INFORMATION ON THE PROCESSING OF PERSONAL DATA
IN CONNECTION WITH THE GRANT / SUBSIDY CALL
(hereinafter referred to as "Information")
1. Information provider:
The information is provided by: ELLMAN, with registered office at: Bratislava, Partizánska 2, ZIP code: 811 03 ICO: 35949309, registration: (hereinafter referred to as "Operator") as the issuer of the call for applications for the provision of a subsidy / grant (hereinafter referred to as "Call").
This information applies to all Calls of the Operator published in the eGRANT information system.
2. This information concerns you if:
● you are a natural person and you are submitting (or someone is submitting on your behalf) an application for a subsidy / grant within the Call through the eGRANT information system, or you are a natural person who submits or collaborates in submitting such an application on behalf of a legal entity or another natural person – the applicant for a subsidy / grant (hereinafter referred to as "Applicant")
● you are a natural person designated by the issuer to manage applications for a subsidy / grant in the eGRANT information system (hereinafter referred to as "Manager")
● you are a natural person designated as an evaluator of applications for a subsidy / grant submitted through the eGRANT information system (hereinafter referred to as "Evaluator")
● you are a natural person who expresses support for one or more of the projects applying for a subsidy / grant within the Call by casting your vote through the eGRANT system (hereinafter referred to as "Voter").
3. Who can you contact with questions, requests, or suggestions regarding privacy and personal data protection?
You can contact the Operator with requests, questions, suggestions, and comments:
● in writing at the address: ELLMAN,
● by email at: zuzana.biloveska@egrant.sk
● by phone at: +421 903 000 000
4. The Operator collects the personal data listed below:
Regarding the Applicant, the Operator processes mainly the following personal data:
● registration data (for registration on the subsidy portal) – login data, program name, email, first name and last name, information about the confirmation of acquaintance with this Information, etc.
● data about the submitted application – information about the project that the Applicant seeks to support, especially the name, description, budget, and other data filled in or attached as attachments in the eGRANT information system
● data about the status of the application – whether it is in progress, submitted, complete, approved, or rejected, whether it has been settled or not, how it was evaluated by the Evaluators, etc.
● data about the possible conclusion and fulfillment of the subsidy agreement based on the approved application
● data published in public registers, for example in the commercial register, trade register, tax debtor register, etc.
The purpose of the Call may also be to provide financial resources to support individuals in a difficult social situation or for a similar purpose. In such cases, special categories of personal data of the Applicant may also be processed to the necessary extent for the evaluation and processing of the application, for example, personal data revealing racial or ethnic origin, religious or philosophical beliefs, data concerning health, or data on integrity.
Most of the information about the Applicant is obtained directly from the Applicant through the registration form, application submission form, application settlement form in the eGRANT information system, or through other forms. Data marked in these forms as mandatory must be filled in by the Applicant; otherwise, they cannot be registered or submit an application for a subsidy / grant within the Call. If the Applicant fills in incorrect or incomplete data, it may have various adverse consequences depending on the circumstances, from the inability to log into the system, to the inability to submit or evaluate the application, non-approval or rejection of the application, the obligation to return the granted subsidy, to the occurrence of damage on the part of the Applicant, the Issuer, or another person that will need to be compensated. In the case of intentional provision of false data, criminal liability is not excluded.
Additional data about the Applicant, especially information about the status of the application and its evaluation, is obtained from the Operator's own activities or from the activities of Managers and Evaluators (e.g., by submitting evaluations).
In the course of its own activities, the Operator may obtain personal data of the Applicant to the necessary extent from public registers, for example, from the commercial register, trade register, tax debtor register, etc., as well as from other registers to which the Operator has legal access. For example, an Operator that is a municipality when providing subsidies has the right and obligation to verify certain facts in the relevant information systems of public administration, such as whether the Applicant has settled their financial obligations to the state, etc.
In this context, the Operator will use access to the TRANSPAREX system database, which collects and processes data from public sources. The TRANSPAREX system is operated by ProWise, a.s., with registered office at: Nobelova 12/B, 831 02 Bratislava, ICO: 51 871 998. Information on the processing of personal data of affected persons by this operator is available on the operator's website: https://www.transparex.sk/privacy/gdpr-database.
About the Manager The Operator processes mainly the following personal data:
● identification and contact details – first name, last name, position at the Operator, contact email / phone, login details for the eGRANT information system, etc.
● logs of the eGRANT information system regarding actions performed by the Manager in the system
●data on the confirmation of acknowledgment of this Information regarding the acceptance of the confidentiality obligation and the acceptance of the obligation to follow the instructions of the Declarant.
About the Manager The Operator obtains personal data from the Manager or from the Operator's own activities and from the logs of the eGRANT information system. If the Manager provides incorrect data to the Operator, it may have various consequences, such as the inability to log into the information system after damage occurs.
About the Evaluator The Operator processes mainly the following personal data:
● identification and contact details – first name, last name, contact email / phone, login details for the eGRANT information system, etc.
● record of the evaluation of individual grant applications by the Evaluator
● data on the confirmation of acknowledgment of this Information regarding the acceptance of the confidentiality obligation and the acceptance of the obligation to follow the instructions of the Declarant
About the Manager The Operator obtains personal data from the Evaluator or from the Operator's own activities and from the logs of the eGRANT information system (for example, regarding the submission of evaluations). If the Evaluator provides incorrect data to the Operator, it may have various consequences, such as the inability to log into the information system after damage occurs.
About the Voter The Operator processes mainly the following personal data:
●data necessary to verify the Voter – first name, last name, phone number, email, address or other identification details of the Voter provided in the voting form in the eGRANT information system, etc.
● additional statistical data – age category, information on where the Voter learned about the voting, etc.
● data on the confirmation of acknowledgment of this Information
● data on whether the Voter has given/has not given/revoked consent to the Operator to send information regarding the Call and potential support, non-support, and implementation of supported projects.
About the Voter The Operator obtains personal data from the Voter, which the Voter provides through the voting form. Data marked in the form as mandatory must be filled in by the Voter when casting a vote; otherwise, they cannot vote. If the Voter provides incorrect data, it may have various consequences, such as casting a vote for a different project than the Voter intended or the invalidity of the vote.
5. Your personal data is processed for the following purpose:
Personal data of the Applicant is processed for the purpose of submitting, processing, and evaluating the application in the eGRANT information system and possibly concluding and fulfilling the grant agreement. The legal basis for processing is the conclusion and fulfillment of the grant agreement. Consent from the Applicant is not required for the processing of personal data for this purpose. Explicit consent from the Applicant is required for the processing of special categories of personal data of the Applicant mentioned in point 4 above. Therefore, the legal basis for processing special categories of personal data of the Applicant is also such explicit consent.
Personal data of the Manager is processed for the purpose of management, processing, and evaluating applications in the eGRANT information system. The legal basis for processing is the fulfillment of obligations from the contractual relationship between the Operator and the Manager (whether it is an employment contract or an ad-hoc oral agreement between the Operator and the Manager), based on which the Manager performs tasks related to the administration of the Call and submitted applications. Consent from the Manager is not required for the processing of personal data for this purpose.
Personal data of the Evaluator is processed for the purpose of evaluating applications in the eGRANT information system. The legal basis for processing is the fulfillment of obligations from the contractual relationship between the Operator and the Evaluator (whether it is an employment contract or an ad-hoc oral agreement between the Operator and the Evaluator), based on which the Evaluator evaluates submitted applications for grants in the context of the Call. Consent from the Evaluator is not required for the processing of personal data for this purpose.
Personal data of the Voter is processed for the purpose of public voting for individual projects that are applying for a grant within the Call. The legal basis for processing is the legitimate interest of the Operator in public participation in the decision-making regarding the provision of grants and the legitimate interest of the Operator in being able to evaluate the validity of the vote (e.g., whether the vote was cast by a person entitled to vote, whether it is not a duplicate vote, etc.). Consent from the data subject is not required for the processing of personal data for this purpose. The data subject may object to the processing if their rights and legitimate interests outweigh the legitimate interest of the Operator.
If the Voter gives consent, the Operator will process information about their contact details for the purpose of sending information to the Voter regarding the Call and potential support, non-support, and implementation of supported projects. Consent from the Voter is required for the processing of personal data for this purpose, which will be provided by checking the relevant box in the voting form. The Voter may revoke consent at any time. The revocation of consent does not affect the lawfulness of the processing of personal data based on consent before its revocation.
The personal data of the Applicant, Manager, Evaluator, and Voter may also be processed by the Operator for ancillary purposes, which are:
●keeping accounts, performing financial control, and fulfilling other legal obligations of the Operator. The legal basis for processing is the fulfillment of legal obligations. Consent from the data subject is not required for the processing of personal data for this purpose.
● asserting and defending contractual rights and defending against unjustified claims made against the Operator. The legal basis for processing is the legitimate interest of the Operator. Consent from the data subject is not required for the processing of personal data for this purpose. The data subject may object to the processing if their rights and legitimate interests outweigh the legitimate interest of the Operator.
● informing the public about the activities of the Operator in the area of providing grants. The legal basis for processing is the legitimate interest of the Operator. Consent from the data subject is not required for the processing of personal data for this purpose. The data subject may object to the processing if their rights and legitimate interests outweigh the legitimate interest of the Operator.
●creating statistics and analyses. The legal basis for processing is the legitimate interest of the Operator. For these purposes, the Operator will process personal data in anonymized form. Consent from the data subject is not required for the processing of personal data for this purpose. The data subject may object to the processing if their rights and legitimate interests outweigh the legitimate interest of the Operator.
6. Access to data:
Personal data as per the previous point is available to the Operator and authorized employees and collaborators, mainly Managers, who are bound by the instructions of the Operator and the obligation to maintain confidentiality.
Personal data to the extent necessary for evaluating applications is available to Evaluators, who are bound by the instructions of the Operator and the obligation to maintain confidentiality.
Data about the Applicant provided in the part of the Application intended for publication will be published on the internet and will therefore be available to an unlimited number of recipients, including Voters. This data will also be published for informational purposes after the end of the Call.
Personal data will be processed in the eGRANT information system, which is operated by ELLMAN, s.r.o., located at: Muškátová 732/23, 900 55 Lozorno, IČO: 35 949 309 (hereinafter referred to as "ELLMANELLMAN operates and administers the mentioned information system based on a contractual relationship with the Operator. ELLMAN processes personal data in the eGRANT information system in such a way that it provides the Operator with web hosting, storage, and tools to publish its call, receive, process, and evaluate applications, record evaluations of Evaluators, and collect votes from Voters. Therefore, ELLMAN generally processes personal data only in an automated manner. Employees, collaborators, and other authorized persons of ELLMAN process the personal data of the affected persons directly only based on the explicit instructions of the Operator (support service). ELLMAN is contractually bound to confidentiality regarding personal data and the obligation to process personal data only in accordance with the instructions of the Operator and in compliance with applicable regulations.
The designer of the eGRANT system and the operator of the servers on which the eGRANT system operates, and in which the data entered into the eGRANT system is stored, is the company ui 42 spol. s r.o., with its registered office at: Haydnova 20/B, 811 03 Bratislava, Company ID: 35 713 003. Data processing at this entity is primarily carried out in an automated manner. Employees of this entity may occasionally come into contact with personal data processed in the eGRANT system in connection with the maintenance and development of the eGRANT system and support activities. This entity is contractually bound to confidentiality regarding personal data and the obligation to process personal data only in accordance with the agreed instructions and in compliance with applicable regulations.
The Operator cannot exclude that, based on the contractual relationship, other persons, so-called processing intermediaries, such as providers of accounting, auditing, legal, cloud, and other services, will process the personal data of the affected persons on its behalf. These intermediaries will be contractually bound to confidentiality regarding personal data and the obligation to process personal data only in accordance with the instructions of the Operator and in compliance with applicable regulations.
The Operator cannot exclude that, in accordance with applicable regulations, courts, law enforcement authorities, or other authorities may request data that it processes as part of control activities or investigations.
Your data, except for selected Applicant data specified in the grant application within the Operator's call, will not be disclosed by the Operator.
The Operator does not plan to send your data to third countries outside the EU. If processing intermediaries do so, they do so exclusively in accordance with applicable legal regulations and requirements.
7. Data processing period:
The Operator processes your data for the longest necessary period, which depends on the purpose of processing. After that, it will delete them.
For the purpose of concluding and fulfilling the grant agreement and for the purpose of asserting and defending the contractual rights of the Operator and defending against unjustified claims made against the Operator, the Operator processes personal data for at least 10 years from their acquisition. At the end of this period and subsequently every maximum of 5 years, the Operator will evaluate whether it still needs this data for the specified purpose. If not, it will delete them. For example, if there is a court dispute regarding rights and obligations from the contract, the Operator will process personal data even during the duration of this dispute and for a reasonable period after its conclusion.
Special categories of personal data (definition see in point 4 above) of the Applicant will be processed by the Operator only until the consent to processing is revoked (if there is no other legal basis for processing). The legality of processing personal data before the consent is revoked is not affected. Revocation of consent may result in (especially regarding data marked as mandatory) that the application cannot be processed or evaluated, that it will be excluded or not supported. It may also result in the impossibility of concluding or fulfilling the grant agreement or the emergence of a reason for its termination.
For the purpose of fulfilling legal obligations, the Operator processes necessary personal data within legally stipulated periods (e.g., in the case of accounting, 10 years from the end of the accounting period to which the data relates).
For statistical and analytical purposes, the Operator processes data in anonymized and aggregated form, so they lose the nature of personal data and will be processed in this way for an unspecified period.
Data about the application intended for publication will be processed by the Operator by publishing for at least 10 years. After this period, the Operator will check whether the publication is still necessary for informational purposes. If not, it will delete the published data. If it still needs the data, it will keep them published and reassess the duration of the publication purpose no later than in another 5 years.
Personal data of the Voter necessary for the purpose of evaluating the voting will be processed by the Operator for at least 10 years from the evaluation of the voting. At the end of this period and subsequently every maximum of 5 years, the Operator will evaluate whether it still needs this data for the specified purpose. If not, it will delete them. The Operator will not delete the data, for example, if it continues to need evidence that it included only valid votes in the voting and that it evaluated the voting correctly due to an ongoing dispute.
Personal data of the Voter processed for the purpose of sending information related to the call, supported, unsupported, and implemented projects will be processed by the Operator for no longer than until the consent to their processing is revoked. After that, it will delete them. Regardless of the revocation of consent, the Operator will evaluate after 10 years from the acquisition of the data whether it still needs them for this purpose. If not, it will delete them. If it still needs the data, it will keep them and reassess the duration of the processing purpose no later than in another 5 years.
In practice, it may happen that the Operator processes the same personal data of the affected person for multiple purposes. If one of the processing purposes ceases, but at least one other continues to exist, the Operator will not delete the personal data, it will just no longer use it for the purposes that have ceased. The Operator will delete the personal data only when all purposes for which it was processed cease.
Your personal data is not subject to automated decision-making or profiling:
No, your personal data will not be used by the Operator for automated decision-making or profiling.
8. Your rights and how to exercise them:
You can exercise your rights by contacting the Operator in the manner specified in point 3 above. The Operator will inform you about the handling of your request within 30 days. In justified cases, the Operator may extend this period by 60 days, even repeatedly. In such cases, the Operator will inform you in advance.
In order for the Operator to handle your request and verify your identity, it will generally require you to provide your name, surname, and permanent residence address in your request.
You have the right to access your data. If you request it, the Operator will inform you whether it processes your data, what data it is, for what purpose, to whom it has been provided, whether it has been transferred to a third country, and how long the Operator will retain it.
You have the right to request the Operator to correct the data it processes about you if you believe they are incorrect.
You have the right to request the deletion of your personal data that the Operator processes about you if it no longer needs them, if you revoke the consent you gave for processing, if the Operator processed personal data unlawfully, or if you correctly object that the legitimate interests of the Operator in processing the data do not outweigh your rights.
You have the right to request the Operator to temporarily suspend the processing of personal data if you believe that it processes incorrect data about you, for the time until their accuracy is verified, if the processing is unlawful, or if the Operator no longer needs the data and you request this instead of deletion, if you object to the processing, until the Operator verifies whether its legitimate interests in processing personal data outweigh your rights.
You have the right to obtain personal data that the Operator processes about you based on consent and/or a contract and processes them by automated means, in a structured, commonly used, and machine-readable format. You can also transfer this data to another person, so if technically possible, the Operator will transfer your personal data directly to the operator of your choice at your request.
You have the right to object to the processing of personal data that the Operator carries out based on its established legitimate interest. In this case, state your rights and legitimate interests that you believe outweigh the interests of the Operator.
If you believe that the Operator violates legal regulations when processing your personal data, you can contact the Office for Personal Data Protection, Hraničná 12, 820 07 Bratislava, https://dataprotection.gov.sk/uoou/.
Further details about your rights can be found in the General Data Protection Regulation.