In accordance with the provisions of Article 16 of the Law on Personal Data Protection (“Official Gazette of the Republic of North Macedonia” No. 42/20 and 294/21), the Company for Tourism, Hospitality, and Services MASTERBET DOOEL Skopje, represented and authorized by the Manager Darko Bilbilovski and the Manager Bojan Kocevski, on the date 23.04.2024 adopted the following:
PROCEDURE
FOR EXERCISING THE RIGHTS OF THE DATA SUBJECT
Introduction
According to the provisions of the Law on Personal Data Protection, the Company for Tourism, Hospitality, and Services MASTERBET DOOEL Skopje is obliged to take appropriate measures to ensure all information specified in Articles 17 and 18 of this law and any communication based on Articles 19 to 26, as well as Article 38, related to the processing of personal data concerning the data subject, in a concise, transparent, and intelligible manner, and in an easily accessible form, using clear and simple language.
With this procedure, MASTERBET DOOEL Skopje regulates the manner of exercising the rights of data subjects as determined in Chapter III, “Rights of the Data Subject,” of the Law on Personal Data Protection, in a way that facilitates the exercise of these rights.
The purpose of this procedure is also to ensure that, when acting upon requests from data subjects, the company provides information about actions taken without undue delay and, in any case, within one month of receiving the request. This period may be extended by an additional two months only if the complexity and number of requests justify it, in which case the data subject must be informed of any extension along with the reasons for the delay. Whenever possible, where the data subject has submitted a request electronically, the information will be provided using electronic means, unless the data subject requests otherwise.
If MASTERBET DOOEL Skopje does not take action on the data subject’s request, it will inform the data subject without delay, and at the latest within one month of receiving the request, of the reasons for not taking action and of the possibility to lodge a complaint with the Agency for Personal Data Protection, as well as the possibility of seeking judicial protection in accordance with the law.
The exercise of data subject rights is enabled free of charge, except in cases where the requests are manifestly unfounded or excessive, particularly due to their repetitive character, in which case MASTERBET DOOEL Skopje may charge a fee, taking into account the administrative costs of providing the information, communication, or taking the requested action.
2. Information Provided When Collecting Personal Data from the Data Subject
When MASTERBET DOOEL Skopje collects personal data directly from the data subject, it provides the following information at the time of collection:
- The full name and contact details of MASTERBET DOOEL Skopje as the data controller;
- Contact details of the data protection officer (email and phone);
- The purposes of the processing for which the personal data are intended, as well as the legal basis for the processing;
- The legitimate interests pursued by MASTERBET DOOEL Skopje, if the processing is necessary for legitimate interests in accordance with the Law on Personal Data Protection;
- The recipients or categories of recipients of the personal data, if any;
- Information about the transfer of personal data to a third country or international organization, as well as, in the case of transfer to an EU or EEA country, details of appropriate safeguards related to the transfer;
- The period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;
- Information about the right of the data subject to request access, rectification, or erasure of personal data, or restriction of processing, or to object to processing, as well as the right to data portability;
- Information about the existence of the right to withdraw consent at any time, in cases where processing is based on consent;
- The right to lodge a complaint with the Agency for Personal Data Protection;
- Information on whether the provision of personal data is a statutory or contractual requirement or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences of failure to provide such data.
3. Information Provided When Personal Data Are Not Obtained from the Data Subject
When personal data are not obtained directly from the data subject, MASTERBET DOOEL Skopje provides the data subject with the following information:
- The full name and contact details of MASTERBET DOOEL Skopje as the data controller;
- Contact details of the data protection officer (email and phone);
- The purposes of the processing and the legal basis for the processing;
- The categories of personal data concerned;
- The recipients or categories of recipients of the personal data, if any;
- Information about the transfer of personal data to a third country or international organization, including, in the case of transfer to an EU or EEA country, details of appropriate safeguards;
- The period for which the personal data will be stored, or the criteria used to determine that period if not possible to specify;
- The legitimate interests pursued by MASTERBET DOOEL Skopje, if processing is necessary for legitimate interests;
- Information about the right of the data subject to request access, rectification, erasure, or restriction of processing, or to object to processing, as well as the right to data portability;
- Information about the right to withdraw consent at any time, if processing is based on consent;
- The right to lodge a complaint with the Agency for Personal Data Protection;
- Information on whether the provision of personal data is a statutory or contractual requirement or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences of failure to provide such data;
- The source of the personal data, and whether the data came from publicly available sources.
MASTERBET DOOEL Skopje provides this information to the data subject:
- No later than one month, taking into account the specific circumstances under which the personal data are processed;
- If the data are used for communication with the data subject, no later than at the time of the first communication;
- If disclosure to another recipient is envisaged, no later than when the personal data are first disclosed.
MASTERBET DOOEL Skopje does not notify the data subject when:
- The data subject already has the information;
- The data must remain confidential due to business secrecy obligations regulated by law, including statutory confidentiality obligations;
- In other cases provided by law.
MASTERBET DOOEL Skopje will respond in writing within a maximum of 30 days to the request, or enable the exercise of the right to personal data protection, provided there are legal grounds. The company does not inform the data subject if they have already been previously informed, unless there have been changes in the data or processing, except if six months have passed since the last request or if there is a justified reason for the request.
4. Right of Access
MASTERBET DOOEL Skopje usually collects personal data directly from data subjects but may also collect from third parties as provided by law. To enable data subjects to exercise their right of access, a Request for Information form is provided.
If MASTERBET DOOEL Skopje processes the data subject’s personal data, the data subject has the right to access information about their data being processed, including the purposes, categories, recipients, retention period, existence of the right to rectification or erasure, restriction, objection, the right to lodge a complaint, the source of the data if not collected from the data subject, existence of automated decision-making, and the right to obtain a copy of the data.
The right of access is exercised by filling in and signing the Request for Information and Access to Personal Data form, which is provided as Appendix 1 to this procedure.
Requests are submitted in person or by email to masterbet@astra.mk. Upon receipt, the Legal and HR department, in cooperation with the data protection officer, processes the request.
5. Right to Rectification of Personal Data
If the data subject requests rectification of inaccurate personal data, MASTERBET DOOEL Skopje will, within 15 days of the request (if justified), correct the data. The data subject may also supplement incomplete data by providing a supplementary statement. If the company determines the data are incomplete or inaccurate, it will supplement, amend, or delete them, regardless of whether the data subject has requested it.
For each rectification, the company notifies the data subject within 30 days, as well as any recipients, unless impossible or requires disproportionate effort. The right is exercised by filling and signing the Request for Rectification form (Appendix 2).
Requests are submitted in person or by email. The Legal and HR department, in cooperation with the data protection officer, processes the request.
6. Right to Erasure of Personal Data
The data subject may request erasure of their personal data, which will be deleted within 30 days if:
- The data are no longer necessary for the purpose collected;
- The data subject withdraws consent and no other legal basis exists;
- The data subject objects to processing and there are no overriding legitimate grounds;
- The data were unlawfully processed;
- The data must be erased to comply with a legal obligation;
- The data were collected in relation to information society services offered directly to children.
If the data have been made public, MASTERBET DOOEL Skopje will take reasonable steps to inform other controllers to erase links, copies, or replications, considering available technology and implementation costs. Erasure will not be carried out to the extent processing is necessary for compliance with a legal obligation.
For each erasure, the company notifies the data subject and any recipients within 30 days, unless impossible or requires disproportionate effort. The right is exercised by filling and signing the Request for Erasure form (Appendix 3).
Requests are submitted in person or by email. The Legal and HR department, in cooperation with the data protection officer, processes the request.
7. Right to Restriction of Processing
The data subject may request restriction of processing if:
- The accuracy of the data is contested, for a period enabling verification;
- Processing is unlawful and the data subject opposes erasure, requesting restriction instead;
- The controller no longer needs the data, but the data subject requires them for legal claims;
- The data subject has objected to processing pending verification of overriding legitimate grounds.
MASTERBET DOOEL Skopje notifies recipients of any restriction within 30 days, unless impossible or requires disproportionate effort. Further processing is only allowed with consent or for legal claims or to protect rights of others. The company will inform the data subject before lifting the restriction.
The right is exercised by filling and signing the Request for Restriction form (Appendix 4). Requests are submitted in person or by email. The Legal and HR department, in cooperation with the data protection officer, processes the request.
8. Right to Data Portability
Under Article 24 of the Law, the data subject has the right to receive their personal data in a structured, commonly used, machine-readable format and to transmit those data to another controller if:
- Processing is based on consent;
- Processing is necessary for a contract or pre-contractual steps;
- Processing is carried out by automated means.
This right does not apply to processing for public interest or official authority. The data subject retains the right to erasure after transfer.
The right is exercised by filling and signing the Request for Data Portability form (Appendix 5). Requests are submitted in person or by email. The Legal and HR department, in cooperation with the data protection officer, processes the request.
9. Right to Object
Under Article 25, the data subject may object at any time to processing for public interest or legitimate interests, including profiling. Upon objection, MASTERBET DOOEL Skopje will stop processing unless it demonstrates compelling legitimate grounds.
If data are processed for direct marketing, including profiling, the data subject may object, and processing for these purposes will cease. The right to object is communicated no later than the first communication with the data subject.
The right is exercised by filling and signing the Objection to Processing form (Appendix 6). Objections are submitted in person or by email. The Legal and HR department, in cooperation with the data protection officer, processes the request.
10. Right Not to Be Subject to Automated Decision-Making or Profiling
MASTERBET DOOEL Skopje processes and stores personal data for its clients based on legal provisions or consent. For legitimate interests, the company may process data automatically and make individual decisions producing legal effects for the data subject.
Under Article 26, the data subject has the right not to be subject to a decision based solely on automated processing or profiling. Automated decision-making and profiling are allowed only if necessary for a contract, authorized by law, or based on explicit consent.
The company ensures the right to express a viewpoint, obtain human intervention, and contest the decision. Automated decisions, including profiling, are not based on special categories of data except with consent or for public interest, with appropriate safeguards.
The right is exercised by filling and signing the relevant Request form (Appendix 7). Requests are submitted in person or by email. The Legal and HR department, in cooperation with the data protection officer, processes the request.
11. Final Provisions
Authorized persons processing personal data must act in accordance with this Procedure and the Law on Personal Data Protection.
This Procedure enters into force on the day of its adoption.