further interest in entering into a contractual relationship with our company, where our legitimate interest is in answering your questions and providing you with the requested information and, if necessary, the requested information material, thereby contributing to your satisfaction.
HOW LONG WE PROCESS AND STORE YOUR PERSONAL DATA
We will process your personal data provided in this way for the duration of the processing of the request for the purpose of contacting you back, after which the personal data will be destroyed. If the communication with our company was intended for the performance of an already concluded contract or for information about an already concluded contract, if such data is in written form, it is further stored together with the contractual documentation.
8. Information on the processing of personal data for the purpose of registering and handling complaints
For this purpose, we process personal data about you if you have made a claim for services provided by us. We process this personal data for the purpose of fulfilling our legal obligations pursuant to Act No. 40/1964 Coll. of the Civil Code and Act No. 250/2007 Coll. on Consumer Protection, as amended, and the legal basis for the processing of this personal data is the aforementioned laws. We will process your personal data for as long as the supervisory authority may initiate proceedings for the imposition of a sanction in the event of a breach of the provisions of the Consumer Protection Act, and for the duration of these proceedings until their final conclusion in accordance with Section 24 of Act No. 250/2007 Coll. on Consumer Protection, as amended.
9. Information on the processing of personal data for the purpose of recording the rights exercised by data subjects
If you exercise your rights as a data subject, i.e. a person about whom we process personal data, we keep a record of this, as we record your enquiry and also record our responses to the questions or requests sent by you, on the basis of Art. 15, 16, 17, 18 , 20, 21 and 22 of the Regulation. Within this purpose, we process all categories of personal data about you for a period of 5 years.
A LIST OF BENEFICIARIES UNDER THE ABOVE PURPOSES
Our company processes your personal data mainly through its employees, who are bound by a duty of confidentiality and may only process your personal data to the extent and in the manner necessary for the performance of their duties. However, in order to achieve the purposes of the processing set out above, it may be necessary for us to provide your personal data to other persons.
The recipient is, within the meaning of the Regulation, the natural or legal person, public authority, agency or other body to whom the personal data are disclosed, whether or not it is a third party. The legal basis for disclosing your personal data to recipients may be a legal obligation, your consent, a written instruction, necessity for the performance of a contract and the legitimate interest of our company or a third party.
Depending on the circumstances of your relationship with our company, the recipients of your personal data may be:
Our company uses third parties to provide services, which may include the processing of personal data on our behalf and for the purpose and in the manner specified by us. Your consent is not required for the provision of personal data to processors; however, in this case we are responsible for the choice of processor and for the protection of the rights of data subjects. A list of our intermediaries is available here.
We inform you in relation to all of the above purposes of processing your personal data that, pursuant to Art. 4(9) of the Regulation, public authorities which may receive personal data in the context of a specific enquiry in accordance with Union or Member State law are not regarded as recipients. Nevertheless, we inform you that in the exercise of our investigative powers, we are obliged to provide or make available your personal data to law enforcement authorities, courts, or authorities dealing with offences, the Office for Personal Data Protection of the Slovak Republic, the Office for Electronic Communications and Postal Services Regulation, the National Bank of Slovakia, or other public authorities, if they ask us to provide such data in accordance with national law or in accordance with Union law.
CROSS-BORDER TRANSFER OF PERSONAL DATA
We also inform you that the transfer of your personal data to a third country (outside the EU) or to an international organisation occurs in connection with the storage of some of your data, in connection with the electronic verification of your identity and in connection with the sending of SMS messages. In cases where we transfer personal data to third countries, we do so only on the basis of an EU Commission adequacy decision or by requiring the fulfilment of other safeguards for the protection of personal data (e.g. the conclusion of so-called standard contractual clauses or the adoption of contractual clauses between the Data Controller and the Processor) in accordance with Art. 46 of the Regulation.
