How we process and protect your personal data

Contents:

LEAF Group

What is personal data processing? What do individual terms mean?

What is the purpose of your data processing?

Which personal data do we process?

How do we acquire your personal data?

What is the legal basis on which we process your personal data?

What is the period of time necessary for processing your data?

What are your rights pertaining to the processing and protection of your personal data?

When and how can you revoke your consent to your personal data processing?

To whom do we provide your personal data?

Where can you turn in order to claim your rights and how?

Security measures

INFORMATION ON PERSONAL DATA PROTECTION

For the LEAF group, securing and protecting the personal data of everybody who shared them with us is important.

Here you will find the information about legal grounds, purpose and processing ways, the extent of personal data processing by the LEAG group as well as information about retention periods, and your legal rights.

The person assigned to supervise data protection is the “Responsible Person”. In case you have any questions pertaining to personal data protection or other questions pertaining to personal data, you can contact the Responsible Person via email or in writing by sending a letter to the LEAF organization address.

The LEAF group does not share personal data in their care with third parties unless they fulfill international standards and European Union standards.

In Bratislava, April 1, 2020.

LEAF Group

Your personal data is processed by members of the LEAF group. The LEAF group comprises non-profit organizations that carry the vision of the LEAF non-profit organization. The common operators of your personal data information systems are (henceforth “Operators” or the LEAF group):

LEAF Group Management:
- LEAF civic association, with its registered office at Prievozska 4, 821 09 Bratislava, Slovak Republic, ID No.: 42264723, registered in the Register of Civic Associations maintained by the Ministry of the Interior of the Slovak Republic under the number: VVS/1-900/90-40088;
LEAF Group Members:
- civic association Akadémia LEAF – LEAF Academy, registered office Sasinkova 13, 811 08 Bratislava, Slovak Republic, ID No.: 50185641, registered in the Register of Civic Associations maintained by the Ministry of Interior of the Slovak Republic under number VVS/1-900/90-48198;
- civic association LEAF Internát, registered office at Sasinkova 13, 811 08 Bratislava, Slovak Republic, ID No.: 52534987, registered in the Register of Civic Associations maintained by the Ministry of the Interior of the Slovak Republic under the number VVS/1-900/90-56913; and
- civic association Butterfly Effect, registered office Prievozská 16633/4, 821 09 Bratislava, Slovak Republic, ID No.: 51646757, registered in the Register of Civic Associations maintained by the Ministry of the Interior of the Slovak Republic under number VVS/1-900/90-53486.

The LEAF group is responsible for the proper and legal processing and fulfillment of duties pertaining to personal data protection. You can claim your rights with LEAF that are described below.

The contact for the Data Protection Officer is: dpo@leaf.sk.

What is personal data processing? What do individual terms mean?

Personal data processing (henceforth PDP) is any handling of personal data by any means, for example collection, recording, sorting, structuring, storing, revision or change, searching, viewing, using, supplying transfer, spreading or supplying by other means, regrouping or combining, limiting, deleting and terminating.

Personal data (henceforth PD): These are any information pertaining to an identified or identifiable natural person. Identifiable natural person is a person that can be directly or indirectly identified especially by referring to such identificator as name, identification number, location data, online identificator, or reference to one or more elements that are specific to the physical, physiological, genetic, mental, economic, cultural or social identity of this physical person. These are any information about you based on which you have already been identified or may be identified.

Person concerned (henceforth PC): It is a person whose personal data are being processed. If we are processing your personal data, for the LEAF group, you are also a person concerned.

Operator: It is each person that alone or together with others sets the purpose and means of personal data processing and at the same time processes personal data in their own name. An operator is someone who initiated your personal data processing with a particular purpose in mind that he/she has set and is in charge of. In relation to you, LEAF group organisations are common operators.

Intermediary: It is each person that processes personal data in the name of the operator. The difference between them two is that the intermediary does not hold their own purpose for which they would process your personal data. They do so solely on the basis of an assignment and guidelines of the operator and in their name.

Recipient: This is a natural person or a legal entity, public authority, agency or another entity to which data is supplied. This includes all the persons with which LEAF will share your personal data (for example, based on a legal requirement)

Purpose: This is the reason why the operator processes personal data.

Consent of the concerned person: This is any freely given, concrete, informed and unambiguous expression of the concerned persons’ will. They will confirm in the form of proclamation or another precise deed their consent with personal data processing within pre-agreed limits. You therefore conceded that the operator can process your personal data within agreed limits.

What is the purpose of your data processing?

The LEAF group can process your personal data for the following purposes:

Butterfly Effect (henceforth„BE“)
- Education of participants (BE): The education of Apps Lab and Games Lab participants;
- Promotion of BE goodwill and communication with Alumni
- Butterfly Effect courses
LEAF Academy (henceforth „LA“)
- LA contacts administration
- Securing the operation of the academy, physical safety of premises and information security (operations)
- LEAF Academy organisation, purposes for education a pertaining activities, accommodation and student board, after-school activities organisation, clubs, internships and trips, the creation of a student yearbook for a given year and student references
- LA academic impact measurement
- LA medical centre
- LEAF Academy Summer Camp organisation
LEAF
- Junior opportunities: Events organisation for program participants, connecting with partner enterprises, evaluating their success rate
- Organisation of community meetings for the IRPU program participants and workshops for teachers.
- Slovaks abroad networking
- Cooperation with Slovaks abroad, linking them to Slovak enterprises and arranging volunteering opportunities; regular surveys and expert volunteering program organisation
- IRPU Program: Education and assessment of teachers
- Online Mentor Incubator Program: Regular monitored Skype with selected IRPU alumni
- LEAF Award Program (Student Mentoring)
- TalentGuide Program: Mentoring program and organisation of pertaining events
- YP Program — Delta: Individual personal development of participants (coaching). The creation of a link between enterprises and program participants and a report for a participant.
- YP — PED Program – Application via the expert volunteering portal. The creation of a link between volunteers and organisations and their mentoring
- Change Schools from Within Program: Assistance with school development and support to its management and teachers
- Scholarship Program: Providing scholarships for highschool students.
- Slovak Professionals Abroad Program portal Vratsa.sk: Connecting young professionals with employers in Slovakia
- Mentoring Program: Mentoring program for college students
- IRPU (Individual Teacher’s Development Program) Impact Assessment
- Participation in the Back2School Program
- Evaluating the participation interest in the Circles Program, Coffee with Principles: Program for school principals
- IRPU Program — HOW TO TEACH ONLINE
- IRPU Program — FROM HOME
- IRPU Program — online workshop
- IRPU Program — online incubator
- IRPU Event Training for the school management staff
- Program Circles
LEAF Group Share Center
- Program evaluation and recording of participation growth in the LEAF/LA, Butterfly Effect programs.
- Marketing and LEAF group promotion:
  - Promotion of organisation’s goodwill, communication with potential applicants, newsletter mailing, direct marketing, remarketing and approaching potential applicants.
  - Publicising stories, creation of promotion materials and their publication.
- Selection of participants (all LEAF group programs)
  - Online program application
  - Selection process of new applicants and its evaluation.
- LEAF community involvement
- Fulfillment assessment of LEAF group vision
- Contacting for the purpose of LEAF programs’ participation evaluation
- Portal events.leaf.sk: LEAF events registration
- Verification of granting the consent of a concerned person under the age of 16.
- Participation in a webinar organized by the LEAF group
- Sending reminders about LEAF events

Which personal data do we process?

We process personal data to the extent necessary for the above mentioned purposes of processing. We acquire personal data during an interview, a questionnaire filled by you, or a lecture. We acquire data also by copying, scanning, or by other means.

Below we mention your personal data categories that we process for a particular purpose. It is the maximum extent of data that we can process within that given purpose:

Butterfly Effect

– Education of Participants (BE): Education of Apps Lab a Games Lab programs participants	Forename and surname, Photograph, Address, CV, Mobile phone number, Video Recording, Email, Workplace, Telephone number, Birthdate, Place of Study, Audio Recording
– Butterfly Effect courses	Forename and surname, Email, Telephone number, Billing data

LEAF Academy

– LA Contacts Administration

E-mail, Name, Telephone number, Surname

– Securing the operation of the academy, physical safety of premises and information security (operations)

Pension fund contract information, Unions membership and fees information, Work starting date, Point evaluation, Camera recording, Pension information, Diplomas, ID card number, Attendance, Bank account, Education information, Reason for refusal, Passport number (foreign employee), Unemployment history, Entrance history (chip cards), Appraisal questionnaire, High school-leaving exam date

– Studying at LEAF Academy

Contact details, Temporary residence certificate, Acceptance confirmation for a parent of an applicant under 16, Confirmation of the study at LA, Courses application (external students), Student file, Study contract, Study administration (assessment, disciplinary hearing, subject registration, etc.), Scholarship request, Student chip cards, Agreement on Study Termination, Intolerance survey, Room assigning survey, Board evidence, Application to universities abroad, Individual study plan, Information for roommates (student profile)

The given categories include these personal data:

statutory representative’s employer, statutory representative’s employer email, Address, Telephone number, Photograph, Online profile, Age of persons living in a common household, Annual income overview, Employer’s/Company’s name of the statutory representative, Gender of persons sharing a common household, Temporary residence certificate, Signature, Birthdate, Parent/statutory representative surname, Profession of persons sharing a common household, Nickname, Name of the person sharing a common household, Nationality, Overall asset value, statutory representative’s telephone number, statutory representative’s email, Tuition fees, Education of the person sharing a common household, Bank statements from the past 3 months, Email, Age, Student birthdate, Copy of student’s statutory representatives’ tax declaration, Employer’s income confirmation, Relation to the person requesting scholarship, Gender, ID number issued by the state, Video recording, Audio recording, Photographs, Name and surname, Birth number.

– LA Academic Impact Assessment

Alumni success rate assessment (survey), Email, Name, Telephone number, Surname

– LA Medical Centre

Address, ID card number, Name, Passport number (foreign employee), Email, Health insurance, Birthdate, Student medical records, Counsellor records

– LEAF Academy Summer Camp Organisation

Name and Surname, email, birthdate, gender, telephone number, address, citizenship, current school information, experience with LEAF

LEAF

– Junior Opportunities

Feedback form JP, Participants’ CV, Contact details, CV, Program evaluation, Workplace, Name and surname, Candidate feedback, CV, Place of study, Photograph, Education information, Email, Birthdate, Online profile, Motivation letter (SPAP), Telephone number, City (village) of residence

– Organisation of community meetings for the IRPU program participants and workshops for teachers

IRPU participant portfolio, Contact details (Email, Name, Telephone number, Surname)

– Slovaks abroad networking

Registration with the portal SvZ, Contact details, Events attendance sheet, Country of study/living, Working sector, Email, Name, Phone number, Surname.

– Cooperation with Slovaks abroad

Registration with the portal SvZ, Contact Form SvZ (SPAP), CV (HR), Survey among Slovaks abroad (SPAP), Opportunity portfolio application (SPAP), Country of studying/living, Working sector, Email, Name, Telephone number, Surname

– IRPU Program

IRPU participant portfolio, IRPU events attendance sheet, Contact detail, Company, department, Email, Camera recording, Telephone number

– Program Online inkubátor mentorov

Meno a priezvisko, Sektor práce

– LEAF Award Program (Student Mentoring)

Skype username, Name and surname, Birthdate, Email, Country of studying/living, School name, Telephone number, Place of studying, Student activities information (LA), Google Hangout username, Year of study

– TalentGuide Program

Mentor profile, Contact details, Mentee profile, Camp participants survey, Enrollment certificate for parents of under-16 applicants, Medical records, Applicant’s statutory representative’s name, Birthdate, Mobile number, Google Hangout username, Interviewer’s name, Surname, City (village) of living, Education, LinkedIn link, Parent’s/statutory representative’s name and surname, Skype username, Address, Gender, Telephone number, Name, Name and surname, Email, Country of studying/living, Age

– Program YP – Delta: Coaching

Delta participant profile, Contact details, Delta program application, Telephone number, Country (village) of living, Name and surname, Employer, Email

– IRPU (Individual teacher development program) Impact Assessment

Name, surname, email address, telephone number, employer, name and location of the school you teach at, assessment of the IRPU program and its influence on my professional development and forms of my cooperation with LEAF

– Slovak Professionals Abroad Portal Program Vratsa.sk

Name and surname, email, telephone number, birthdate, country of residence, field of expertise, employer, your current job title, year of study completion

– Scholarship Program: Providing scholarships for highschool students.

Name and surname, email, telephone number, address, birthdate, current high school

– Mentoring Program: Mentoring program for college students

Name and surname, email address, telephone number, current college, major, tentative final study year, graduated high school, further accomplished education, work experience, future field of professional interest, information on past participation in mentoring programs, mentoring areas preferences, information contained in the attached CV

– Evaluating the participation interest in the Circles Program

Name, surname, employer, college, residence, birthdate, email address, telephone number, motivation behind the participation in Circle

– Participation in Back2School Program

Name, surname, email address, telephone number, place of living abroad, feedback on the Back2School program

– Participation in Coffee with Principles

Name, surname, email address, school, post at school

– YP – PED Program: Application via the expert volunteering portal

Registering to the volunteers’ portal, Contact details, Volunteer application, Work applicant’s profile, Organisation’s application, Volunteer work contract, Applicant’s CV, Job position, Country of studying/living, City (village) of living, Workplace, Current job title

– Change School from Within Program

Change School from Within assessment ( teacher/student/mentor), Program materials portfolio, Email, Name, Telephone number, surname

– IRPU Program – HOW TO TEACH ONLINE

Name and surname, email, information about the school you teach at, job title, audio recording, visual recording, audiovisual recording

– IRPU Program – FROM HOME

Name and surname, email, information about the school you teach at, job title, audio recording, visual recording, audiovisual recording

– IRPU Program – online workshop

Name and surname, email, telephone number, information about the school you teach at, aprobation

– IRPU Program – online incubator

Name and surname, email, telephone number, information about the school you teach at, role/work position, feedback and experience with coaching and online incubator

– IRPU Event Training for the school management staff

Name and surname, email, telephone number, information about the school you teach at, role/work position, feedback and experience with personal development and leadership

– Program Circles

Name and surname, email, telephone number, information about employer, working status, city (village), state and audiovisual recording.

Share Center of LEAF Group

– Alumni (LA) / Alumni (BE) /Alumni účastníci programov LEAF

Email, Name and surname, Information on finishing the program

– Program evaluation and recording of participation growth in the LEAF/LA, Butterfly Effect programs.

Email, Telephone number, Surname, Work experience, skills, career and personal growth feedback on LEAF program’s publicly funded alumni, references from third parties or affected persons, personal integrity and character assessment, information on participation and finishing LEAF group’s program

– Publicising stories, creation of promotion materials and their publication.

Employer, Job title, LinkedIn link, Photograph, Video recording, Audio recording, name, surname

– Online program application; Selection process of new applicants

Contact details, Personality survey NEO, Notes from selection, Delta Program (YP) application, IRPU application, Volunteer application (YP-PED), Junior Opportunities application (SPAP) LEAF Academy (LA) application, LEAF Awards application, IRPU community meetings and other meetings application, Organisation’s application (YP-PED), Opportunities portfolio application (SPAP), TalentGuide application, Teacher application (ZŠzV), Teacher application for Change School from Within, Mentor Profile (TG), Records from TalentGuide interviews, CV (HR), Participants’ CV (SPAP), LEAF Summer Camp Application

– Events Portal: LEAF events registration

Name and surname, email, school.

– Contacting for the purpose of LEAF programs’ participation evaluation

Contacting to evaluate participation in LEAF programs

– Verification of granting the consent of a concerned person under the age of 16

statutory representative’s name and surname, statutory representative’s email address and telephone number

– LEAF community involvement

Photographs, audio and video recordings, Complex assessment connected with LEAF program graduation and ensuing development, Contact details, Area of interest, Work and work experience, LEAF experience, Data pertaining to the application to and participation in LEAF programs, Education, CV data, Other – attribute in CRM

– Evaluation of LEAF group vision fulfillment

– Marketing

Contact details, area of interest, LEAF experience, CV data.

– Participation in a webinar organized by the LEAF group

Name, surname, email, telephone number.

– Sending reminders about LEAF events

Email.

As part of data processing for the purpose of LEAF community involvement, evaluation of LEAF group’s vision fulfillment and marketing, a profiling is carried out through a supplied data analysis.

If you have any doubts which data we are processing, do not hesitate to contact us.

How do we acquire your personal data?

We receive your data almost in all cases directly from you. We want to contribute to the development of young people with the potential to grow into people who will possess strong character traits, excellence, entrepreneurial leadership and civic engagement. And to do this without taking their socio-economic background into consideration. Thus we offer a number of programs and events where you may grow as a person as well as a professional.

Most often you offer your personal data by:

filling in the application (for example, through FormStack surveys placed on our web sites);
filling in a survey (usually also through FromStack)
providing photographs and videos recording your participation in programs or events, etc.
and by indirect public information from your social media profiles (Facebook, Skype, LinkedIn, Instagram), etc.

From third parties we usually acquire assessment of your activities or abilities, and references.

What is the legal basis on which we process your personal data?

We process your data on several legal bases according to definitions drawn from the GDPR Directive.

Throughout your personal data processing we adhere to Slovak Legal Code, especially to the generally binding legal policies below:

Generally binding legal regulations, including EU legal acts, regulating rights and obligations in the field of financial intermediation, namely

– Act No. 40/1964 Coll. Civil Code as amended;

Act No. 18/2018 Coll. On Protection of Personal Data.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 EC (General Data Protection Regulation).

We process most frequently your personal data based on the contract between LEAF organisation and yourself. Exempt are processing activities executed according to the law.

Contract means also a relation, not based only upon a written form, but also upon an oral agreement.

Other processing operations are executed on the basis of:

express consent you gave us for the following purposes:
- Alumni employees;
- LEAF Academy – Students;
- Marketing;
- Selection of participants;
- Publicizing of stories, photographs, video and audio recordings;
- Alumni (LA)/ Alumni (BE) / Alumni participants of individual programmes;
- Assessment of the impact of the programme Individual Development Program of Teachers (IDPT);
- Evaluation of the interest in the participation in the Circles Program;
- Participation in the program.

or legitimate interest, confirmed by a proportionality test, for the purposes as follows:
- Organisation of community meetings for the participants of IDPT programme;
- Condition for granting a licence by a foreign university and for the purpose of the protection of children and adolescents;
- Contacting with the aim to assess the participation in LEAF programmes;
- Verification of granting the consent of a concerned person under the age of 16.

Legitimate interest is an interest, pursued by an operator , or a third party, except those cases, when these interests are outweighed by interests or fundamental rights and freedoms of concerned persons, requiring the protection of personal data, especially when a person concerned is a child.

Legitimate interest must not be in contradiction to legislation on the protection of personal data, or other generally binding legal regulations. As long as some interest of an operator is considered to be legitimate, to achieve its aim it is possible to process personal data of concerned persons, provided that their rights and interest override the fundamental rights, freedoms and legitimate interests of a person concerned. It means that before processing personal data on the basis of legitimate group interests, LEAF verifies whether the interest is really legitimate, and consequently considers whether the legitimate interest prevails over the rights and freedoms of a person concerned.

Concerned person is entitled to raise an objection to the responsible person against such methods of processing personal data and to ask for the deletion of personal data. In case of such objection, the operator is obliged to implement an individual assessment whether his legitimate interest is really outweighing fundamental rights and freedoms of the concerned person, who raised the objection.

What is the period of time necessary for processing your data?

The time of processing the data is set in such a way so we could process your data in the necessary period of time :

which is needed for meeting the concrete aim of the processing, and
for the duration of legal basis for their processing (legal option of their processing).

Sometimes this period cannot be precisely set by a concrete deadline, as it depends upon other facts; for such cases we present to you ways of its setting:

Consents for Alumni employees, LEAF Academy – Students, Marketing and distribution of the newsletter, Selection of participants, Publicising of stories, photographs, audio and video recordings Alumni (LA), Alumni (BE) / Alumni participants of individual programs, Involvement in LEAF Community, Fulfillment assessment of LEAF group vision, Marketing for the period of five years , or, until the revocation of consent.
Processing on the basis of legitimate interest lasts for the period of two years at most, for the following purposes:

– contacting with the aim to assess the participation in the LEAF programs; organising community meetings for the IDPT programme participants; condition for granting a licence by a foreign university and for the purpose of the protection of children and adolescents.

– other purposes are processed mostly for the period of two years, or, in accordance with the valid legislation.

After the expiration of relevant periods we finish the processing of your personal data for the relevant purpose and we delete and liquidate them properly.

The period of processing and archiving of personal data pertaining to a person concerned is appointed by valid legislation, registry and archival rules of the LEAF group, or, by the consent of a concerned person with the processing of personal data.

What are your rights pertaining to the processing and protection of your personal data?

The LEAF group guarantees your rights to a concerned person in accordance with the GDPR Directive, those rights you can apply with us. These rights include:

The right to information in acquiring personal data

The right to information means for you, as the person concerned, the possibility to find out before, or during obtaining your personal data, in what way LEAF group is going to process your personal data, as well as conditions stated for this processing. Its content includes, e. g., the right to information about the identity and contact data of the operator and his responsible person, about the purposes of processing personal data, legal basis, legitimate interests, whether the personal data are provided by a legal or contractual request, about recipients or categories of recipients of personal data (if existing), periods of their storage, the list of rights you have, the options to turn to the Office For Personal Data Protection of the Slovak Republic, or, the information, whether during processing of your personal data there is automated decision-making and profiling, or cross-border transfer, etc. The LEAF group is obliged to fulfill these obligations in acquiring your personal data, when they are obtained from you (the person concerned), in other cases in an adequate period of time, up to one month at the latest following the acquisition of personal data, or, up to the first contact, at the latest, with a person concerned, when the personal data are to be used for communication.

In case the LEAF group intends to process your personal data further on for another purpose, as for the one they have been obtained for, it will provide you before such further processing with information on that other purpose as well as other relevant information.

The right of access to the data

The right of access includes the following:

the right to obtain a certificate from the LEAF group stating whether LEAF processes your information, and if it does,
the right of access to your personal data we process, so the LEAF group provides you with the copy of your personal data (of the person concerned) it processes
- Any other copies requested by a person concerned can be billed by the LEAF group for the fee matching administration costs. The request can be submitted in any way, In case the person concerned submits the request by electronic means, the information will be provided in commonly used electronic form. However, you can ask for another way of access.
The right to related information, including especially:
- The right to information on processing purposes;
- The right to information on the categories of relevant personal data;
- The right to information about recipients, or the categories of recipients, to whom the personal data were or will be provided, especially the information on recipients in the third countries, or, within international organisations;
- The right to information on presumed period of time for the storage of personal data, and, if it is not possible, al least to criteria for its specification;
- The right to demand from the operator the correction of personal data pertaining to the person concerned, or their deletion, or the limitation of their processing as well as the right to raise an objection to such processing;
- The right to submit a complaint to the supervisory body;
- The right to any available information about the source of personal data, from which the personal data have been obtained, in case they did not come from the person concerned;
- In case of automated decision-making, including profiling (according to Article 22, sections 1 and 4, GDPR) – the right to meaningful information about the applied procedure, as well as about the meaning and assumed consequences of such processing for the person concerned;
- In case the personal data are transferred to a third country ar to an international organisation, the person concerned has the right to be informed about adequate guarantees (according to Article 46, GDPR), related to the transfer.

The right to correction

In case your personal data, processed by the LEAF group, are not up-to-date, incorrect or incomplete, you have the right to their correction or completion, without any delay, right after we learn to know about it.;

with regard to the processing purposes the person concerned has the right to completion of incomplete personal data, namely through the provision of supplementary statements.

The right to deletion

In case of the fulfilment of some of the following condition you are entitled to request the deletion of your data:

personal data are not necessary anymore for purposes, they were obtained for, or processed;
the person concerned revokes the consent with processing the personal data, which was given by this person according to Article 6, section 1, letter a), or Article 9, section 2, letter a) of GDPR, as on its basis the processing has been performed, if there is no other legal basis for processing;
the person concerned objects against processing (according to Article 21, section 1 of GDPR) and his/her rights are not overridden by any legitimate interests for processing, or the person concerned objects against processing according to Article 21, section 2 of GDPR;
personal data have been processed unlawfully;
personal data have to be deleted to fulfil the legal obligation in accordance with the law of the European Union, or of the law of a member state to which the operator reports (the operator deletes the personal data, if such legal regulations require it);
the personal data have been obtained in connection with the offer of services from an information company according to Article 8, section 1 of GDPR.

The right to limitation of processing personal data

You have the right to request the limitation of processing your personal data. If the conditions are fulfilled (see below), we are going to limit the processing of your personal data. If the processing is limited, such personal data , except their storage, are processed exclusively:

with your consent, or
for establishing, implementing or defending legal claims, or for the protection of rights of another natural person or legal entity, or with regard to an important public interest of the European Union or a member state.

The person concerned has the right to the limitation of processing by the operator in following cases:

the person concerned contests the correctness of personal data, in the period allowing the operator to verify the correctness of personal data;
the processing is unlawful and the person concerned object against the deletion of personal data and requests instead the limitation of their use ;
the operator does not need personal data anymore for processing purposes, but they are needed by the person concerned to establish, implement or defend legal claims;
the person concerned objects against processing, up to the verification, whether the legitimate reasons of the operator prevail over legitimate reasons of the person concerned.

The right to object

You, the person concerned, have the right to object anytime against processing of your personal data:

for reasons related to your concrete situation in the following cases of processing, including contesting the profiling based on the undermentioned provisions of GDPR:
- in case of processing, necessary for the fulfilment of a task, performed in the public interest, or for the exercise of public authority, vested on the operator (according to Article 6, section 1, letter f) of GDPR);
- processing is necessary for the purposes of legitimate interests, pursued by the operator, or, by a third party, except those cases, when these interests are overridden by interests or fundamental rights and freedoms of the person concerned, requiring the protection of personal data, namely when the person concerned is a child (according to Article 6, section 1, letter f) of GDPR).

In case of an objection, the operator must not process personal data any further, until he proves necessary legitimate reasons for processing, overriding the interests, rights and freedoms of the person concerned, or proves reasons for establishing, implementing or defending legal claims.

When your personal data are processed for the purposes of direct marketing, including profiling, to the extent, connected with such direct marketing.If the person concerned objects against processing for the purposes of direct marketing, then the personal data cannot be processed for such purposes.
In connection with provision of services at a distance through communication by electronic means, you can, as the person concerned, claim your right to object by automated means, using technical specifications.
For reasons related to your concrete situation, when your personal data are processed for the purposes of scientific or historical research, or to statistical purposes (according to article 89, section 1 of GDPR) except those cases, when the processing is necessary to fulfil tasks related to public interest.

The right to the data transferability

The person concerned has the right:

To acquire personal data, pertaining to him/her and provided to the operator in the specified format, allowing the transfer (in the structured, commonly used and machine-readable format) and
To transfer these data to another operator, provided that the original operator, to whom these data were given, could not prevent this transfer, when:
(i) the processing is based on the consent (according to Article 6, section1, letter a), or Article 9, section 2, letter a) of GDPR), or on the contract (according to Article 6, section 1, letter b) of GDPR), and
(ii) when the processing is performed by automated means.

In claiming his/her right to the transferability of the data, the person concerned has the right to the transfer of personal data directly from one operator to another, as far as it is technically possible, however, without adverse conditions to the rights and freedoms of others by no means.

The right to raise a complaint

In case of any doubts concerning adherence to the duties in processing your personal data by the LEAF group, you have the right to submit a complaint concerning processing personal data to the supervisory body, in the Slovak Republic it is namely the Office for Protection of Personal data of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovak Republic, IČO (company registration number): 36 064 220.

When and how can you revoke your consent to your personal data processing?

If you have given your consent to the LEAF group to process your personal data, this consent is based upon your free and voluntary decision, and in case you do not agree with further processing of your personal data for the purposes you gave the consent for, you are entitled to revoke it anytime without influencing the lawfulness of the processing, based upon the consent given before its revocation.

You can revoke your consent by sending an electronic application concerning revocation of the consent to the person responsible for the protection of personal data (dpo@leaf.sk).

It is necessary to mention that even though the LEAF group ends the processing of your personal data, based upon your consent, and liquidates these personal data properly, it does not always need to mean that the LEAF group will not process any of your personal data at any extent. The reason can be the fact that e.g. there may exist another purpose of processing your personal data, which is based upon a different legal reason, other than your consent, e.g., upon the contract, existing between us, or upon our statutory duty.

In case you revoke your consent with processing your personal data, it means the following:

We immediately stop processing your personal data for the purpose they have been processed according to your consent, and your personal data will be deleted from the relevant databases, kept for the given purpose;
If there is no other purpose we process your personal data for, in another way than on the basis of your consent, the LEAF group will not process your personal data at all in any extent;
If there is another purpose we process your personal data for, in another way than on the basis of your consent for the given purpose, the LEAF group will process your personal data for this another purpose only.

To whom do we provide your personal data?

The personal data are accessed or provided to third parties on the basis of legal request (according to the GDPR Regulation, the Act on Protection of Personal Data, other generally binding legal regulation, directly enforceable legally binding act of EU or international treaty, by which the Slovak Republic is being bound, and other legitimate subject arising out from the legislation of the Slovak Republic).

In its activities the LEAF group also uses the services of contractual partners. In some cases this activities include processing of personal data. In all cases we pay attention to consistent selection of contractual partners, we assess their reliability, and in the contracts we include the rules concerning the protection of personal data. In compliance with the law in the selection of an operator we find out his/her professional, technical, organisational and personal competence and his/her ability to guarantee the security of processed personal data by measures according to Article 28 of Regulation and section 39 of the Act on Protection of Personal Data. The subjects, performing processing of personal data on our behalf, have made the contracts on processing personal data in compliance with the Act on Protection of Personal Data.

We can provide your personal data to following recipients:

Web applications (e.g., FormStack),
Marketing instruments (e.g., Wordpress)
Physicians and hospitals, health insurance companies
Airline companies
Translators
Language schools
Statutory representatives (of children under the age of 18)
Accommodation providers
Food suppliers
Foreign universities and USA universities
Transport providers
The partner of LEAF Academy for study organisation
Partners for events organisation
Partners of LEAF Academy (mentors, lecturers, tutors)

Where can you turn in order to claim your rights and how?

You can turn to the LEAF group or to its responsible person (to above mentioned contact data) with your questions, requests or claiming your rights as the person concerned.

You can submit your complaint or initiative to the Office for Protection of Personal data of the Slovak Republic.

Security measures

With the aim of protecting personal data the LEAF group implements security measures. These measures are applied in the same way to processes of collection of information, its storage, processing and liquidation, and they are focused upon the protection of personal data of concerned persons against their damage, destruction, loss, alteration, unauthorised access and provision or publication, as well as against any other undue processing methods.

The safety of personal data is secured by accepted technical, organisational and personal precautions, corresponding to the method of processing personal data. The personal data are processed using manual means of processing data within information systems and are secured and protected in compliance with relevant security standards and regulations on the protection of personal data.

LEAF has implemented security measures in compliance with good practice in the field of information security (e. g. the management of access rights, data backup, security rules for end users, etc.) The organisation is not obliged to document these measures based on the exception according to Article 30 section 5 of GDPR.

The LEAF group saves and protects personal data of concerned persons for the period stated in the valid legal regulations. The personal data, whose processing and saving permission has expired, are deleted within the period given in the sub-chapter Retention Periods and Methods of their Specification.

Acquired and processed personal data can be the object of cross-border transfer of personal data to member states of the European Union, as well as to the states providing adequate level of the protection in compliance with the provisions of relevant legal regulations.