Terms and conditions of processing personal data on the www.picoballoon.org portal

The security of the processing and protection of the personal data of all persons who entrust it to us is extremely important to us.

The operator of the www.picoballoon.org portal is Noove s.r.o. Your personal data is processed by joint operators who together act under the name noove. The Noove group consists of companies and non-profit organizations that are the carriers of the vision of the company Noove s.r.o.. The joint controllers of your personal data information systems are (collectively, the "Controllers" or the Noove Group).

Noove Group's management company:

• Noove s. r. o., with registered office at Ševčenkova 1034/9, 851 01 Bratislava - Petržalka district, Slovak Republic, ID No.: 53 243 854, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Entry No. 147950/B, e-mail: hello@noove.org 

• Members of the Noove Group:

  • Noove - sk.

The Noove Group is responsible for the proper and lawful processing and compliance with its data protection obligations. You may exercise your rights against Noove Group as described below.

The contact person for the Data protection officer is: dpo@noove.org.

For what purposes do we process your personal data in relation to the consents you have provided?

Noove Group may process your personal data for the following purposes:

• Marketing;

• Project Picoballoon careers - Providing contact and personal data to a potential employer

The scope of the categories of personal data processed for the purpose is set out below:

As part of the processing of data for marketing purposes, profiling is also carried out by means of data analysis of the data provided.

Where do we get your personal data from?

In almost all cases, we get your data directly from you. We want to contribute to the development of young people and professionals with the potential to grow into individuals who combine character, excellence, entrepreneurial leadership and civic engagement. Regardless of the socio-economic background they come from. That's why we offer a variety of challenges, projects and events where you can further develop yourself personally and career-wise.

We only process data that you provide to us through the www.picoballoon.org careers platform as a user using publicly accessible services.

On what legal basis do we process your personal data?

We process your data based on the legal basis as defined by the GDPR, namely:

• explicit consent you have given us for the purpose of marketing, or arranging a job opportunity, or pursuing IP transfer due to being a winner in a Noove challenge;

• contracts, i.e. by registering on the trynoove.com platform

What is the processing period of your personal data?

We determine the processing period so that we process your personal data for as long as is strictly necessary for the duration of the legal basis for processing (legal possibility of processing).

We process personal data on the basis of the consent given for a period of one or five years after the consent is given or until the consent is withdrawn.

We process personal data based on your activity on the picoballoon.org careers platform within five days after cancellation of your profile on the portal.

Upon expiry of the relevant periods, we will stop processing your personal data for the relevant purpose and delete and properly dispose of it.

What rights do you have in relation to the protection and processing of your personal data?

The Noove Group guarantees your rights as a data subject under the GDPR, which you can exercise against us. These rights are:

Right to information when obtaining personal data 

The right to information means your possibility, as a data subject, to find out before or when your personal data is collected how your personal data will be processed by the Noove Group, as well as the specified conditions for this processing. This includes, for example, the right to be informed of the identity and contact details of the controller and its responsible person, the purposes of the processing of personal data, the legal basis, the legitimate interests, whether the provision of personal data is a legal or contractual requirement, the recipients or categories of recipients of the personal data (if any), the period of storage, the calculation of the rights you have, the possibility of contacting the Office for Personal Data Protection of the Slovak Republic, or information on whether automated decision-making and profiling or transborder transfers take place in the processing of your personal data, etc. The Noove Group is obliged to comply with these obligations when obtaining your personal data if it is obtained from you (the data subject), in other cases within a reasonable period of time, but no later than one month after obtaining the personal data, or no later than the first contact with the data subject if the personal data is to be used for communication.

Should Noove Group intend to further process your personal data for a purpose other than that for which it was collected, it will provide you with information about that other purpose and other relevant information before such further processing.

Right of access to data

The right of access includes the following:

• the right to obtain confirmation from Noove as to whether Noove processes your personal data and if so,

• the right of access to your personal data that we process, i.e. Noove will provide you with a copy of your personal data (as a data subject) that it processes.

  • For any additional copies requested by the data subject, Noove may charge a reasonable fee corresponding to the administrative costs. You may make your request by any means. If the data subject has made the request by electronic means, the information will be provided in a commonly used electronic format. However, you may request a different method of disclosure.

• the right to related information, which includes in particular:

  • the right to be informed of the purposes of processing;

  • the right to be informed of the categories of personal data concerned;

  • the right to be informed of the recipients or categories of recipients to whom personal data have been or will be disclosed, in particular information on recipients in third countries or within international organizations;

  • the right to be informed of the expected period of retention of personal data and, where this is not possible, at least the criteria for determining it;

  • the right to require the controller to rectify personal data relating to the data subject or to erase or restrict processing and the right to object to such processing;

  • the right to lodge a complaint with the supervisory authority;

  • the right to any available information about the source of the personal data from which the personal data were obtained, if not obtained from the data subject;

  • in the case of automated decision-making, including profiling (pursuant to Article 22(1) and (4) of the GDPR), the right to be informed in a meaningful way about the procedure used, as well as the meaning and the envisaged consequences of such processing for the data subject;

  • where personal data are transferred to a third country or an international organization, the data subject has the right to be informed of the appropriate safeguards (under Article 46 of the GDPR) relating to the transfer.

Right to repair

If your personal data processed by the Noove Group is outdated, incorrect or incomplete, you have the right to have it corrected or completed without undue delay after we become aware of it;

• with regard to the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by providing a supplementary declaration.

Right to erasure

If one of the reasons is met, you can request the deletion of your data:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

• the data subject withdraws the consent to the processing of personal data given pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR on the basis of which the processing is carried out, unless there is no other legal basis for the processing;

• the data subject objects to the processing (pursuant to Article 21(1) of the GDPR) and his or her rights are not overridden by any legitimate interest in the processing or the data subject objects to the processing pursuant to Article 21(2) of the GDPR;

• personal data have been unlawfully processed;

• the personal data must be erased in order to comply with a legal obligation under European Union law or the law of a Member State to which the controller is subject (i.e. the controller will erase the personal data if required to do so by such law);

• personal data was collected in connection with the offer of information society services pursuant to Article 8(1) of the GDPR.

Right to restriction of processing of personal data 

You have the right to request the restriction of the processing of your personal data. If the conditions for this are met (see below), we will restrict the processing of your personal data. If the processing is restricted, such personal data will, apart from being stored, only be processed:

• your consent or

• for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

You have the right to have the controller restrict the processing of your data in one of the following cases:

• you contest the accuracy of the personal data during a period allowing the controller to verify the accuracy of the personal data,

• the processing is unlawful and you object to the erasure of your personal data and request instead that its use be restricted,

• the controller no longer needs the personal data for the purposes of the processing, but you, as the data subject, need them to establish, exercise or defend legal claims,

• you object to the processing, pending verification that the legitimate grounds on the part of the controller outweigh your legitimate grounds.

Right to object

You have the right, as the data subject, to object at any time to the processing of your personal data:

• For reasons relating to your particular situation, in the following cases of processing, including objecting to profiling based on the GDPR provisions below:

  • in the case of processing which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (pursuant to Article 6(1)(e) of the GDPR); or

  • the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child (pursuant to Article 6(1)(f) of the GDPR).

If you object, we may no longer process your personal data unless you demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

• Where your personal data is processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. If the data subject objects to the processing for direct marketing purposes, the personal data may no longer be processed for such purposes.

• In relation to the provision of services provided at a distance by means of a connection via electronic devices, you, as the data subject, may exercise your right to object by automated means using technical specifications.

• For reasons relating to your particular situation, where your personal data is processed for scientific or historical research purposes or for statistical purposes (pursuant to Article 89(1) of the GDPR), except where the processing is necessary for the performance of a task carried out for reasons of public interest.

Right to data portability

The person concerned has the right to:

• to obtain the personal data concerning him or her which he or she has provided to the controller in a specified format which permits transmission (in a structured, commonly used and machine-readable format); and

• transfer those data to another controller without being prevented by the controller to whom the personal data have been disclosed, if:

• (i) the processing is based on consent (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR) or on a contract (pursuant to Article 6(1)(b) of the GDPR), and

• (ii) where the processing is carried out by automated means.

When exercising his or her right to data portability, the data subject shall have the right to have personal data transferred directly from one controller to another controller, insofar as this is technically feasible, but without adversely affecting the rights and freedoms of others.

Right to lodge a complaint

In case of any doubts with the compliance with the obligations in the processing of your personal data by the Noove Group, you have the right to file a complaint regarding the processing of personal data to the supervisory authority, which in the Slovak Republic is the Office for the Protection of Personal Data of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27, Slovak Republic, ID No.: 36 064 220.

When and how can you withdraw consent to the processing of your personal data?

If you have given consent to Noove to process your personal data, your consent to the processing of your personal data is based on free choice and voluntariness, so if you no longer consent to the further processing of your personal data for the purpose for which you have given your consent, you may withdraw it at any time without affecting the lawfulness of the processing based on the consent given before its withdrawal.

You can withdraw your consent by sending an electronic withdrawal request to the Data Protection Officer (dpo@noove.org).

For the sake of completeness, it should be noted that even if the Noove Group terminates the processing of your personal data based on your consent and duly disposes of such personal data, this does not necessarily mean that the Noove Group will not process any of your personal data to any extent whatsoever. This is because, for example, there may be another purpose for processing your personal data that is based on a legal basis other than your consent, such as a contract that exists between us or our legal obligation.

Therefore, if you withdraw your consent to the processing of your personal data, this will mean the following:

• we will immediately stop processing your personal data for the purpose for which it was processed on the basis of your consent and we will delete your personal data from the relevant databases maintained for that purpose,

• if there is no other purpose for which we process your personal data other than on the basis of your consent, the Noove Group will no longer process your personal data to any extent at all,

• if there is another purpose for which we process your personal data other than on the basis of your consent for that purpose, the Noove Group will process your personal data but only for that other purpose.

Who do we provide your personal data to?

We will disclose or provide personal data to third parties only on the basis of a legal requirement (under the GDPR, the GDPR, another generally binding legal regulation, a directly enforceable legally binding EU act or an international treaty to which the Slovak Republic is bound, and to other authorized entities under Slovak legislation).

The Noove Group also uses contractors in its operations. In some cases, personal data is processed in the course of these activities. In all cases, we take care to select our contractors carefully, assess their reliability and have contractual rules on the protection of personal data. In accordance with the law, when selecting a processor, we ascertain its professional, technical, organizational and personnel competence and its ability to guarantee the security of the personal data processed by means of measures pursuant to Article 28 of the Regulation and Section 39 of the PDPA. Entities that carry out personal data processing on our behalf have a personal data processing contract concluded in accordance with the PDPA.

Processors may be entities that Noove has entrusted to process personal data on its behalf. Such processors may include, in particular, companies providing marketing activities, companies providing press and mass mailing services, companies providing delivery services and companies collecting contact data and obtaining data subjects' consent.

We may also disclose your personal data to the following recipients:

• potential employers (based on your choice),

• cooperating organizations providing internships, apprenticeships, volunteering, mentoring, etc;

• mentor (name only) for the purpose of mentoring the person concerned,

• mentee (contact and profile details)

• partner for organizing events,

• owners of linked accounts (Google, Facebook, LinkedIn),

• marketing tools (such as Exponea, Google Analytics).

Safety measures

In order to protect personal data, the Noove Group implements security measures. These measures are equally applied to the processes of information collection, storage, processing and disposal and aim to protect the personal data of data subjects from damage, destruction, loss, alteration, unauthorized access and disclosure, disclosure or disclosure, as well as from any other impermissible means of processing.

The security of personal data is ensured by technical, organizational and personnel measures that are appropriate to the manner in which personal data are processed. Personal data are processed using manual means of data processing within information systems and are secured and protected in accordance with the relevant security standards and data protection regulations.

Noove has implemented security measures in line with good information security practice (e.g. access rights management, data backup, end-user security policies, cloud service management, etc.). The organization is not required to document these measures under the exemption in Article 30(5) of the GDPR.

The Noove Group stores and protects members' personal data for the period specified in the chapter by the applicable law. Personal data for which the authorization to process and store it has expired are deleted within the period specified in the subsection Retention periods and methods of determining them.

The personal data collected or processed may be subject to a cross-border transfer of personal data to Member States of the European Union, as well as to countries that provide an adequate level of protection, in accordance with the provisions of the relevant legislation.