Processing of personal data
Processing of personal data information patients/clients
To carry out our business, we process your personal data. Appropriate processing of your personal data is very important to New Look Holiday. To New Look Holiday is very important an appropriate processing of your personal data and its protection, this is why we would like to provide you with information regarding processing of your personal date in accordance with the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (further only as “Regulation”), and act no. 18/2018 Slovak data protection statue (further only as “act”).
The operator had appointed a responsible person for protection of personal data, who supervises following of the legal obligations and policies of personal data protection. You can contact the responsible person on: firstname.lastname@example.org
If you are unsure or unclear on anything after reading this document, we would be happy to clarify any concept or any part of this document. Please do not hesitate to contact us anytime on email@example.com.
Who processes your personal data?
Operator: New Look Holiday, Active Assist Ltd., 3rd Floor 207 Regent Street, London, UK, W1B 3HH
Contact for the operator: 0800 206 1568, firstname.lastname@example.org
Contact for the responsible person: email@example.com
(further only as “operator”)
Which personal data do we process?
Operator processes personal data in electronic or paper form in order to provide medical care for purposes of cosmetic and plastic surgery, in the extent of the law, especially name, surname, date of birth, address and health records necessary for finding out about the anamneses, information about illnesses, examinations and results of those, therapy and other important information from your medical background and methods of provided health care, information about the extent of provided health care, information about the services related to providing health care, information about the method of treatment and other facts important to establish health capability to performing work, serious facts about epidemiology, your contact details or those of your relatives.
For what purpose and on what legal basis is operator processing your personal data?
a) To provide cosmetic and plastic surgery and services related to providing health care - for this purpose is providing of your personal information a legal requirement and without providing this information, it is not possible to provide you with health care, cosmetic or plastic surgery or related services.
b) Registration and bookings of customers via www.newlookholiday.co.uk - contract; legitimate interest in accordance with article 6.1 (f) Regulation GDPR and paragraph 13 1 (a) act no. 18/2018 with regard to the protection of personal data
c) Based on your consent - for the marketing purposes, advertising of the company, advertising of services, discounts, bonuses, competitions and surveying satisfaction with the services of the company.
Provided consent for those purposes is completely voluntary, however, it is essential in order to be contacted with service offers and special offers. Any kind of your voluntary consent, which you will unambiguously confirm with your signature, can be revoked anytime by email to firstname.lastname@example.org. Revoking of the consent does not effect legitimacy of processing based on the consent prior to it being revoked.
Will your personal details be passed on to other subjects?
Your personal details will not be passed on to other subjects.
Will your personal details be passed on to third countries?
Operator does not intend to pass on your personal information to third countries.
How long will be your personal data processed for this purpose?
The operator will store your personal data for the duration of your contractual relationship with the operator and after the completion of contract, until fulfilment of all contractual obligations, eventually until the legitimate interest of the operator for the processing expires. If the operator processes your personal data based on your consent, your personal data will be processed for relevant purpose for the duration of validity of the consent or until the time you will revoke your consent. During processing of personal data, the operator applies principles of minimalisation, which means, that as soon as the time period for which the operator is obliged to store the data expires, the operator makes your personal data anonymous from databases and information systems.
What are your rights with regards to the processing of data?
Based on the written request which is located on our website www.newlookholiday.co.uk, you are entitled to set the claim with the operator for the following:
Right to access to the personal data
According to article 21 act 18/2018 with regards to the personal data protection, the aggrieved person has the right to obtain a confirmation from the provider, if the personal data relevant to him/her are being processed. If the operator processes this data, the aggrieved person has the right to access the personal data and to information about the personal data.
Right to correct personal data
According to article 22 act 18/2018 with regards to the personal data protection, the aggrieved person has the right to correct their incorrect personal data by the operator, without unnecessary delay. In regard to the purpose of the personal data processing, the aggrieved person has the right to add to incomplete personal data.
Right to deletion of personal data
According to article 23 act 18/2018 with regards to the personal data protection, the aggrieved person has the right for their personal data to be deleted by the operator, without unnecessary delay.
Operator is obliged to delete the personal data without unnecessary delay, if the aggrieved person exercised their right to deletion, due to the following:
a) personal data are not required for the purpose for which they were obtained or otherwise processed,
b) aggrieved person revokes the consent according to article 13 1a), or article 16 2a), based on which the personal data is being processed, and there are no other legal bases for the personal data processing,
c) aggrieved person objects to personal data processing according to article 27 1 and there are no paramount legal bases for personal data processing, or aggrieved person objects to personal data processing according to article 27 2,
d) personal data is being processed illegally,
e) the reason for deletion is fulfilling an obligation according to this article, special regulation or an international contract, with which Slovak Republic complies, or
f) personal data was obtained in relation with information society offered services according to article 15 1.
Right to restrict processing of personal data
According to article 24 act 18/2018 with regard to personal data protection, the aggrieved person has the right to restrict processing of personal data by the operator, due to the following:
a) aggrieved person objects accuracy of the personal data, and this is during the period of time when the operator is able to verify accuracy of personal data,
b) processing of personal data is illegal and the aggrieved person objects to deletion of the personal data and requires restriction of its use instead,
c) operator no longer requires the personal data for the purpose of processing personal data, but the aggrieved person requires them to raise legal claim, or
d) aggrieved person objects to personal data processing according to article 27 1, until it is verified, that operator’s lawful cause is paramount to the lawful cause of aggrieved person.
Right to portability of personal data
According to article 26 act 18/2018 with regards to personal data protection, the aggrieved person has the right to obtain their personal data which they provided to the operator, in structured, normally used and machine readable format and has the right to transfer this personal date to another operator, if it is technically possible and due to the following:
a) if personal data is processed according to article 13 1 a), article 16 2 a) or article 13 1b) and
b) processing of the personal data is performed by automated means.
Claiming the right noted in the above paragraph does not affect the right according to article 23. The right to portability does not apply to processing of personal data necessary for fulfilling a task in pursue of public interrest, service of public authority assigned to the operator.
Rights of aggrieved persons cannot have adverse effects on rights of other persons.
Right to object processing of personal data
According to article 27 act 18/2018 with regards to data protection:
(1) Aggrieved person has the right to object processing of their personal data due to involvement of their specific situation performed according to article 13 1e) or f) including profiling based on these clauses. The operator cannot further process the personal data, unless proves fundamental legitimate interest to process personal data, which are paramount over the rights or interests of the aggrieved person, or reasons to file a legal claim.
(2) Aggrieved person has the right to object processing of their personal data, for reasons of direct marketing including profiling in the extent of which it is related to direct marketing. If the aggrieved person objects to processing of their personal data for direct marketing, the operator cannot further process their personal data for direct marketing.
(3) The operator is obliged to specifically notify the aggrieved person about the rights according to paragraph 1 and 2 during the first communication at the latest, whereby the information about this right must be noted clearly and separately from any other information.
(4) In connection with the use of information society services, the aggrieved person can exercise their right to object by automated means with the use of technical specifications.
(5) Aggrieved person has the right to object processing of their personal date, due to involvement of their specific situation, apart from cases where the processing of the personal data is necessary for fulfilling a task in pursue of public interest, if the personal data is processed for scientific purpose, historical research or statistic purpose according to article 78 8.
Right to revoke consent
Aggrieved person has the right to revoke their consent at any time.
Right to file a motion to start proceeding
Aggrieved person has the right to file a motion to start proceedings according to article 100 act 18/2018 with regards to personal data protection.
Right to automatise individual decisions including profiling
According to article 28 act 18/2018 with regards to the personal data protection, the aggrieved person has the right to:
(1) The aggrieved person has the right for the non relevance of the decision, which is based specifically on the automatised personal data processing including profiling and which have legal effects, which are relevant to them or which comparably significantly affect them.
(2) Paragraph 1 is not enforced, if the decision is:
a) necessary to conclusion of contract or fulfilling the contract between the aggrieved person and the operator,
b) performed based on specific directive or international contract, which the Slovak Republic complies with, and in which are simultaneously appointed suitable precautions that guarantee the protection of rights of the legitimate interests of the aggrieved person, or
c) based on definite consent of the aggrieved person.
(3) In cases according to paragraph 2 a) and c), the operator is obliged to take suitable precautions for protection of rights and legitimate interests of aggrieved person, especially the rights to validate the decision not by automatised means of the operator, rights to express their opinion and rights to challenge the decision.
(4) The decisions according to paragraph 2 cannot be based on special categories of personal data according to article 16 1 apart from cases, if the article 16 2 a) or g) applies and simultaneously suitable precautions are implemented to guarantee rights and legitimate interests of the aggrieved person.
Operator will provide the aggrieved person with information about precautions which had been taken based on their request within one month period from receiving the request.
Is there automatised decision making including profiling during the processing of your personal data?
During processing of your personal data, there is no automatised decision making including profiling.