Personal Data Protection

On 27 April 2016, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter “GDPR”) was published in the Official Journal of the European Union. It became applicable in all Member States of the European Union and the European Economic Area as of 25 May 2018.

A regulation is a legislative act of the European Union that has general application, is binding in its entirety, and is directly applicable in all Member States without the need for implementation into the national legal order of a Member State.

The Slovak Republic, through the Office for Personal Data Protection, adopted a new Act on the Protection of Personal Data under No. 18/2018 Coll. (hereinafter the “Act”), which repeals and fully replaces the original Act No. 122/2013 Coll.

As of 25 May 2018, both the GDPR and the Act (hereinafter the “new legislation”) apply in the Slovak Republic with respect to the processing and protection of personal data, imposing specific obligations and responsibilities on those processing personal data, both in relation to processing and to data protection itself.

Under Article 4(7) of the GDPR, a controller is: “a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law”.

Under Article 4(8) of the GDPR, a processor is: “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller”.

Based on the above, your company, in connection with the use of the personnel, payroll, and accounting program (hereinafter the Humanet system), has the legal status of a controller under the GDPR, and our company has the legal status of a processor, since in connection with providing services to your company, our company processes personal data on your behalf.

In general, the controller and the processor (persons obliged under the GDPR and the Act) are required to adopt appropriate technical and organizational measures to ensure adequate protection of personal data.

Given that all data within the Humanet system is stored with us, personal data must be adequately protected and processed in accordance with the new personal data protection legislation. Accordingly, the provider and the user of the Humanet system are, among other things, required to conclude an agreement under Art. 28(3) of the GDPR, no later than before the first processing operation involving the user’s personal data in the Humanet system. The user of the Humanet system has the legal status of a controller, while our company (the provider) has the legal status of a processor.

It is not excluded, however, that your legal status as a user of the Humanet system may differ from that of a controller. Such a situation may arise in particular if, as a user, you process the personal data of another controller (for example, if, under a separate agreement, you provide payroll or accounting services as a user without being an employee of the controller). In such a case, as a user, you are required under the GDPR to have an agreement in place with the provider under Art. 28(4) of the GDPR, under which we, as the provider in the legal position of a further processor in the chain, are subject to the same data protection obligations as those set out in the agreement concluded between the controller and you as the user in the legal position of a processor.

Given that our company takes the protection of your personal data seriously, in order to comply with the legislative requirements of the new legislation, we have prepared for our customers a draft agreement under Art. 28(3) of the GDPR, which is available to all customers free of any additional charge. In addition, if you are a user in the legal position of a processor as described in the previous paragraph, our draft agreement under Art. 28(4) of the GDPR is also available on our website.

For more information on personal data protection, please see our page Personal Data Protection for Business Partners and Other Persons, or feel free to contact us at gdpr@hour.sk or info@humanet.sk.