1. Controller
Controller
Fitore s. r. o.
The controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the “Regulation”) and with Act No. 18/2018 Coll. on Personal Data Protection.
No data protection officer has been designated; the conditions under Article 37 of the Regulation are not met.
2. Purposes of processing, legal bases and retention periods
| Purpose | Categories of data | Legal basis | Retention period |
|---|---|---|---|
| Handling an enquiry submitted through the contact form | name, e-mail address, telephone number, content of the message | Art. 6(1)(b) of the Regulation — steps prior to entering into a contract | 1 year from the last communication |
| Sending requested materials and marketing communications | name, e-mail address | Art. 6(1)(a) of the Regulation — consent | until consent is withdrawn |
| Publication of a testimonial on the website | name, e-mail address, content and rating | Art. 6(1)(a) of the Regulation — consent | until consent is withdrawn |
| Provision of nutrition consulting services | identification and contact data, anthropometric data, photographic records, records of the course of cooperation | Art. 6(1)(b) of the Regulation — performance of a contract | 3 years from the end of the contractual relationship |
| Taking health status into account when preparing a plan | data concerning health under Art. 9(1) of the Regulation | Art. 9(2)(a) of the Regulation — explicit consent | 3 years from the end of the contractual relationship |
| Bookkeeping and compliance with tax obligations | billing and payment data | Art. 6(1)(c) of the Regulation in conjunction with Act No. 431/2002 Coll. and Act No. 222/2004 Coll. | 10 years |
| Advertising performance measurement | IP address, device and browser identifiers, website usage data | Art. 6(1)(a) of the Regulation — consent | no more than 13 months from collection |
Upon expiry of the stated period the personal data are erased unless further retention is required by a specific legal provision.
3. Special categories of personal data
Data concerning health are processed solely on the basis of the explicit consent of the data subject granted in the intake form. These data are not collected through the website and are not disclosed to third parties.
The services provided do not constitute health care within the meaning of Act No. 576/2004 Coll. and do not replace medical diagnosis or treatment.
4. Recipients of personal data
Personal data are not disclosed to third parties for their own marketing purposes and are not sold. The following act as processors within the meaning of Art. 28 of the Regulation:
- Formspree, Inc. (United States) — delivery of messages submitted through forms.
- UAB “MailerLite” (Lithuania) — management of the subscriber database and distribution of communications.
- WebSupport s. r. o. (Slovakia) — website and mailbox hosting.
- Meta Platforms Ireland Limited (Ireland) — advertising performance measurement.
- Accounting services provider — to the extent necessary for bookkeeping.
Personal data are further disclosed to public authorities where required by law.
5. Transfers to third countries
Transfers of personal data to the United States are carried out on the basis of the European Commission’s adequacy decision under Art. 45 of the Regulation (EU–US Data Privacy Framework) or, where applicable, on the basis of standard contractual clauses under Art. 46(2)(c) of the Regulation.
6. Cookies and website analytics
Website analytics are carried out using Plausible Analytics, which stores no cookies, retains no IP addresses and creates no visitor profiles. Only aggregated statistical data are processed, from which the data subject cannot be identified.
The measurement code of Meta Platforms Ireland Limited is activated only after consent has been granted pursuant to Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications. Until consent is granted, no cookies are stored for marketing purposes.
Consent may be withdrawn at any time by clearing the website data in the browser settings or by notice sent to the controller’s contact address. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
The browser stores in the local storage of the device a record of the choice made and of the display of the information notice. These data are not transmitted to the controller.
7. Provision of personal data
The provision of personal data for the purposes set out in Section 2 is voluntary. The provision of data marked as required is a contractual requirement; without it a contract cannot be concluded and the requested service cannot be provided. The provision of billing data is a statutory requirement.
8. Automated decision-making
No automated individual decision-making, including profiling within the meaning of Art. 22 of the Regulation, takes place in the course of processing.
9. Rights of the data subject
- the right of access to personal data (Art. 15 of the Regulation),
- the right to rectification (Art. 16 of the Regulation),
- the right to erasure (Art. 17 of the Regulation),
- the right to restriction of processing (Art. 18 of the Regulation),
- the right to data portability (Art. 20 of the Regulation),
- the right to object to processing (Art. 21 of the Regulation),
- the right to withdraw consent at any time (Art. 7(3) of the Regulation).
Requests are to be submitted to fit@erikamala.sk. The controller shall provide information on the action taken within one month of receipt of the request; that period may be extended in justified cases pursuant to Art. 12(3) of the Regulation.
10. Supervisory authority
The data subject has the right to lodge a complaint pursuant to Art. 77 of the Regulation, or a petition under Section 100 of Act No. 18/2018 Coll., with:
Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovakia, statny.dozor@pdp.gov.sk, dataprotection.gov.sk
11. Changes to this policy
The controller is entitled to amend this policy. The current version is published at this address together with its effective date.