The operator hereby, in accordance with Article 13 par. 1. and 2. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 May 2016 on the protection of natural persons in the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (General Data Protection Regulation ) (hereinafter referred to as the " Regulation ") provides the following information to the Data Subject , from whom the Operator obtains personal data concerning him/her :

Identity and contact details of the Operator:

The operator is the trading company Mavasto, s.r.o., with registered office at Južná trieda 1575/48, 040 01 Košice – city district Juh, ID number: 54 406 820, registered in the Commercial Register of the District Court of Košice I, section: Sro, insert number: 53494/V, VAT number: 2121655415, statutory body: Ladislav Stoklasa - managing director, Juraj Stoklasa - managing director, Jozef Maďar - managing director, Richard Václavík - managing director, email: [email protected], phone number: +421 951 175 870 .

Contact details of the responsible person:

The responsible person has not been established.

Personal data processed:

The operator processes the following personal data: name, surname, place of residence, phone number, email address, IP address, cookies, signature, date of birth, gender, photo.

Purposes of processing personal data of the Data Subject:

The purposes of processing the Personal Data of the Data Subject are:

a) processing of accounting documents

b) execution and recording of contracts

c) operation of the www.hladamchatu.sk portal and mediation of the conclusion of an accommodation contract between the accommodation provider and a third party and persons interested in accommodation

d) records of clients and contractual partners for the purpose of concluding and fulfilling contracts

e) archiving of documents in accordance with legal regulations

f) correspondence and communication

g) marketing activities of the Operator (implementation of marketing activities of Mavasto, s.r.o. and includes sending information about news and time-limited discounted offers in the area of services provided by Mavasto, s.r.o. and the entire product portfolio)

Legal basis for the processing of personal data of the concerned person:

Depending on the specific personal data and the purpose of their processing, the legal basis for the processing of the personal data of the affected person will be the fulfillment of the operator's legal obligation or the fulfillment of the contract to which the affected person is a party. In the case of marketing activities of the Operator, the legal basis for processing will be the consent of the Data Subject.

Specification of legitimate interests pursued by the Operator or a third party: Not applicable.

Recipients or categories of recipients of personal data:

Employees and associates of the operator, the body and members of the body of the operator, its business partners, suppliers and contractual partners can be recipients of the personal data of the affected person, in particular: an accounting company, a company providing legal services to the operator, a company providing services related to the creation and maintenance of software, real estate brokers cooperating with the Operator in providing real estate services.

The recipient of personal data will also be the tax office, courts, law enforcement authorities and other state authorities, in cases provided by law.

The following personal data of the Affected Person may be made available within the www.hladamchatu.sk portal to a third party with whom the Affected Person is interested in concluding an accommodation contract: first and last name, email address, phone number and photo uploaded to the www.hladamchatu portal. sk by the Affected Person.

Information on the intended transfer of personal data to a third country: Not carried out.

Personal data retention period :

Personal data, which are provided for the purpose of concluding and fulfilling the contract, will be kept in accordance with legal regulations for the necessary time for which they will be needed for the purpose of fulfilling the contract and their subsequent archiving.

Personal data provided for the marketing activities of the Operator will be kept for the period for which consent to their processing was granted.

Instruction on the existence of the relevant rights of the Data Subject:

The affected person has, among other things, the following rights:

a) the Data Subject's right to access data according to Article 15 of the Regulation, the content of which is:

(i) the right to obtain confirmation from the Operator as to whether personal data relating to the Data Subject is being processed;

(ii) in case the Personal Data of the Affected Person is processed, the right to obtain access to the processed personal data and the right to obtain the following information:

- information about the purposes of processing;

- information on categories of affected personal data;

- information about recipients or categories of recipients to whom personal data have been or will be provided, especially in the case of recipients in third countries or international organizations;

- if possible, information on the expected period of storage of personal data or, if this is not possible, information on the criteria for its determination;

- information on the existence of the right to request from the Operator the correction of personal data concerning the Affected Person or their deletion or restriction of processing and on the existence of the right to object to such processing;

- information on the right to file a complaint with the supervisory authority;

- if the personal data were not obtained from the Data Subject, any available information regarding their source;

- information on the existence of automated decision-making, including the profiling referred to in Article 22, paragraph 1. and 4. Regulations and in these cases at least meaningful information about the procedure used, as well as the meaning and expected consequences of such processing of personal data for the Data Subject;

(iii) the right to be informed about adequate guarantees according to Article 46 of the Regulation, regarding the transfer of personal data, if personal data are transferred to a third country or an international organization;

(iv) the right to provide a copy of the personal data that is being processed, subject to the condition that the right to provide a copy of the processed personal data must not have adverse consequences on the rights and freedoms of others;

b) the Data Subject's right to correction according to Article 16 of the Regulation, the content of which is:

(i) the right for the Operator to correct incorrect personal data relating to the Data Subject without undue delay;

(ii) the right to supplement incomplete personal data of the Affected Person, including by providing an additional statement of the Affected Person;

c) the Data Subject's right to delete personal data (the so-called "right to be forgotten") according to Article 17

Regulations, the content of which is:

(i) the right to obtain from the Operator the deletion of personal data relating to the Data Subject without undue delay, if any of the following reasons are met:

- personal data are no longer necessary for the purposes for which they were obtained or otherwise processed;

- The affected person revokes the consent on the basis of which the processing is carried out, subject to the condition that there is no other legal basis for the processing of personal data;

- The affected person objects to the processing of personal data according to Article 21, paragraph 1. Regulations and there are no valid reasons for the processing of personal data or the affected person objects to the processing of personal data according to Article 21, paragraph 2. Regulations;

- personal data were processed illegally;

- personal data must be deleted in order to fulfill a legal obligation under the law of the European Union or the law of a member state to which the Operator is subject;

- personal data were obtained in connection with the offer of information society services according to Article 8, paragraph 1. Regulations;

(ii) the right for the Operator who has disclosed the Personal Data of the Data Subject to take appropriate measures, including technical measures, taking into account the available technology and the costs of implementing the measures, to inform other operators who process personal data that the Data Subject requests them to deleted all references to such personal data, its copy or replicas;

at the same time, the right to delete personal data with the content of rights according to Article 17 par. 1. and 2. Regulations [that is, with the content of rights according to (i) and (ii) of this letter. c) point J. of this document] will not arise , if the processing of personal data is necessary:

1. to exercise the right to freedom of expression and information;

2. to fulfill a legal obligation that requires processing according to the law of the European Union or the law of a member state to which the Operator is subject, or to fulfill a task carried out in the public interest or in the exercise of public authority entrusted to the Operator;

3. for reasons of public interest in the field of public health in accordance with Article 9 par. 2. letter h) ai) Regulations, as well as Article 9 par. 3. Regulations;

4. for the purposes of archiving in the public interest, for the purposes of scientific or historical research or for statistical purposes pursuant to Article 89, paragraph 1. Regulations, as long as it is likely that the right referred to in Article 17 paragraph 1. Regulations will make it impossible or seriously difficult to achieve the goals of such processing of personal data; or

5. to demonstrate, exercise or defend legal claims;

d) the Data Subject's right to limit the processing of personal data according to Article 18 of the Regulation,

whose content is:

(i) the right for the Operator to restrict the processing of personal data in one of the following cases:

- The affected person contests the correctness of the personal data, during the period allowing the Operator to verify the correctness of the personal data;

- the processing of personal data is against the law and the Data Subject objects to the deletion of personal data and instead requests the limitation of their use;

- The operator no longer needs personal data for the purposes of processing, but the Data Subject needs them to prove, exercise or defend legal claims;

- The person concerned objected to the processing according to Article 21 par. 1. Regulations, until it is verified whether the legitimate reasons on the part of the Operator prevail over the legitimate reasons of the Affected Person;

(iii) the right to, in the event that the processing of personal data is limited according to point (i) of this letter. d) point J. of this document, such limited personal data, with the exception of storage, were only processed with the consent of the Data Subject or to demonstrate, exercise or defend legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the European of the Union or a member state;

(iv) the right to be informed in advance about the cancellation of the restriction on the processing of personal data;

e) the right of the Affected Person to fulfill the notification obligation towards the recipients according to Article 19 of the Regulation , the content of which is:

(i) the right for the Operator to notify each recipient to whom personal data has been provided of any correction or deletion of personal data or restriction of processing carried out pursuant to Article 16, Article 17 par. 1. and Article 18 of the Regulation, unless it proves to be impossible or requires disproportionate effort;

(ii) the right for the Operator to inform the Data Subject about these recipients, if the Data Subject requests it;

f) the Data Subject's right to data portability according to Article 20 of the Regulation, the content of which is:

(i) the right to obtain personal data relating to the Data Subject and provided to the Operator in a structured, commonly used and machine-readable format and the right to transfer this data to another operator without the Operator preventing it, if:

- the processing is based on the consent of the concerned person according to article 6 par. 1. letter a) Regulation or Article 9 par. 2. letter a) Regulations, or on the contract according to article 6 par. 1. letter b) Regulations, and at the same time

- the processing is carried out by automated means, and at the same time

- the right to obtain personal data in a structured, commonly used and machine-readable format and the right to transfer this data to another operator without the Operator preventing it, will not have adverse consequences on the rights and freedoms of others;

(ii) the right to transfer personal data directly from one operator to another operator, as long as it is technically possible;

g) the right of the affected person to object according to Article 21 of the Regulation, the content of which is:

(i) the right to object at any time, for reasons related to the Data Subject's specific situation, to the processing of personal data concerning him, which is carried out on the basis of Article 6 par. 1. letter e) or f) of the Regulation, including objecting to profiling based on these provisions of the Regulation;

(ii) [in the case of exercising the right to object at any time for reasons related to the specific situation of the Data Subject against the processing of personal data concerning him, which is carried out on the basis of Article 6 par. 1. letter e) or f) of the Regulation, including objection to profiling based on these provisions of the Regulation] the right that the Operator does not further process the Personal Data of the Data Subject, unless he proves the necessary legitimate reasons for processing that outweigh the interests, rights and freedoms of the Data Subject, or reasons for proving, exercising or defending legal claims

(iii) the right to object at any time to the processing of personal data concerning the Data Subject for the purposes of direct marketing, including profiling to the extent that it is related to direct marketing; it also applies that if the Data Subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes;

(iv) (in connection with the use of information society services) the right to exercise the right to object to the processing of personal data by automated means using technical specifications;

(v) the right to object, for reasons related to the Data Subject's specific situation, to the processing of personal data concerning the Data Subject, if the personal data are processed for the purposes of scientific or historical research or for statistical purposes pursuant to Article 89 paragraph 1. Regulations, but with the exception of cases where the processing is necessary for the performance of the task for reasons of public interest;

h) the Data Subject's right related to automated individual decision-making according to Article 22 of the Regulation, the content of which is:

(i) the right not to be subject to a decision that is based solely on automated processing of personal data, including profiling, and which has legal effects that concern or similarly significantly affect the Data Subject, except in cases pursuant to Article 22 para. 2. Regulations [that is, with the exception of cases where the decision is: (a) necessary for the conclusion or performance of the contract between the Data Subject and the Operator, (b) permitted by the law of the European Union or the law of the Member State to which the Operator is subject and which also establish appropriate measures guaranteeing the protection of the rights and freedoms and legitimate interests of the Affected Person or (c) based on the express consent of the Affected Person].

Instruction on the Data Subject's right to withdraw consent to the processing of personal data:

The person concerned is entitled to withdraw his consent to the processing of personal data at any time, without this affecting the legality of the processing of personal data based on the consent granted before its withdrawal.

The affected person is entitled to withdraw his consent to the processing of personal data at any time - in whole or in part. Partial withdrawal of consent to the processing of personal data may relate to a certain type of processing operation / processing operations, while the legality of personal data processing in the scope of the remaining processing operations remains unaffected. Partial revocation of consent to the processing of personal data may relate to a certain specific purpose of processing personal data / certain specific purposes of processing personal data, while the legality of processing personal data for other purposes remains unaffected.

The Data Subject may exercise the right to withdraw consent to the processing of personal data in written form at the Operator's address entered as its registered office in the commercial register at the time of withdrawal of consent to the processing of personal data or in electronic form via electronic means (by sending an e-mail to the Operator's e-mail address specified when identifying the Operator in this document or by filling out the electronic form published on the Operator's website).

Instruction on the right of the affected person to file a complaint with the supervisory authority:

The person concerned has the right to file a complaint with the supervisory authority, in particular in the Member State of his habitual residence, place of work or in the place of the alleged violation, if he believes that the processing of personal data concerning him is in violation of the Regulation, namely all without prejudice to any other administrative or judicial remedies. The supervisory authority in the Slovak Republic is the Personal Data Protection Office of the Slovak Republic, with headquarters at Hraničná 12, 820 07 Bratislava, ID: 36 064 220, email: [email protected] , phone: 02/3231 3214.

Information on the existence / non-existence of the obligation of the concerned person to provide personal data:

The Operator informs the Affected Person that the provision of personal data of the Affected Person is necessary for the conclusion of the contract and its fulfillment. The Operator informs the Affected Person that the Affected Person is not obliged to provide personal data nor is he obliged to grant consent to their processing. The consequence of not providing personal data and/or the consequence of not granting consent to the processing of personal data will be that the Operator will not be able to conclude and fulfill the contract.

Information related to automatic decision-making, including profiling: Not applicable