Notice on the Processing of Personal Data
DS Corporation, s.r.o., with registered office at Skalnatá 364/21, Veľká Lomnica 059 52, Slovak Republic, ID No.: 44 383 258, registered in the Commercial Register of the District Court Prešov, Section: Sro, Insert No.: 20630/P (hereinafter referred to as the "Company") is the controller of the personal data that the User provides to the Company when using the MONTYO application (hereinafter referred to as the "Application") or that the Company obtains when using the Application.
In this Notice, the Company provides information about:
- how it obtains and processes personal data provided by Users when using the App; and
- what are the rights of data subjects in relation to the processing of their personal data and how they can exercise those rights.
Any personal data of Data Subjects provided by Users when using the Application will be processed by the Company on behalf of Users in the capacity of an intermediary.
The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as "GDPR") and Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments and Additions to Certain Acts (hereinafter referred to as "the Act").
Capitalised terms in this Notice shall have the same meanings as assigned to them in the General Terms and Conditions of the App (the "Terms"), unless otherwise stated in this Notice. The Terms and Conditions are available on the Application under Terms and Conditions.
I. To Whom This Notice Is Addressed
The information provided in this Notice is intended for Users and data subjects whose personal data is provided by the User when using the Application.
II. How You Can Contact the Company
If you have any questions about the processing of your personal data, you can contact the Company by phone or email at:
- Email: legal@montyo.app
- Phone: +421 911 091 990
III. Purpose, Legal Basis, Categories of Personal Data and Retention Period
| Purpose of Processing | Legal Basis for Processing | Categories of Personal Data | Retention Period |
|---|---|---|---|
| Conclusion of the Contract with the User (B2B) | Legitimate interest according to Article 6(1)(f) GDPR | Name, surname, company name, function, email | During the duration of the contractual relationship and for 5 years after its termination |
| Operation of the Application: registering and creating an account on the App; introduction of a certified plumber | Legitimate interest according to Article 6(1)(f) GDPR | Email, password, company name, first name, last name, address, permit number, signature | For the duration of the contractual relationship with the User, or until the User deletes the personal data |
| Provision of Services: provision of maintenance services; communication with the User | Legitimate interest according to Article 6(1)(f) GDPR | Name, surname, email, company name | For the duration of the contractual relationship with the User, or until the User deletes the personal data |
| Marketing: sending marketing communications by email | Legitimate interest according to Article 6(1)(f) GDPR | E-mail, company name | During the duration of the contractual relationship and for 5 years after its termination |
| Handling complaints | Compliance with the legal obligation under Article 6(1)(c) of the GDPR | Name and surname, email, personal data provided in the complaint | Pending resolution of the complaint |
| Exercise of data subjects' rights (submissions) | Compliance with the legal obligation under Article 6(1)(c) of the GDPR | Name, surname, place of residence, date of birth or any other data to properly verify the identification of the data subject | 2 years after the processing of the data subject's request |
| Records of data breaches | Compliance with the legal obligation under Article 6(1)(c) GDPR | Personal data affected by a data breach | During the term of the Company |
| Proving, asserting and defending the Company's legal claims | Legitimate interest under Article 6(1)(f) GDPR | Common personal data | Pending the final termination of the claim being proved, asserted or defended |
IV. What Legitimate Interests Are Exploited by the Company?
The Company relies on legitimate interests in the event of legal or extrajudicial disputes or in proceedings with public authorities in which it asserts or defends its legal claims, as well as when sending marketing communications to its current and former Users.
On the basis of legitimate interest, the Company also processes personal data of contact persons or other persons authorized to act for or on behalf of Users in the operation of the Application or provision of the Services.
V. Disclosure of Personal Data
| Area/Service | Recipient of Personal Data | Transfer outside the EEA |
|---|---|---|
| IT services | AliDesign s.r.o. | No |
| Cloud services platform | Render Services, Inc. | Yes |
| Cloud services platform | Hetzner Online GmbH | No |
| Accounting service provider | Argania, spol. s r.o. | No |
VI. Transfer of Personal Data to Third Countries or International Organisations
In processing personal data, the Company seeks to minimise any transfer of personal data outside the European Economic Area (EEA). However, in operating the Application, the Company may also use service providers who may transfer personal data outside the EEA. In these cases, the Company will ensure that the GDPR conditions for such processing are met and will only make the transfer based on the existence of a European Commission adequacy decision under Article 45 of the GDPR (e.g., an adequacy decision relating to the EU-US Privacy Shield Framework) or on the basis of standard data protection clauses under Article 46(2) of the GDPR (e.g., transfers to the US).
VII. Automated Individual Decision-Making and Profiling
The Company does not perform automated decision-making, including profiling, in the operation of the Application and the provision of the Services.
VIII. Collection of Personal Data
In particular, the Company processes personal data of data subjects provided directly by Users.
The provision of personal data is not a legal obligation, but without it, the Company would not be able to properly operate the Application and provide the Services.
IX. Rights of Data Subjects
If the Company processes personal data on the basis of your consent, you have the right to withdraw your consent at any time by sending an email to: legal@montyo.app. Withdrawal of consent does not affect the lawfulness of the processing based on the consent prior to its withdrawal.
In addition to the above right, you have the following rights under the conditions set out in the GDPR:
- Right of access to personal data: The data subject has the right to obtain confirmation from the Company as to whether or not personal data concerning him or her are being processed and, if so, the right to obtain access to such personal data and a copy of the personal data processed.
- Right to rectification of personal data: The data subject has the right to have inaccurate personal data concerning him or her rectified or incomplete personal data completed by the Company without undue delay.
- Right to erasure of personal data: The data subject has the right to have the Company erase the personal data concerning him or her without undue delay if:
- The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
- The data subject withdraws the consent on the basis of which the data were processed and there is no further legal basis for the processing.
- The data subject objects to the processing and there are no overriding legitimate grounds for the processing.
- The personal data have been unlawfully processed.
- The personal data must be erased in order to comply with a legal obligation under the law of the European Union or of the Slovak Republic.
- The personal data have been collected in connection with the offer of information society services.
However, the right to erasure does not apply if the processing is necessary for compliance with legal obligations, for the establishment, exercise or defence of legal claims and in other cases provided for in the GDPR.
- Right to restriction of processing: The data subject has the right to have the Company restrict processing in any of the following cases:
- The data subject denies the accuracy of the personal data for the period necessary for the Company to verify the accuracy of the personal data.
- The processing of the personal data is unlawful and the data subject refuses the erasure of the personal data and instead requests the restriction of their use.
- The Company no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims.
- The data subject has objected to the processing, unless it is verified that the legitimate grounds of the Company outweigh the legitimate grounds of the data subject.
- Right to object to processing: The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her and processed by the Company on the grounds of legitimate interest. In such a case, the Company shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests or the rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
- If the data subject exercises his or her right to object to the processing of personal data for direct marketing purposes, the Company may no longer process his or her personal data for this purpose.
- Right to data portability: The data subject has the right to obtain the personal data concerning him or her that he or she has provided to the Company in a structured, commonly used and machine-readable format and to transmit that data to another controller without being prevented from doing so by the Company, in the event that:
- The processing is based on consent; and
- The processing is carried out by automated means.
- Right to lodge a complaint: The data subject may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, Bratislava, email: dozor@pdp.gov.sk or with the supervisory authority in the Member State of your habitual residence.
You can exercise your rights by using the contact details of the Company set out in Part II of this Notice. The Company advises that it is entitled to ask the data subject to verify his or her identity before responding to his or her request.
X. Changes to the Notification
The Company reserves the right to modify and amend the Notice. Any changes to this Notice will become effective upon posting on the Application.