UNDER WHICH REGULATION IS THIS INFORMATION OBLIGATION?
Pursuant to Articles 13 and 14 of Regulation 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC ("GDPR") ("Information obligation") “)

WHO IS THE CARRIER OF MY PERSONAL DATA?
The operator of your personal data is:
TapGest s. r. o., registered office: Staré Grunty 6347/18 841 04 Bratislava - mestská časť Karlova Ves, ID number: 50641905(hereinafter referred to as the "Operator")
CONTACT: info@tapgest.com | +421 800 232 710

WHO CAN I TURN TO IN CASE OF QUESTIONS?
We care about protecting your privacy. In case of questions or questions about the protection of your personal data, you can contact the responsible person of the Operator at any time:

Name and surname: Tomas Tiefenbach

Contact details: tomas.tiefenbach@tapgest.com | +421 800 232 710

WHO IS THIS INFORMATION OBLIGATION FOR?
This information obligation is intended for:
• visitors to public spaces where the Operator performs monitoring via a camera system (hereinafter referred to as the “Visitor of public spaces”),
• visitors to websites where the Operator uses cookies necessary to provide the functionality of the website and improve the user experience (hereinafter referred to as the "Website Visitor").
• Other affected persons whose personal data the Operator processes on the basis of a special legal regulation or the legitimate interest of the Operator (senders and recipients of the Operator's correspondence; job seekers; affected persons exercising their rights under the GDPR)

IN WHICH SITUATIONS DO YOU PROCESS MY PERSONAL DATA?
We process your personal data without your consent only in cases where applicable law allows us to do so. You must provide us with the personal data that you provide to us on the basis of a contract, special regulation or on the basis of a legitimate interest, otherwise we will not be able to fulfill your or our obligations intended for that purpose.
We process your personal data without your consent only in the following cases and on the basis of the following legal bases:
• If you are a visitor to public spaces in which we perform monitoring through a camera system, we process your personal data exclusively for the purpose of applied research in the field of marketing, the so-called creation of aggregated anonymous statistics on the performance of off-line advertising campaigns.
• If you are a Website Visitor, your personal data will be processed on the basis of a legitimate interest in monitoring traffic to the Operator's website.
• If you are the sender and recipient of the Operator's correspondence, we process your personal data on the basis of a special legal regulation.2
• If you are an affected person exercising your rights under the GDPR, we process your personal data on the basis of the Operator's legitimate interest in complying with the GDPR.
• If you are an Advertiser, when registering your advertising campaign in the LURITY system, the processing of your personal data is necessary for the purposes of fulfilling the contract between you (the affected person) and the Operator. We use this personal information exclusively for the purpose of fulfilling contractual obligations, which includes the provision of customer support.
• If you are a Supplier / Customer, the processing of your personal data is necessary for the purpose of fulfilling the contract between you (the affected person) and the Operator when concluding a contractual relationship and after concluding a contractual relationship. We use this personal data exclusively for the purpose of fulfilling contractual obligations, including the provision of customer support. • If you are a Person authorized by the Supplier / Customer, the processing of your personal data is necessary for the purposes of the legitimate interest of the Operator, which is the performance of the contract between the Supplier / Customer and the Operator.
• If you are the recipient or sender of the Operator's correspondence, we process your personal data on the basis of a special legal regulation.2
• If you are a Visitor of the Operator's website, your personal data is processed on the basis of a legitimate interest in monitoring traffic to the Operator's website.
• If you are a job seeker with the Operator, we process your personal data on the basis of special legal regulations.3
• If you are an affected person exercising your rights under the GDPR, we process your personal data on the basis of the Operator's legitimate interest in complying with the GDPR.

2 Act no. 395/2002 Coll. on archives and registries and on the amendment of certain laws as amended
3 Act no. 311/2001 Coll. Labor Code as amended; Act no. 55/2017 Coll.

WHAT PERSONAL DATA DO YOU PROCESS ABOUT ME?
We process your personal data in the following cases and to the following extent:
• If you are a Visitor of public spaces, we process the following personal data about you:
1. Estimation of age and sex based on facial features;
2. The start time of the interaction and the end time of your interaction with the advertising screen;
3. The distance of your face from the device;
We do not identify you when we process this personal data. We use the data exclusively for statistical purposes.
This data is stored on the server of our server provider, which meets international security standards, for a maximum of 180 days.
• If you are an Advertiser or a Person authorized by the Advertiser, common personal data, especially contact details such as name, surname, telephone number and e-mail address, when registering in the LURITY system.
• If you are a Supplier / Customer or a Person authorized by the Supplier / Customer, when concluding contractual relations and after concluding contractual relations with the Operator, we process all your personal data necessary for concluding contractual relations (ordinary personal data - contact and identification data) and other data necessary to achieve for the purpose of contractual relations.
• If you are the recipient and / or sender of correspondence of the Operator, we process your current personal data about you, such as title, name, surname, address, e-mail address and other data necessary for the fulfillment of our obligations under special legal regulations.2
• If you are a Website Visitor, we process your IP address and cookies.
• If you are a job seeker with the Operator, we process common personal data about you, especially contact details and personal data stated in the CV and / or motivation letter.
• If you are an affected person exercising your rights under the GDPR with the Operator, we process personal data necessary for you to keep records and fulfill obligations under the GDPR (current personal data - identification data, contact information, etc.) and other data that you have provided to us in as part of your application.

2 Act no. 395/2002 Coll. on archives and registries and on the amendment of certain laws as amended

FOR WHICH TIME DO YOU PROCESS MY PERSONAL DATA?
We store your personal data for as long as necessary to fulfill the stated purposes. When storing personal data, we follow special regulations that set us the deadlines for storage and / or the basic principles of the GDPR regarding the storage and disposal of personal data.
If you are a visitor to public areas where we perform monitoring via a camera system, this data is stored on the server of our server provider, which meets international security standards, for a maximum of 180 days.

WHAT SOURCES DO MY PERSONAL DATA COME FROM?
If you are a Visitor of public spaces, the source of your personal data is smart advertising screens.
In other cases, we process information that you have provided to us in connection with the conclusion of the contract or that you have communicated to us in the course of our cooperation or provided to us by another person of the Advertiser.

WHO RECEIVES MY PERSONAL DATA?
We note that we do not provide personal data about Visitors to public spaces to entities other than our intermediaries (server provider and programmers). This personal information is used to generate anonymous statistics on the appearance of advertising campaigns. We provide anonymous statistics on the appearance of advertising campaigns to our clients (advertisers). Anonymous statistics do not contain any of your personal data, only aggregated and anonymized statistical data from which you cannot be identified in any way.
We provide your personal data only in justified cases and only to the extent necessary to the following categories of recipients:
• To the server provider - DigitalOcean EU B.V. - branch office Germany;
• Programmers who develop and maintain software source code.
• to the extent necessary to other entities in cases where the obligation to provide your personal data is imposed on us by law, or if it is necessary to protect our legitimate interests.
In other cases (unless they are visitors to public spaces) We provide your personal data only in justified cases and only to the extent necessary to the following categories of recipients:
• our contractual partners, whom we need for our normal functioning and implementation of contractual relations (server provider, external accounting firm, programmer, etc.)
• to other entities in cases where the obligation to provide your personal data is imposed on us by law, or if it is necessary to protect our legitimate interests.

DO YOU TRANSFER MY PERSONAL DATA TO THIRD COUNTRIES?
We do not provide your personal data to third countries outside the EU.

WHAT ARE MY RIGHTS WITH REGARD TO THE PROTECTION OF MY PERSONAL DATA?
• right of access - you can ask us for access to the personal data we process about you.
• the right to rectification - you can ask us to correct inaccurate or incomplete personal data that we process about you.
• right to delete - you can ask us to delete your personal data if any of the following situations occur:
1. personal data are no longer required for the purposes for which they were obtained or otherwise processed;
2. in the past, you have given us consent to the processing, which you revoke, and we are not entitled to process the personal data in question without your consent;
3. you object to processing carried out in specific situations under the GDPR (task carried out in the public interest, legitimate interest of the Operator or profiling) and no legitimate reasons for processing prevail over your interests, rights and freedoms, or
4. object to processing for direct marketing purposes;
5. personal data have been processed illegally;
6. personal data must be deleted in order to comply with a legal obligation under EU law or the law of the Member State to which the Operator is subject;
7. personal data were obtained in connection with the offer of information society services according to the GDPR.
• the right to restrict the processing - you can ask the Operator to restrict the processing of your personal data if any of the following situations occurs:
1. you have denied the accuracy of the personal data for the time necessary for the Operator to verify the accuracy of the personal data;
2. the processing of your personal data is illegal, but you refuse to delete this data and instead request a restriction on its use;
3. the controller no longer needs personal data for processing purposes, but you request them to determine, enforce or defend legal claims;
4. you have objected to the processing of your personal data in specific situations according to the GDPR (task performed in the public interest, legitimate interest of the Operator or profiling), until it is verified that the legitimate reasons of the Operator outweigh your legitimate reasons.
• the right to data transfer - if we process your personal data on the basis of
1. your consent or
2. it is necessary for the performance of the contract to which you are a party,
and at the same time it is a process by automated means of processing, you have the right to request the transfer of personal data to another operator. This applies if you have provided personal data to the Operator, in a structured, commonly used and machine-readable format and this right does not adversely affect the rights and freedoms of others.
• the right to object - you can object to the processing of your personal data at any time by the Operator for the purposes of direct marketing carried out on the basis of the Operator's legitimate interest and whenever we process your personal data on the basis of a legitimate interest or public interest, including profiling.
• the right to lodge a complaint - you have the right to lodge a complaint with the supervisory body, which is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.uoou.sk.
Your rights may be limited by relevant EU or Member State law.
The person concerned may exercise his rights orally, in writing or electronically, through the above contact details. If the person concerned requests the exercise of the right, he is obliged to prove his identity to the Operator.

1 Act no. 172/2005 Coll. on the organization of state support for research and development, as amended .; Directive of the Ministry of Education of the Slovak Republic no. 27/2006-R of 21 December 2006 on the system of science and technology departments and the code list of science and technology departments; Annex no. 1 to the Directive of the Ministry of Education of the Slovak Republic no. 27/2006-R of 21 December 2006 on the system of science and technology departments and the code list of science and technology departments.

2 Act no. 395/2002 Coll. on archives and registries and on the amendment of certain laws as amended

3 Act no. 311/2001 Coll. Labor Code as amended; Act no. 55/2017 Coll.