Personal data protection and privacy policy

At the Pension and Disability Insurance Institute of Slovenia (hereinafter »ZPIZ«), we are aware of the importance of protecting your privacy and personal data. Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and of the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the controller must provide the data subject with information on the processing of their personal data.

The following information integrate the key information on personal data protection at ZPIZ pursuant to Article 13 of the General Data Protection Regulation.

1. Personal data controller

2. Data Protection Officer

3. Rights of the data subject

4. Detailed information on the processing of personal data at the ZPIZ website: https://www.zpiz.si

5. Detailed information on the processing of personal data in the records held by ZPIZ

 

_______________________________

1. Personal data controller

Personal data controller is the Pension and Disability Insurance Institute of Slovenia, Kolodvorska 15, 1000 Ljubljana, company registration number: 5156700000.

Contact details of the controller

telephone number: 01 4745 100

fax number: 01 4321 046

email address: informacije@zpiz.si

________________________________

2. Data Protection Officer

Contact details of the DPO:

Jasmina Habulin

email address: dpo@zpiz.si

______________________________

3. Rights of the data subject

Data subject shall have the right:

- to request access to personal data

- to request rectification and erasure of personal data

- to request restriction of processing of their personal data

- to object to processing of their personal data, and

- to data portability.

ZPIZ can comply with the request of the data subject only if and as soon as the conditions laid down by the General Data Protection Regulation and by the sectoral legislation are met. 

The data subject whose personal data (telephone number and/or email address) are, with their consent, processed for the purpose of the digital transmission of documents, can withdraw the consent with the Withdrawal statement HERE.

If you believe that your rights in regard with protection of personal data have been infringed, you have the right to file a complaint with a personal data supervisory authority – Data Protection Officer.

____________________________ 

4. Detailed information on the processing of personal data on the ZPIZ website: https://www.zpiz.si

ZPIZ operates the website https://www.zpiz.si/ by using its own server infrastructure.

For the purpose of operating the website, none of the personal data shall be transmitted to third countries, international organizations or other users.

ZPIZ processes collected personal data of the website users for different purposes:

4.1. Visiting website

4.2. Cookies

4.3. Processing of personal data in online services provided by ZPIZ:

4.3.1. My eZPIZ

4.3.2. e-Applications for EVERYONE

4.3.3. Digital document retrieval

4.3.4. My BiZPIZ

4.3.5. Online surveys

 

4.1. Visiting website

What information: ZPIZ shall not collect any personal data on any visit to the website https://www.zpiz.si/, used by a website visitor only for the purpose of obtaining information, who does not register or log in to online portals, does not fill in any applications, or otherwise provides personal data. The IP address – a unique number that identifies an individual computer or a device on the internet – shall be anonymised with an IP number generated on the Firewall used by ZPIZ.

 

4. 2. Cookies

The ZPIZ website uses different types of computer cookies

 

4. 3. Processing of personal data in online services provided by ZPIZ (My eZPIZ, e-Applications for EVERYONE, Digital document retrieval, and My BiZPIZ)

 

 4.3.1. Online service My eZPIZ

Where lodging an e-Application via My eZPIZ online service, ZPIZ shall (via online eApplication forms) process personal data of the data subject that are (at each registration with a qualified digital certificate or login with the SI-PASS) automatically transferred to the information system, and those provided in the application by the data subject.

Purpose: ZPIZ uses personal data from the digital certificate or identification data from the SI-PASS system for the purpose of unique identification of the registered user. Data from an e-Application provided by the data subject shall be used for the purpose of deciding on the claim.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation

Users’ categories: Data from the digital certificate shall not be transferred to the users.

Information regarding transmission of personal data to third countries or international organizations: Data from the digital certificate shall not be transferred to third countries or international organizations.

Retention period: Data on registered users of the My eZPIZ online portal shall be kept indefinitely.

Right to withdraw consent: Since the processing of personal data is not based on consent of the data subject, the later cannot prevent the processing of data from their digital certificate by revoking their consent for as long as they hold a registered user account with ZPIZ via My eZPIZ online service.

 

Information on

o        whether provision of personal data is a statutory or contractual requirement: No.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: Yes, personal data shall be processed due to the nature of the operation of the services.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

4.3.2. Online service e-Applications for EVERYONE

What information: When applying via e-Requests for EVERYONE online service, ZPIZ shall collect personal data provided by the data subject in an application form. Information on PIN (EMŠO) is mandatory. For a successful submission of an application information on mobile telephone number is also required; information on email address is optional.

Purpose: ZPIZ shall process information on telephone number and email address, if provided, for the purpose of submission of an application. Mobile telephone number and e-mail address for the purpose of digital document retrieval shall be processed only, if the data subject has signed a consent when applying. Personal data provided in an e-Application are requested for the purpose of deciding on a claim.

Legal Basis: For the processing of telephone number and email address (if provided), Article 6(1)(a) of the General Data Protection Regulation shall apply. With regard to personal data provided in the application form, Article 6(1)(c) of the General Data Protection Regulation shall apply.

Users’ categories: Information on telephone number and email address (if provided) shall not be transferred to the users.

Information regarding transmission of personal data to third countries or international organizations: Information on telephone number and email address, provided for the purpose of submission of application via e-Applications for EVERYBODY shall not be transferred to third countries or international organizations.

Retention period: Personal data provided on the basis of personal consent of the data subject shall be processed for the consented purposes only until revoked. ZPIZ shall keep these data for the demonstration of validity of the consent even after the withdrawal.

Right to withdraw consent: Where processing of personal data (mobile telephone number and email address) by ZPIZ is based on personal consent of the data subject, the later has the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Information on

o        whether provision of personal data is a statutory or contractual requirement: No.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If data subject fails to provide mobile telephone number, they shall not be able to use e-Applications for EVERYONE online service. Providing information on email address is optional.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

4.3.3. Digital Document Retrieval online service

What information: Online service enables access to Institute's source documents originally issued in electronic form by entering an ID number of the selected document and mobile telephone number or email address of the data subject. Successfully collected document can be downloaded via ZPIZ webpage.

Purpose: Provided personal data shall serve for receiving a link to the document, a user wishes to retrieve.

Legal Basis: Article 6(1)(a) of the General Data Protection Regulation

Users’ categories: Information collected for the purpose of digital documents retrieval shall not be transferred to the users.

Information regarding transmission of personal data to third countries or international organizations: Information collected for the purpose of digital documents retrieval shall not be transferred to third countries or international organizations.

Retention period: Personal data provided on the basis of personal consent of the data subject shall be processed for the consented purposes only until revoked. ZPIZ shall keep these data for the demonstration of validity of the consent even after the withdrawal.

Right to withdraw consent: Where processing of mobile telephone number and email address for the purpose of digital documents retrieval is based on personal consent of the data subject, the later has the right to withdraw their consent at any time.

Where in order to access the source document by entering document ID number, the data subject has provided their contact details for one-time retrieval only, this information shall only be used once for each session respectfully, thereby exhausting their right to withdrawal.

 

Information on

o        whether provision of personal data is a statutory or contractual requirement: No.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If data subject fails to provide personal data when using Digital document retrieval online service, downloading of such document shall not be enabled. 

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

4.3.4. My BiZPIZ online service

What information: Upon registration and each time the data subject logs in to the portal, ZPIZ obtains data from a digital certificate of the data subject.

Where lodging an e-Application via My BiZPIZ online service, ZPIZ shall process (via online e-Application forms) personal data of the data subject that are (at each registration with a qualified digital certificate) automatically transferred to the information system, and those provided in the application by the data subject.

Purpose: ZPIZ shall use personal data from the digital certificate for the purpose of unique identification of the registered user. Data from the e-Application provided by the data subject shall be used for the purposes of deciding on the claim.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation

Users’ categories: Data from the digital certificate shall not be transferred to the users.

Information regarding transmission of personal data to third countries or international organizations: Data from the digital certificate shall not be transferred to third countries or international organizations.

Retention period: Data on registered users of the My BiZPIZ online portal shall be kept indefinitely.

Right to withdraw consent: Where processing of personal data is not based on personal consent of the data subject, the later cannot prevent the processing of data from their digital certificate by revoking their consent for as long as they hold a registered user account with ZPIZ via My BiZPIZ online service.

Information on

o        whether provision of personal data is a statutory or contractual requirement: No

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: Yes, personal data are processed due to the nature of the operation of the services.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

4.3.5 Online survey

All information provided by the data subject when taking part in a survey shall be collected on an anonymous basis only unless the data subject explicitly decides to reveal any of their personal data publicly. If the data subject decides to reveal any of their personal data or personal data of third persons, they shall do so by understanding the risks and potential consequences of such conduct. When participating in a non-anonymous survey the data subject shall be informed thereof in advance and shall be given the opportunity to consent to processing of their personal data for the purposes specified in a respective survey.

Where the data subject has been invited to participate in a survey by SMS or/and email, the legal basis for the processing of contact details shall be either the prior consent of the data subject when providing contact details (Article 6(1)(a) of the General Data Protection Regulation, or Article 6(1)(f) of the General Data Protection Regulation allowing the processing of personal data for other purposes, where the legitimate interests pursued by the controller are not overridden by the interests of the data subject.

What information: When completing the survey ZPIZ shall collect personal data provided by the data subject in their answers to the questions in the survey. The data so collected shall not be processed separately and shall not be linked to any other data.

Purpose: ZPIZ shall use the collected data exclusively for the purpose of research or for those exclusively defined in a respective survey and not for the purposes of direct marketing.

Legal basis: Article 6(1)(a) of the General Data Protection Regulation

Users’ categories: Information collected shall not be transferred to the users.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries or international organizations.

Retention period: Data shall be stored until the consent given by the data subject has been revoked.

Right to withdraw consent: Consent to processing of personal data provided in the survey can be revoked by a request for withdrawal of consent sent to informacije@zpiz.si in which the data subject must specify the survey they have taken part in.

Furthermore, the data subject can object to processing of their contact details (telephone number or/and email address) for the purpose of future online surveys via informacije@zpiz.si.

 

Information on

o        whether provision of personal data is a statutory or contractual requirement: No.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: Where the data subject decides to participate in an online survey they have to answer all questions in order to submit the survey successfully (unless otherwise provided in an individual question).

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

__________________________________________

5. Processing of personal data in the individual records kept by ZPIZ

For performing its activities, ZPIZ in the role of data controller processes personal data of the data subjects in its various records, such as:

5.1. Register of beneficiaries of pension and disability benefits

5.2. Register of insured persons

5.3. Register of liable persons

5.4. Payments records

5.5. Expert medical opinions records

5.6. Electronic records of the medical examiners

5.7. Infringers records

5.8. Records of job applicants responding to job vacancy notices

5.9. Video surveillance records

5.10. ZPIZ visitors log

5.11. Records of applicants under the Public Information Access Act

5.12. Processing of personal data in records collections concerning physical asset
management

5.13. Records of applicants under the Mass Media Act

5.14. Register of the members of the Council of the Institute

 

5. 1. Register of beneficiaries of pension and disability benefits

Purpose: Pension and disability insurance implementation, claiming of entitlements, and processing of claims with ZPIZ.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation, ZPIZ-2, ZEPDSV, Articles 7, 11, 12, 13, 14, 15, 16, 17, 18 of ZMEPIZ-1

Users' categories: Legally authorized users (Article 8, paragraph 3 of ZMEPIZ-1) and users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: With regard to international insurance data shall be transferred to third countries on the basis of concluded and ratified international agreements.

Retention period: Indefinitely.

Right to withdraw consent: Since the processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on: in administrative proceedings

o        whether provision of personal data is a statutory or contractual requirement: Yes, since the entitlements from pension and disability insurance are granted in an administrative proceeding, the data subject is pursuant to ZPIZ-2, ZMEPIZ-1 and ZUP obliged to provide all personal data and other information required for the processing of their claim.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If, in their formal claim, the data subject fails to provide obligatory personal data and other information required for the processing of their claim, the claim shall be rejected. Other optional data, not provided by the data subject or obtained by ZPIZ ex officio, shall not be taken into account when deciding on the claim.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 2. Register of insured persons

Purpose: Pension and disability insurance implementation, claiming of entitlements, and processing of claims with ZPIZ.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation, ZPIZ-2, ZEPDSV, Articles 7 and 11 of ZMEPIZ-1

Users' categories: Legally authorized users (Article 8, paragraph 3 of ZMEPIZ-1) and users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: With regard to international insurance data shall be transferred to third countries on the basis of concluded and ratified international agreements.

Retention period: Indefinitely.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes, pursuant to ZPIZ-2 and ZMEPIZ-1 liable persons are obliged to provide all information concerning the insured persons. Where the status of an insured person is established in an administrative proceeding, the data subject is pursuant to ZPIZ-2, ZMEPIZ-1, and ZUP obliged to provide all personal data and other information required for the processing of their claim.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If a liable person fails to enter all information they are legally bound to provide, ZPIZ shall decide upon the status of an insured person ex officio.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 3. Register of liable persons

Purpose: Pension and disability insurance implementation, claiming of entitlements, and processing of claims with ZPIZ.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation, ZPIZ-2, ZEPDSV, Articles 7 and 22 of ZMEPIZ-1

Users' categories: Legally authorized users (Article 8, paragraph 3 of ZMEPIZ-1) and users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: With regard to international insurance data shall be transferred to third countries on the basis of concluded and ratified international agreements.

Retention period: Indefinitely.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If the data subject as a person liable for registering for insurance or reporting data on bases for calculation and payment of contributions fails to provide the required data, the existence of the insurance shall not be registered or the bases shall not be entered into the Register of the insured persons.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 4. Payments records

Purpose: Pension and disability insurance implementation and payment of benefits provided by ZPIZ.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation, ZPIZ-2, Articles 7 and 19 of ZMEPIZ-1.

Users' categories: Legally authorized users (Article 8, paragraph 3 of ZMEPIZ-1) and users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall be transferred to third countries for the purpose and in the scope necessary to ensure orderly payments of benefits due.

Retention period: Indefinitely.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If the data subject fails to provide required data, not already held by ZPIZ, payment of benefits could be terminated.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 5. Expert medical opinions records

Purpose: Pension and disability insurance implementation, claiming of entitlements, and processing of claims with ZPIZ.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation, ZPIZ-2, Articles 7 and 20 of ZMEPIZ-1

Users' categories: Legally authorized users (Article 8, paragraph 3 of ZMEPIZ-1) and users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries.

Retention period: Indefinitely.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes, since the entitlements from pension and disability insurance are established in an administrative proceeding, the data subject is pursuant to ZPIZ-2, ZMEPIZ-1 and ZUP obliged to provide all personal data and other information required for the processing of their claim.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If, in their formal claim, the data subject fails to provide obligatory personal data and other information required for the processing of their claim, the claim shall be rejected. Other optional data, not provided by the data subject or obtained by ZPIZ ex officio, shall not be taken into account when deciding on the claim.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 6. Electronic records of the medical examiners

Purpose: Drawing up statements on labour costs of medical examiners.

Legal Basis: Article 6(1)(c) and 6(1)(b) of the General Data Protection Regulation

Users' categories: Legally authorized users and users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries.

Retention period: Indefinitely.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes, since the entitlements from pension and disability insurance are established in an administrative proceeding, the data subject is pursuant to ZPIZ-2, ZMEPIZ-1 and ZUP obliged to provide all personal data and other information required for the processing of their claim.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If, in their formal claim, the data subject fails to provide obligatory personal data and other information required for the processing of their claim, the claim shall be rejected. Other optional data, not provided by the data subject or obtained by ZPIZ ex officio, shall not be taken into account when deciding on the claim.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 7. Infringers records

Purpose: Pension and disability insurance implementation and processing of infringement proceedings.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation, Article 206 ZP-1, ZMEPIZ-1

Users' categories: Legally authorized users (Article 204(a) of ZP-1).

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries.

Retention period: for 5 years after the infringement decision has become final.  Documentary material in the form of registers shall be kept indefinitely, subsidiary registers shall be kept for 5 years.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes, a person initiating the infringement proceeding is obliged to provide personal data.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If a person initiating the infringement proceeding pursuant to ZP and ZUP fails to provide information required for processing their claim, the claim shall be rejected.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 8. Records of job applicants

Purpose: Storing of documentation for the purpose of ensuring the regularity of the selection procedure in line with the legislation governing employment relationships or public employees.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation, ZJU, ZDR-1.

Users' categories: Users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries.

Retention period: Selected job applicant – indefinitely, declined job applicant – for 2 years after the recruitment procedure has been concluded.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If the selecting commission cannot verify whether the job applicant meets the eligibility and selection criteria specified in the vacancy notice, the application of the job applicant shall not be processed.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 9. Video surveillance records

Purpose: Protection of data subject's life, protection of movable and immovable property, maintaining order in ZPIZ premises and supervision of entries and exits in and from business premises at the addresses: Kolodvorska 15, Ljubljana; Ob železnici 30, Ljubljana; Opekarniška cesta 15 c, Celje; Zagrebška 84, Maribor; Rozmanova 38, Novo mesto; Vadnova 13, Kranj.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation in connection with Article 74 ZVOP-1.

Definition of legal interests: Safety of people and property and supervision of entries and exits in and from business premises under the conditions regarding the video surveillance laid down by law is the legal interest of ZPIZ. Protecting the rights of the data subject during video surveillance is defined in ZVOP-1 and in the General Data Protection Regulation.

Users' categories: Users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries.

Retention period: for maximum of one year

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: No.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: No, however; the data subject shall not be able to enter the ZPIZ premises without being under video surveillance.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 10. ZPIZ visitors log

Purpose: Protection of property, protection of the data subject's life or limb, and maintaining order in ZPIZ premises as well as supervision of entries by limiting the access to the premises.

Legal Basis: Article 82 ZVOP-1.

Users' categories: Legally authorized users and users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries.

Retention period: for maximum of 3 years.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: The data subject – visitor – is obliged to provide personal data specified by ZVOP-1. If failing to do so, access to the ZPIZ premises shall be rejected.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 11. Records of applicants under the Public Information Access Act (ZDIJZ)

Purpose: Processing of applications under ZDIJZ.

Legal Basis: Article 6(1)(c) of the General Data Protection Regulation and ZDIJZ

Users' categories: Users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries.

Retention period: Indefinitely.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If the data subject applying for access to public information under ZDIJZ and ZUP fails to provide personal data required for the processing of their application, the application shall be rejected.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 12. Processing of personal data in records collections concerning physical asset management

Purpose: ZPIZ physical assets management procedures and conclusion of contracts of sale and other contracts relating to physical assets of ZPIZ.

Legal Basis: Article 6(1)(c) and 6 (1)(b) of the General Data Protection Regulation and the Physical Assets of the State and Local Government Act

Users' categories: Users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries or international organizations.

Retention period: Indefinitely.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If the data subject fails to provide information required for the adjudication of their bids, their tender shall be considered incomplete or a contract with the selected data subject shall not be concluded.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 13. Records of questions and replies under the Mass Media Act

Purpose: Documenting answers to the questions raised by the media

Legal Basis: Article 6(1)(e) of the General Data Protection Regulation and the Mass Media Act

Users' categories: Users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries or international organizations.

Retention period: Indefinitely.

Right to withdraw consent: Since processing of personal data is not based on consent, the data subject shall not have the right to withdraw their consent.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If the data subject fails to provide contact details, the answer to their question could not be provided.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

5. 14. Register of the members of the Council of the Institute

Purpose: Convening of the Council of the Institute meetings and communicating with the members of the Council.

Legal Basis: Articles 6(1)(c) and 6(1)(a) of the General Data Protection Regulation, ZPIZ-2.

Users' categories: Users providing legal basis for obtaining of personal data pursuant to sectorial legislation.

Information regarding transmission of personal data to third countries or international organizations: Data shall not be transferred to third countries or international organizations.

Retention period: Indefinitely.

Right to withdraw consent: The members of the Council of the Institute providing their telephone number or email address in order to facilitate the communication with the Institute have the right to withdraw their consent to use of these data.

Information on

o        whether provision of personal data is a statutory or contractual requirement: Yes, except from email address and telephone number.

o        whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: If the data subject fails to provide the required data, exercising of the statutory powers of the Council of the Institute will be obstructed.

The existence of automated decision-making, including profiling: Automated decision-making and/or profiling shall not be implemented.

 

___________________________________