Privacy policy template (GDPR)
Law-firm GDPR template · Laniková Group
Law in force as at
Zásady ochrany osobných údajov
- NAŠE ÚDAJE
- Kto sme?
- KATEGÓRIE OSOBNÝCH ÚDAJOV, ÚČEL, PRÁVNY ZÁKLAD A OBDOBIE
- Účtovná agenda
- Eshop
- Reklamácie
A privacy policy is the document through which the controller meets its information duty towards data subjects: it explains what data it processes, on what legal basis, how long it keeps the data and what rights the person the data concerns has.
The duty follows directly from Regulation (EU) 2016/679 (GDPR), specifically from Articles 13 and 14. In Slovakia it is supplemented by Act 18/2018 Coll. on personal data protection.
Who needs this document
- Every website that collects any personal data, including through a contact form
- Online shops processing orders and delivery addresses
- Newsletter operators
- Employers processing the data of employees and job applicants
What the document must contain
- The identity and contact details of the controller
- The purposes of processing and the legal basis for each purpose
- The categories of personal data processed
- The recipients or categories of recipients of the data
- Information on transfers to a third country, where these take place
- The retention period or the criteria for determining it
- The rights of the data subject, including the right to lodge a complaint with the supervisory authority
- Information on automated decision-making, including profiling, where it is carried out
Legal basis
Nariadenie (EÚ) 2016/679 (GDPR)
The information duty is in Articles 13 and 14, the rights of the data subject in Articles 15 to 22.
Zákon č. 18/2018 Z. z. o ochrane osobných údajov
Supplements the GDPR within the Slovak legal order.
Most common mistakes
No legal basis for the individual purposes
The most common shortcoming. Listing what data is processed is not enough. Every purpose has to have a stated legal basis, for example performance of a contract, legitimate interest or consent.
Consent as a universal legal basis
Processing data needed to fulfil an order rests on performance of a contract, not on consent. If everything is built on consent, withdrawing it would leave the controller without a basis for processing it has to carry out anyway.
Recipients of the data not listed
The hosting provider, the emailing tool, analytics and the carrier are recipients of the data and belong in the document.
Confusing the privacy policy with the cookie policy
These are two different documents with a different legal basis. Cookies and similar technologies have their own rules and consent for them is handled separately.
Frequently asked questions
Does a small website without an online shop need a privacy policy?
If the website collects any personal data, even only through a contact form or a newsletter, the information duty under Articles 13 and 14 of the GDPR applies.
What is the difference between a controller and a processor?
The controller determines the purposes and means of processing. The processor processes the data on the controller's behalf, for example a hosting provider or an emailing tool.
Where is a complaint about processing lodged?
The supervisory authority in Slovakia is the Office for Personal Data Protection of the Slovak Republic. Information about the right to lodge a complaint has to form part of the policy.
Privacy policy (GDPR) for your business
You fill in your company details and the document is ready in under a minute.
Generate the document