This statement on personal data protection contains information about the processing and protection of your personal data in activities related to the electronic vignette, the collection and registration of which is provided by Národná diaľničná spoločnosť, a.s. (National Motorway Company).
1. General information on personal data processing
Národná diaľničná spoločnosť, a.s., (National Motorway Company) Dúbravská cesta 14, 841 04 Bratislava, CRN: 35 919 001, registered in the Company Register of the Municipal Court Bratislava III, Section: Sa, File No. 3518/B, is the operator of an electronic system enabling the collection and registration of vignette payments for the use of Specified Road Sections in the Slovak Republic (hereinafter referred to as “Národná diaľničná spoločnosť, a.s. (National Motorway Company)” or “the Controller”), in which personal data of vehicle and/or vehicle train operators, drivers, as well as individuals interested in matters related to vignette payment (hereinafter referred to as “Data Subjects”), are processed. The processing of such data is subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Národná diaľničná spoločnosť, a.s. (National Motorway Company) has designated a Data Protection Officer. Contact details of the Data Protection Officer:
a) e-mail: zodpovednaosoba@ndsas.sk
b) address: Národná diaľničná spoločnosť, a.s., (National Motorway Company), Dúbravská cesta 14, 841 04 Bratislava.
Národná diaľničná spoločnosť, a.s., (National Motorway Company) processes personal data of Data Subjects to the extent necessary and ensures the security of personal data processing to prevent unauthorized or accidental access to processed personal data, their destruction or loss, unauthorized transmission, unauthorized processing, or other misuse.
Národná diaľničná spoločnosť, a.s., (National Motorway Company) processes personal data manually and automatically. Automated processing of personal data does not involve automated decision-making or profiling.
The transmission of personal data to a third country or international organization does not take place during the processing of personal data by Národná diaľničná spoločnosť, a.s., (National Motorway Company).
2. Purposes of personal data processing, legal basis and extent of personal data processing
Národná diaľničná spoločnosť, a.s., (National Motorway Company) processes only such personal data whose content and extent correspond to the defined purposes, namely:
a) Vignette payment and vignette payment register
The processing of personal data of Data Subjects is necessary for the fulfillment of the legal obligation of the Controller, arising from Act 488/2013 Coll. on Vignette and on amending certain acts as amended (hereinafter referred to as the “Vignette Act”).
The personal data of Data Subjects are processed to the following extent: country of vehicle registration, registration number of the vehicle or vehicle trailer category O1 and O2, vehicle type, and the fact whether or not it is a vehicle or trailer, vignette validity and the start of its validity.
In the event of failure to provide personal data, it will not be possible to pay for the vignette and register the vignette payment in the vignette payment register.
b) Vignette payment refund
The processing of personal data of Data Subjects is necessary for the fulfillment of the legal obligation of the Controller arising from the Vignette Act.
The personal data of Data Subjects are processed to the following extent: name and surname, address, bank account number, and contact details of the vehicle operator, namely telephone number and e-mail address.
In the event of failure to provide personal data, it will not be possible to refund the vignette payment.
c) Registration of exemption for the vignette payment of vehicles and vehicle trains
The processing of personal data of Data Subjects is necessary for the fulfillment of the legal obligation of the Controller arising from the Vignette Act.
The personal data of Data Subjects are processed to the following extent: name and surname, date of birth, address, nationality, ID card or passport number, and contact details of the vehicle operator, namely telephone number, fax number and e-mail address. As for a natural person with a severe health disability who holds a parking pass, also the data about the natural person to the extent of information that he or she is a holder of such a pass.
In the event of failure to provide personal data, it will not be possible to register the exemption of the vehicle from the vignette payment.
d) Handling claims, complaints, requests and suggestions
The processing of personal data of Data Subjects is necessary for the fulfillment of the legal obligation of the Controller arising from the Vignette Act.
As for complaints, requests and suggestions not regulated by the Act, personal data is processed based on the consent of the Data Subject in order to fulfil the purpose.
The personal data of Data Subjects are processed to the following extent: name and surname, address, and contact details, namely telephone number, fax number and e-mail address.
e) Providing telephone support when submitting information related to vignette payment, verifying the vignette validity, imposing fines for offenses and regulatory offenses for violations of the Vignette Act, and providing information regarding vignette payment exemptions
The processing of personal data of Data Subjects is necessary for the fulfillment of the legal obligation of the Controller arising from the Vignette Act and is related to the purposes above, for which telephone support is provided.
The personal data of Data Subjects are processed to the extent of the telephone number.
f) Check of a vehicle operator and driver for compliance with the obligations
The processing of personal data of Data Subjects is necessary in order to fulfill the legal obligation of the Controller and arises from the Vignette Act. Národná diaľničná spoločnosť, a.s., (National Motorway Company), together with the Ministry of the Interior represented by District Offices, have
a common purpose to check the vehicle operator and driver for compliance with the obligations as defined by the Vignette Act.
The personal data of Data Subjects are processed to the following extent: the photograph of the vehicle or vehicle train, registration number of the vehicle or vehicle train, and the location and time data.
The processing of personal data is entrusted to the data processor BETAMONT s.r.o., Lieskovská cesta 456, 960 03 Zvolen, CRN: 31 564 518, registered in the Company Register of the District Court Banská Bystrica, Section: Sro, File No. 455/S, carrying out some processing operations with personal data.
3. Categories of personal data processed
Národná diaľničná spoločnosť, a. s. (National Motorway Company) processes:
I. general personal data of Data Subjects to the following extent:
a) country of vehicle registration,
b) registration number of the vehicle or vehicle trailer category O1 and O2,
c) vehicle type and the fact whether or not it is a vehicle or trailer,
d) the vignette validity and the start of its validity,
additional data required in accordance with the Vignette Act for addressing issues related to the vignette payment
within the scope of the specified purposes:
a) name and surname,
b) address,
c) nationality,
d) ID card or passport number,
e) contact details, including the telephone number, fax number, e-mail address,
and the photograph of the vehicle or vehicle train,
II. special category of personal data:
data about a natural person with a severe health disability who holds a parking pass, to the extent of the information that the person is the holder of the pass, solely for the purpose of registering the exemption of the vehicle and vehicle train from the vignette payment for the person holding the parking pass.
4. Categories of recipients of personal data
According to Sect. 8 (5) of the Vignette Act, Národná diaľničná spoločnosť, a. s. (National Motorway Company) provides data to the Police Corps, Slovak Information Service, Financial Administration, and Military Intelligence for the purpose of fulfilling their tasks according to special regulations, granting continuous and direct access to the personal data of Data Subjects collected by the electronic system enabling the collection and registration of vignettes.
According to Sect. 8( 6) Vignette Act, Národná diaľničná spoločnosť, a. s. (National Motorway Company) is required, upon request, to provide personal data of Data Subjects to the Ministry of Transport of the Slovak Republic and District Offices for the performance of tasks according to the Vignette Act and special regulations.
Personal data may be provided to third parties such as auditors, independent experts, legal representatives, courts, police, law enforcement bodies, and state and public administration authorities in the cases where this obligation is imposed on the Controller by special regulations.
5. Personal Data retention period
Národná diaľničná spoločnosť, a. s. (National Motorway Company) stores the personal data of Data Subjects only for the period necessary for the specified purpose, namely:
a) vignette payment and payment registration - personal data is stored for ten years,
b) vignette payment refund - personal data is stored for ten years,
c) registration of vehicle toll payment exemption - personal data is stored for three years,
d) handling claims, complaints, requests and suggestions - personal data is stored for five years,
e) providing telephone support when submitting information related to vignette payment, verifying the vignette validity, imposing fines for offenses and regulatory offenses for violations of the Vignette Act, and providing information regarding vignette payment exemptions - personal data is stored for the duration of processing the request,
f) check of compliance with the obligations of a vehicle operator and driver- personal data is stored for the time necessary to ascertain and prove the violation of the obligation to pay the vignette.
6. Rights of the Data Subject
a) Right to withdraw consent
In cases where the Controller processes personal data based on the consent of the Data Subject, the Data Subject may withdraw the consent at any time. The Data Subject may withdraw consent electronically at the email address of the Data Protection Officer or in form of a written notification to the registered address of Národná diaľničná spoločnosť, a. s. (National Motorway Company). The withdrawal of the consent does not affect the lawfulness of the processing of personal data that the Controller carried out based on the consent of the Data Subject.
b) Right to access personal data
The Data Subject has the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, as well as information on how Národná diaľničná spoločnosť, a. s. (National Motorway Company) utilizes the personal data of the Data Subject.
c) Right to rectification
The Data Subject has the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning him or her.
d) Right to erasure (right to “be forgotten”)
The Data Subject has the right to obtain from the Controller the erasure of personal data concerning him or her without undue delay and the Controller has the obligation to erase personal data without undue delay if the personal data is not necessary to fulfill the purpose of processing.
e) Right to restriction of processing
The Data Subject has the right to obtain from the Controller restriction of processing his or her personal data for reasons established by law (e.g. due to inaccuracy in the processing of personal data).
f) Right to data portability
Under certain circumstances, the affected person has the right to request the Controller to have the personal data transmitted to another third party. The right to data portability applies only to those
personal data that the Controller obtained on the basis of the consent of the Data Subject or on the basis of a contract to which the Data Subject is one of the contracting parties.
g) Right to file a motion to initiate proceedings for the protection of personal data
If the Data Subject believes that the Controller is processing personal data unfairly or unlawfully, the Data Subject may file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, Park One, Námestie 1. mája 18, 811 06 Bratislava.
The secure processing of personal data and compliance with processing at the Controller are overseen by the Data Protection Officer, whom you can also contact in case of asserting your rights:
a) by e-mail: zodpovednaosoba@ndsas.sk
b) by post to the address: Národná diaľničná spoločnosť, a.s., (National Motorway Company), Dúbravská cesta 14, 841 04 Bratislava.
