Information on the processing of personal data

NGX, s.r.o. provides the following information regarding the processing of personal data in accordance with
Articles 13 and 14 of Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals
persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as „GDPR“) and with Articles 19 and 20
Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments and Additions to Certain Acts, as amended
as amended (hereinafter referred to as the „Personal Data Protection Act“):

Identification and contact details

Operator: NGX, s.r.o.
Bancíkova 1/A, 821 03 Bratislava
ICKO: 51 881 560
Tel: +421 915 898 353, e-mail: info@ngx.digital
(hereinafter also referred to as „the Company“)

The Company processes personal data primarily in connection with the provision of its services and in the context of
the fulfilment of its obligations under generally binding legislation. Personal data are
collected directly by the data subjects in the performance of their tasks from third parties (e.g. employer) or
from other natural persons (due to legal obligations, e.g. family members under
labour relations). For the processing of personal data obtained from third parties or others
persons (not obtained directly from the data subject), for the purposes of fulfilling the obligations to inform the data subjects in a transparent manner
persons may be exempted pursuant to Article 14(5) of the GDPR and Section 20(5) of the Personal Data Protection Act.
Information on the processing of personal data for individual purposes (purposes of processing, legal basis, recipients,
categories of data subjects, categories of personal data, retention periods) are set out in more detail in the Annex.
Personal data shall not be processed for any purpose other than that for which it was originally collected, if so
not provided for by a special regulation, according to which the company shall proceed, or if the person concerned does not so authorise
voluntary consent.

Additional information on the processing of personal data

- Consent to the processing of personal data and the right to withdraw it
The data subject's consent shall only be obtained if no other legal ground for processing personal data applies
data without consent. The provision of personal data and consent in this case is voluntary.
Where personal data are processed on the basis of consent, the data subject shall have the right to withdraw his or her consent at any time
Recall. Withdrawal of consent does not affect the lawfulness of the processing of personal data based on
on the consent given before its revocation.

- Recipients of personal data
Personal data is generally provided primarily in the context of the performance of obligations arising from
from the applicable generally binding legal regulations or to the intermediary in the framework of contractual
relationships, if the controller chooses to do so in accordance with the GDPR and the law
on data protection.
Cross-border transfer of personal data to third countries or international organisations
Cross-border transfers of personal data to third countries or international organisations shall
does not take place, does not result from specific regulations and does not intend to make such a transfer
to perform.

- Automated individual decision-making and profiling, information society services
The company does not carry out processing of personal data based on automated individual
decision-making, does not carry out profiling or provide information society services pursuant to Article 8(1)
GDPR and Section 15(1) of the Data Protection Act.

- Obligation to provide personal data
The data subject is obliged to provide his or her personal data if the processing of personal data that
arising from specific regulations (fulfilment of legal obligations). A similar procedure applies in the case of
entering into a contractual relationship with the data subject. In the event of failure to provide personal data, resp.
the provision of incorrect or incomplete personal data would prevent the performance of obligations or
entering into a contractual relationship.
Rights of data subjects
In accordance with Articles 15 to 22 of the GDPR and Sections 21 to 28 of the Personal Data Protection Act, the data subject is entitled to
to exercise the rights of data subjects, namely the right to obtain confirmation of the processing of personal data, the right of access
to personal data, the right to rectification of personal data, the right to erasure of personal data, the right to restriction
processing of personal data, the right to data portability, the right to object to the processing of personal data
data, the right not to have decisions based on automated individual decision-making
including profiling.

- Right to confirmation and access to personal data
The data subject shall have the right to obtain confirmation from the controller as to whether his or her personal data are being processed
data. The data subject shall also have the right to request access to the personal data processed about him or her,
including the following information: (a) the purpose of the processing of the personal data relating to it, (b) the categories of
the personal data processed for the purpose, (c) the identification of the recipients or categories of recipients,
to whom the personal data have been or are to be disclosed, (d) the period of retention of the personal data or, if
(e) the source of the personal data, if the personal data have not been collected
from the data subject, (e) information on the existence of the right to request rectification of personal data relating to
of the data subject, erasure or restriction of processing, or of the right to object to processing
personal data, (f) information on the right to lodge a complaint or to initiate proceedings with the Office, (g) information on the right to lodge a complaint with the Office, (h) information on the right to lodge a complaint with the Office
for the protection of personal data of the Slovak Republic, (g) information on whether the conditions of the company
carries out automated individual decision-making or profiling.

- Right to rectification of personal data
The data subject shall have the right to have his or her personal data rectified without undue delay. The data subject
the person also has the right to request the completion of incomplete personal data. If the data subject wishes to
be informed of the notification of the fulfilment of this obligation to the recipients of its personal data, it is necessary
ask for it.

- Right to erasure of personal data
The data subject shall have the right to have his or her personal data erased without undue delay if: (a) he or she is no longer
they are not necessary for the purpose for which they were obtained and/or processed, (b) the data subject withdraws consent
with the processing of personal data and there is no other legal basis for the processing, (c) the data subject
objects to the processing of personal data for the performance of a task carried out in the public interest and legitimate interests
and there are no overriding legitimate grounds for processing the personal data, (d) the personal data are processed
unlawfully on the basis of a decision of the Office for Personal Data Protection of the Slovak Republic or other
the authority competent to decide on unlawful processing, (e) the ground for erasure is the fulfilment of
obligations under a legal regulation or an international treaty by which the Slovak Republic is bound.
The right to erasure if the personal data were collected in connection with the offer of information society services pursuant to
Article 8(1) of the GDPR or Section 15(1) of the Data Protection Act, the conditions of the company
does not apply; information society services are not provided.
However, the obligation to erase personal data does not apply if an exception is given pursuant to Article 17(3) GDPR or
§ 23 (4) of the Data Protection Act.
If the data subject wishes to be informed of the notification of the fulfilment of this obligation to the recipients of his or her
personal data, you need to request it.

- Right to restriction of processing of personal data
The data subject shall have the right to have the processing of his or her personal data restricted if he or she: (a) objects to
the accuracy of the personal data during a period of time that allows the accuracy of the personal data to be verified,
(b) the processing of personal data is unlawful by decision of the Data Protection Authority
the Slovak Republic or another authority competent to decide on unlawful processing and the data subject
the person objects to the erasure of the personal data and requests instead a restriction on its use, (c) the company
it no longer needs the personal data to achieve the purpose of the processing, but the data subject needs them
to assert a legal claim, (d) objects to the processing of personal data for the purpose of carrying out the tasks
in the public interest and for legitimate interests, pending verification that the legitimate reasons on the part of
of the company outweigh the legitimate grounds of the data subject.
The data subject will be notified in advance of the lifting of the restriction of his or her personal data.
If the data subject wishes to be informed of the notification of the fulfilment of this obligation to the recipients of his or her
personal data, you need to request it.

- Right to portability of personal data
The data subject has the right to obtain personal data concerning him or her which he or she has provided to the company
in a structured, commonly used and machine-readable format and has the right to transfer that personal
the data to another controller under the conditions laid down by law, if technically feasible.
Transferability will be assessed on a case-by-case basis.

- Right to object to the processing of personal data
The data subject shall have the right to object to the processing of his or her personal data if the processing: (a) is carried out
for the purpose of fulfilling a task carried out in the public interest, (b) carried out for the purpose of legitimate
the interests of the controller or of a third party, (c) carried out for direct marketing purposes. Profiling
the company does not perform.
The data subject does not have the right to object to the processing of personal data on grounds of public interest if
personal data are processed for scientific, historical research or statistical purposes.

- The right not to have decisions based on automated individual decision-making
including profiling
Processing of personal data which would be based on automated individual decision-making
or profiling is not carried out in the company's terms and conditions.
Contact with the supervisory authority
If the data subject considers that the processing of personal data has infringed his or her rights protected by
GDPR and the Data Protection Act, has the right to lodge a complaint with the Office for Personal Data Protection
Slovak Republic, Hraničná 12, 820 07, Bratislava 27, Slovak Republic
to initiate proceedings.

- Exercise of the rights of the data subject
In particular, the data subject may exercise his or her rights through the contact details of the controller
mentioned above. If there are reasonable doubts as to the identity of the data subject who has made a claim
their rights, the company is entitled to verify their identity, for example by requesting
additional information, summoning her, if expedient, and verifying her identity document or otherwise
in an appropriate manner.