Legal

Personal Data Protection Terms "pantheon.team"

Introduction

These Personal Data Protection Terms "pantheon.team" (hereinafter the "Terms") govern the processing of the personal data of data subjects by the Operator, i.e. our company Pantheon Group s.r.o., which occurs on the Website https://www.pantheon.team/ or on the Operator's profile on social networks.

Within the text of these Terms, terms may be used whose definition is available in the Terms of Use of the "pantheon.team" website (hereinafter the "Terms of Use") published on the Website. Terms defined in the Terms of Use with a capital initial letter have the same meaning in these Terms, and their meaning is preserved even if they are used in a different grammatical form or with a lowercase letter, provided it is clear from the context that a defined term is meant.

These Terms are drawn up pursuant to Art. 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter "GDPR") and Sec. 19 of Act No. 18/2018 Coll. on the protection of personal data and on amendments to certain acts (hereinafter the "Personal Data Protection Act").

Pursuant to the GDPR and the Personal Data Protection Act, as the Operator we are obliged to inform you as data subjects about how your personal data will be processed and for what purposes, as well as about your rights and obligations related to the processing of personal data.

The conditions for processing personal data outside the Website and the Operator's profiles on social networks are governed by other internal regulations of the Operator on the protection of personal data.

Who are we?

When processing your personal data on the Website or on the Operator's profiles on social networks, the Operator is our company Pantheon Group s.r.o., with registered office at Mlynské nivy 56, 821 05 Bratislava, ID No.: 46 544 569, registered in the Business Register of the City Court Bratislava III, Section: Sro, Insert No.: 79717/B (hereinafter the "Operator").

If you have any questions regarding the processing of your personal data, you can contact us using the following contact details:

Postal address: Mlynské nivy 56, 821 05 Bratislava, Slovak Republic
Email address: legal@pantheon.sk

If you are not satisfied with our response, or you believe that we process your data unlawfully, you can complain to the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic. Further information about the supervisory authority of the Slovak Republic and the procedure for filing complaints can be found on its official website: https://dataprotection.gov.sk/uoou/.

What is the legal basis for processing your personal data under the GDPR and the Personal Data Protection Act?

The lawfulness of processing your personal data is justified for us by the legal bases stated for the individual purposes of processing in the following Art. 5 of these Terms.

For the most part, we process your personal data as a result of your interaction with the Website, its Content and/or the Services provided through it. As a result, the legal bases include in particular the fulfilment of our legal obligations, the performance of a contract and the implementation of pre-contractual relations, your and our legitimate interests, and your consent to the processing of personal data.

If we process your personal data on the basis of your consent, you are entitled to withdraw this consent at any time.

How do we obtain your personal data?

We obtain personal data directly from you as the data subject and, if necessary, also from other sources.

We obtain personal data directly from you e.g. by your sending a request addressed to the Operator via the contact form on the Website, by subscribing to the newsletter, by ordering Services from the Operator, by participating in a competition organised by the Operator, or directly during your visit to the Website or the Operator's profile on social networks (online identifiers).

If Services are ordered from the Operator by a legal entity of which you are a representative or contact person, the source of your personal data is that company.

In certain cases, however, we also obtain personal data from other sources, in particular public sources (e.g. the commercial register, the trade register, the central register of distraints, the register of bankrupts), or in justified cases from other third parties.

We may also obtain personal data from other sources when they contact us because of you, e.g. when they alert us to certain conduct of yours or recommend you as a possible recipient of the Services we provide or arrange.

We also obtain technical data of the devices and settings used, for example IP address, browser settings, operating system, platform, cookies; for more information on how we use cookies, see the Terms of Use of Cookies "pantheon.team", available at https://pantheon.team/cookies.

What are our purposes of processing, legal bases, categories of processed data and retention periods?

The Operator processes your personal data in accordance with the principle of minimisation, only for justified purposes, for a limited period set by the relevant legal regulations, and using the maximum possible degree of security.

The Operator processes personal data only on the basis of a legal basis, thereby complying with the principle of lawfulness.

The specific purposes of processing, legal bases, categories of processed personal data and information about the retention periods applied by the Operator are listed in the table below.

The Operator will provide you with more detailed information about the retention period of your personal data also upon your request.

PurposesLegal basisCategories of personal dataRetention period or criteria for determining it
Responding to messages and handling queries / requests from messages sent to the Operator via the contact form on the Website, messages on social networks, email communication or by telephone Art. 6(1)(f) of the Regulation - legitimate interest of the Operator, which is responding to messages from email communication or messages received in another form, for the proper conduct of business communication, the quality of service provision and the acquisition of new clientele name, surname, email, tel. no., other data stated in the message thirty (30) days from the date of delivery of the request or until the request is handled (fulfilment of the purpose), whichever occurs first
Receiving and recording orders for Services and implementing pre-contractual relations Art. 6(1)(b) of the Regulation - performance of a contract and implementation of pre-contractual relations ordinary personal data (name, surname, address of residence / place of business, contact details - tel. no., email address, bank details) until the conclusion of the contract or for one (1) year from the date of delivery of the data subject's request for cooperation / preparation of a price quotation
Provision of Services Art. 6(1)(b) of the Regulation - performance of a contract and implementation of pre-contractual relations ordinary personal data (name, surname, email address) until the complete settlement of legal and other claims arising from the contractual relationship
Handling the exercised rights of data subjects Art. 6(1)(c) of the Regulation - fulfilment of legal obligations ordinary personal data that are part of the request until the exercised rights are handled
Recording the exercised rights of data subjects and recording the ways in which the exercised rights were handled Art. 6(1)(f) of the Regulation - legitimate interest of the operator, which is recording the exercised rights of data subjects in order to demonstrate the fulfilment of obligations arising from legal regulations ordinary personal data that are part of the request five (5) years from the date the rights were exercised
Resolving disputes, asserting contractual and legal claims Art. 6(1)(f) of the Regulation - legitimate interest of the operator, which is asserting or defending the legal claims of the Operator, preventing the occurrence of damages and ensuring the fulfilment of receivables and other legal claims of the Operator ordinary personal data (title, name, surname, address and, in the case of a foreigner, type of residence, bank account number, payment data, telephone number, email, signature) five (5) years from the final conclusion of the proceedings or from the settlement of the legal claim
Direct marketing - former and current customers (especially the newsletter) Art. 6(1)(f) of the Regulation - legitimate interest of the operator, which lies in the operator's need to inform its clients about business offers and other information concerning clients email address, name, surname, affiliation to the client's company three (3) years from the date of providing the service or until unsubscribing from the newsletter
Direct marketing (especially sending the newsletter to new customers) Art. 6(1)(a) of the Regulation - consent of the data subject email address, name, surname, affiliation to the client's company three (3) years from the date of granting consent or until its withdrawal, whichever occurs first
Taking and publishing photographs and audiovisual recordings of data subjects on the operator's website and on other communication channels (the social networks Facebook, Instagram, LinkedIn and the channel on the Youtube service) Art. 6(1)(a) of the Regulation - consent of the data subject photograph, audiovisual recording five (5) years from the date of granting consent or until its withdrawal, whichever occurs first
Publishing the title, name, surname, tel. no., email address and position of data subjects on the Operator's Website and on other communication channels (the social networks Facebook, Instagram, LinkedIn and the channel on the Youtube service) Art. 6(1)(a) of the Regulation - consent of the data subject name, surname, tel. no., email address, position five (5) years from the date of granting consent or until its withdrawal, whichever occurs first
Organising competitions for the public and publishing winners Art. 6(1)(a) of the Regulation - consent of the data subject ordinary personal data (title, name, surname, address of residence, photograph) two (2) years from the date of granting consent or until its withdrawal, whichever occurs first
Publishing references about the Operator's services (on the website, communication channels and in the Operator's presentation and business materials) Art. 6(1)(a) of the Regulation - consent of the data subject name, surname, position in the client's company three (3) years from the date of granting consent or until its withdrawal, whichever occurs first

How is the processing of personal data secured?

Your personal data is stored in accordance with the technical and organisational security measures adopted by the Operator, for the period necessary to fulfil the purpose of processing. These measures include, for example, data encryption, access management based on the 'need-to-know' principle and regular data backup. Access to your personal data is exclusively for persons whom the Operator has entrusted with the processing of personal data and who process personal data solely on the basis of the Operator's instructions.

Personal data stored on data storage is backed up in accordance with the security requirements of the General Data Protection Regulation and the Personal Data Protection Act. In the event of a security incident, the Operator has implemented procedures for its rapid detection and resolution. More detailed conditions of the security of processing and the protection of information are set out in the Operator's related internal regulations.

To whom do we provide or disclose your personal data?

Under the GDPR and the Personal Data Protection Act, our company has the status of Operator, which means that it is our company that defines the purposes of processing personal data when using the Website or the Operator's profile on social networks.

In connection with our activities, your personal data may be transferred or disclosed to other entities, whether in the position of an independent operator or an intermediary.

As the Operator, we ensure that everyone to whom your personal data is transferred complies with a high standard of its protection. Under no circumstances do we provide your personal data to an entity that does not have this standard ensured.

In certain cases, the Operator has an obligation to provide your personal data to public authorities or other recipients who are entitled to process your personal data. These recipients include courts, law enforcement authorities, the relevant tax administrator, supervisory authorities (the Slovak Trade Inspection) as well as the Office for Personal Data Protection.

The Operator may also, when processing your personal data for the purposes stated above in Art. 5 of these Terms, provide personal data to these categories of recipients:

  • related parties of the Operator within the Pantheon group, where related parties are considered to be legal entities that participate in the Operator's registered capital with a business share of at least 15% or in which the Operator has at least a 15% direct or indirect business share. Simply put, these are legal entities that are connected with the Operator by an ownership relationship;
  • subcontractors with whom the Operator cooperates in providing the Services;
  • providers of accounting services;
  • providers of personal data protection services;
  • providers of marketing and advertising services;
  • operators of social networks (especially for marketing and communication purposes);
  • providers of cloud services and software solutions;
  • providers of hosting and email hosting services;
  • providers of training, courses and similar opportunities for deepening qualifications;
  • lawyers, or law firms.

The Operator will provide you with more detailed information about the recipients of your personal data upon your request.

Will your personal data be provided outside the European Union?

Your personal data may be subject to cross-border transfer to third countries that are not a member state of the European Union or a contracting party to the Agreement on the European Economic Area.

When carrying out the transfer of personal data to third countries, the Operator always takes into account that these countries guarantee adequate protection of personal data. The Operator does not transfer personal data to third countries that do not guarantee adequate protection of personal data.

In the event of a possible transfer of personal data to third countries, the Operator always undertakes to ensure a sufficient degree of protection of the personal data of data subjects.

If the Operator were to carry out a transfer of personal data to third countries in the future that would not guarantee an adequate level of protection, it undertakes to proceed in accordance with the GDPR and the Personal Data Protection Act, as well as other generally binding legal regulations.

Among the range of recipients to whom your data may be provided are providers of cloud services, social networks and other technology companies. These transfers take place when sharing information on social networks, as well as in connection with the use of various cloud and hosting services.

The Operator will, upon your request, provide you with more detailed information about the transfer of your personal data to third countries and international organisations.

Will your data be used for automated decision-making or profiling?

In connection with the processing of the personal data of data subjects, the Operator does not use decision-making that is based solely on automated processing, including profiling, and which has legal effects that concern the data subject or similarly significantly affect them.

What rights do you have in connection with our processing of your personal data?

The Personal Data Protection Act as well as the GDPR provide you with several rights that allow you to keep the protection of your personal data under your own control. The Operator fully respects these rights. In this article you will therefore learn what these rights are.

Right of access to personal data

This right means that you are entitled to request from us confirmation as to whether personal data concerning you is being processed. If we process such personal data about you, you have the right to obtain access to your personal data and information about:

  • why we process your personal data (the purpose of processing personal data);
  • what data about you we process (the category of personal data);
  • to whom your personal data may or will be provided (identification of the recipients or range of recipients);
  • how long we will retain your personal data (the retention period of personal data);
  • that you have the right to request from us the correction of personal data, its erasure as well as restriction of its processing, or that you have the option to object to the processing of personal data;
  • that you have the right to file a motion to initiate proceedings on the protection of personal data under the Personal Data Protection Act, or the right to lodge a complaint with the supervisory authority under the GDPR, which is the Office for Personal Data Protection of the Slovak Republic;
  • where your personal data comes from (information about the source), if you did not provide the personal data to us directly;
  • whether we use automated individual decision-making including profiling under Sec. 28(1) and (4) of the Personal Data Protection Act; in particular about the procedure used, as well as about the significance and envisaged consequences of such processing of personal data for you;
  • about the appropriate safeguards relating to the transfer, in case we transfer your personal data to a third country or international organisation.

This right of access also means for you the possibility to obtain the personal data that we process about you. We will provide you with a copy of your personal data that we process about you. However, if you repeatedly request the provision of your personal data, we may charge you a reasonable administrative fee in connection with your request for a copy of your personal data.

Right to correction of personal data

Within the use of the Websites, their Content, Services and/or our profile on social networks, we ask you to provide us with correct data. However, if it nevertheless happens that we process incorrect data about you, the right to correction of personal data means that you are entitled to request that we correct incorrect personal data concerning you. Also, with regard to the purpose of processing personal data, you have the right to have your incomplete personal data completed.

Right to erasure of personal data

You have the right to have us erase personal data concerning you, provided that at least one of the following reasons is met:

  • your personal data is no longer needed for the purpose for which we obtained or otherwise processed it;
  • you have withdrawn your consent to the processing of personal data on the basis of which we process your personal data, and at the same time there is no other legal basis for its further processing;
  • you object to the processing of personal data that is carried out on the legal basis of public interest or legitimate interest, and there are no overriding legitimate grounds for its processing;
  • your personal data was processed unlawfully;
  • your personal data must be erased, as it is necessary to fulfil an obligation under the law of the Slovak Republic or the law of the European Union;
  • your personal data was obtained in connection with the offer of information society services under Sec. 15(1) of the Personal Data Protection Act.

However, your right to erasure of personal data may not be granted in a specific case, with regard to specific circumstances, if the processing of personal data is necessary for:

  • exercising our right to freedom of expression or the right to information;
  • fulfilling a legal obligation;
  • asserting our legal claim;
  • archiving purposes, historical research purposes or statistical purposes, if it is likely that the right to erasure would make it impossible or seriously impair the achievement of the objectives of such processing.

Right to restriction of processing of personal data

You have the right to have us restrict the processing of personal data concerning you, provided that at least one of the following reasons is met:

  • during the period enabling us to verify the accuracy of your personal data, you contest the accuracy of your personal data;
  • the processing of personal data is unlawful, you object to the erasure of personal data and request, instead of erasure, the restriction of processing of personal data;
  • we no longer need your personal data for any of the purposes of processing, or you need it to demonstrate, assert or exercise your legal claims;
  • you object to the processing of personal data, until verification of whether our legitimate interests override your legitimate interests.

Right to portability of personal data

If our right to process your personal data is based on your consent or on the fulfilment of obligations arising from a contract that we have concluded with you, you have the right to request the transfer of data concerning you that you have provided to us, to another operator of personal data.

Right to withdraw consent

If we process your personal data on the legal basis of the consent of the data subject, you have the right to withdraw this consent at any time, even before the expiry of the period for which this consent was granted. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to the ineffectiveness of automated individual decision-making including profiling

You have the right to request that automated individual decision-making including profiling be ineffective towards you.

Right to object

If you have reasons relating to your specific situation, you have the right to object to the processing of your personal data, if the legal basis for such processing is our legitimate interest.

However, if our legitimate interest in processing overrides your personal interest, we may continue processing your data, despite your objection to the processing. We are also entitled to continue processing your data if it is necessary for demonstrating, asserting or defending our legal claims.

If, as a data subject, you do not have full legal capacity, your rights under the GDPR and the Personal Data Protection Act may be exercised by your legal representative. The rights of a data subject who is deceased may, under the GDPR and the Personal Data Protection Act, be exercised by a close person.

If your requests as a data subject are manifestly unfounded or disproportionate, in particular due to their repetitive nature, we may charge a reasonable fee taking into account the administrative costs of providing the information, or refuse to act on the request.

You can exercise your rights stated above through the contact details of the Operator specified in Art. 2 of these Terms.

The response to the exercise of your rights will be provided by the Operator free of charge. In the case of a repeated, unfounded or disproportionate request to exercise your rights, the Operator is entitled to charge a reasonable fee for providing the information. The Operator will provide you with a response within one (1) month from the date you exercised your rights. In certain cases, the Operator is entitled to extend this period, in the case of a high number and complexity of requests of data subjects, but by no more than two (2) months. The Operator will always inform you of the extension of the period.

Date of publication and effectiveness of the Personal Data Protection Terms in this version: 1 April 2025.

Back to home