Personal data protection

List of Processed Personal Data

 

Data required for sending a message via the online contact form
– Name
– Email address
– Telephone number

 

Data required for order fulfillment
– First and last name
– Email address
– Permanent address or other mailing address for delivery
– Telephone number

 

Billing information
– First and last name
– Permanent address or other billing address
– Bank account number / IBAN

 

Contact information for delivery purposes
– First and last name
– Permanent address or other delivery address
– Telephone number – for confirming the date, time, and place of delivery or in case of changes to the order
– Email address – to send electronic confirmation of the order and order status updates, and as an emergency communication channel if the customer is unreachable via phone.

Data Processing and Storage Period

Your personal data, which we have processed or are processing under Article 6(1)(b) of the GDPR – for the purpose of fulfilling obligations of the controller Alesa s.r.o. towards customers and clients – are further processed for the purpose of complying with our legal obligations related to taxes and accounting under generally binding legal regulations (e.g. retention of accounting records of confirmed orders and invoicing for delivery purposes in accordance with Act No. 431/2002 Coll. on Accounting, as amended, or for demonstrating compliance with tax obligations under the relevant tax legislation, such as Act No. 595/2003 Coll. on Income Tax, Act No. 563/2009 Coll. on Tax Administration, etc.). These must be retained for the period required by the relevant legal regulations. In all cases, we adhere to the principle of data minimization under Article 5(1)(e) of the GDPR, and personal data not subject to archiving under special legal regulations will be deleted or anonymized.

Personal data processed under Article 6(1)(f) of the GDPR – based on legitimate interest, which were obtained in response to your inquiry or question regarding our services and products and where verification or follow-up was necessary – are deleted immediately if they do not result in a pre-contractual or contractual relationship.

 

As the controller, we will ensure deletion of personal data without undue delay after:
– All contractual relationships between you and us as the controller have ended; and/or
– All your obligations towards the controller have ceased; and/or
– All your complaints and requests have been resolved; and/or
– All other rights and obligations between you and us as the controller have been settled; and/or
– The purposes for processing as defined by legal regulations or your consent (if applicable) have been fulfilled; and/or
– The period for which consent was granted has expired, or the data subject has withdrawn consent; and/or
– A request for deletion has been granted under applicable justifications; and/or
– A legal basis for processing has ceased and any retention period has expired based on the principle of storage limitation;
– And there is no longer a legitimate interest of the controller, and all obligations under applicable legislation that require retention of personal data (e.g., for archiving or tax audits) have expired.

Any accidentally obtained personal data are never further systematically processed for any specified purpose. If possible, we will inform the data subject whose data were accidentally obtained and provide support in restoring control over their data. After resolving the situation, the data will be securely destroyed without delay.

For more detailed information about the specific retention period of your personal data, please contact us using the contact details on our website.

 

Data Disclosure

 

Our company does not disclose obtained data under any circumstances.

Cross-Border Transfer of Personal Data

Cross-border transfer of your personal data may occur depending on the purchased trip.

Details about the cross-border transfer of your personal data in the event of purchasing a stay, vacation, or tour outside of the Slovak Republic, including the destination country of the recipient, are outlined in the contract terms of service for the given trip or in the separate section "Recipients" in point 2.

 

Rights and Obligations of the Data Subject

 

The customer is obligated to provide only complete and truthful information.

The customer agrees to update their personal data in case of changes, no later than before placing the next order following the change.

If the customer provides third-party personal data (e.g., name, phone number), they confirm doing so with that person's consent and that the third party has been informed of the policies, rights, and obligations outlined on this website.

 

As our client and data subject, you have the following rights under the law. You can exercise your rights:
– In person at the controller’s office at Koprivnická 9/D, 841 02 Bratislava – Dúbravka
– By email: solarova@alesa.sk
– In writing to: Alesa s.r.o., Koprivnická 9/D, 841 02 Bratislava – Dúbravka

 

We will respond as soon as possible, but no later than 30 days from receiving your request. According to applicable laws and the GDPR, you are entitled to the following:

 

Right of Access
You have the right to request confirmation of whether your personal data are being processed and, if so, to receive a copy of the data and related information as defined in Article 15 of the GDPR or § 21 of the Act. If we process a large amount of data about you, we may ask you to specify which data you want access to.

 

Right to Rectification
To ensure we process only current and accurate data, we ask that you notify us of any changes. You have the right to have incorrect data corrected.

 

Right to Erasure
If the conditions of Article 14 of the GDPR or § 23 of the Act are met, you can request the deletion of your personal data. This includes, for example, withdrawing your consent where no other legal basis exists, if the data were processed unlawfully, or if the original purpose has expired. We will not delete your data if they are necessary for legal claims.

 

Right to Restriction of Processing
You may request restriction under Article 18 of the GDPR or § 24 of the Act, e.g., while the accuracy of the data is contested or if processing is unlawful but you wish for the data to be retained for legal claims.

 

Right to Data Portability
If processing is based on consent or a contract and is automated, you have the right to receive your data in a machine-readable format or request transfer to another controller where technically feasible. This right does not apply to public interest or public authority processing.

 

Right to Object
If we process your data based on public interest, public authority, or legitimate interest, you may object. We will restrict processing unless we demonstrate compelling legal grounds or need to establish, exercise, or defend legal claims. You may object to direct marketing at any time; in that case, your data will no longer be processed for such purposes.

 

Right to File a Complaint
If you believe your data have been processed unlawfully, you can file a complaint with a supervisory authority in your country or where the violation occurred. In Slovakia, the authority is:

 

Office for Personal Data Protection
Hraničná 12, 820 07 Bratislava, Slovakia
Website: www.dataprotection.gov.sk
Phone: +421 2 3231 3220

 

Right to Withdraw Consent
If processing is based on your consent, you may withdraw it at any time. This does not affect processing done prior to withdrawal. If you later wish to receive our commercial and marketing offers again, you can re-grant your consent through any of the above contact methods.