Privacy Policy

Controller’s Information Obligation

This notice is based on Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR), in particular Articles 13 and 14, as well as Act No. 18/2018 Coll. on the Protection of Personal Data.

This Privacy Notice explains for what purposes, on what legal basis, by what means and for how long the Controller processes the personal data of data subjects. It also sets out the rights of data subjects.

I. Data Controller

St. Nicholas Roman Catholic ParishHlavná 212991 11 Balog nad IpľomSlovak Republic

Telephone: +421 (0)47 488 51 46

E-mail: lelkiatya@ipolybalogiplebania.sk

Website: https://ipolybalogiplebania.sk

(hereinafter the “Controller”)

II. Data Protection Officer

Data subjects may direct questions, requests and comments concerning the processing of personal data to the Controller or to the person responsible for data protection within the Catholic Church’s data protection system.

Within the data protection system of the Roman Catholic Church in Slovakia, the responsibilities of the designated data protection officer are carried out by the data protection team of the Conference of Bishops of Slovakia. Further information concerning the Catholic Church’s data protection rules and the rights of data subjects is available at https://gdpr.kbs.sk.

  • Responsible person: Conference of Bishops of Slovakia, Data Protection Team
  • Address: Kapitulská 11, P.O.BOX 113, 814 99 Bratislava, Slovak Republic
  • Telephone: +421 2 59 20 65 01
  • E-mail: dpo@kbs.sk
  • Data protection information: https://gdpr.kbs.sk

Data subjects may also contact the Controller or the competent person responsible within the Catholic Church’s data protection system regarding specific questions concerning the processing of personal data in connection with the parish.

The Controller processes personal data only for specified, explicit and legitimate purposes and in accordance with the requirements laid down by the GDPR, applicable Slovak legislation and the applicable ecclesiastical data protection rules.

1. Parish and Pastoral Ministry

The Controller processes the personal data of parishioners, interested persons and other data subjects to the extent necessary for carrying out parish and pastoral ministry and for handling matters connected with the life of the Church.

Depending on the particular processing activity, the legal basis may include consent under Article 6(1)(a) GDPR, performance of a contract under Article 6(1)(b), compliance with a legal obligation under Article 6(1)(c), or the legitimate interests pursued by the Controller under Article 6(1)(f). Where special categories of personal data revealing religious beliefs or religious affiliation are processed, an additional condition under Article 9 GDPR must also be satisfied.

The processing may be governed in particular by:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR),
  • Act No. 18/2018 Coll. on the Protection of Personal Data, as amended,
  • Act No. 308/1991 Coll. on Freedom of Religious Belief and the Status of Churches and Religious Communities,
  • the binding internal data protection rules of the Roman Catholic Church in Slovakia,
  • other legislation and ecclesiastical rules applicable to the Controller.

2. Church and Parish Records

The Controller processes personal data necessary for parish administration, the celebration of religious rites and the keeping of ecclesiastical records.

In processing such data, the Controller acts in accordance with applicable legislation and ecclesiastical rules. The retention periods and access conditions applicable to individual records may be determined by the purpose of the processing, applicable legislation and ecclesiastical rules.

3. Church Events, Programmes and Celebrations

The Controller processes personal data necessary for organising and documenting church events, programmes, celebrations and community gatherings.

Where photographs, video recordings or other recordings capable of identifying data subjects are made public, the legal basis for processing may, depending on the circumstances, be consent or another legal basis permitted by the GDPR.

Where processing is based on consent, giving consent is voluntary. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Consent must be capable of being withdrawn as easily as it was given.

The Controller processes the personal data of employees and other persons working with the parish to the extent necessary to fulfil obligations arising from employment relationships and applicable employment legislation.

5. Contact, Requests and Communication

The Controller may process personal data contained in requests, enquiries, electronic correspondence and other communications submitted by data subjects for the purpose of responding to such communications, handling the relevant matter and complying with any applicable legal obligations.

IV. Categories of Personal Data

Depending on the purpose of processing, the Controller may process, in particular:

  • identification and contact details of data subjects,
  • information relating to parish and ecclesiastical administration,
  • information necessary for religious rites and ecclesiastical records,
  • special categories of personal data revealing religious beliefs or religious affiliation, where an appropriate legal basis exists and the additional requirements of Article 9 GDPR are met,
  • employees’ personal data relating to employment,
  • photographs and video recordings from events where their processing is lawful,
  • information contained in requests, submissions and communications from data subjects.

Special categories of personal data may be processed only where an appropriate legal basis exists and the requirements of Article 9 GDPR and applicable Slovak legislation are satisfied.

V. Recipients of Personal Data

Access to personal data is restricted to the extent necessary for the relevant processing purpose. Personal data may be disclosed only to recipients where the disclosure is based on legislation, the performance of ecclesiastical duties, a contract or another appropriate legal basis.

Recipients and categories of recipients may include, in particular:

  • the competent ecclesiastical authorities of the Roman Catholic Church, including the competent diocese and the competent bodies within the data protection system of the Conference of Bishops of Slovakia, solely to the extent necessary for the performance of ecclesiastical and data protection duties,
  • service providers processing personal data on behalf of the Controller or providing related services,
  • public administration bodies and public authorities where they are legally entitled to obtain the data,
  • social security and health insurance authorities where processing is supported by a legal basis,
  • tax authorities,
  • courts, public prosecutors, police and other bodies specified by law,
  • accounting, legal, IT and other relevant service providers where necessary for the performance of the relevant task.

The Controller discloses to recipients only those personal data for which an appropriate legal basis exists in relation to the relevant purpose and processing activity.

VI. Retention Periods

The Controller processes personal data for as long as necessary to fulfil the purpose for which they were collected or for as long as retention is required by law or by applicable ecclesiastical rules.

Retention periods may vary depending on the processing activity. During a statutory or ecclesiastically prescribed retention period, it may not always be possible to request the deletion of personal data.

VII. Rights of Data Subjects

Under the GDPR and applicable Slovak legislation, data subjects have, in particular, the following rights.

1. Right of Access

Data subjects have the right to obtain confirmation as to whether their personal data are being processed and to request access to their personal data and to the information concerning their processing as provided for by the GDPR.

2. Right to Rectification

Data subjects have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.

3. Right to Erasure

Data subjects may request the deletion of their personal data where the conditions set out in Article 17 GDPR are met.

The right to erasure is not absolute. It does not apply, in particular, where processing is necessary for compliance with a legal obligation, the performance of a task carried out in the public interest, public health purposes, archiving, research, statistical purposes or the establishment, exercise or defence of legal claims, or where retention is required by law or applicable ecclesiastical rules.

4. Right to Restriction of Processing

Data subjects have the right to request restriction of the processing of their personal data in the cases specified in Article 18 GDPR.

5. Right to Data Portability

Subject to the conditions laid down by the GDPR, data subjects have the right to receive personal data concerning them that they have provided to the Controller in a structured, commonly used and machine-readable format and may request that those data be transmitted to another controller.

This right does not apply to all processing activities, particularly where processing is based on legislation, ecclesiastical rules or the performance of a task carried out in the public interest.

6. Right to Object

Where processing is based on Article 6(1)(e) or (f) GDPR, data subjects have the right to object to the processing on grounds relating to their particular situation, subject to the conditions laid down by the GDPR.

Where processing is based on consent, data subjects may withdraw their consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

8. Rights Relating to Automated Decision-Making

Where the Controller carries out automated decision-making or profiling, it provides information about such processing where Article 22 GDPR applies.

VIII. Handling Requests from Data Subjects

Data subjects may submit requests concerning the exercise of their rights to the Controller using the contact details set out in Chapter I.

The Controller will handle the request without undue delay and, as a general rule, within one month of receiving it. Where the request is complex or a large number of requests have been submitted, this period may be extended by a further two months. The data subject will be informed of the extension within the first month.

Data subjects have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), particularly where they believe that the processing of their personal data infringes the GDPR or Slovak data protection legislation.

Contact details of the supervisory authority:

Úrad na ochranu osobných údajov Slovenskej republikyGalvaniho 7/B821 04 BratislavaSlovak Republic

E-mail: statny.dozor@pdp.gov.sk

The authority’s current registered office and contact details are published on its official contact page.

X. Public-Interest Reports and Whistleblowing

The protection of whistleblowers is governed by Slovak legislation, in particular Act No. 54/2019 Coll., as amended and currently in force.

The legislation establishes rules for the protection of persons reporting protispoločenská činnosť and imposes, on certain employers, obligations concerning internal reporting systems and the designation of a responsible person.

The Controller applies and publishes its internal rules for handling reports and the details of the designated responsible person in accordance with the actual legal and organisational circumstances, where such an obligation applies.

Contact for data protection matters and general enquiries:

St. Nicholas Roman Catholic Parish

Address:Hlavná 212991 11 Balog nad IpľomSlovak Republic

Telephone: +421 (0)47 488 51 46

E-mail: lelkiatya@ipolybalogiplebania.sk

XI. Data Security

The Controller implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, destruction and other unlawful processing.

These measures must be appropriate to the risks associated with the processing of personal data and must be reviewed regularly.

XII. Transfers of Personal Data to Third Countries

The Controller transfers personal data to a third country or an international organisation only where the conditions laid down in Chapter V GDPR are satisfied.

Where such a transfer takes place, the data subject will be informed in the applicable privacy notice about the transfer and the appropriate safeguards applied.

XIII. Amendments to this Notice

The Controller reserves the right to amend this Privacy Notice, particularly where there are changes to applicable legislation, processing operations or the functioning of the Church.

The current version of the Privacy Notice is available on the Controller’s website.

Last updated: 2 September 2026