Snapshot 96810
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Labyrinth Labs
Privacy Policies
1. PRIVACY STATEMENT FOR BUSINESS PARTNERS AND
CUSTOMERS
2. PRIVACY STATEMENT FOR JOB APPLICANTS AND FUTURE
COWORKERS
1
PRIVACY STATEMENT FOR BUSINESS PARTNERS AND CUSTOMERS
Whenever you are interested in our products and services as our potential customer, or
you would like to start a business cooperation with us as our business partner, our
company Labyrinth Labs s.r.o., having its seat at Račianska 78, 831 02 Bratislava -
mestská časť Nové Mesto, Slovakia, ID number (IČO): 52 071 391, registered with the
Commercial Registry of District Court Bratislava I, Section Sro, Insert No. 133310/B (the
“Company”, or “we”, or “our”), will process your personal data as mentioned in this
Privacy Statement for Business Partners and Customers(the “Privacy Statement”).
Please note that the content of this Privacy Statement might be updated from time to
time. This version of the Privacy Statement is effective as of September 1st, 2022. You
can always find an up-to-date version of this Privacy Statement on our website
www.lablabs.io/privacypolicies .
With respect to the Privacy Statement, we will be responsible for protection of your
personal data as a data controller. This Privacy Statement explains how we will use your
personal data obtained directly from you. In this Privacy Statement we provide you with
the following information:
▪ Whose data will be processed?
▪ Why do we process your personal data, which data do we process and on
which legal basis?
▪ With whom may we share your personal data?
▪ Do we transfer your personal data to third countries?
▪ How long do we process your personal data?
▪ Are you subject to automated decision making or profiling?
▪ Which measures do we use to protect your personal data?
▪ What are your rights?
▪ How can you contact us?
For the purposes of this Privacy Statement, the abbreviation “GDPR” means General
Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on
the protection of individuals with regard to the processing of personal data and on the
free movement of such data. Please be informed that the information provided in this
Privacy Statement shall fulfil our information obligation based on art. 13 of GDPR and
we use all our efforts to ensure our compliance with the applicable data protection
legislation
Please note that this Privacy Statement applies exclusively to the processing of personal
data carried out by us. This Privacy Statement does not deal with the processing
methods and data protection practices of other third parties for which we are not
responsible. Further, note that we do not process personal data of persons younger
than 18 years old.
2
1. Whose data will be processed?
Since we are interested in development of our business, we process personal data of:
a) potential business partners who approach us with the request for business
cooperation through our website or by other means,
b) our customers who order our products and services,
c) our suppliers who provide us with certain services based on the concluded
commercial contracts.
(“you” or “your”).
3
2. Why do we process your personal data, which data do we process and on which
legal basis?
Our main purpose for processing your data is development of our business through
provision of our products and services to potential customers. Since we wish to provide
our customers with the best quality products and services, we need to select and
engage the right suppliers, who can support us in this mission. Therefore we are
interested mostly in getting in touch with you, discussing with you our potential
business and ideally concluding a contract with you. In most of the cases, we will obtain
your personal data directly from you, but we may also receive the information about you
from third parties, e.g., if we ask for a reference.
Please find below more detailed overview of the purposes for processing of your data,
concrete scope of processed data and applicable legal basis:
DETAILED PURPOSE APPLICABLE LEGAL
PURPOSE SCOPE OF PROCESSED DATA
DESCRIPTION BASIS
Finding You may be interested in When you approach us Art. 6 (1) (f) of
business cooperation with us, in via a contact form on GDPR for the
partner getting our products our website, we will purpose of our
and and services, and thus process your name, legitimate interest
customer you may approach us surname, email, phone to find potential
to discuss via a contact form number and content of business partner
potential available on our the message that you and develop our
business website, through leave to us. If you use business
cooperatio professional social other means to contact
n networks, or by other us, then we can process Art. 6 (1) (b) of
means. We can also your personal data you GDPR for the
come to you and use the decide to share with us performance of a
same tools to discuss (e.g., on a professional contract or to take
our potential business. social network). steps prior to
conclusion of a
contract
Conclude Once we see you are We process mainly your Art. 6 (1) (b) of
business interested in a contact details (full GDPR for the
agreement cooperation, we will name, address of your performance of a
approach you, we will seat or other contact contract or to take
discuss details of our address, e-mail, phone steps prior to
potential cooperation number), information conclusion of a
and if we agree, we will that you shared with us contract
conclude a business (e.g., your job title,
agreement. Prior to the information about the
contract conclusion, we company you represent,
need to obtain certain your picture, your
data from you in order previous
4
to prepare the contract. business-related
We may use various experience, information
tools during this process about your company
to achieve the desired from the trade register,
outcome (e.g., video content of our
calls, electronic communication) and
communication, possibly references
electronic signing, about you provided to
obtaining references us from third parties.
from the third parties). Further we process
Depending on the information related to
nature of our the payment for
cooperation, we may products and services
run a basic screening of either received or
your business to provided, i.e., your bank
determine whether account number and
there are any bank related
circumstances which information.
would prevent us from
concluding an
agreement with you
(e.g. missing experience,
missing permission to
perform business).
Promotion We wish to develop and When we send you our Art. 6 (1) (f) of
and promote our business newsletter, we process GDPR for the
marketing by all possible means, your name, surname purpose of our
including posting about and email. When we legitimate interest
it on social networks post on our accounts on to promote our
and sending electronic social networks, we may business as part
newsletter about our process your name, of our direct
activities (as part of our surname, name of your marketing
direct marketing) to our company, and possibly
business partners. details of our
cooperation (unless it is
agreed otherwise due to
business reasons).
Keeping Once you approach us In our database we keep Art. 6 (1) (f) of
database of with the request for your name, surname, GDPR for the
our cooperation, or when your contact details purpose of our
business you become our partner, (address, email, phone legitimate interest
partners we include your details number), information to develop and
and into our internal about the company you maintain our
customers database of business represent, details about business
contacts, which we can
5
use later on for our cooperation or
development of our potential cooperation.
common business.
Dispute We may process your We process your Art. (6) (1) (f) of
resolution personal data for the personal data mainly in GDPR for the
purposes of solving the scope of information purpose of our
legal disputes, claims related to our business legitimate interest
complaints or other cooperation, contact to handle
similar proceedings. details, content of our disputes that may
communication, any arise in relation to
other personal data that our business
may be included in your cooperation
complaint, or part of the
dispute and necessary Art. 6 (1) (c) of
for its solution GDPR for
compliance with a
legal obligation to
which we are
subject
Fulfilment We are obliged to The scope of personal It is our legal
of our legal process your personal data we process for this obligation to
obligations data to fulfil our various purpose depends on the process your
legal obligations (e.g., requirements imposed personal data
tax obligations, on us by the public within the
accounting obligations). authorities and by meaning of art. 6
We may also be obliged applicable law. (1) (c) of GDPR.
to provide your personal
data in case of
inspection by public
authorities, when
requested by them and
for preventing,
monitoring and proving
fraud, combating money
laundering and other
criminal activities.
Further, we may have to
process your personal
data to comply with a
decision of respective
public authority or with
a judicial order.
In cases where we process your personal data based on our legitimate interest
according to art. 6 (1) (f) of GDPR, you are entitled to object to such processing
6
according to art. 21 of GDPR. If you decide to object to the processing, please do so by
contacting us through the contact information below.
If the processing of your personal data is a contractual requirement according to art. 6
(1) (b) of GDPR and you decide not to provide us with this personal data, such action
may result in the impossibility of concluding a contractual relationship with you, or other
complications related to the fulfilment of our contractual obligations.
If we are legally required to process personal data, you may have an obligation to
provide us with that personal data. If you refuse to do so, it may have various legal
consequences for you and for us, including adverse consequences (e.g., impossibility to
perform relevant action, impossibility of further cooperation, etc.).
3. With whom may we share your personal data?
We may share your personal data with our suppliers who support us in our business or
provide us with partial services, e.g. postal services, marketing services, physical security
services, legal and audit services, tax advisors, various support services, technical
subcontractors, etc. These include the following:
COING Inc
- 2100 Geng Road, Suite 210, Palo Alto, CA 94303, USA
- time tracking
Atlassian Corporation Plc
- Sydney (Global HQ), Level 6, 341 George Street, Sydney, NSW 2000, Australia
- project management
Salesforce, Inc.
- Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA
- customer relationship management
PandaDoc Inc.
- 3739 Balboa St #1083, San Francisco, CA 94121, USA
- contracts e-signing
Google, Inc.
- 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
- emails, cloud storage
Superfaktura s.r.o
- Pri Suchom mlyne 6 811 04 Bratislava, Slovakia
- accounting and contact data
Slack Technologies Limited
- Level 1, Block A, Nova Atria North, Sandyford Business District, Dublin 18, Ireland
- internal communication
We do not permit our suppliers to sell any personal data we share with them, or to use
any personal data we share with them for their own purposes or for other purposes
than to perform the services they provide to us. Before engaging any supplier, we
7
perform extensive due diligence, including detailed privacy, security and legal analysis.
We do not engage a supplier unless our quality standards are met. Our suppliers are all
subject to contract terms that enforce compliance with applicable data protection laws.
Certain of our employees and coworkers may have access to your personal data as
well. In such a case, access shall be granted only if it is necessary for the purposes
described and only if the respective employee is bound by the confidentiality duty.
Further, please be informed that our suppliers may engage additional contractors to
support them in their business and to provide them with certain services, which can
possibly also require processing of your data. Such services may include but are not
limited to: cloud services and website hosting, data analysis, information technology
and related infrastructure, customer service, email delivery, banks and payment
method providers, accounting, legal, tax and audit services. These further contractors
should provide their services based on the contract, under which they are obliged to
follow applicable law, especially with respect to observance of applicable data
protection legislation.
Lastly, please note that we may share your personal data if required to do so by law or
decision of respective public authority or court order, for example with our suppliers or
clients, tax authorities, social security agencies, law enforcement agencies or other
governmental agencies.
4. Do we transfer your personal data to third countries?
We process your personal data also outside the EU/EEA and your personal data will be
transferred outside this region. Some of our partners with whom we cooperate are
located outside the territory of the EU/EEA, respectively, have their subcontractors
located in those countries or process personal data in third countries in a different way.
In this case, we strive to ensure that your personal data is transferred exclusively to
countries that are considered to have an equivalent level of personal data protection in
accordance with the relevant European Commission decision, or where the appropriate
personal data protection measures are in place. In general, we use standard
contractual clauses for data transfers to third countries or require compliance with
other additional guarantees and measures. Regardless of the country in which your
personal data is processed, we take appropriate technical, security and organisational
measures to ensure that the level of protection is the same as in the EU/EEA. If you
would like to know more about the international transfer of your personal data and the
relevant safeguards, we have in place to govern the transfer of your personal data, you
can contact us via email sent to the address mentioned above.
5. How long do we process your personal data?
We store your personal data as long as is necessary to fulfil the purpose mentioned in
this Privacy Statement, for which the data were obtained, i.e. to pursue our legitimate
8
interests and comply with applicable laws. This means that we retain most of your data
during the initial discussion about our potential cooperation. If we conclude a business
agreement with you, we process your personal data during our contractual relationship
and 10 years afterwards (due to tax and accounting obligations). If we include your
details into our database of existing business partners and customers, we retain your
data there during our cooperation and 3 years afterwards. If you are our potential
business partner, who expressed an interest in business cooperation with us, we store
your data in our database for 3 years
Please note that we may process some of your personal data for longer period of time, if
e.g.: (i) the applicable law requires us to do so, (ii) there is an ongoing legal proceeding,
or (iii) in exceptional cases, if you have given us the permission to keep your personal
data on record for a longer period of time. Please note that the above stated period may
be prolonged in case of the request of the relevant public authority or of the court.
9
6. Are you subject to automated decision making or profiling?
Your personal data are not used for automated decision making or for profiling.
7. Which measures do we use to protect your personal data?
We make reasonable efforts to ensure a level of security appropriate to the risk
associated with the processing of your personal data. We maintain technical and
organisational measures designed to protect your personal data within our organisation
against relevant security threats, including against unauthorised access, destruction,
loss, alteration, or misuse. As already mentioned above, your data are accessible only to
a limited number of personnel who need access to perform their duties. In case you
wish to learn more about our technical and organisational measures, please do not
hesitate to contact us on the contact details mentioned below.
8. What are your rights?
You are entitled to exercise your rights as a data subject with respect to the processing
of your personal data. Please see the table below for more details.
YOUR RIGHT WHAT DOES IT MEAN?
Right to access You have the right to obtain the information whether your personal
data are processed, and if yes, you can request a copy of your
personal data we process, for which we may charge you with a fee.
If we process your personal data, you can request information
about:
- why we process your personal data,
- which personal data we process,
- with whom do we share your personal data,
- for how long we store your personal data and how do we
determine the period,
- your rights to rectification or erasure, restriction or
objection of processing of your personal data,
- your right to lodge a complaint with a supervisory authority,
- from where we collected your personal data, if not directly
from you,
- whether you are subject to automated decision making or
profiling,
- whether we transfer your personal data to third countries.
All of the above-mentioned information is included in this Privacy
Statement.
10
Right to It is important that we have the correct information, and we
rectification request you to notify us if any of your personal data is incorrect or
if any of your personal data have been changed. We will rectify your
personal data without undue delay upon your notification.
Right to If the processing of your personal data is no longer necessary or
erasure (“right has been unlawfully processed, you withdraw your consent or
to be object to the processing of your personal data, you may request us
forgotten”) to erase your personal data.
Right to From the moment when you (i) asked for rectification of your
restrict personal data, or (ii) objected the processing, until we assess your
processing request (e.g. to confirm the accuracy of your personal data or to
rectify them according to your instructions), you are entitled to
request us to restrict the processing.
You may also request us to restrict the processing of your
personal data if the processing was unlawful, but you do not want
us to delete your personal data, or if we do not need your data
anymore for the original processing purposes, however the data
are important for defending your legal claims.
This means that we (except for the retention of personal data) may
process your personal data for which the processing was restricted,
only if you consented with such processing, if it is necessary in
connection with legal claims, to protect someone else's rights, or if
there is a significant public interest in processing.
Right to object If we process your personal data based on our legitimate interest
processing or for direct marketing purposes, you may object to such
processing.
We can process your personal data further if we can demonstrate
the compelling legitimate grounds for the processing which
override your interests, rights and freedoms, or for the
establishment, exercise or defence of legal claims.
Right to data You may request us to provide you with the personal data that you
portability provided to us for the processing based on the consent or for
fulfilment of the contract. We should provide you with your
personal data in a structured, commonly used and
machine-readable format. You also have the right to request the
transfer of these data directly to another data controller, if it is
technically feasible.
Right to We do not process your personal data based on your consent, but
withdraw your in general, if some processing activities are based on the consent,
consent you will have the right to withdraw such consent at any time. Please
11
note that the withdrawal of your consent does not affect legality of
the processing previously performed based on the originally
granted valid consent.
Rights related You have the right not to be subjected to automated
to automated decision-making, including profiling, which produces legal effect for
decision you or has a similar significant effect. We do not use automated
making and decision-making or profiling for the outlined purposes of data
profiling processing. However, if you have been subject to an automated
decision and do not agree with the outcome, you can contact us
using the details below and ask us to review the decision in a
non-automated manner.
9. How can you contact us?
If you have any questions or complaints about this Privacy Statement or processing of
your personal data, please do not hesitate and contact us via phone, electronically or
send physical mail to:
e-mail: gdpr@lablabs.io
address: Labyrinth Labs s.r.o.
Data Privacy
Račianska 78
831 02 Bratislava
Slovakia
12
PRIVACY STATEMENT FOR JOB APPLICANTS AND FUTURE COWORKERS
Since you have decided to apply for a position in our company Labyrinth Labs s.r.o.,
having its seat at Račianska 78, 831 02 Bratislava - mestská časť Nové Mesto, Slovakia, ID
number (IČO): 52 071 391, registered with the Commercial Registry of District Court
Bratislava I, Section Sro, Insert No. 133310/B (the “Company”, or “we”, or “our”), after you
approach us, or after you submit your application and when we start the selection
process, this Privacy Statement for Job Applicants and Future Coworkers (the “Privacy
Statement”) will apply to you and your personal data.
Please note that the content of this Privacy Statement might be updated from time to
time. This version of the Privacy Statement is effective as of September 1st, 2022. You
can always find an up-to-date version of this Privacy Statement on our website
www.lablabs.io/privacypolicies .
With respect to the Privacy Statement, we will be responsible for protection of your
personal data as a data controller. This Privacy Statement explains how we will use your
personal data obtained directly from you or from third parties during the selection
process to find our future employee or coworker. In this Privacy Statement we provide
you with the following information:
▪ Whose data will be processed?
▪ Why do we process your personal data, which data do we process and on
which legal basis?
▪ With whom may we share your personal data?
▪ Do we transfer your personal data to third countries?
▪ How long do we process your personal data?
▪ Are you subject to automated decision making or profiling?
▪ Which measures do we use to protect your personal data?
▪ What are your rights?
▪ How can you contact us?
For the purposes of this Privacy Statement, the abbreviation “GDPR” means General
Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on
the protection of individuals with regard to the processing of personal data and on the
free movement of such data. Please be informed that the information provided in this
Privacy Statement shall fulfil our information obligation based on art. 13 of GDPR and
we use all our efforts to ensure our compliance with the applicable data protection
legislation
Please note that this Privacy Statement applies exclusively to the processing of personal
data carried out by us. This Privacy Statement does not deal with the processing
methods and data protection practices of other third parties for which we are not
13
responsible. Further, note that we do not process personal data of persons younger
than 18 years old.
1. Whose data will be processed?
Since we are interested in finding the right candidates for the positions in our
organisation, we process personal data of:
a) all candidates who actively applied for the concrete position,
b) persons, who approached us with the request to start a cooperation, or
c) of those about whom we got reference.
(“you” or “your”).
We can obtain respective data either directly from you (e.g. if you are applying through
dedicated job portals, web pages or via email) or from third parties, who refer to you as
a right candidate for the respective position.
2. Why do we process your personal data, which data do we process and on which
legal basis?
Our main purpose for processing your data is our legitimate interest to find a right
candidate for the concrete position that we need to fill. There are several ways through
which we are able achieve this legitimate interest, e.g. through collecting information
about potential coworkers and candidates and keeping of their database for the future,
during an interview conducted either in online form (video calls) or personally, through
assessing the information included in your CV, motivation letter, references or videos,
and through specific knowledge-based questionnaires provided by us.
Please note that we process your data and possibly data of your relatives in limited
scope, securely, only when we have a justified reason and legal basis for processing
and in compliance with applicable data protection legislation.
Please find below more detailed overview of the purposes for processing of your data,
concrete scope of processed data and applicable legal basis:
DETAILED PURPOSE APPLICABLE LEGAL
PURPOSE SCOPE OF PROCESSED DATA
DESCRIPTION BASIS
Submission You may apply for a When you apply for a Art. 6 (1) (f) of
of position in our position in our GDPR for the
application organisation via our organisation, we will purpose of our
or career page, or through process your name, legitimate interest
contacting job portals, or directly surname, email, to find suitable
for by contacting us via information from your candidate for
potential email. We can also CV, information from vacant position
cooperatio search for the right your profile available on
n candidate on professional social
professional social networks, and possibly
14
networks (e.g., LinkedIn) other details you decide
or use references from to share with us.
third parties provided to
us.
Interview Once we receive your We process mainly your Art. 6 (1) (f) of
and application, your contact details (full GDPR for the
candidate request for cooperation, name, academic degree, purpose of our
selection or reference on you, or address (permanent and legitimate interest
when we find you on the contact one), e-mail to find suitable
social website, we will address, phone number) candidate for
approach you and ask and information that vacant position
you for an interview you mentioned in your
conducted either CV (information about
personally or via online your date of birth, your
tools (video call). We will picture, previous work
review the professional experience, education,
information you shared skills, language skills
with us in order to and any other
assess whether you fit in information that you
our organisation and for decide to mention in
the concrete position. your CV). We may also
process data from your
motivation letter, if you
decide to send it to us.
Pre-employ Depending on the In addition to the based Art. 6 (1) (f) of
ment nature of the job, we data from the interview, GDPR for the
screening may run a we may process data purpose of our
pre-employment required to prove legal legitimate interest
screening to determine eligibility for to find suitable
whether there are any performance of candidate for
circumstances which respective jobs. vacant position
would disqualify you as Depending on the
a candidate from that nature of the job, we Art. 6 (1) (b) of
job (e.g. missing may request you to GDPR for the
qualification, missing provide us with a performance of a
trade licence). Whether declaration from contract or to take
or not a screening will relevant public authority steps prior to
occur, as well as the confirming that you conclusion of a
scope and purpose will have not been convicted contract
be discussed with you of any crime, which
prior to the start of the would disqualify you
screening. from the selection
process of applicant for
the respective job, or
15
that you are entitled to
perform business.
Obtaining We may decide to obtain In this case we will Art. 6 (1) (f) of
references references from process your basic GDPR for the
from third individuals who have contact details full purpose of our
parties worked with you in the name, academic degree, legitimate interest
past. Generally, we will address (permanent and to find suitable
only contact those contact one), e-mail candidate for
individuals if you have address, phone number) vacant position
provided us with their and information about
names and contact your previous
details. experience included in
In addition, we may the references provided
receive referrals to you to us from third parties.
from our colleagues or
other people who know
you and consider you a
suitable candidate for
us.
Conclusion If you are successful in When we decide to enter Art. 6 (1) (b) of
of the selection process, into a contract with you, GDPR for the
employmen we will conclude an we will process data performance of a
t contract employment contract or required to identify you contract or to take
or contract similar contract for in the contract - your full steps prior to
of similar cooperation with you name, academic degree, conclusion of a
nature and you will become our contact details (address contract
employee or coworker. (permanent and contact
Prior to the contract one), e-mail address, In the case of a
conclusion, we need to phone number), your special category
obtain certain data from bank account number of personal data
you in order to prepare and bank related (health data), our
your contract, to inform information. Further, we legal basis for the
respective public will process information processing is art.
authorities about your required by public 9 sec. (2) (b) of
new employment and to authorities (especially, if GDPR.
ensure that everything we conclude an
is ready for you, when employment contract)
you start to work for us. and information needed
We also enable you to to register you in the
provide us with the relevant internal
emergency contact to systems (e.g., your date
your close relatives. of birth, birth
registration number, ID
number). We will also
process information
16
about your health,
however only in case
this information is
relevant for the
performance of the job
that you apply for.
Further, we may process
personal data of your
close relatives within the
scope name, surname,
phone number,
character of your
relationship
Database Once you apply for a job In our database we keep Our legal basis for
of job in our organisation, we your contact details and processing of
candidates include your details in selected information your data is art. 6
and our internal database of originally included in (1) (a) of GDPR, i.e.
potential candidates, which we your CV (e.g., your consent
coworkers can use for another information about your
selection process. skills) that you provided
to us, when applying for
the job.
Dispute We may process your We process your Art. (6) (1) (f) of
resolution personal data for the personal data mainly in GDPR for the
purposes of solving the scope of information purpose of our
legal disputes, claims related to the selection legitimate interest
complaints or other process, contact details, to handle
similar proceedings. content of our disputes that may
communication, any arise in relation to
other personal data that the selection
may be included in your process
complaint, or part of the
dispute and necessary Art. 6 (1) (c) of
for its solution GDPR for
compliance with a
legal obligation to
which we are
subject
Fulfilment We are obliged to The scope of personal It is our legal
of our legal process your personal data we process for this obligation to
obligations data to fulfil our various purpose depends on the process your
legal obligations (e.g., requirements imposed personal data
tax obligations, on us by the public within the
accounting obligations).
17
We may also be obliged authorities and by meaning of art. 6
to provide your personal applicable law. (1) (c) of GDPR.
data in case of
inspection by public
authorities, when
requested by them and
for preventing,
monitoring and proving
fraud, combating money
laundering and other
criminal activities.
Further, we may have to
process your personal
data to comply with a
decision of respective
public authority or with
a judicial order.
In cases where we process your personal data based on our legitimate interest
according to art. 6 (1) (f) of GDPR, you are entitled to object to such processing
according to art. 21 of GDPR. If you decide to object to the processing, please do so by
contacting us through the contact information below.
If the processing of your personal data is a contractual requirement according to art. 6
(1) (b) of GDPR and you decide not to provide us with this personal data, such action
may result in the impossibility of concluding a contractual relationship with you, or other
complications related to the fulfilment of our contractual obligations.
Whenever we process your personal data based on your consent given to us in
accordance with the art. 6 (1) (a) of GDPR, you have the right to withdraw such consent
at any time, without affecting the lawfulness of processing based on consent before its
withdrawal. If you wish to withdraw your consent to the processing of your personal
data, please contact us via the contact information below.
If we are legally required to process personal data, you may have an obligation to
provide us with that personal data. If you refuse to do so, it may have various legal
consequences for you and for us, including adverse consequences (e.g., impossibility to
perform relevant action, impossibility of further cooperation, etc.).
3. With whom may we share your personal data?
We may share your personal data with our suppliers who support us in our business or
provide us with partial services, e.g. recruitment agencies, postal services, physical
security services, legal and audit services, tax advisors, various support services,
technical subcontractors, etc. These include the following:
18
PandaDoc Inc.
- 3739 Balboa St #1083, San Francisco, CA 94121, USA
- contracts e-signing
Freshworks Inc
- 2950 S. Delaware Street, Suite 201, San Mateo CA 94403, USA
- candidate tracking
Google, Inc.
- 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
- emails, cloud storage
Slack Technologies Limited
- Level 1, Block A, Nova Atria North, Sandyford Business District, Dublin 18, Ireland
- internal communication
We do not permit our suppliers to sell any personal data we share with them, or to use
any personal data we share with them for their own purposes or for other purposes
than to perform the services they provide to us. Before engaging any supplier, we
perform extensive due diligence, including detailed privacy, security and legal analysis.
We do not engage a supplier unless our quality standards are met. Our suppliers are all
subject to contract terms that enforce compliance with applicable data protection laws.
Certain of our employees and coworkers may have access to your personal data as
well. In such a case, access shall be granted only if it is necessary for the purposes
described and only if the respective employee is bound by the confidentiality duty.
Further, please be informed that our suppliers may engage additional contractors to
support them in their business and to provide them with certain services, which can
possibly also require processing of your data. Such services may include but are not
limited to: cloud services and website hosting, data analysis, information technology
and related infrastructure, customer service, email delivery, banks and payment
method providers, accounting, legal, tax and audit services. These further contractors
should provide their services based on the contract, under which they are obliged to
follow applicable law, especially with respect to observance of applicable data
protection legislation.
Lastly, please note that we may share your personal data if required to do so by law or
decision of respective public authority or court order, for example with our suppliers or
clients, tax authorities, social security agencies, law enforcement agencies or other
governmental agencies.
4. Do we transfer your personal data to third countries?
We process your personal data also outside the EU/EEA and your personal data will be
transferred outside this region. Some of our partners with whom we cooperate are
located outside the territory of the EU/EEA, respectively, have their subcontractors
19
located in those countries or process personal data in third countries in a different way.
In this case, we strive to ensure that your personal data is transferred exclusively to
countries that are considered to have an equivalent level of personal data protection in
accordance with the relevant European Commission decision, or where the appropriate
personal data protection measures are in place. In general, we use standard
contractual clauses for data transfers to third countries or require compliance with
other additional guarantees and measures. Regardless of the country in which your
personal data is processed, we take appropriate technical, security and organisational
measures to ensure that the level of protection is the same as in the EU/EEA. If you
would like to know more about the international transfer of your personal data and the
relevant safeguards, we have in place to govern the transfer of your personal data, you
can contact us via email sent to the address mentioned above.
5. How long do we process your personal data?
We store your personal data as long as is necessary to fulfil the purpose mentioned in
this Privacy Statement, for which the data were obtained, i.e. to pursue our legitimate
interests and comply with applicable laws. This means that we retain most of your data
during the selection process and will delete them within 6 months after we have found
the suitable candidate. If you provide us with the consent to include you in our database
of applicants, we will process your data for 3 years, unless you withdraw your consent
concerning processing of your data in our database earlier. If you have been selected as
a successful candidate, we will further retain your personal data in your personnel file in
accordance with applicable legislation and our internal HR regulations.
Please note that we may process some of your personal data for longer period of time, if
e.g.: (i) the applicable law requires us to do so, (ii) there is an ongoing legal proceeding,
or (iii) in exceptional cases, if you have given us the permission to keep your personal
data on record for a longer period of time. Please note that the above stated period may
be prolonged in case of the request of the relevant public authority or of the court.
6. Are you subject to automated decision making or profiling?
Your personal data are not used for automated decision making or for profiling.
7. Which measures do we use to protect your personal data?
We make reasonable efforts to ensure a level of security appropriate to the risk
associated with the processing of your personal data. We maintain technical and
organisational measures designed to protect your personal data within our organisation
against relevant security threats, including against unauthorised access, destruction,
loss, alteration, or misuse. As already mentioned above, your data are accessible only to
a limited number of personnel who need access to perform their duties. In case you
wish to learn more about our technical and organisational measures, please do not
hesitate to contact us on the contact details mentioned below.
20
21
8. What are your rights?
You are entitled to exercise your rights as a data subject with respect to the processing
of your personal data. Please see the table below for more details.
YOUR RIGHT WHAT DOES IT MEAN?
Right to access You have the right to obtain the information whether your personal
data are processed, and if yes, you can request a copy of your
personal data we process, for which we may charge you with a fee.
If we process your personal data, you can request information
about:
- why we process your personal data,
- which personal data we process,
- with whom do we share your personal data,
- for how long we store your personal data and how do we
determine the period,
- your rights to rectification or erasure, restriction or
objection of processing of your personal data,
- your right to lodge a complaint with a supervisory authority,
- from where we collected your personal data, if not directly
from you,
- whether you are subject to automated decision making or
profiling,
- whether we transfer your personal data to third countries.
All of the above-mentioned information is included in this Privacy
Statement.
Right to It is important that we have the correct information, and we
rectification request you to notify us if any of your personal data is incorrect or
if any of your personal data have been changed. We will rectify your
personal data without undue delay upon your notification.
Right to If the processing of your personal data is no longer necessary or
erasure (“right has been unlawfully processed, you withdraw your consent or
to be object to the processing of your personal data, you may request us
forgotten”) to erase your personal data.
22
Right to From the moment when you (i) asked for rectification of your
restrict personal data, or (ii) objected the processing, until we assess your
processing request (e.g. to confirm the accuracy of your personal data or to
rectify them according to your instructions), you are entitled to
request us to restrict the processing.
You may also request us to restrict the processing of your
personal data if the processing was unlawful, but you do not want
us to delete your personal data, or if we do not need your data
anymore for the original processing purposes, however the data
are important for defending your legal claims.
This means that we (except for the retention of personal data) may
process your personal data for which the processing was restricted,
only if you consented with such processing, if it is necessary in
connection with legal claims, to protect someone else's rights, or if
there is a significant public interest in processing.
Right to object If we process your personal data based on our legitimate interest
processing or for direct marketing purposes, you may object to such
processing.
We can process your personal data further if we can demonstrate
the compelling legitimate grounds for the processing which
override your interests, rights and freedoms, or for the
establishment, exercise or defence of legal claims.
Right to data You may request us to provide you with the personal data that you
portability provided to us for the processing based on the consent or for
fulfilment of the contract. We should provide you with your
personal data in a structured, commonly used and
machine-readable format. You also have the right to request the
transfer of these data directly to another data controller, if it is
technically feasible.
Right to If some processing activities are based on the consent, you will
withdraw your have the right to withdraw such consent at any time. Please note
consent that the withdrawal of your consent does not affect legality of the
processing previously performed based on the originally granted
valid consent.
Rights related You have the right not to be subjected to automated
to automated decision-making, including profiling, which produces legal effect for
decision you or has a similar significant effect. We do not use automated
making and decision-making or profiling for the outlined purposes of data
profiling processing. However, if you have been subject to an automated
decision and do not agree with the outcome, you can contact us
23
using the details below and ask us to review the decision in a
non-automated manner.
9. How can you contact us?
If you have any questions or complaints about this Privacy Statement or processing of
your personal data, please do not hesitate and contact us via phone, electronically or
send physical mail to:
e-mail: gdpr@lablabs.io
address: Labyrinth Labs s.r.o.
Data Privacy
Račianska 78
831 02 Bratislava
Slovakia
24