Information on the Processing of Personal Data.

Processing of personal data of persons participating in a tour.

The travel agency (hereinafter also referred to as the “TA”) hereby informs the persons listed in the travel contract (hereinafter also referred to as the “data subject”) that, in accordance with Act No. 18/2018 Coll. on Personal Data Protection (hereinafter also referred to as the “Act”), it processes personal data for the purpose of fulfilling the travel contract and contractual obligations arising therefrom. The TA is not required to obtain separate consent for the processing of personal data provided in connection with the performance of the travel contract. If the required personal data is not provided, it is not possible to ensure the fulfillment of the contractual obligations arising from the travel contract.

The TA processes the personal data of data subjects to the extent in which it has been provided and recorded in the travel contract, namely: first name, last name, date of birth, permanent residence address or contact address, travel document details (number, place and date of issue, expiration date), nationality, email address, phone number, and information on specific requirements (dietary needs, assistance).

The TA stores personal data for an indefinite period for the purposes of archiving, marketing (sending promotional catalogs for the new season), and maintaining its internal records.

The data subject has the right to object to the processing of personal data concerning them for the purposes of direct marketing, including profiling to the extent that it is related to direct marketing. If the data subject objects to the processing of personal data for direct marketing purposes, the TA shall no longer process the personal data for such purposes.

The data subject has the right to object to the processing of their personal data on grounds relating to their particular situation carried out pursuant to Section 13(1)(e) (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) or (f) (processing necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data, in particular where the data subject is a child; this legal basis does not apply to processing carried out by public authorities in the performance of their tasks) of Act No. 18/2018 Coll., including profiling based on these provisions. The TA shall no longer process personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests or rights of the data subject, or grounds for the establishment, exercise, or defense of legal claims.

In connection with the use of information society services, the data subject may exercise their right to object by automated means using technical specifications. The data subject also has the right to object to the processing of personal data concerning them on grounds relating to their particular situation, except where processing is necessary for the performance of a task carried out for reasons of public interest, or where personal data is processed for scientific, historical research, or statistical purposes pursuant to Section 78(8) of Act No. 18/2018 Coll.

The TA hereby informs data subjects that their personal data is transferred to a third country (the destination specified in the travel contract, as well as to carriers providing transportation to and from the destination). Such transfer is necessary for the performance of the travel contract between the data subject and the TA and for the implementation of pre-contractual measures. The TA ensures appropriate safeguards for the transfer of personal data to third countries in accordance with the Code of Conduct for Personal Data Processing of SACKA pursuant to Section 85 of Act No. 18/2018 Coll.


Rights of persons participating in the tour in relation to the processing of their personal data.

1. Each data subject has the right to obtain confirmation from the TA as to whether personal data concerning them is being processed. If such personal data is processed, the data subject has the right to access the personal data and information about: the purpose of processing; the categories of personal data concerned; the identification of the recipient or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations, where possible; the period for which the personal data will be stored, or if not possible, the criteria used to determine that period; the right to request rectification, erasure, or restriction of processing of personal data concerning the data subject, or to object to such processing; the right to lodge a complaint with a supervisory authority (pursuant to Section 100 of Act No. 18/2018 Coll.); the source of the personal data if it was not obtained from the data subject; and the existence of automated decision-making, including profiling pursuant to Section 28(1) and (4) of Act No. 18/2018 Coll. In such cases, the TA shall provide the data subject with information about the procedure used, as well as the significance and the envisaged consequences of such processing.

2. The data subject has the right to be informed by the TA about appropriate safeguards relating to the transfer of their personal data to a third country or an international organization. The TA is obliged to provide the data subject with the personal data it processes. For repeated requests, the TA may charge a reasonable fee corresponding to administrative costs. The TA shall provide personal data in the manner requested by the data subject.

3. The data subject has the right to have the TA correct inaccurate personal data concerning them without undue delay. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed.

4. The data subject has the right to have the TA erase personal data concerning them without undue delay. The TA is obliged to erase such personal data if the data subject has exercised the right to erasure and the conditions set out in Section 23(2) and (4) of Act No. 18/2018 Coll. are met.

5. The data subject has the right to obtain restriction of processing where:
a) the data subject contests the accuracy of the personal data, for a period enabling the TA to verify its accuracy,
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests restriction instead,
c) the TA no longer needs the personal data for processing purposes, but the data subject requires it for the establishment, exercise, or defense of legal claims, or
d) the data subject has objected to processing pursuant to Section 27(1) of Act No. 18/2018 Coll., pending verification whether the legitimate grounds of the TA override those of the data subject.

6. Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest. The TA shall inform the data subject before the restriction of processing is lifted.

7. The data subject has the right to receive the personal data concerning them, which they have provided to the TA, in a structured, commonly used, and machine-readable format and has the right to transmit those data to another controller, where technically feasible, and where processing is based on Section 13(1)(a), Section 16(2)(a), or Section 13(1)(b) of Act No. 18/2018 Coll., and is carried out by automated means.

8. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This shall not apply if the decision:
a) is necessary for entering into, or performance of, a contract between the data subject and the TA,
b) is authorized by law or an international agreement binding on the Slovak Republic, which also lays down suitable measures to safeguard the data subject’s rights and legitimate interests, or
c) is based on the explicit consent of the data subject.

9. The TA is obliged to notify the data subject without undue delay of a personal data breach where such breach is likely to result in a high risk to the rights and freedoms of a natural person. The notification shall describe in clear and plain language the nature of the breach and include at least: contact details of a responsible person or contact point; a description of the likely consequences; and a description of the measures taken or proposed to address the breach, including measures to mitigate possible adverse effects.
Such notification is not required if: a) the TA has implemented appropriate technical and organizational protection measures (such as encryption) rendering the data unintelligible to unauthorized persons, b) the TA has taken subsequent measures ensuring that the high risk is no longer likely to materialize, or c) it would involve disproportionate effort; in such cases, the TA shall instead inform the public or take similar measures to ensure effective communication.

10. The data subject has the right to withdraw their consent to the processing of personal data at any time (where consent is the legal basis). Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The data subject must be informed of this prior to giving consent and may withdraw it in the same manner as it was given.

11. Where the travel contract has been concluded on behalf of other travelers by another person (e.g., a family member, legal representative, or authorized person), the TA is obliged to inform the data subject about the source of the personal data and whether it originates from publicly accessible sources.

The Travel Agency is obliged to provide the data subject with information on the measures taken based on their request pursuant to points 1 to 10 of the preceding paragraphs within one month of receipt of the request.

In justified cases, taking into account the complexity and number of requests, the TA may extend this period by a further two months, even repeatedly. The TA is obliged to inform the data subject of any such extension within one month of receipt of the request, along with the reasons for the extension. If the data subject submitted the request electronically, the TA shall provide the information in electronic form, unless the data subject has requested otherwise.

Identification Data of the TA as the Data Controller:
LEONARDO - OSCAR s.r.o. Zadunajská 12, 851 01 Bratislava ID (IČO): 36 203 190 Registered in the Commercial Register of the District Court Bratislava I, Section: Sro, Entry No.: 25041/B

Contact Details of the Data Protection Officer (DPO):
In accordance with the law, the TAis not required to appoint a Data Protection Officer. Recipients of Your Personal Data

The recipients of your personal data are: LEONARDO - OSCAR s.r.o., Airlines and transport companies, Foreign business partners located in your destination abroad.