We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR), Act No. 18/2018 Coll. on Personal Data Protection and other applicable legislation.
1. Personal Data Controller
The controller of personal data is:
Masarykova 22
080 01 Prešov
Slovak Republic
Company ID No.: 364 846 95
E-mail: studijne@vste.sk
Telephone: +421 904 183 805
Hereinafter referred to as “VŠTE” or the “Controller”.
This Privacy Statement provides information on the personal data processed by VŠTE, the purposes and legal grounds for such processing, the recipients to whom the data may be disclosed, how long the data are retained and the rights of data subjects.
2. Principles of Personal Data Processing
When processing personal data, we comply in particular with the following principles:
- lawfulness, fairness and transparency,
- purpose limitation,
- data minimisation,
- accuracy and keeping data up to date,
- storage limitation,
- integrity and confidentiality,
- security of processing,
- accountability of the Controller.
Personal data are not processed solely on the basis of consent. Depending on the specific purpose, the legal basis for processing may include compliance with a legal obligation, performance of a contract or steps taken prior to entering into a contract, the legitimate interests of the Controller, or the consent of the data subject.
3. Categories of Data Subjects
VŠTE processes personal data relating in particular to:
- applicants for study,
- students,
- graduates,
- participants in further and lifelong education,
- employees and job applicants,
- academic, teaching and professional staff,
- contractual partners and their contact persons,
- suppliers and service providers,
- participants in events organised by VŠTE,
- visitors to the VŠTE website,
- persons communicating with VŠTE electronically or in writing.
4. Purposes and Legal Bases of Processing
| Purpose of processing | Legal basis | Personal data processed |
|---|---|---|
| Admissions procedure and processing of applications | Compliance with legal obligations and taking steps prior to the establishment of the relevant legal relationship | Identification, contact and other data required for the assessment of the application |
| Organisation and provision of studies | Compliance with legal obligations and performance of the legal relationship between VŠTE and the student | Identification data, contact details, data concerning studies, study programme, courses and academic results |
| Communication with students | Legal obligation, performance of the relevant legal relationship or legitimate interest, depending on the nature of the communication | First name, surname, institutional e-mail address, study programme, year of study or study group |
| Operation of information systems | Legal obligation, performance of the relevant legal relationship or the legitimate interest of VŠTE in the secure operation of information systems | Identification, authentication, technical and operational data |
| Accounting, payment records and invoicing | Compliance with legal obligations | Identification, invoicing and payment data |
| Human resources and payroll administration | Performance of employment relationships and compliance with legal obligations | Personal data to the extent required under labour, tax and related legislation |
| Handling enquiries, requests and submissions | Legal obligation, legitimate interest or performance of the relevant legal relationship | First name, surname, contact details and the content of the communication |
| Protection of VŠTE's rights and legal claims | Legitimate interest of the Controller | Data necessary for establishing, exercising or defending legal claims |
5. Electronic Communication with Students
VŠTE may use students' institutional e-mail addresses to provide communications relating to their studies, teaching and the activities of the higher education institution.
Students may receive in particular:
- current notices published on the VŠTE website,
- information concerning the organisation of teaching,
- notifications of timetable and date changes,
- information related to studies,
- information about academic and institutional events,
- other organisational and operational information from VŠTE.
Scope of Personal Data Processed
For this purpose, we may process in particular:
- first name and surname,
- institutional e-mail address,
- study group,
- year of study or study programme where necessary for appropriate targeting of the information.
6. Information E-mails and the Brevo Service
VŠTE may use the Brevo platform for the technical provision of bulk informational e-mails.
Through this service, students may receive in particular updates from the VŠTE website and information related to their studies, teaching and the activities of the institution.
The following data may be entered into the Brevo system:
- the student's first name and surname,
- institutional e-mail address,
- data required to assign the student to the appropriate recipient group.
Where the provider of the Brevo service processes personal data on the instructions of VŠTE, it acts as a processor in relation to VŠTE within the meaning of Article 28 GDPR.
Processing of personal data through the Brevo service is governed by the applicable contractual terms and a Data Processing Agreement (DPA).
VŠTE does not provide lists of students' e-mail addresses to the Brevo service provider for the provider's own marketing purposes.
7. Students' Contact Details for Teaching Staff
VŠTE may make students' contact details available to authorised employees and teaching staff to the extent necessary for the provision of teaching and communication with students.
This may include in particular:
- first name and surname,
- institutional e-mail address,
- study group or study programme.
These data may be used, for example, for:
- inviting students to Microsoft Teams environments,
- sending study materials,
- communication relating to teaching,
- sending organisational notices.
8. Operation of the Website
When visiting the VŠTE website, technical data necessary to ensure its correct and secure operation may be processed automatically.
This may include in particular:
- the IP address of the device,
- date and time of access,
- the page visited,
- type and version of the web browser,
- operating system and device type,
- technical data necessary to protect the website.
These data may be processed on the basis of VŠTE's legitimate interest in ensuring the functionality, protection and security of its website and information systems.
9. Cookies
The VŠTE website may use cookies and similar technologies.
Essential Cookies
Essential cookies are necessary for the proper and secure functioning of the website. They may be used without the user's specific consent where they are necessary to provide a service requested by the user.
Optional Cookies
Analytical, statistical, marketing or other optional cookies are used only where the relevant legal basis exists and the user has provided the required consent.
Users may change or withdraw their consent to optional cookies through the available cookie settings.
10. Recipients of Personal Data
Personal data may, to the extent necessary, be made available in particular to:
- authorised employees of VŠTE,
- authorised teaching staff and collaborators of VŠTE,
- providers of information systems,
- IT and hosting service providers,
- communication service providers,
- the provider of the Brevo service,
- accounting, legal and other professional service providers,
- public authorities where the obligation to provide the data arises from applicable legislation.
Depending on the current contractual arrangements, external service providers may include in particular:
- the VŠTE hosting service provider,
- MI:SU Design, s.r.o.,
- Brevo – a platform used for electronic communication and the distribution of informational messages,
- other providers of information systems and technical services used by VŠTE.
Where a third party processes personal data on behalf of VŠTE, the processing is contractually regulated in accordance with Article 28 GDPR.
11. Transfers of Data Outside the European Economic Area
When using certain technology service providers, personal data may in some circumstances be processed or accessed outside the European Economic Area.
In such cases, VŠTE ensures that the transfer is carried out in accordance with GDPR and that appropriate safeguards are used, such as a European Commission adequacy decision or Standard Contractual Clauses, where required.
12. Retention Period for Personal Data
We retain personal data only for the period necessary to fulfil the purpose for which they were collected or for the period required by applicable legislation.
When determining the retention period, we take into account in particular:
- the duration of studies or another legal relationship,
- statutory record-keeping and archiving periods,
- periods necessary for the protection of legal claims,
- the duration of consent where processing is based on consent,
- the duration of the legitimate interest where processing is based on legitimate interest.
Contact details used exclusively for communication with current students are removed from mailing lists once the relevant purpose has ended, unless another legal basis exists for their continued retention.
13. Security of Personal Data
VŠTE implements appropriate technical and organisational measures to protect personal data in particular against:
- unauthorised or unlawful access,
- accidental loss,
- destruction or damage,
- unauthorised alteration,
- unauthorised disclosure or provision.
Access to personal data is restricted to persons who require such access for the performance of their employment, teaching, statutory or contractual duties.
14. Rights of the Data Subject
Subject to the conditions laid down in GDPR, the data subject has in particular the right:
- to access their personal data,
- to rectify inaccurate or incomplete personal data,
- to erasure of personal data where the statutory conditions are met,
- to restriction of processing,
- to data portability in cases provided for by GDPR,
- to object to processing based on legitimate interests,
- to withdraw consent at any time where processing is based on consent,
- not to be subject to a decision based solely on automated processing in cases provided for by GDPR,
- to lodge a complaint or submit a request for proceedings concerning the protection of personal data.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
15. Exercising the Rights of the Data Subject
If you have any questions or requests concerning the processing of personal data, you may contact:
Masarykova 22
080 01 Prešov
Slovak Republic
E-mail: studijne@vste.sk
Telephone: +421 904 183 805
Where we have reasonable doubts concerning the identity of the person making a request, we may request additional information necessary to confirm their identity.
16. Supervisory Authority
If you believe that the processing of your personal data has infringed applicable data protection legislation, you have the right to contact:
Galvaniho 7/B
821 04 Bratislava
Slovak Republic
17. Links to Third-Party Websites
The VŠTE website may contain links to websites and services operated by third parties.
After visiting a website operated by another controller, the processing of personal data is governed by the privacy rules and policies of that controller.
VŠTE is not responsible for the content or privacy policies of external websites.
18. Social Media
VŠTE may operate profiles on social media platforms and may publish links to these services on its website.
When visiting a social media platform, personal data are also processed by the relevant social media provider in accordance with its own privacy policy and terms.
19. Updates to this Privacy Statement
VŠTE may update this Privacy Statement from time to time, in particular following changes to legislation, information systems, service providers or the methods used to process personal data.
The current version will always be published on the VŠTE website.