Privacy policy

Introduction

This English translation is provided for information only. The Slovak version is legally binding.

The purpose of this policy is to demonstrate that the controller processes personal data in accordance with the legislation currently in force, in particular Act No. 18/2018 Coll. on the Protection of Personal Data (hereinafter the ‘new ZOOÚ Act’) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the ‘GDPR’).

The new legislation requires the controller, taking into account the nature, scope and purpose of the processing of personal data and the risks of varying likelihood and severity for the rights of natural persons, to implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that personal data are processed in accordance with the new legislation. The controller is obliged to update these measures where necessary.

This document is the result of an assessment of the controller’s processing of personal data for the purposes of the legislation governing personal data protection. Introducing standardised personal data protection based on the principles set out here minimises the risk of personal data breaches.

Controller

Company name

Z&H Lean, s. r. o.

Registered office

Hraničná 3975/32, 058 01 Poprad

Legal form

limited liability company (spoločnosť s ručením obmedzeným)

Company ID (IČO)

52 758 486

Registration

Company registered in the Commercial Register of the District Court of Prešov, section Sro, insert no. 39309/P

Statutory body

Ing. Štefan Hrebík – managing director
Ing. Milan Svitana – managing director

Controller’s contact details

Name

Ing. Štefan Hrebík – managing director
Ing. Milan Svitana – managing director

Phone

+421 905 905 275

Email

info@zahlean.sk

Postal address

Hraničná 3975/32, 058 01 Poprad

Legal basis for processing personal data

The legal basis for the controller’s processing of personal data concerning data subjects of all categories is provided by the following provisions of the GDPR and of the new ZOOÚ Act respectively:

1. processing of personal data is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract – under Section 13(1)(b) ZOOÚ and Article 6(1)(b) GDPR respectively (orders, contracts for work, employment contracts, pre-contractual relations, CVs…);
2. under Section 78(3) ZOOÚ, a controller who is the employer of the data subject is entitled to provide or publish the data subject’s personal data to the extent of title, first name, surname, job position, service position, functional position, personal number or employee number, department, place of work, telephone number, fax number, work email address and the employer’s identification data, where this is necessary in connection with the performance of the data subject’s work, service or functional duties. The provision or publication of personal data must not impair the standing, dignity and safety of the data subject;
3. processing of personal data is necessary under a special regulation or an international treaty by which the Slovak Republic is bound – under Section 13(1)(c) ZOOÚ and Article 6(1)(c) GDPR respectively (Commercial Code, Labour Code, Health Insurance Act, Social Insurance Act, Income Tax Act…);
4. processing of personal data is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or rights of the data subject which require protection of personal data, in particular where the data subject is a child – under Section 13(1)(f) ZOOÚ and Article 6(1)(f) GDPR respectively;
5. further processing of personal data for archiving purposes, scientific purposes, historical research purposes or statistical purposes, where it complies with a special regulation and appropriate safeguards for the rights of the data subject are in place.

Declaration

We declare that, as the controller of your personal data, we meet all the legal obligations required by applicable legislation, in particular the Personal Data Protection Act and the GDPR, and therefore that:

• we will process your personal data only on the basis of a valid legal ground as described above,
• we hereby fulfil our obligation to inform data subjects under Article 13 GDPR,
• we will enable you to exercise your rights under the new ZOOÚ Act and the GDPR, and support you in doing so.

Data subjects

• Contractual/pre-contractual partners and customers of the controller
• Employees of the controller

Purposes of processing

We process personal data that you entrust to us yourself, for the following purposes:

Contractual/pre-contractual partners and customers of the controller

Z&H Lean, s. r. o. is the controller of personal data about its contractual and pre-contractual partners obtained in connection with its business activities.

We process your personal data – business name, postal address, email address, telephone number, first names and surnames of contact persons, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH) – for the following purposes:

• performance of contractually agreed cooperation,
• processing orders, delivering ordered products and all related matters,
• processing enquiries for the supply of products and services, their acceptance and all related matters,
• identification of the contracting party,
• provision of the agreed service.

Employees

• The controller processes the personal data of its employees exclusively for the purposes of employment relationships and other legal relationships arising from employment law and social security law.
• The controller processes the personal data necessary for paying wages and keeping personnel records on the basis of an employment relationship or of agreements on work performed outside an employment relationship.
• A further purpose is the fulfilment of the employer’s obligations relating to an employment relationship, a civil service relationship or a similar relationship (e.g. on the basis of agreements on work performed outside an employment relationship), including pre-contractual relationships.
• Also to ensure the identification of its employees in employment contracts.

How long we keep your personal data

The controller undertakes to process personal data provided by the data subject in the relevant contract or otherwise in its information systems in line with the principle of storage limitation and, should the purpose of processing cease to exist, to erase the personal data. If these personal data are to be processed for a purpose other than that set out above in this article, the data subject will be informed of that purpose and of the legal basis for such processing before such processing takes place.

Security and protection of personal data

We protect personal data to the greatest extent possible. We protect them as if they were our own. We have implemented appropriate technical and organisational measures that prevent the misuse, damage or destruction of your personal data.

Right to lodge a complaint with the supervisory authority

The data subject has the right to lodge a complaint or a petition to initiate proceedings with the supervisory authority:

More information on submitting a petition is available on the website of the Office for Personal Data Protection of the Slovak Republic, in the section Petition to initiate personal data protection proceedings (in Slovak).

Transfer of personal data to third parties (processors, recipients)

Your personal data can be accessed by authorised persons appointed by the controller, who are bound by confidentiality and trained in processing security.

We handle most processing operations ourselves and do not need third parties for them.

For certain specific processing operations that we cannot carry out with our own resources, we use the services of processors who specialise in the processing concerned and are bound by a data processing agreement in accordance with the GDPR.

These are providers of the following platforms and services:

• Occupational health and safety (BOZP)
• Occupational health service (PZS)
• Website administrator

Transfer of data outside the European Union

We process data exclusively in the European Union or in countries that ensure an adequate level of protection on the basis of a decision of the European Commission.

Your rights in relation to personal data protection

You have several rights in relation to the protection of personal data. If you wish to exercise any of these rights, please contact us at the email address given above.

• You have the right to information – we fulfil this obligation with this personal data processing policy.
• Under the right of access, you can ask us at any time and, within one month at the latest, we will show you which of your personal data we process and why.
• If something changes for you, or you find any of your personal data out of date or incomplete, you have the right to have your personal data completed and rectified.
• You can exercise the right to restriction of processing if you believe that we are processing inaccurate data about you, if you think our processing is unlawful but you do not want all the data erased, or if you object to the processing. You can restrict the scope of the personal data or of the purposes of processing.
• Right to erasure (‘right to be forgotten’): You also have the right to erasure where there is no legal basis entitling us, or legal obligation requiring us, to process your personal data. In that case we will erase all your personal data from our system and from the systems of all processors and backups within the statutory time limit.
• Complaint to the Office for Personal Data Protection: If you feel that we are not handling your data in accordance with the law, you have the right to lodge a complaint with the Office for Personal Data Protection at any time. We would very much appreciate it if you told us about such a concern first, so that we can look into it and put right any error.

Confidentiality

We would like to assure you that we as the controller, as well as the collaborators and processors who will process your personal data, are obliged to maintain confidentiality about personal data whose disclosure would endanger the security of your personal data. This duty of confidentiality continues even after your relationship with us has ended. Your personal data will not be provided to any third party without your consent.

This personal data processing policy is effective from 17 October 2026 and replaces the previous privacy policy.

Contact form

If you write to us using the form on this website, we process your name, email address and, where provided, your phone number, company name and the content of your message solely to handle your enquiry and, where applicable, to prepare a quotation (Article 6(1)(b) GDPR). We do not share the data with third parties for marketing purposes.

Cookies

This website does not use analytics or marketing cookies and does not load any third-party content (fonts and libraries are stored directly on our server). We therefore do not need your consent to cookies.

If you press ‘Pause motion’ on the home page, your browser remembers this choice in your device’s local storage (localStorage). This is not tracking: the information is not sent anywhere and you can delete it at any time in your browser settings. When you move between pages, the browser also briefly stores a technical flag for the page transition animation (sessionStorage), which is deleted automatically when you close the window.

How can you contact us?

If you have any comments, questions or requests concerning the use of your personal data, or any question about this privacy and cookies statement, please contact us at this email address: info@zahlean.sk or using the contact details given in the Contact section. We welcome your questions and suggestions regarding this statement.

Final provisions

By ticking the box in the online form, you confirm that you have read the personal data protection terms in full.

The controller is entitled to change these terms. It will publish the new version of the personal data protection terms on its website and will inform you of this via the email address you have provided to the controller.