In accordance with the provisions of Article 16 of the Law on Personal Data Protection (“Official Gazette of the Republic of North Macedonia” No. 42/20 and 294/21), the Company for Tourism, Hospitality and Services MASTERBET DOOEL Skopje, represented and managed by Manager Darko Bilbilovski and Manager Bojan Kocevski, on April 23, 2024, adopted the following:
PROCEDURE
FOR THE EXERCISE OF THE RIGHTS OF PERSONAL DATA SUBJECTS
- Introduction
According to the provisions of the Law on Personal Data Protection, the Company for Tourism, Hospitality, and Services MASTERBET DOOEL Skopje is obliged to take appropriate measures to ensure all information specified in Articles 17 and 18 of this law and any communication based on Articles 19 to 26, as well as Article 38 of this law, related to the processing of personal data concerning the data subject, in a concise, transparent, and comprehensible manner, and in an easily accessible form, using clear and simple language.
With this procedure, MASTERBET DOOEL Skopje regulates the manner of exercising the rights of personal data subjects as determined in Chapter III, “Rights of the Data Subject,” of the Law on Personal Data Protection, in a way that will facilitate the exercise of these rights.
The purpose of this procedure is also to ensure that, when acting on requests from personal data subjects, information about the actions taken is provided without undue delay and in any case within one month from the date of receipt of the request. This period may be extended by an additional two months only if the complexity and number of requests justify it, in which case the data subject must be informed of any extension along with the reason for the delay. Whenever possible, where the data subject has submitted a request electronically, the information will be provided using electronic means, unless the data subject requests otherwise.
If MASTERBET DOOEL Skopje does not take action on the request of the personal data subject, it shall in any case inform the subject without delay, and at the latest within one month from the date of receipt of the request, of the reasons for not taking action and of the possibility to submit a request to the Agency for Personal Data Protection, as well as the possibility of seeking judicial protection in accordance with the law.
The exercise of the rights of the personal data subject is enabled free of charge, except in cases where the requests from the subject are obviously unfounded or excessive, particularly due to their repetitive character, in which case MASTERBET DOOEL Skopje charges a fee, taking into account the volume, complexity, and time required to provide the information, communication, or action on the request.
2. Information Provided When Collecting Personal Data from the Data Subject
When MASTERBET DOOEL Skopje collects personal data directly from the data subject, at the time of collection it provides the following information:
- The full name and contact details of MASTERBET DOOEL Skopje as the controller;
- Contact details of the personal data protection officer (e-mail and phone);
- The purposes of the processing for which the personal data are intended, as well as the legal basis for the processing;
- The legitimate interests for processing, if the processing is necessary for the purposes of the legitimate interests of MASTERBET DOOEL Skopje in accordance with the Law on Personal Data Protection;
- The recipients of the personal data or categories of recipients, if any;
- Information about the transfer of personal data to a third country or international organization, as well as in the case of transfer of personal data to a country of the European Union or European Economic Area, together with data on the appropriate safeguards regarding the transfer;
- The period for which the personal data will be stored, or the criteria used to determine the storage period, if it is not possible to determine the period exactly;
- Information about the right of the subject to request from MASTERBET DOOEL Skopje access, rectification, or erasure of personal data or restriction of processing of personal data relating to them, or the right to object to the processing, as well as the right to data portability;
- Information about the existence of the right to withdraw consent at any time, in cases where the data subject has given consent for the processing of their personal data for one or more specific purposes;
- The right to submit a request to the Agency for Personal Data Protection in accordance with the Law on Personal Data Protection;
- Information on whether the provision of personal data is a legal or contractual obligation or a requirement necessary for the conclusion of a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences if these data are not provided.
3. Information Provided When Personal Data Are Not Obtained from the Data Subject
When personal data are not obtained directly from the data subject, MASTERBET DOOEL Skopje provides the subject with the following information:
- The full name and contact details of MASTERBET DOOEL Skopje as the controller;
- Contact details of the personal data protection officer (e-mail and phone);
- The purposes of the processing for which the personal data are intended, as well as the legal basis for the processing;
- The categories of personal data being processed;
- The recipients of the personal data or categories of recipients, if any;
- Information about the transfer of personal data to a third country or international organization, as well as in the case of transfer of personal data to a country of the European Union or European Economic Area, together with data on the appropriate safeguards regarding the transfer;
- The period for which the personal data will be stored, or the criteria used to determine the storage period, if it is not possible to determine the period exactly;
- The legitimate interests for processing, if the processing is necessary for the purposes of the legitimate interests of MASTERBET DOOEL Skopje in accordance with the Law on Personal Data Protection;
- Information about the right of the subject to request from MASTERBET DOOEL Skopje access, rectification, or erasure of personal data or restriction of processing of personal data relating to them, or the right to object to the processing, as well as the right to data portability;
- Information about the existence of the right to withdraw consent at any time, in cases where the data subject has given consent for the processing of their personal data for one or more specific purposes;
- The right to submit a request to the Agency for Personal Data Protection in accordance with the Law on Personal Data Protection;
- Information on whether the provision of personal data is a legal or contractual obligation or a requirement necessary for the conclusion of a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences if these data are not provided;
- The source of the personal data, i.e., information on whether the data were collected from publicly available sources.
MASTERBET DOOEL Skopje provides the information from this point to the data subject:
- No later than one month, taking into account the specific circumstances under which the personal data are processed;
- If the personal data are used for communication with the data subject, no later than at the first contact with the data subject;
- If disclosure to another recipient is envisaged, no later than at the time when the personal data are disclosed for the first time.
MASTERBET DOOEL Skopje does not notify the data subject in cases where:
- The subject already has the information;
- The personal data must remain confidential in accordance with the obligation of business secrecy, which is regulated by law, including a statutory obligation of confidentiality;
- In other cases provided by law.
MASTERBET DOOEL Skopje, within a maximum of 30 days, provides a written response to the request or enables the exercise of the right to personal data protection, if there are legal grounds for this. MASTERBET DOOEL Skopje does not inform the data subject if they have already been previously informed about the personal data, if in the meantime there are no changes to their personal data or processing, except if six months have passed since the previous request or if there is a justified reason for the request.
4. Right of Access
MASTERBET DOOEL Skopje usually collects the personal data of subjects directly from them, but in cases provided by law, it may also collect them from third parties. To enable subjects whose personal data are processed by MASTERBET DOOEL Skopje to exercise their right of access to their personal data, subjects are provided with the opportunity to fill out a Request for Information form to determine whether MASTERBET DOOEL Skopje processes the subject’s personal data.
If MASTERBET DOOEL Skopje processes personal data, the subject has the right to access information about their personal data being processed, and according to Article 19 of the Law on Personal Data Protection, may access the following information: the purposes of processing; categories of personal data processed; recipients or categories of recipients to whom the personal data are disclosed, especially when the transfer is made to another country; the period for which the personal data will be stored; the existence of the right to request rectification or erasure, or restriction of processing of personal data, as well as the right to object to processing; the right to submit a request to the Agency for Personal Data Protection if they believe the processing of personal data violates the provisions of the Law on Personal Data Protection; the source of the data if personal data are not collected from the data subject; data on the existence of an automated decision-making process in the case of a decision made based on automated processing, which affects the data subject; information on the application of appropriate safeguards in the case of data transfer; as well as the right to obtain a copy of the personal data being processed.
The right to obtain access is exercised by filling in and signing the Request for Information and Access to Personal Data form processed by MASTERBET DOOEL Skopje, which is provided in Appendix 1 as an integral part of this procedure.
The request for information and access to personal data processed by MASTERBET DOOEL Skopje is filled out and submitted personally by the data subject, or by e-mail to masterbet@astra.mk
Upon receipt of the request at MASTERBET DOOEL Skopje, the Legal and Human Resources department, in cooperation with the personal data protection officer, processes the right.
5. Right to Rectification of Personal Data
If the data subject requests rectification of their personal data, claiming that they are inaccurate, MASTERBET DOOEL Skopje, within 15 days from the date of submission of the request, if it is justified, rectifies their inaccurate personal data. Taking into account the purposes of processing, the data subject has the right to supplement incomplete personal data by providing an additional statement, after which MASTERBET DOOEL Skopje, within 15 days, supplements the subject’s incomplete personal data. If MASTERBET DOOEL Skopje determines that the subject’s personal data are incomplete, inaccurate, or outdated, it will supplement, amend, or delete them, regardless of whether the data subject has submitted a request for supplementation or amendment.
For each rectification of personal data carried out, MASTERBET DOOEL Skopje informs the subject no later than 30 days from the date of rectification, as well as the recipients of the personal data or third parties to whom the personal data have been disclosed, unless this is impossible or requires disproportionate effort or costs. The right to rectification of personal data is exercised by filling in and signing the Request for Rectification of Personal Data form processed by MASTERBET DOOEL Skopje, which is provided in Appendix 2 as an integral part of this procedure. The request for rectification of personal data processed by MASTERBET DOOEL Skopje is filled out and submitted personally by the data subject, or by e-mail to masterbet@astra.mk
Upon receipt of the request at MASTERBET DOOEL Skopje, the Legal and Human Resources department, in cooperation with the personal data protection officer, processes the right.
6. Right to Erasure of Personal Data
The data subject has the right to request from MASTERBET DOOEL Skopje the erasure of their personal data, and the subject’s personal data will be erased within 30 days from the date of submission of the request. In order to erase the personal data of a subject who has submitted a request for erasure, it must first be established that: the personal data are no longer necessary for the purpose for which they were collected or processed; the data subject has withdrawn their consent, and there is no other legal basis for processing by MASTERBET DOOEL Skopje; the data subject has objected to processing, and there are no overriding legitimate grounds for processing by MASTERBET DOOEL Skopje; the personal data have been unlawfully processed; the personal data must be erased for compliance with a legal obligation by MASTERBET DOOEL Skopje; or the personal data were collected in connection with the offer of information society services, with the direct offer of information society services to children, in accordance with Article 12 paragraph (1) of the Law on Personal Data Protection. If the subject’s personal data for which erasure is requested have been made public, MASTERBET DOOEL Skopje will take actions and technical measures to inform other controllers processing the personal data that the subject has requested the erasure of all links, copies, or replications of the personal data by those controllers, taking into account the available technology and the implementation costs. The erasure of the subject’s personal data will not be carried out to the extent that processing is necessary for compliance with a legal obligation of MASTERBET DOOEL Skopje. For each erasure of personal data carried out, MASTERBET DOOEL Skopje, within 30 days from the date of erasure, informs in writing the recipients of the personal data or third parties to whom the personal data have been disclosed, unless this is impossible or requires disproportionate effort or costs. The right to erasure of personal data is exercised by filling in and signing the Request for Erasure of Personal Data form processed by MASTERBET DOOEL Skopje, which is provided in Appendix 3 as an integral part of this procedure.
The request for erasure of personal data processed by MASTERBET DOOEL Skopje is filled out and submitted personally by the data subject, or by e-mail to masterbet@astra.mk
Upon receipt of the request at MASTERBET DOOEL Skopje, the Legal and Human Resources department, in cooperation with the personal data protection officer, processes the right.
7. Right to Restriction of Processing of Personal Data
The data subject has the right to request restriction of processing from MASTERBET DOOEL Skopje if one of the following conditions is met:
- The accuracy of the personal data is contested by the data subject, for a period enabling MASTERBET DOOEL Skopje to verify the accuracy of the personal data;
- The processing is unlawful and the data subject opposes the erasure of the personal data, requesting instead the restriction of their use;
- For the purposes of processing, MASTERBET DOOEL Skopje no longer needs the personal data, but the data subject requires them for the establishment, exercise, or defense of legal claims;
- The data subject has objected to processing in accordance with Article 25 paragraph (1) of this law, pending verification of whether the legitimate interests of MASTERBET DOOEL Skopje override those of the data subject.
MASTERBET DOOEL Skopje, no later than 30 days from the date of restriction, informs in writing the recipients of the personal data or third parties to whom the personal data have been disclosed, unless this is impossible or requires disproportionate effort or costs. When the processing of personal data is restricted, further processing of those personal data may be carried out only with the consent of the data subject, or for the establishment and protection of their legal claims, or for the protection of the rights of another natural or legal person. MASTERBET DOOEL Skopje will inform the subject before the restriction of processing ceases. For each restriction of processing of personal data, MASTERBET DOOEL Skopje, within 30 days from the date of restriction, informs in writing the recipients of the personal data or third parties to whom the personal data have been disclosed, unless this is impossible or requires disproportionate effort or costs. The right to restriction of processing of personal data is exercised by filling in and signing the Request for Restriction of Processing of Personal Data form processed by MASTERBET DOOEL Skopje, which is provided in Appendix 4 as an integral part of this procedure. The request for restriction of processing of personal data processed by MASTERBET DOOEL Skopje is filled out and submitted personally by the data subject, or by e-mail to masterbet@astra.mk
Upon receipt of the request at MASTERBET DOOEL Skopje, the Legal and Human Resources department, in cooperation with the personal data protection officer, processes the right.
8. Right to Data Portability
According to Article 24 of the Law on Personal Data Protection, the data subject has the right to receive their personal data in a structured, commonly used, machine-readable format, and has the right to transmit those data to another controller if: the processing is based on the subject’s consent for the processing of their personal data; for the performance of a contract where the subject is a party, or for taking steps at the request of the subject prior to entering into a contract; and if the processing is carried out by automated means. The right to data portability of the data subject does not apply to the portability of processing of personal data for matters of public interest or official authority of MASTERBET DOOEL Skopje. The data subject retains the right to erasure of personal data after the transfer of their personal data from MASTERBET DOOEL Skopje to another controller.
The right to data portability is exercised by filling in and signing the Request for Transfer of Personal Data form processed by MASTERBET DOOEL Skopje, which is provided in Appendix 5 as an integral part of this procedure.
The request for transfer of personal data processed by MASTERBET DOOEL Skopje is filled out and submitted personally by the data subject, or by e-mail to masterbet@astra.mk
Upon receipt of the request at MASTERBET DOOEL Skopje, the Legal and Human Resources department, in cooperation with the personal data protection officer, processes the right.
9. Right to Object
According to Article 25 of the Law on Personal Data Protection, the data subject has the right to object at any time to a situation related to them, in the processing of personal data for the performance of tasks of public interest or processing necessary for the purposes of the legitimate interests of MASTERBET DOOEL Skopje, including profiling based on public interest or for legitimate interests.
When the data subject submits an objection, MASTERBET DOOEL Skopje stops processing the personal data and may no longer process the personal data for the above purposes, unless it demonstrates that the legitimate interests of MASTERBET DOOEL Skopje for processing the personal data override the interests, rights, and freedoms of the subject. If the subject’s personal data are processed for direct marketing purposes, the subject may object to such processing related to this type of marketing, which includes profiling to the extent that it is related to direct marketing. When the data subject submits an objection to processing for direct marketing purposes, MASTERBET DOOEL Skopje stops processing the personal data for those purposes. Regarding the right to object, the data subject is informed no later than the first communication of the Company for Trade and Services MASTERBET DOOEL Skopje with them.
The right to object to the processing of personal data is exercised by filling in and signing the Objection to Processing of Personal Data form processed by MASTERBET DOOEL Skopje, which is provided in Appendix 6 as an integral part of this procedure.
The objection to the processing of personal data processed by MASTERBET DOOEL Skopje is filled out and submitted personally by the data subject, or by e-mail to masterbet@astra.mk
Upon receipt of the request at MASTERBET DOOEL Skopje, the Legal and Human Resources department, in cooperation with the personal data protection officer, processes the right.
10. Right of the Personal Data Subject Not to Be Subject to a Decision Based on Automated Processing or Profiling
MASTERBET DOOEL Skopje, for its clients, based on legal provisions or consent, processes and stores in its system personal data of subjects. Due to justified legitimate interests, MASTERBET DOOEL Skopje also processes and uses personal data in an automated manner, directly from the system, and makes individual decisions for subjects, which produce legal consequences for the subject.
The data subject, according to Article 26 of the Law on Personal Data Protection, has the right not to be subject to a decision solely based on automated processing of personal data or profiling. Automated individual decision-making for personal data subjects and profiling is allowed only when the decision of MASTERBET DOOEL Skopje is necessary for the conclusion or performance of a contract between the subject and MASTERBET DOOEL Skopje; automated individual decision-making or profiling is allowed by law applicable to MASTERBET DOOEL Skopje; automated individual decision-making or profiling is based on the explicit consent of the data subject.
When making automated individual decisions and profiling, MASTERBET DOOEL Skopje provides the data subject with the right to express their opinion regarding the decisions, human intervention, as well as the right to contest the decision. Decisions made automatically, including profiling, are not based on the processing of special categories of personal data, except when automated decision-making is based on the subject’s consent or for reasons of public interest, with respect and application of appropriate safeguards for the protection of the rights and freedoms of the data subject.
The right of the data subject not to be subject to a decision based on automated processing or profiling is exercised by filling in and signing the Request form provided in Appendix 7 as an integral part of this procedure.
The request for the decision not to be based (solely) on automated processing of personal data or profiling is received and submitted personally by the data subject, or by e-mail to masterbet@astra.mk
Upon receipt of the request at MASTERBET DOOEL Skopje, the Legal and Human Resources department, in cooperation with the personal data protection officer, processes the right.
11. Final Provisions
Authorized persons who process personal data are obliged to act in accordance with this Procedure, as well as in accordance with the Law on Personal Data Protection.
This Procedure enters into force on the day of its adoption.