Personal Data Protection

When you use our services, participate in our consumer competitions, various consumer promotions, are our client in the Cash & Carry program, or visit our website or our social media profiles, we collect various types of data such as your initials, contacts, and possibly other settings.

The scope or list of processed personal data is determined by the relevant legal regulations, further directly or indirectly arising from the concluded contract or stated in the consent to the processing of personal data. MILK-AGRO, as the controller, processes personal data to the extent necessary to fulfill the purpose of their processing. This mainly concerns data related to the identity of the data subject and contact details.

We process the following types of personal data:

• Identification data, which primarily means name and surname, title, address, telephone number, if you purchase in the Cash & Carry program (you are an entrepreneur), also Company ID, Tax ID, email address – i.e., data by which the data subject can be uniquely identified;
• Contact data, meaning personal data that allow us to contact you, especially email address, telephone number, delivery address, billing address, and possibly your social media contact;
• Possible photographs, meaning photographs of you as the data subject taken if you become a winner of any consumer competition, the photograph will be used to promote the competition on the controller's website or in other advertising and promotional materials of MILK-AGRO;
• Derived data, meaning personal data derived from your settings, data about your behavior on the web and other electronic media, and data about your behavior when reading emails we send you; mainly data about your gender, purchasing behavior, and relationship to various goods and services;
• Data related to store visits, mainly recordings from camera systems in stores.

1.1 Overview of purposes of personal data processing

If you, as a MILK-AGRO customer, want to participate in our consumer promotions and competitions, we need your first name, last name, and address. If you give consent to the processing of personal data electronically, then also your email address. If you are registered as a Cash & Carry cardholder, these are the name of your company/trade name, name and surname (if different from the trade name – for contact purposes), title, address, telephone contact. These data are necessary to contact the winners of consumer competitions.

To execute the contractual relationship regarding the Cash & Carry card and to use the benefits for its holder, it is necessary when filling out the form to provide us with the name of your company/trade name, name and surname (if different from the trade name – for contact purposes), address, Company ID, Tax ID, telephone contact, possibly fax contact. Providing your email address is necessary for online registration.

For sending current information and advertising as a Cash & Carry cardholder, it is necessary to provide us with the name of your company/trade name, name and surname, title, address. For information and advertising via email, we need your email address.
For sending current information and advertising, it is necessary to provide us with your first name and surname, title, address. For information and advertising via email, we need your email address.

You naturally have the option to provide optional data as well. For example, in communication via email, you can provide a mobile phone number along with the email address.

We process your personal data in various situations for different purposes. If you register with us in the Cash & Carry system, we use your data to manage your account(s) and provide related services. We also process your personal data if you participate in our consumer competitions. We also send you our offers using your contacts and other data. With your consent, we may also transfer data to third parties. We are authorized to process personal data either by preparing or fulfilling a contract with you, complying with legal obligations, our legitimate interests, or your consent.

If personal data are processed in connection with fulfilling contractual obligations of the controller, the legitimate interest of the controller, or according to a special regulation or international treaty binding on the Slovak Republic, the purpose of processing mainly relates to the following activities:

• concluding, recording, and managing protocols on inclusion in the Cash & Carry program, including customer care;
• ensuring all services arising from the Cash & Carry program contract;
• processing personal data within accounting;
• processing personal data related to fulfilling obligations arising from employment relationships;
• recording and archiving;
• handling possible complaints;
• performing internal audits, compliance checks with legal regulations, etc.

When registering for the Cash & Carry program, personal data are necessarily required to realize our contractual relationship regarding the use of the Cash & Carry card after registration and to establish your customer account as a Cash & Carry cardholder. Along with establishing your account, you will be assigned a customer card number related to your personal customer data, whereby the customer is uniquely identifiable based on this number. In connection with the Cash & Carry card, we will record the card number issued to you and data about your purchases made with this card.

The customer is not obliged to provide this data, but it is necessary to fulfill this contractual relationship, and without providing it, the Cash & Carry card cannot be issued. This does not apply to processing data about your gender and title except for addressing purposes in communication between MILK-AGRO and you.

If personal data are processed based on consent for participation in consumer competitions, the main purpose of such processing is to fulfill conditions related to your participation in ongoing consumer competitions organized by MILK-AGRO (or its partners), with the purpose mainly related to:

• enabling the data subject's participation in ongoing MILK-AGRO consumer competitions;
• announcing winners of completed consumer competitions;
• publishing winners and possibly their likeness on the MILK-AGRO website and other promotional materials.

As part of sales promotion (without requiring permission from state authorities), you can participate in ongoing consumer competitions by purchasing in one of our stores. Competitions can also be entered by persons who do not own our Cash & Carry card. If you meet the competition conditions, you have the opportunity to win the specified prize. We usually offer draws for shopping vouchers, trips, tangible prizes, or products. You can learn about ongoing competitions from our advertisements, in our stores, or on the company's website www.milkagro.sk. However, it is always necessary to familiarize yourself with the conditions of participation in ongoing competitions.

If you give your consent to the processing of personal data in written form directly in any MILK-AGRO store by filling out a form, it is not necessary to provide an email address. If you give your consent electronically on the MILK-AGRO website for participation in a consumer competition, your email address is necessary. We use a double explicit consent procedure for registration, so your registration will only be completed if you confirm it by clicking on a link sent to you in a confirmation email for this purpose. If you do not confirm promptly, your registration will be automatically deleted from our database.

The customer is not obliged to provide this data, but it is necessary to evaluate consumer competitions, and without providing it, you cannot become one of the winners of announced ongoing consumer competitions. This does not apply to processing data about your gender and title except for addressing purposes in communication between MILK-AGRO and you. Detailed conditions of participation in any MILK-AGRO consumer competition are available on the company's website www.milkagro.sk or directly in each MILK-AGRO store.

If personal data are processed based on consent for marketing purposes, the main purpose is to offer the latest information about current products and services of MILK-AGRO or offers and services of MILK-AGRO's business partners, mainly related to:

• offering products and services, where offers may be provided electronically, especially by email, mail, telephone, etc.;
• sending non-personalized (general) advertising in the form of newsletters;
• possible satisfaction surveys with used products and services;
• organizing consumer promotions.

Advertising is a presentation in the course of business, entrepreneurship, etc., aimed at promoting goods or services, including real estate, rights, and obligations. MILK-AGRO's advertising usually includes products, goods, services, or consumer competitions sold and organized by MILK-AGRO.

If you, as the data subject, provided an email contact, after processing your data, you will receive a confirmation email from us. This is the so-called double explicit consent procedure. You will receive advertising emails only after clicking the link contained in the email. If you consent to receiving information and advertising, we will inform you about our current consumer competitions, products, and promotions. When sending advertising by mail, we process data about your gender for addressing purposes, your first name, last name, and address. When sending advertising by email, we process data about your gender for addressing purposes, your first name, last name, and verified email address.

Consent given for marketing purposes is voluntary. However, it is necessary for the controller to send general offers of products and services, ensure consumer competitions, promotions, etc., and without such consent, the controller is not authorized to provide these services.

MILK-AGRO as the controller may process personal data of data subjects without their consent based on legitimate interest, specifically for the security and protection of its property. In such cases, the purpose of processing personal data mainly relates to:

• making camera recordings;
• storing camera recordings.

If you visit one of the controller's stores or premises monitored by a camera system or its surroundings, the controller makes and processes camera system recordings on which you as the data subject may be captured. We have the right to make and subsequently handle such recordings based on legitimate interest (i.e., even without your consent) for the purpose of protecting our and your property and persons moving in the store (premises) and its surroundings.

The recipient of your personal data is the controller – camera recordings are stored on the controller's servers. For this purpose, we keep personal data for 14 days. In cases defined by special laws, your personal data may be provided to law enforcement authorities.

In most cases, we process your personal data for our own purposes as the controller. In some justified cases, MILK-AGRO may transfer personal data obtained from the data subject to other (third) parties who process the data as processors. Processors process these data either according to our instructions or in a manner prescribed by legal regulations.

We process all mentioned personal data as the controller. This means that we define the purposes for which we collect your personal data, determine the means of processing, and are responsible for their proper execution. Besides the controller and its employees, other persons who process personal data as processors may have access to personal data. Regarding the scope of services provided by MILK-AGRO, this concerns a clearly defined group of processors, and personal data transfer occurs. The categories of processors are:

• IT service providers;
• accounting service providers;
• law firms;
• public authorities;
• other persons providing services for MILK-AGRO and processing personal data on its behalf based on a personal data processing contract

MILK-AGRO uses other processors for services related to the Cash & Carry card and some consumer competitions. Your personal data provided for these purposes are made available to them only to the extent and for the period necessary to provide their services and for which you as a customer have given consent. All processors have been carefully selected. They process personal data exclusively according to MILK-AGRO's instructions and are obliged to comply with personal data protection regulations.

For processing personal data for marketing purposes, besides the controller and its employees, other persons processing personal data as processors may have access. For example, these may be external companies managing IT systems or providing other services related to personal data processing for marketing purposes, authorized in writing by the controller by a written contract.

The legal basis for processing personal data is usually fulfilling a legal obligation (especially Act No. 18/2018 Coll. on personal data protection), concluding, managing, and fulfilling contractual obligations from the Cash & Carry program contract, legitimate interest, which is the protection of the rights and legally protected interests of the controller, and consent of the data subject (especially for marketing, consumer competitions, etc.).

If you refuse to provide MILK-AGRO with personal data required for fulfilling the controller's contractual obligations or based on the law, the controller is not obliged to provide any further services.

MILK-AGRO takes such technical and organizational security measures to protect your data from misuse to the greatest extent possible. Besides securing the operational environment, MILK-AGRO uses, for example, encryption methods in some areas (Cash & Carry cards and registration forms for participation in consumer competitions on our website). The data you provide to our company are then transmitted in encrypted form via SSL (Secure Socket Layer) protocol to prevent misuse of data by third parties. Data protection will always be updated according to the current technical state and software.

The MILK-AGRO controller is authorized to process your personal data obtained without your consent (as the data subject) for the period specified by the relevant legal regulations. Processing personal data based on consent is possible only for the period for which consent was given. The storage of personal data is governed by the legal regulations of the Slovak Republic.

The duration of processing of personal data of the data subject by MILK-AGRO depends on the purpose for which they were obtained and whether the data subject gave consent to their processing or they are processed based on another legal purpose. Consent is given to MILK-AGRO for the duration of the contractual relationship and for the following 10 years after the termination of the contractual relationship or until the consent is withdrawn. Similarly, if you are an employee of the controller, your personal data will be processed until the consent is withdrawn; in case of termination of employment, personal data will be processed according to applicable legal regulations.

Your personal data are stored for the duration of the contractual relationship regarding the Cash & Carry card and for another 3 years after its termination. In the case of participation in consumer competitions, your personal data are stored for the necessary period during the competition until its evaluation. Winners' personal data will be stored according to the applicable legal regulations of the Slovak Republic. Personal data of participants who did not become winners will be promptly destroyed after the end or evaluation of the respective consumer competition.

Data that need to be stored longer based on a special legal obligation will be stored for the necessary period according to the relevant special law. After the expiration of the relevant period, personal data will be deleted if their storage is not required under the applicable legal regulations of the Slovak Republic.

Your personal data are provided to supervisory authorities, courts, or law enforcement authorities only to the extent permitted by law.

If you visit one of the controller's stores or premises monitored by a camera system or its surroundings, the controller makes and processes a recording from the camera system on which you as the data subject may be captured. We have the right to make and subsequently handle such a recording based on legitimate interest (i.e., even without your consent) for the purpose of protecting our and your property and persons moving in the store (premises) and its surroundings. The recipient of your personal data is the controller – camera recordings are stored on the controller's servers. For this purpose, we keep personal data for 14 days.

In cases defined by special laws, your personal data may be provided to law enforcement authorities.

The personal data mentioned in the previous sections are mostly obtained directly from you as the data subject. If personal data are not obtained directly from you, the source of these personal data is usually various publicly available sources, registers, and records (e.g., from the commercial register). In exceptional cases, your personal data may come from third parties authorized to provide them to MILK-AGRO as the controller.

In most cases, we process personal data you provide during registration for the Cash & Carry program, registration for participation in consumer competitions organized by MILK-AGRO or included in your applications, completed questionnaires, and CVs you send us for employment purposes. We also obtain personal data directly from you by monitoring your behavior on our website and social networks and by camera recordings in our stores, premises, and their surroundings.

MILK-AGRO as the controller does not transfer your personal data to any countries outside the EU.

Just as we have rights and obligations regarding the processing of your personal data, you also have several rights as the data subject in relation to your personal data. When processing your personal data, you can exercise the following rights: the right of access and information, the right to rectification, deletion, restriction of processing, the right to data portability, the right to withdraw consent to personal data processing, the right to object, and the right to lodge a complaint.

9.1 Right of access and information

Our customers have the right to request information from us at any time about their personal data processed in our company. You also have the right to know their origin or other recipients to whom your data are transferred and the purpose of their processing. The first request for such information in written form (sent by mail) is free of charge; each subsequent issuance of requested information in this form may be charged. This does not apply to requests addressed and sent electronically to osobneudaje@milkagro.sk.

9.2 Right to rectification

If your data stored in MILK-AGRO are incorrect or outdated, you can notify us at any time, and we will correct them.

9.3 Right to erasure and right to restriction of processing

As a MILK-AGRO customer, you have the right to delete data about yourself processed by our company. Deletion can be requested by sending a request to our contact details listed in section (10.8) or electronically by filling out a form on our website in the "Personal Data Protection" section. Your data will usually be deleted immediately, but no later than one month after exercising this right. If deletion conflicts with legal, contractual, tax, or commercial-legal obligations of data archiving or other legally regulated reasons, only their "locking" may be carried out instead of deletion.

In specified cases, you have the right to restrict the processing of your data. If the restriction or deletion concerns your data, we will inform you. After deleting your data, you will no longer be able to request access to these personal data.

Exercising the right to erasure is not necessary for the Cash & Carry card if you have not used your customer card for 3 years. All personal data that do not need to be stored for legal reasons will be deleted after this period. Personal data that must not be deleted during the duration of legal storage reasons will be "locked" for your safety.

9.4 Right to data portability

Personal data processed about you by MILK-AGRO will be provided or transferred, based on your exercise of the right to data portability, to you or another person. We will do this in a common computer-readable format. This applies only if technically feasible.

9.5 Right to withdraw consent (if consent is the legal basis for processing)

Consent to personal data processing is based on the principle of voluntariness. You have the right to withdraw any such consent you have given to MILK-AGRO at any time without giving a reason, with immediate effect. This must be done by sending an email to osobneudaje@milkagro.sk. Withdrawal of consent can also be done in writing by sending a letter to MILK-AGRO spol. s r.o., Čapajevova 46, 080 46 Prešov. If you gave consent by filling out and submitting a form in any of our stores, you can also withdraw it in our store. When receiving advertising emails, you can exercise your right to withdraw by clicking the "UNSUBSCRIBE" link at the end of each sent advertisement.

9.6 Right to object to data processing

You have the right to object at any time and without giving a reason to the processing of personal data for survey and public opinion purposes.

9.7 Extended rights related to processing data for personalized/profiled advertising

Regarding the processing of personal data for personalized/profiled advertising, you have, in addition to the above rights, the right to participate in deciding what information and advertisements will be sent to you, the right to refuse such processing, and the right to express your opinion.

9.8 Right to lodge a complaint

In case of your complaint, contact us using the contacts listed in section 10.1. Exercising the above rights does not affect your right to lodge a complaint with the relevant supervisory authority. You can exercise this right especially if you believe that your personal data are processed unlawfully or contrary to generally binding legal regulations. Complaints against our personal data processing can be submitted to the Office for Personal Data Protection, located at Hraničná 4826/12, 820 07 Bratislava 27, tel. +421 2 32 313 214.

Simply fill out the form on the MILK-AGRO website, or send us an email, or call us, and we will advise you on how to proceed.

10.1 Contact details for exercising data subject rights

The fastest way to exercise and request the exercise of rights in MILK-AGRO is by filling out the web form. Of course, you can also fill out the form in the usual way (in writing) and send it to the controller by mail. If you communicate with MILK-AGRO by email at osobneudaje@milkagro.sk or by mail to MILK-AGRO spol. s r.o., Čapajevova 36, 080 46 Prešov, we will store the data sent this way – your email address, your name, surname, address, and phone number – to answer your questions or handle your request. The data will be deleted as soon as they are no longer needed for processing purposes, or we will restrict their processing if there are legal obligations to retain them.

We will handle your request without undue delay, but no later than within one month. In justified cases, especially due to the complexity of your request, we as the controller are entitled to extend this period by another two months, even repeatedly. We will inform you about such extension and its justification within one month of receiving the request.