PROTECTION OF PERSONAL DATA IN DEBT COLLECTION

Identity of the controller

EOS KSI, Upravljanje terjatev d.o.o.
Letališka cesta 33
SI - 1000 Ljubljana

Contact details of data protection officer (DPO):

MIKROCOP Information Engineering and Services d. o. o. , Ulica Ambrožiča Novljana 7, 1000 Ljubljana

You can contact the DPO via email dpo@eos-ksi.si.

Purpose, legal basis and rights of data subjects (debtors)

1. EOS KSI d.o.o. as a controller, in accordance with the provision of Article 6 (1) b of the General Data Protection Regulation (hereinafter: GDPR), processes personal data of debtors for the purpose of performing the contract concluded by the debtor with the creditor. The performance of the contract includes the execution of unpaid debts and claims for damages under the contract, which occurred due to the payment indiscipline of the debtor.

In this context of processing your personal data, you have the following rights:

Right of access

You have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:

• the purposes of the processing,
• the categories of personal data concerned,
• the recipients to whom the personal data have been or will be disclosed,
• the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing,
• the right to lodge a complaint with a supervisory authority,
• where the personal data are not collected from you, any available information as to their source,
• the existence of automated decision-making.

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested, the controller may charge a reasonable fee based on administrative costs.

Right to rectification

You have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed.

Right to erasure

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw consent on which the processing is based;
• you object to the processing and there are no overriding legitimate grounds for the processing;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

Right to restriction of processing

You have the right to obtain from the controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
• you have objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override yours.

Right to data portability

You have the right to receive the personal data concerning you which you have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

• the processing is based on consent and
• the processing is carried out by automated means.

You have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

2. EOS KSI d.o.o. as a controller processes personal data of debtors for the purpose of debt recovery in accordance with the provision of Article 6 (1) f of the GDPR, with a legitimate interest in taking further measures and using appropriate remedies to exercise its right to repay the claim.

In this context of processing your personal data, you have the following rights (*more about individual rights in the description under point a):

• Right of access
• Right of rectification
• Right to erasure
• Right to restriction of processing
• Right to object

You have the right to object to the processing of personal data concerning you at any time. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

3. EOS KSI d.o.o. also performs the activity of receivables management for clients (controllers). In these cases, it acts as a processor in relation to debtors.

Your personal data is processed for the purpose of debt recovery in accordance with the provision of Article 6 (1) b of the GDPR. The processing of personal data on the basis of a contract that you concluded with the creditor is necessary for successful fulfilllment of it.

Your personal data is processed in accordance with the provision of Article 6 (1) f of the GDPR for the same purpose of debt recovery, except we process your personal data on the basis of the client's (controller's) legitimate interest in cases where further measures are required to repay the debt, triggered by non-payment of debt on your part.

Your request to exercise your rights under the GDPR is decided by the controller.

Data categories and sources

Type of personal data	Purpose of processing
Name and surname Address of permanent and/or temporary residence Date of birth Unique Master Citizen Number TAX number Employment data Bank account number Debtor's financial situation (real estate, movable property and information on other property rights)	Unambigouous identification of the individual Carrying our queries with the authorities which, in accordance with the applicable regulations, provide information on employment, residence, bank account number and any real estate or movable property owned by the debtor Sending reminders and other writings Reports for clients (controllers) in accordance with the contract concluded with each of them
Phone number E-mail address	Communication with the debtor regarding debts (concluding agreements, reminders etc.)
Contract data Data on receivables Payment information	Conducting debt recovery proceedings
The case number of the court file	Judicial recovery

Personal data were obtained from publicly available records or were provided to us by the original creditors, clients (controllers) and authorities to which the controller, in accordance with the applicable regulations, addresses a request for a query or directly by you or your legal representative.

Data recipients

• Clients (controllers)
• Courts, bailiffs, lawyers, in accordance with the applicable law
• Authorities to whom we address requests for queries
• Other recipients, if necessary for the recovery procedure and legal basis exists

Retention period

Type of procedure	Retention period
Prelegal recovery	1 year after the end of the year in which receivable is due or 1 year after the end of the year in which last payment was made (for “household receivables” – e.g. for supplied electricity and heat, gas, water, receivables from the post office, telephone etc.); 3 years from the maturity of receivable or from the receipt of last payment (for “occasional receivables” – receivables maturing annually or at shorter intervals); 5 years after maturity of receivable or from the receipt of last payment (for “other receivables”); 10 years after maturity of receivable or from the receipt of last payment (for receivables established by a final court decision)
Judicial recovery	10 years after the suspension of the enforcement procedure or other legal proceedings

Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data violates the provisions of the GDPR or other applicable regulations in the field of personal data protection, you have the right to lodge a complaint with the supervisory authority in accordance with the Article 77 of the GDPR, to:

Republika Slovenija
Informacijski pooblaščenec
Dunajska cesta 22
1000 Ljubljana

Phone number: 01 230 97 30
Fax: 01 230 97 78
E-pošta: gp.ip@ip-rs.si

How to exercise your rights

You can send a request to exercise your rights from point 7:

• By mail to the company’s address
• Electronically to the email address dpo@eos-ksi.si.

Request should include:

• Your identification details,
• right you wish to exercise,
• Any additional information or documentation.

The form for exercising your rights can be found HERE.