PRIVACY NOTICE

DAC 1904 LOYALTY PROGRAMME

Effective: 16 June 2026


During the operation of the DAC 1904 Loyalty Programme (“Loyalty Programme”), DS OPERATOR, a.s. (the “Club”) and MOL Nyrt. (“MOL”) process personal data as independent and joint controllers under Regulation (EU) 2016/679 (the “GDPR”). This Privacy Notice provides data subjects with information regarding data processing activities related to the Loyalty Programme, in accordance with Articles 13 and 14 of the GDPR.  


Terms and expressions used but not separately defined in this Privacy Notice shall have the meaning ascribed to them in the General Terms and Conditions of the Loyalty Programme (“Loyalty Programme Rules”). The Loyalty Programme Rules, the general terms and conditions for the use of other services related to the operation of the Loyalty Programme (if any), and the privacy notice(s) related to other services connected with the operation of the Loyalty Programme (if any) are available on the https://www.dac1904.sk/en/ website (the “Website”).


The table below sets out the purpose, legal basis, duration, scope and source of personal data processed in connection with the Loyalty Programme, as well as the recipients of any data transfers and the data processors engaged (where applicable).


Operation of the Loyalty Programme.

The processing includes, for example, 


  • ensuring participation in the Loyalty Programme, and the provision of related services, including in particular registration, management of the Loyalty Account and the virtual Loyalty Card, recording of Points and Loyalty Levels, provision of discounts and benefits, and operation of the Referral Programme,
  • Loyalty Programme Rules, 
  • communication with Customers and sending System Messages strictly necessary for the operation of the Loyalty Programme 
  • and handling of Customers' questions and any complaints.

Article 6(1)(b) GDPR – the processing is necessary for the performance of the contract concluded between the Customer and the Club for participation in the Loyalty Programme, and for the provision of related services. 


Minimum requirements for registration: name (surname and first name), email address, 

optional data that may be provided during registration: date of birth, address (country, city, postcode, street), gender ( assists the Club in more easily identifying the Customer), phone number (in which case the Customer may receive System Messages (at the Club's choice) via SMS, messaging application or other electronic communication channel) , identifier created by the Club.


Loyalty Account-related data: 


  • for example, Loyalty Programme Rules information on acceptance of the Privacy Notice, information on the Customer's consents to data processing and on withdrawal of consents, registration date, in the case of online registration, the encrypted (hash) version of the password, 
  • Loyalty Card number, Loyalty Card usage data (e.g. information on transactions and their time, location, quantity, nature ), information on possible deactivation of the Loyalty Card or its unauthorised use, 
  • communication with the Customer (e.g. declarations, complaints, requests), 
  • information on Points credited to the Loyalty Account, information on the Customer's Loyalty Level, including the discounts to which the Customer is entitled based on their Loyalty Level, and information on the use of discounts (e.g. time, place, manner of use of individual discounts, etc.), coupons assigned to the Customer based on their Loyalty Level or related campaigns (in the case of insurance-related campaigns, insurance-related data).

Participation in the Referral Programme: identity of the Referring Customer, identity of the Referred Customer, referral code, transaction carried out by the Referred Customer, reward given to each Customer.


Source of data: the Club collects data directly from the Customer during registration or subsequently, or collects it during the Customer's use of the Loyalty Programme or Loyalty Card. 


The Club processes personal data until the end of the Customer's participation in the Loyalty Programme, or for the period required by the following legal obligations. 


If the Club is required to retain non-anonymised transaction information for the purposes of fulfilling tax obligations  : the retention period is10 years from the last day of the calendar year in which the tax return, data report or notification was due, or, in the absence of such return, the day on which the tax was due. 


If the Club is required to retain non-anonymised transaction information contained in documents supporting accounting records (e.g. invoices) for the purposes of fulfilling accounting obligations : the retention period is 10 years.


Other retention periods may also apply in relation to specific processing purposes.


SFDC Ireland Limited (Salesforce)

Activities: assistance and information during registration, case management, communication with Customers — including assistance in answering Customer questions and resolving complaints.


Microsoft

Activity: storage of Customer login credentials.


Purchase of tickets and season passes 

Customer-initiated purchase of tickets and season passes, including facilitating the purchase process and transferring necessary data to external providers to complete the purchase.


Detailed data processing conditions relating to the purchase of tickets and season passes are set out in the Club's separate privacy notice, available at: link. See: Privacy Notice relating to the purchase of tickets and season passes. See: Privacy Notice relating to the purchase of tickets and season passes.


Source of data:

the Club collects data directly from the Customer during registration, or subsequently, during the use of the Loyalty Programme and the purchase process. At the Customer's option, the DAC 1904 Application may store certain data provided by the Customer to facilitate future purchases. In such case, the Customer does not need to re-enter those data for subsequent purchases. If the Customer does not opt for data storage, the data must be entered separately for each purchase. The Club processes the purchase-facilitating data stored in the DAC 1904 Application until the end of the Customer's participation in the Loyalty Programme, or until their deletion.


Sending general marketing messages by email, via the DAC 1904 Application(including in-app messages and push notifications)or in some cases by phone.


Such messages include, for example (where they encourage the Customer to make a purchase):

  • offers and surprises, 
  • coupons,
  • reminders about level upgrades or downgrades,
  • invitations to participate in challenges, market research, satisfaction surveys, and questionnaire completion, invitations to campaigns and games,
  • prize draws invitations to participate in the Referral Programme.
  • Online voting

Article 6(1)() GDPR –the Customer's voluntary consent. The Customer may unsubscribe from general marketing messages at any time. Unsubscribing from marketing messages constitutes withdrawal of consent to processing for marketing purposes.


This does not affect the lawfulness of processing carried out prior to withdrawal. Customer's name, email address, phone number (if provided during registration or subsequently) and identifier. In connection with invitations to participate in challenges, market research, satisfaction surveys and questionnaire completion, the Club may contact Customers by phone and email and may take into account data relating to the Customer's use of the Loyalty Card, and may process Customer feedback. Source of data: the Club collects data directly from the Customer during registration or subsequently, or collects it during the Customer's use of the Loyalty Programme or LoyaltyCard.


The Club processes data until the end of the Customer's participation in the Loyalty Programme, unless the Customer unsubscribes from general marketing messages,


  • in the following ways: in the DAC 1904 Application
  • via the unsubscribe link in the email,
  • or via DAC 1904 Customer Service (support@dac1904.sk) following processing of the unsubscription request.

If the Customer has not used their Loyalty Card for 12 months and no transaction has been registered on their Loyalty Account (i.e. the Customer has not collected Points on the Loyalty Account to which the Loyalty Card is linked), the Club may reduce the number of general marketing messages it sends, or may decide not to send the Customer any general marketing messages. The Club may still send, for example, the Club information about prize draws, or an informational email or invitation in the case of a new DAC 1904 service launch .


SFDC Ireland Limited (Salesforce)

Activities: design and execution of advertising campaigns, sending advertising messages.


Sending personalised marketing messages by email or via the DAC 1904 Application(including in-app messages and push notifications).

Such messages include, for example:


  • offers,
  • promotions,
  • discounts,
  • coupons,
  • complementary products,
  • invitations to campaigns and games, prize draws and 
  • invitations to participate in challenges, market research, satisfaction surveys, and questionnaire completion.
  • Online voting

Recommendations may also appear to the Customer in the fan shop at the time of purchase, on the relevant checkout screen.


Article 6(1)(a) GDPR and Article 22(2)(c) GDPR (the Customer's voluntary consent).


Personalised messages are primarily based on the Customer's purchasing habits and interests (profiling).


The Customer may unsubscribe from personalised marketing messages at any time. Unsubscribing from marketing messages constitutes withdrawal of consent to processing for marketing purposes. This does not affect the lawfulness of processing carried out prior to withdrawal.


Customer's name, email address, identifier, date of birth, (if provided during registration or subsequently), gender, city, postcode, Loyalty Card number, Loyalty Card usage data (e.g. nature, quantity, location, time of transactions), interests relating to services/products offered, other data available on the Customer (e.g. data collected during satisfaction surveys).


Source of data: the Club collects data directly from the Customer during registration or subsequently, or collects it during the Customer's use of the Loyalty Programme or Loyalty Card.


The Club processes personal data until the end of the Customer's participation in the Loyalty Programme, unless the Customer unsubscribes from personalised marketing messages, in the following ways: 


  • in the DAC 1904 Application ,
  • via the unsubscribe link in the email, or
  • via DAC 1904 Customer Service(email:support@dac1904.sk – following processing of the unsubscription request). 

SFDC Ireland Limited (Salesforce)

Activities: design and execution of advertising campaigns, including creation of Customer profiles and sending marketing messages


Sending general and personalised marketing messages relating to third parties by email or via the DAC 1904 Application(including in-app messages and push notifications).


Such messages include, for example:

 

  • offers,
  • promotions,
  • discounts,
  • coupons,
  • complementary products,
  • invitations to campaigns and games, prize draws
  • invitations to participate in challenges, market research, satisfaction surveys, and questionnaire completion.

Article 6(1)(a) GDPR and Article 22(2)(c) GDPR (the Customer's voluntary consent).

 

Personalised marketing messages are primarily based on the Customer's purchasing habits and interests (profiling).

 

Only the Club sends marketing messages relating to third parties; the Club does not share personal data with the relevant third parties. The Club reserves the right to modify the list of third-party partners at any time. Customers will always be notified of new partners and may unsubscribe from messages at any time. Unsubscribing from marketing messages constitutes withdrawal of consent to processing for marketing purposes. This does not affect the lawfulness of processing carried out prior to withdrawal.

 

The list of third-party partners is available here: Partner list


Customer's name, email address, identifier, date of birth (if provided during registration or subsequently), gender, city, postcode, Loyalty Card number, Loyalty Card usage data (e.g. nature, quantity, location, time of transactions), interests relating to services/products offered, other data available on the Customer (e.g. data collected during satisfaction surveys).

 

Source of data: the Club collects data directly from the Customer during registration or subsequently, or collects it during the Customer's use of the LoyaltyProgramme or LoyaltyCard, or receives it from a third party, for example in connection with coupons used.


The Club processes personal data until the end of the Customer's participation in the Loyalty Programme, unless the Customer unsubscribes from general and personalised marketing messages relating to third parties, in the following ways:


  • in the DAC 1904 Application ,
  • via the unsubscribe link in the email, or
  • via DAC 1904 Customer Service (support@dac1904.sk) (following processing of the unsubscription request).


SFDC Ireland Limited (Salesforce)

Activities: design and execution of advertising campaigns, including creation of Customer profiles and sending marketing messages.


Prevention, detection, investigation and handling of possible fraud and misuse related to the Loyalty Programme.

An example of fraud or misuse is an attempt to claim benefits without authorisation using a false account. Article 6(1)(f) GDPR – the processing is necessary for the legitimate interests of the Club and/or MOL .


The Club and/or MOL has a legitimate interest in applying strict controls and measures to ensure the fair operation of the Loyalty Programme, including ensuring the fair operation of payment services available in the DAC 1904 Application. 


Preventing misuse related to the Loyalty Programme and handling it effectively protects the resources devoted to operating the Loyalty Programme (assets, trade secrets, intellectual property), preserves the credibility of the brand of the Club and/or MOL, maintains a positive relationship with and trust of Customers, and prevents, detects irregularities related to the Loyalty Programme and holds responsible parties accountable.


The Club and MOL may provide a balancing test (also known as a "legitimate interest assessment") upon request. Name of the data subject, Loyalty Card number and usage data of the Customer concerned, data related to the use of the relevant service, data contained in reports of possible fraud or misuse, and data generated during the investigation. The Club and/or MOL may link these data with other data they otherwise process – for example "block data" (including: name, product code, quantity, price, location and time of purchase of the product(s) purchased, etc.).


Source of data:

the Club and/or MOL collect data directly from the Customer during registration, or collect them during the Customer's use of the Loyalty Programme or Loyalty Card, or obtain them through reports of possible fraud or misuse and information generated during the investigation. If the investigation establishes that no fraud or misuse has occurred in connection with the Loyalty Programme and no further action is required, the Club and/or MOL will deletethe personal data within 60 days of the conclusion of the investigation.


In other cases the Club and/or MOL processthe data until the completion of the steps relating to any measure taken (e.g. disciplinary measure, suspension of the Customer's participation in the Loyalty Programme) or the actual enforcement of legal claims. If the Customer's right to participate in the Loyalty Programme has been terminated by the Club due to a breach of the Loyalty Programme Rules or other misuse or infringement, the Club retains the relevant data of the Customer concerned in relation to the breach for the purpose of verifying any re-registration of the Customer for a period of 1 year from the date of termination. 


If, following the investigation, formal or court proceedings are initiated, the Club and/or MOL will processthe personal data until the final conclusion of those proceedings.


The formal documents generated will be retained by the Club and/or MOL in accordance with the rules applicable to the retention of the relevant documents.


Establishment, exercise and defence of legal claims related to the Loyalty Programme. 

This includes for example multiple registrations for the purpose of obtaining free products available in the DAC 1904 Application. Article 6(1)(f) GDPR – the processing is necessary for the legitimate interests of the Club and/or MOL. 


The Club and/or MOL havea legitimate interest in taking legal steps if the Club's rights related to the Loyalty Programme are violated or endangered. This legitimate interest also includes the right of the Club and/or MOL to successfully defend in any dispute or administrative proceedings.


The Club and MOL may provide a balancing test (also known as a "legitimate interest assessment") upon request. 


In the case of enforcement of legal claims, the Club and/or MOL may disclose available data to the competent authority, for example by initiating court proceedings or filing a criminal complaint against the data subject. All data defined under the previous processing purposes, in particular the scope of data necessary for enforcing legal claims or defending in a particular case.


Such data typically include: name, email address, phone number of the person concerned by the legal claim (only if the dispute relates to the lawfulness of the processing of the phone number), date of birth, Loyalty Card number affected by the legal claim and usage data thereof.


Source of data: depending on the circumstances of the case, the data subject, a third party, the Club or MOL. The Club and/or MOL processthe data until the completion of the steps relating to the possible enforcement of legal claims.


If formal or court proceedings are initiated in connection with the enforcement of legal claims, the Club and/or MOL will process the personal data until the final conclusion of those proceedings.


The formal documents generated will be retained by the Club and/or MOL in accordance with the rules applicable to the retention of the relevant documents.


Ensuring the exercise of data subjects' rights in relation to data protection

The purpose of the processing is to ensure the exercise of the Customer's rights under the GDPR (e.g. access, rectification, erasure, restriction of processing, objection, portability), handling requests, their assessment and response.

Article 6(1)(c) GDPR – compliance with a legal obligation, for the purposes of handling, assessing, responding to data subject requests and documenting related measures. Data of the Customer necessary for identification and assessment of the request , in particular: name (surname and first name), contact details (e.g. email address), content of the request submitted, data relating to the handling of the request.


Source of data:

the Club and/or MOL collect data directly from the Customer upon submission and handling of the request; data also come from data processed by the Club/or MOL in connection with the Loyalty Programme to the extent necessary for the assessment of the request.

The Club and/or MOL process the data after handling the request until the expiry of the limitation period for legal claims, or until the final conclusion of any administrative or court proceedings.



1 Mandatory data retention is governed by the relevant provisions of Act No. 563/2009 on Tax Administration and Act No. 431/2002 on Accounting.

2 Mandatory data retention is governed by Section 35 and other relevant provisions of Act No. 431/2002 on Accounting.

3 The Customer may receive two reminders to participate in the Referral Programme – approximately two weeks after the first invitation, and then approximately 3 months after the first invitation.


Data controllers:


MOL Nyrt.

Registered address: 1117 Budapest, Dombóvári út 28., Hungary

Company registration number: Cg.01-10-041683


DS OPERATOR, a.s.

Registered address: Povodská 5351/14A, 929 01 Dunajská Streda, Slovak Republic

Statistical identification number: 50 868 683  

https://www.dac1904.sk/hu/


With respect to the Loyalty Programme, the Club acts as an independent controller for the following processing purposes:

  • Operation of the Loyalty Programme.
  • Ticket and season ticket purchases, and purchases in the DAC Store online shop.
  • Sending general marketing messages by e-mail, via the DAC 1904 Application, or in some cases by phone.
  • Sending personalised marketing messages by e-mail or via the DAC 1904 Application.
  • Sending general and personalised third-party marketing messages (advertisements) by e-mail or via the DAC 1904 Application.

With respect to the Loyalty Programme, MOL and the Club act as joint controllers for the following processing purposes:  

  • Prevention, detection, investigation and examination of possible fraud and misuse related to the Loyalty Programme.
  • Establishment, exercise and defence of legal claims related to the Loyalty Programme. 
  • Ensuring the exercise of the Customer’s data protection rights.

MOL and the Club have entered into a joint controller agreement for these processing purposes, which defines their roles and responsibilities to ensure that personal data is processed in accordance with applicable law.  


Regardless of the terms of the joint controller agreement, the data subject may exercise their rights against both the Club and MOL. Further details about the joint controller agreement are available from the DAC 1904 Customer Service.  


The Club and MOL use the services of their legal counsel pursuant to Article 6(1)(f) GDPR (the legitimate interest of the Club and/or MOL ) for the management and successful enforcement of their claims, and transfer the necessary personal data to those lawyers for this purpose. These lawyers act as independent controllers in accordance with their own privacy notices. Where a specific matter is referred to a legal partner, and upon the request of the individual, the Club or MOL will provide information on the identity of the legal partner involved in the relevant data processing operation, and on the contact details, activities and the data processed in connection therewith.


When downloading the DAC 1904 Application, Apple Inc. (App Store) and Google Inc. (Google Play) act as independent controllers and have their own privacy notices.


Contact details of the Club (DAC 1904 Customer Service):

support@dac1904.sk


Contact details of MOL:

MOL Retail Customer Service

1117 Budapest, Dombóvári út 28.

+36 1 886 5000

ugyfelszolgalat@mol.hu  


Contact details of the Club’s Data Protection Officer:

zodpovednaosoba@virelaw.sk


Contact details of MOL’s Data Protection Officer: 

dpo@mol.hu 


Data processors

  • SFDC Ireland Limited (Salesforce) - Salesforce Tower Dublin, North Dock, Dublin 1, D01 W2Y3, Ireland
  • Microsoft

Where the Club and/or MOL engages service providers acting as data processors, it ensures that appropriate data processing agreements are in place in accordance with Article 28 GDPR. The purpose of these agreements includes ensuring that personal data is processed by the data processor on behalf of the Club and/or MOL and exclusively on the instructions of the Club and/or MOL


Data transfers

If the Customer initiates a ticket and/or season ticket purchase via the DAC 1904 Application, they are redirected to the Predpredaj website. In this process, the Customer’s name and e-mail address are transferred to Predpredaj for the purpose of completing the ticket and/or season ticket purchase, from where the ticket is forwarded to Triton, which handles access control and ticket management. MADWIRE, s. r. o. (registered address: Svätoplukova II. 18892/2 A, 821 08 Bratislava - mestská časť Ružinov, statistical identifier: 47 436 310) and T R I T O N spol. s r. o. (registered address: Topoľčianska 25, Bratislava 851 01, statistical identifier: 31 323 642) act as controllers during the ticket and/or season ticket purchase process – independently or jointly with others, they may determine the purposes of processing personal data, take decisions relating to the processing (including the means) and implement, or have implemented, those decisions by a data processor engaged by them. MADWIRE, s. r. o. and T R I T O N spol. s r. o. act in accordance with their own data processing terms available on their website – the Club and MOL have no supervisory authority in this regard. At the Customer’s option, the Club may also transfer the Customer’s billing data (postal address – country, city, postal code, street, house number) to MADWIRE, s. r. o. and T R I T O N spol. s r. o.


Automated decision-making and profiling, applied logic, significance and consequences of processing 


The profiling applied for the purposes of “Sending personalised marketing messages by e-mail or via the DAC 1904 Application” and “Sending general and personalised third-party marketing messages by e-mail or via the DAC 1904 Application” is primarily based on Loyalty Card usage data. In this context, the Club takes into account the Customer’s purchase history: the services used/products purchased from the Club by the Customer, e.g. the type of product and service, the frequency and value of purchases, and the Customer’s age and gender.

For example:

  • The Club examines what other products men between the ages of 35 and 40 purchased on occasions when a jersey was also in the basket, and recommends similar products alongside the purchase of a jersey for men aged 35–40. The Club records, for the purpose of measuring the success of marketing messages, what marketing messages the Customer received, what products and services they purchased, and when, how frequently and at what cost. The Club determines, based on the above factors, what personalised messages it may send to the Customer in the future. The Club identifies, for example, based on purchasing habits, in what period or with what frequency it is advisable to send a personalised message to a Customer, or what product or service it is advisable to recommend to the Customer. An example of a personalised offer: the Club sends a coupon related to the Customer’s favourite product on their birthday, for example sunglasses. The Club infers the Customer’s favourite product type from their previous purchases. If the Club
  • sees that the Customer purchases a key ring alongside sunglasses, it may also recommend such a product in the marketing message. If the Customer has not used their Loyalty Card for 12 months and no transaction has been registered on their Loyalty Account (i.e. the Customer has not accumulated Points on the Loyalty Account linked to the Loyalty Card), the Club

may reduce the number of personalised marketing messages it sends, or decide not to send personalised marketing messages to the Customer.


Rights of data subjects and available remedies in relation to processing The rights of data subjects and available remedies, and their limitations, are set out in detail in the GDPR (in particular Articles 15, 16, 17, 18, 19, 20, 21, 22, 77, 78, 79 and 82 of the GDPR). The data subject may at any time request information about the processing of their data, request the rectification, erasure or restriction of their data,may at any time object to processing based on legitimate interest, and the data subject also has the right to data portability. The Club summarises below the most important data protection rights of the data subject applicable to the processing purposes covered by this Privacy Notice.


Right to information Where the Club and/or MOL processes personal data relating to the data subject, the Club and/or MOL is obliged to provide information to the data subject – even without a request from the data subject – about the key characteristics of the processing, including the purpose and legal basis of the processing, its duration and the criteria for determining its duration, the Cluband /or MOL’s representative and contact details, the contact details of the data protection officer, the recipients of personal data (with an indication of appropriate and suitable safeguards where data are transferred to a third country), in the case of processing based on legitimate interest, the legitimate interest of the Club, MOL and/or a third party, and the rights and available remedies of the data subject in relation to processing (including the right to lodge a complaint with a supervisory authority), and further, where the data subject is not the source of the data, information on the source of personal data and the categories of personal data concerned, if the data subject does not already have this information. In the case of automated decision-making and profiling, the Club and/or MOL also informs the data subject about the applied logic, and provides intelligible information on what significance such processing has and what its expected consequences are for the data subject. The Club and/or MOL provide this information by making this Privacy Notice available.


Right of access 

The data subject is entitled to receive confirmation from the Club-tól and/or MOL as to whether personal data concerning them are being processed, and if so, to obtain access to the personal data and certain information relating to the processing, including the purposes of processing, the categories of personal data concerned, the recipients of personal data, the (envisaged) duration of processing, the data subject’s rights and available remedies (including the right to lodge a complaint with a supervisory authority), and, where data are not collected from the data subject, information on their source.  


Upon request by the data subject, the Club and/or MOL will provide the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the Club and/or MOL may charge a reasonable fee based on administrative costs. If the data subject submits the request electronically, the information shall be provided in a commonly used electronic format, unless the data subject requests otherwise. The right to receive a copy shall not adversely affect the rights and freedoms of others.  


The Club and/or MOL will provide information to the data subject upon request about the possibility, manner, potential costs and other details of providing a copy. the Club and/or MOL 


In the case of automated decision-making and profiling, the data subject may access the following information: the applied logic, and what significance such processing has and what its expected consequences are for the data subject.


Right to rectification

The data subject is entitled to have inaccurate personal data relating to them rectified by the Club and/or MOL without undue delay upon request. Taking into account the purposes of the processing, the data subject is also entitled to have incomplete personal data completed, including by means of providing a supplementary statement.  


Right to erasure

The data subject is entitled to have personal data relating to them erased by the Club and/or MOL without undue delay upon request. The Club and/or MOL is obliged to erase personal data relating to the data subject without undue delay where certain conditions are met. the Club and/or MOL is obliged, in particular upon the request of the data subject, to erase the data subject’s personal data where the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; where the data subject withdraws consent on which processing is based and there is no other legal basis for processing; or where personal data have been processed unlawfully; or where the data subject objects to processing and there is no overriding legitimate ground for processing; or where personal data must be erased in order to comply with a legal obligation under EU or Member State law applicable to the Club and/ or MOL; The Club and/or MOL or where personal data have been collected in relation to the offer of information society services. to the Club and/or MOL applicable under EU or Member State law; or where personal data have been collected in relation to the offer of information society services.  


Right to restriction of processing

The data subject is entitled to obtain restriction of processing from the Club and/or MOL upon request, where one of the following applies:  


(a) the data subject contests the accuracy of the personal data, in which case the restriction applies for a period enabling the Club and/or MOL to verify the accuracy of the personal data;  

(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

(c) the Club-nak and/or MOL no longer needs the personal data for processing purposes, but the data subject requires them for the establishment, exercise or defence of legal claims;

(d) the data subject has objected to processing; in this case the restriction applies for a period pending verification of whether the legitimate grounds of the Club and/or MOL override those of the data subject.  


Where processing is restricted on the above grounds, such personal data may, with the exception of storage, only be processed with the data subject’s consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.


Where restriction of processing requested by the data subject is lifted, the Club and/or MOL will notify the data subject in advance. the Club and/or MOL will notify the data subject in advance.


Right to data portability

The data subject is entitled to receive the personal data concerning them, which they have provided to the Club and/or MOL , in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from the Club and/or MOL, to which the personal data have been provided, where:  


(a) the processing is based on consent given by the data subject or on the performance of a contract to which the data subject is a party; and

(b) the processing is carried out by automated means.


In exercising the right to data portability, the data subject is entitled – where technically feasible – to request the direct transfer of personal data from one controller to another.


The right to data portability shall not adversely affect the right to erasure, nor shall it adversely affect the rights and freedoms of others.


Right to object

The data subject is entitled to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them by the Club and/or MOL based on legitimate interest, including profiling based on those provisions. In that event, the Club and/or MOL may no longer process the personal data, unless the Club and/or MOL demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.


Where personal data are processed for direct marketing purposes (“Sending general marketing messages by e-mail, via the DAC 1904 Application, or in some cases by phone.”), the data subject is entitled to object at any time to the processing of personal data concerning them for that purpose – in that case the personal data may no longer be processed for that purpose.  


Withdrawal of consent

The data subject is entitled to withdraw the consent given to and/or MOL the Club at any time in the manner and form specified in this Privacy Notice (see: General marketing messages, Personalised marketing messages, General and personalised third-party marketing messages). Withdrawal of consent is free of charge and does not affect the lawfulness of processing based on consent carried out prior to its withdrawal. Withdrawal of consent is free of charge and does not affect the lawfulness of processing based on consent carried out prior to its withdrawal.


Framework for the exercise of rights


The Club and/or MOL will respond to the data subject without undue delay, and in any event within one month of receipt of the request, about the measures taken further to the request relating to the rights listed above. Where necessary, taking into account the complexity and number of requests, this deadline may be extended by a further two months. the Club and/or MOL will notify the data subject of the extension within one month of receipt of the request, stating the reasons for the delay. If the data subject submitted the request electronically, the response shall, where possible, be provided electronically, unless the data subject requests otherwise.   


The above information must be provided by the Club and/or MOL in writing or by other means, the Club-nak and/or MOL including by electronic means where applicable. Oral information may also be provided at the request of the data subject, provided that the identity of the data subject has been verified by other means.


Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with a supervisory authority – in particular in the Member State of their habitual residence, place of work or place of the alleged infringement – if the data subject considers that the processing of personal data relating to them infringes the GDPR. The contact details of the supervisory authorities within the EU are available at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. The competent supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), registered address: Galvaniho Business Centrum II, Galvaniho 7/B, Bratislava, Slovak Republic. Contact: Galvaniho Business Centrum II, Galvaniho 7/B, Bratislava, Slovak Republic. Contact:  

  • Tel. + 421 2 32 31 32 14
  • Fax + 421 2 32 31 32 34
  • E-mail: statny.dozor@pdp.gov.sk
  • Website: http://www.dataprotection.gov.sk/


Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, the data subject is entitled to an effective judicial remedy if they consider that their rights under the GDPR have been infringed as a result of the processing of their personal data in a manner that does not comply with the GDPR. Proceedings against the Club, MOL or their controller or processor partners shall be brought before the courts of the Member State where the Club, MOL or the controller or processor has an establishment. Such proceedings may also be brought before the courts of the Member State where the data subject has their habitual residence. the Club, MOL or the controller as well as processor has an establishment in. Such proceedings may also be brought before the courts of the Member State where the data subject has their habitual residence. 


In Slovakia such proceedings fall within the jurisdiction of the Regional Court. Information on the jurisdiction and contact details of the courts is available at:  https://www.justice.gov.sk/sudy-a-rozhodnutia/.



Version history:

2026.06.16 - First version