INFORMATION MEMORANDUM ON PERSONAL DATA PROTECTION

What are personal data and why do we process them?

“Personal data” means any information relating to an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. We process only those personal data that are necessary to achieve a specific purpose of processing. Personal data are always processed for a legitimate purpose specified in advance that could not be achieved without such processing.

Claims Collection, s. r. o., with its registered office at Národná 16A, 010 01 Žilina, Slovak Republic, Company ID (IČO): 51 875 101 (hereinafter “Claims Collection”), is, within the meaning of Article 4(7) GDPR, the controller of its own information system in which it processes data on legal persons and personal data of natural persons in accordance with the legal basis and for the purposes set out in this Memorandum.

In our company, we process your personal data exclusively on the basis of:

• consent, in accordance with Article 6(1)(a) GDPR, where the data subject has given consent to such processing of his or her personal data,
• performance of a contract, in accordance with Article 6(1)(b) GDPR, under which processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract,
• legal obligation, in accordance with Article 6(1)(c) GDPR, under which processing is necessary for compliance with a legal obligation to which the controller is subject,
• legitimate interest, in accordance with Article 6(1)(f) GDPR, under which processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

Your personal data are always processed only for a legitimate purpose specified in advance, and there must always be an appropriate legal basis for such processing. We hereby assure you that your personal data are never further processed for purposes incompatible with the purposes originally specified.

What is the purpose of processing my personal data?

The purposes of processing the personal data of data subjects are (i) identification of clients, (ii) entering into contractual relationships with clients, including pre-contractual relationships, (iii) management of contractual relationships, including their amendment and termination, (iv) identification of debtors with regard to the legal relationships arising between debtors and clients, (v) contacting debtors for the purpose of enforcing legal claims, (vi) taking legal steps to enforce legal claims, (vii) handling inquiries submitted through the contact form on the website, (viii) sending the newsletter if you have subscribed to it, and (ix) demonstrating your consent to the use of cookies on the website.

Contact form on the website

If you send us an inquiry through the contact form on the website claimscollection.eu, we process the data you enter in it, in particular (i) the company name or your name, (ii) email address, (iii) telephone number, (iv) subject, (v) the debtor’s Company ID (IČO) or other identifier, (vi) the amount and currency of the claim, (vii) a description of the facts and (viii) attachments. We use the data to reply to you, assess the claim and prepare an offer for you. The legal basis is Article 6(1)(b) GDPR, i.e. taking steps at your request prior to entering into a contract. We process the debtor’s data that you enter in the form on the basis of our legitimate interest in assessing and recovering the claim under Article 6(1)(f) GDPR.

The inquiry is stored in the database of our website and is also sent to us by email. To protect the form against misuse, we also process the IP address from which the inquiry was sent. The section “How long do you keep my personal data?” sets out the retention period.

Do you also use my data for marketing purposes?

For the purpose of informing you about services, innovations and special offers provided by our company, and in connection with obtaining benefits from Claims Collection, we process your personal data on the legal basis of your prior, freely given consent or on the basis of legitimate interests under Article 6(1)(f) GDPR.

Our company has a legitimate interest in taking care of its clients and developing business relationships with them, and thus in informing them about its services or special offers. In this context, we may contact you even without your prior consent; we will inform you of such processing of your personal data and of your rights, in particular the right to object to the processing of your personal data. This, of course, does not apply if you have expressed your disagreement with such contact or if you object to it.

For the above purpose, we may communicate with you by telephone, email, SMS or other means of distance communication.

In order to tailor our offer of services to you, we evaluate the information we process about you so that you can be provided with a targeted offer and the sending of untargeted marketing offers is limited.

Newsletter

We send you the newsletter only with your consent under Article 6(1)(a) GDPR and § 116(3) of Act No. 452/2021 Coll. on Electronic Communications, as amended. After you enter your email address on the website, we will send you an email with a link to confirm your subscription. The subscription starts only after you confirm it.

You may withdraw your consent at any time by using the unsubscribe link included in every newsletter or by email to office@claimscollection.eu. We will confirm the withdrawal to you and will no longer send you the newsletter. We retain the record of your consent and its withdrawal (your email address and the time of subscription, confirmation and unsubscription, your IP address without its last part and the page on which you subscribed) even after you withdraw your consent, as required by § 116(5) and (6) of Act No. 452/2021 Coll. The legal basis is Article 6(1)(c) GDPR. The section “How long do you keep my personal data?” sets out the retention period.

Cookies on the website and server logs

We always use necessary cookies; we use analytics and advertising cookies only with your consent. We store a record of your consent (the time, the selected categories, the language, the version of the cookie banner text and your IP address without its last part) so that we are able to demonstrate the consent. We retain the record on the basis of our legitimate interest under Article 6(1)(f) GDPR. Further details can be found in our Cookie Policy.

Each time you visit the website, the server records your IP address, the time and the page visited. We use these logs only to secure and operate the website, on the basis of our legitimate interest under Article 6(1)(f) GDPR. The section “How long do you keep my personal data?” sets out the retention period.

To whom may my personal data be disclosed?

We do not disclose your personal data to other entities except where you have given our company your consent or written instruction to do so, or where there is another legal basis for disclosing your personal data to another entity, for example where our company, as the controller, is complying with a legal obligation.

In operating the website, email and our information system, we are assisted by processors, in particular the server provider, the website administrator and Google, whose Google Drive service we use to store encrypted backups of the website. They process personal data only on our behalf and in accordance with our instructions. Data from analytics and advertising cookies are obtained, after you give your consent, by Google Ireland Limited; further details can be found in our Cookie Policy.

Are my personal data transferred to third countries?

We do not transfer your personal data to third countries within the meaning of the GDPR, with two exceptions, namely (i) if you consent to analytics or advertising cookies, the data from them may be transferred to Google LLC in the USA, and (ii) we store encrypted backups of the website in the Google Drive service provided by Google. Google LLC participates in the EU-U.S. Data Privacy Framework, in respect of which the European Commission decided, by Implementing Decision (EU) 2023/1795 of 10 July 2023, that it ensures an adequate level of protection of personal data.

We consider the protection of your personal data to be our priority and, for this reason, we would not risk the loss of our integrity by transferring your personal data to countries that do not provide the same or a similar level of security and protection of personal data as the Slovak Republic.

How long do you keep my personal data?

We keep your personal data in a form that permits your identification for no longer than is necessary for the purposes for which the personal data are processed. If your personal data are processed on the basis of your consent, after the consent has been withdrawn or has expired, such personal data will be kept only for as long as is necessary for the establishment, exercise or defense of legal claims. The same procedure applies to the processing of your personal data on a contractual basis.

If your personal data are processed in order to comply with a legal obligation, the applicable legislation specifies the period during which we are required to keep your personal data and related documentation.

The retention periods for individual categories of data are summarized in the table below. Retention periods for cookies are also set out in more detail in our Cookie Policy. The same periods also apply to backups containing such data. We delete backups after 30 days.

We keep the data of clients and debtors for 11 years after the contract and the recovery have ended because claims for damage caused intentionally and claims arising from intentional unjust enrichment become time-barred after 10 years at the latest, and a court may serve on us an action filed on the last day of that period even several months later. During this period, we need the data for the establishment, exercise or defense of legal claims.

How do you protect my personal data?

We take appropriate technical and organizational measures to protect your personal data against intentional or negligent erasure, loss or alteration and against unauthorized disclosure. Employees of our company, as well as our contractual partners who process personal data on our behalf, are bound by a duty of confidentiality, which continues even after the termination of the contractual relationship.

What are my rights in relation to the processing of personal data?

In relation to the processing of personal data, you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, Slovak Republic.

You have the right to have inaccurate personal data concerning you rectified or incomplete personal data completed. If you find that we process inaccurate or incomplete data about you, please do not hesitate to contact us.

If your personal data are processed on the basis of your consent under Article 6(1)(a) GDPR, you have the right to withdraw such consent at any time. However, the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You also have the other rights to which you are entitled as a data subject under the GDPR.

Do I have to provide you with my personal data?

Without personal data enabling identification, we cannot conclude a contract on the assignment of claims with you, as it would not be possible to define the contractual relationships between the creditor and the debtor. For the purpose of concluding a contract on the assignment of claims, the provision of personal data is a requirement necessary for entering into such a contract.

Do I have the right to object to the processing of my personal data?

As a data subject, you have the right to object to the processing of your personal data where the processing is based on legitimate interests. Our company may continue to process your personal data on the basis of legitimate interests only if it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for the establishment, exercise or defense of legal claims.

You have the right to object at any time to the processing of your personal data for direct marketing purposes where the processing is based on legitimate interests. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.

Do I have the right to information on the personal data you process about me?

As a data subject, you have the right of access to your personal data. If the conditions laid down in the GDPR are met, you may request from us a copy of the personal data we process about you. Under certain circumstances laid down in the GDPR, you may request restriction of processing or the portability of your personal data, and you also have the right to obtain erasure of your personal data.