in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individual persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter also referred to as “GDPR”).

The controller is a company engaged in the field of information technology services, computer services and services related to computer data processing.

In connection with the provision of our services, we process the personal data of potential customers and customers. In connection with our activity, we also process personal data of other persons, such as e.g. our suppliers or their contact persons, employees, participants in consumer competitions.

We obtain personal data mainly from the data subjects. In certain cases, we also obtain personal data from other sources (e.g. from the employer of the data subject, who is our contractual partner).

Depending on the purpose, identification data, contact data, invoicing (payment) data may be processed in connection with the provision of our services.

Controller: the company Love IT, s.r. o., with registered office: Bernolákova 1578/7, 900 31 Stupava, Slovakia, ID: 50700979 (hereinafter referred to as the “controller”).

Contact details of the controller: phone number: 0944 293 509, email: info@loveit.sk.

In case of any questions or if you want to exercise your rights in connection with the processing of your personal data, please contact the controller via the above-mentioned e-mail or by written delivery to the address of the controller’s registered office.

We process personal data on the following legal basis:

on the basis of contractual and pre-contractual relations (Article 6(1)(b) GDPR)
on the basis of the fulfilment of a legal obligation (Article 6, paragraph 1, letter c) GDPR)
on the basis of our legitimate interests (Article 6(1)(f) GDPR)
on the basis of the data subject’s consent (Article 6, paragraph 1, letter a) GDPR).

We would like to inform you that the data subject is obliged to provide his personal data if the processing of personal data is necessary in connection with the fulfilment of the legal obligation of the controller.

The data subject is also obliged to provide personal data in cases where their provision is a contractual requirement arising from the contract concluded between the controller and the data subject. Failure to provide data could make it impossible to fulfil the contract. Failure to provide data within the framework of pre-contractual relations would make it impossible to conclude a contract.

If the legal basis for the processing of personal data is consent, the granting of consent is voluntary. If we process personal data based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. Withdrawal of consent is not charged or otherwise sanctioned.

In the event that we process personal data based on our legitimate interests (Article 6, paragraph 1, letter f) GDPR), the data subject has the right to object at any time for reasons related to his specific situation against the processing of their personal data carried out on this legal basis.

How long will we store your personal data?

We will keep personal data for the time necessary to achieve the purpose for which the personal data is processed. If your personal data is processed as part of the fulfilment of the legal obligations of the controller and the legal regulation determines the storage period or the criteria for determining it, we will retain the personal data and related documentation for the period required by the relevant legal regulation. You can find more detailed information about the storage period later in this document.

For what purposes do we process personal data, what is the legal basis for their processing and the storage period?

– processing of the request for the provision of the service/product offered by the controller

We process the personal data of the person interested in providing the service/product (potential customer) on the basis of pre-contractual relations (processing is necessary in order to take measures before concluding the contract based on the request of the data subject). Failure to provide data would make it impossible to conclude a contract.

Storage period: until the conclusion of the contract, but no more than 3 years.

– implementation of the contractual relationship with customers

In this case, data processing is necessary for the performance of the contract to which the data subject is a party.

Storage period: until rights and obligations from the contract are settled, but at least 10 years from the end of the contractual relationship.

– registration and handling of complaints

For this purpose, we process personal data of individual persons – consumers who complain about products/services that we have delivered/provided to them. Processing is necessary to fulfil the legal obligations of the controller arising from the law no. 250/2007 Coll. on consumer protection and on the amendment of Act of the Slovak National Council No. 372/1990 Coll. on offenses as amended (according to this law, the controller is obliged to keep records of complaints and present them at the request of the supervisory authority for inspection, as well as at the request of the supervisory authority to show a copy of the confirmation of receipt of the complaint, etc.).

Storage period: 5 years from the processing of the complaint.

– communication with customers (contact details)

The legal basis for processing the customer’s personal (contact) data is the legitimate interest of the controller to communicate with customers in the provision of services and the performance of the controller’s business activities.

Storage period: until the end of the contractual relationship with the customer.

– proving, defending or exercising the controller’s legal claims in connection with the contractual relationship

The legal basis for processing personal data for this purpose is the legitimate interest of the controller to protect the controller’s rights and legally protected interests and to prevent damage.

Storage period: until the expiry of the preclusion and limitation periods; in the case of a lawsuit, execution or other procedure, the related documentation is kept for 5 years from the legal end of the procedure or from the settlement of the enforced legal claim.

– fulfilment of the request for the provision of information regarding the services provided by the controller

For this purpose, we process personal data based on the consent of the data subject, to the extent of the data filled in by the data subject in the relevant contact form published on our website (www.loveit.sk). The provision of data is voluntary, but it is not possible to process the request without providing it.

You can revoke the given consent at any time by sending an e-mail to the controller’s contact e-mail. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Storage period: personal data is stored until the request is fulfilled (until the required information is provided), but for a maximum period of 3 years.

– negotiation of the contract and conclusion of a commercial relationship with the supplier

The processing is necessary in order to carry out measures prior to the conclusion of the contract (pre-contractual relations) based on the request of the data subject.

The provision of personal data of the data subject is necessary within the framework of pre-contractual relations, otherwise, failure to provide them would make negotiation and conclusion of the contract impossible.

Storage period: until the conclusion of the contract with the data subject, but no more than 3 years.

– fulfilment of contracts with suppliers (payment, delivery of work/service/product)

The legal basis is contractual relations (Article 6, paragraph 1, letter b) GDPR) – processing is necessary for the fulfilment of the contract concluded with the data subject.

The provision of personal data of the data subject within the framework of contractual relations is necessary, otherwise, failure to provide them would make it impossible to fulfil the contract.

Storage period: for the duration of the contractual relationship until the settlement of mutual rights and obligations arising from them, but at least for a period of 10 years from the end of the contractual relationship.

– valid conclusion and ensuring the fulfilment of contractual relations

For this purpose, we process the personal data of persons authorized to act on behalf of the contractual partner (legal entity) as well as the data of employees of the contractual partners, whose data are specified in the concluded contracts or in the drafts of these contracts as well as the employee data provided to us for this purpose by the contractual partner in accordance with sec. § 78 par. 3 of Act No. 18/2018 Coll. on the protection of personal data and on the amendment of certain laws. We process the data of the data subjects for this purpose on the basis of the legitimate interest of the controller to ensure the valid conclusion of contracts and their effective performance.

You have the right to object at any time on grounds relating to your particular situation to the processing of your personal data based on this legal basis (Article 6(1)(f) GDPR – legitimate interest of the controller).

Storage period: until the end of the contractual relationship with the contractual partner.

– business communication with suppliers (contact details)

The legal basis for the processing personal (contact) data of contact persons of our contractual partners (i.e. persons authorized to act on their behalf or their employees) is the legitimate interest of the controller to communicate with business partners in carrying out the business and commercial activities of the controller.

Storage period: until the end of the contractual relationship with the contractual partner.

– recruitment procedure for employment

This purpose includes the activities of receiving and assessing the CV and application for employment, conducting the selection procedure and informing the applicant of the result (acceptance or non-acceptance). The processing is necessary in order to carry out pre-contractual measures at the request of the data subject (pre-contractual relations) in accordance with Article 6(1)(b) of the GDPR.

Data processing is necessary for the applicant’s participation in the selection process as well as for the implementation of measures before starting employment. Without it, it is not possible to participate in the recruitment process or enter into an employment contract or an agreement for work outside the employment relationship.

Storage period: until the end of the recruitment procedure.

– inclusion in the register of job applicants

Based on the consent of the data subject, we will keep the job applicant’s personal data even after the end of the selection procedure in the register of job with the possibility of being contacted in the event of further competitions for a position matching his/her qualifications.

Consent is voluntary. Without granting consent, we cannot include the applicant in the register of job applicants. You have the right to withdraw your consent at any time by sending an e-mail to the controller’s contact e-mail. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Storage period: 3 years.

– bookkeeping, processing of accounting and tax documents, invoicing and cash register records

Data processing for this purpose is necessary to fulfil the legal obligations of the controller.

Storage period: 10 years.

– handling requests for the exercise of the rights of the data subjects

For this purpose, we process the personal data of the data subjects who exercise their rights in accordance with the GDPR. The processing is necessary for the fulfilment of the legal obligations of the controller according to the legal regulations on the protection of personal data (GDPR), which the controller has in connection with the exercise of the rights of the data subjects in accordance with Art. 15 to 22 GDPR.

Storage period: 5 years from the date of processing the request, but at least until the legal end of the administrative procedure, which was initiated in connection with the request at the initiative of the data subject.

– registry purposes, including records of mail sent and received

Processing is carried out in accordance with Art. 89 GDPR in conjunction with Act no. 395/2002 Coll. on archives and registries and on supplementing some laws as amended.

Storage period: for the period required by the relevant legal regulation (i.e. for the period during which the originator of the registry needs the registry record for his activity). We keep personal data in the records of sent and received mail for a period of 5 years (from the end of the calendar year in which the mail was sent/received).

– ensuring network security and information security

In this case, the legal basis for processing personal data is the controller’s legitimate interest in preventing unauthorized access to electronic communication networks, preventing damage to computer and electronic communication systems, and protecting data contained in the controller’s IT technologies and systems.

Storage period: 5 years following the end of the calendar year in which the log was recorded.

– sending marketing e-mails and electronic newsletters

If we have obtained the e-mail address of the data subject in connection with the sale of goods or services, we will process it for this purpose on the basis of our legitimate interest to inform our customers about news of products and services provided by us. We only carry out marketing of our own similar goods and services on the basis of legitimate interest. Pursuant to Article 21(2) of the GDPR, the data subject shall have the right to object at any time to processing of personal data for direct marketing purposes. In this case, we may no longer process the personal data for this purpose.

In other cases, we process data for this purpose based on the consent of the data subject. We will send e-mail messages with the presentation of the offered services and promotional offers and newsletters to the e-mail address provided to us by the data subject for this purpose. Consent is voluntary and you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Every marketing e-mail or newsletter sent contains an unsubscribe link.

Storage period: 5 years.

– organization of consumer competitions

The controller organizes consumer competitions. Processing for this purpose is carried out based on the consent of the data subject (Article 6, paragraph 1, letter a) GDPR). The consumer competition is governed by the rules of the competition, which the participant of the competition accepts by participating in the given competition.

Without providing data for this purpose, it is not possible to participate in the competition. Participation in the competition (giving consent to the processing of personal data for this purpose) is voluntary. The data subject has the right to withdraw his consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Consent can be revoked by e-mail to the controller’s contact address or, if consent was obtained in another way (e.g. by telephone), in the same form as it was obtained.

Processing for this purpose includes obtaining data by registering for the competition as well as further processing in accordance with the rules of the competition, which the participant accepts by participating in the given competition (e.g. informing the participants of the competition by telephone about the progress of the competition, verifying that the conditions of the competition have been met and that the information provided is correct and up-to-date, informing you about the prize and delivering the prize).

Storage period: max. 3 years.

– dissemination of awareness and information about our provided services and new knowledge

Legal basis: the consent of the data subject or the legitimate interest of the controller to inform customers about new knowledge in the field of information technology, computer services (if it is a customer). We provide information by phone or by organizing webinars.

The provision of personal data for the stated purpose is not a legal or contractual requirement, nor is it a requirement necessary to conclude a contract.

If the processing is based on consent (if it is not a customer), the data subject has the right to withdraw his consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. Consent can be revoked by telephone (directly in a telephone conversation) or by e-mail to the controller’s contact address.

If we process the customer’s data for this purpose, the data subject has the right to object to the processing of personal data at any time. In that case, we will no longer process personal data for this purpose. Objections can be raised by telephone (directly in a telephone conversation) or by e-mail to the controller’s contact address.

Period of storage of personal data: 3 years.

– ascertaining the interest of competition participants in the service/product offered by the controller

We process data for this purpose based on the consent of the data subject (competition participants). The provision of personal data for the stated purpose is not a legal or contractual requirement or a requirement that is necessary to conclude a contract. Giving consent is voluntary. If you do not give us your consent, we will not process your data for this purpose.

The data subject has the right to withdraw his consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. Consent can be revoked by telephone (directly in a telephone conversation) or by e-mail to the controller’s contact address.

Period of storage of personal data: until the conclusion of the contract, but no more than 3 years.

– providing an e-book on the website of the controller

For this purpose, we process personal data based on the consent of the data subject. Consent is voluntary. Without granting it, it is not possible to send a link to download the e-book. You have the right to revoke your consent at any time by sending an e-mail to the controller’s contact address. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Storage period: 5 years.

– telephone contact with individual offers

In the case of customers who have provided us with their telephone contact, we will process the data for this purpose on the basis of our legitimate interest in informing customers about the offer of products and services, taking into account the individual needs of customers. On the basis of legitimate interest, we only carry out marketing of similar goods and services. In accordance with Art. 21 par. 2 GDPR the right to object at any time to the processing of personal data for direct marketing purposes. In that case, we may no longer process personal data for this purpose.

In other cases, we process data for this purpose based on the consent of the data subject. Consent is voluntary. You have the right to revoke your consent at any time by sending an e-mail to the controller’s contact address. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. If you do not give us your consent or if you revoke it, we will not contact you with individual offers.

Storage period: 5 years.

– running your own FUN PAGE profile on social networks

When operating a profile on social networks (LinkedIn, X (Twitter), Facebook, Instagram, YouTube), our legitimate interest is to raise awareness of the controller in the online environment and communicate with customers and participants in competitions organized by us through the fun page.

Personal information that you post on our “FUN PAGE” social media pages such as comments, likes, videos, images, etc. will be published via the social network platform. We do not subsequently process personal data for any other purpose.

The data subject has the right to object at any time for reasons related to his specific situation against the processing of personal data concerning him. You can send objections by e-mail to the controller’s contact address.

Social network controllers have their own adopted rules, service infrastructure and their own provisions for the protection of personal data. We recommend that you familiarize yourself with the privacy policy terms of the social network platform provider. We have no control over and are not responsible for the processing of your personal data by the controller of the social network and their further provision to third parties and cross-border transfer to third countries that they perform.

To obtain more detailed information about the transfer, processing and use of your data by:

– Facebook can be found in Facebook’s Personal Data Protection Statement at the following link: https://www.facebook.com/policy.php;

– social network Instagram, you can use the link: https://help.instagram.com/519522125107875;

– of the YouTube social network, you can use the link: https://policies.google.com/privacy,

– social network LinkedIn, you can use the link: https://www.linkedin.com/legal/privacy-policy,

– social network X (Twitter), you can use the link: https://x.com/en/privacy.

In certain processing operations, we and the controller of the social network act as joint controllers within the meaning of Art. 26 point 4 GDPR.

When managing our profile set up on the Facebook social network, your personal data may be processed for statistical purposes through a function called Facebook Insight, which is provided to us free of charge by Facebook under the unchangeable conditions of use. When you visit our profile set up on Facebook, Facebook records, among other things, your Internet IP address as well as other information that is located on your computer in the form of “cookies”, each of these files containing a unique user code that is active for a period of two years and Facebook stores it on the hard drive of the computer or other device of the visitors of the fan page. The user code, which can be assigned to the connection data of users registered on Facebook, is collected and processed when opening fan pages.

This information is used to provide us as the controller of the Facebook pages with statistical information about the use of the Facebook page. More information about this statistical information (“insights”) can be found at: https://www.facebook.com/help/pages/insights.

In this processing, we act as joint controllers with Facebook, while the basic elements of the joint controllers agreement for this case are available here: https://www.facebook.com/legal/terms/page_controller_addendum.

Storage period: until the fan unfollows the fun-page (deletes posts on the controller’s timeline) or files an objection to processing (in which case we, as the controller, will delete the posts).

– We use cookies on our website. Regarding cookies and the terms of their processing, please read the separate information published on our website.

Who are the recipients of your personal data:

The recipients of your personal data are or may be entities designated by legal regulations, especially state administration and public authority bodies for the exercise of control and supervision.

Depending on the purpose of processing and specific circumstances, the recipients of your personal data may also include other persons (in the position of intermediary or independent controller), in particular:

– external service providers in the field of information systems and software products,

– the court,

– lawyer,

– postal service provider,

– distribution companies,

– external archive,

– external consultants in the field of HR,

– providers of tools for analysis, processing and storage of data (e.g. Google Analytics – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)

– controller of the social network Facebook and the social network Instagram (Facebook Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland),

– the controller of the YouTube social network (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland),

– controller of the LinkedIn social network (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland),

– controller of the social network X (Twitter) (Twitter International Unlimited Company, Attn: Data Protection Officer, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland).

– website visitors and users of social networks on which the controller has created their profile (LinkedIn, X (Twitter), Facebook, YouTube, Instagram) in relation to the published data,

– contractual employees.

When using the services of our suppliers, which we use in connection with our online activities on the social network (LinkedIn, X (Twitter), Facebook, Instagram, YouTube), data is transferred to the United States of America (USA). The USA is considered a third country that does not provide an adequate level of protection, but any transfer of personal data outside the EU and/or the European Economic Area is carried out only within the framework of strict compliance with the protection of personal data in accordance with the requirements of the GDPR. As the EU-US Privacy Shield mechanism was invalidated based on the decision of the Court of Justice of the EU in the Schrems II case of July 16, 2020, we use standard contractual clauses approved by the Commission for data transfers by these suppliers in the USA, which you can find here:

Facebook: https://www.facebook.com/help/566994660333381?ref=dp

Google: https://policies.google.com/privacy/frameworks?hl=en

LinkedIn: https://www.linkedin.com/legal/privacy-policy

X (Twitter): https://x.com/en/privacy#x-privacy-9.1

Your personal data will not be used for automated individual decision-making, including profiling.

What rights do you have in relation to the processing of your personal data?

The right to access personal data according to Art. 15 GDPR:

The data subject has the right to obtain confirmation that the controller processes personal data concerning him or her. The data subject has the right to obtain access to his or her personal data (the right to be provided with a copy of the personal data held by the controller about the data subject) and information about how the controller processes it, to the extent provided for in Article 15 of the GDPR.

The right to correct personal data according to Art. 16 GDPR:

The data subject has the right to have personal data concerning him or her rectified if it is incorrect or to have it completed if it is incomplete. The controller must comply with the request for rectification or completion of the personal data without undue delay.

The right to erasure (the right to be “forgotten”) according to Art. 17 GDPR:

The data subject has the right to obtain from the controller without undue delay the deletion of personal data concerning him or her, under the conditions set out in Art. 17 GDPR (e.g. if the personal data obtained by the controller are no longer necessary for the purposes for which they were obtained or otherwise processed). This right of the data subject will be assessed by the controller from the point of view of all relevant circumstances in accordance with Art. 17 GDPR (e.g. the controller will not comply with the request if the processing is necessary for proving, exercising or defending legal claims).

The right to limit the processing of personal data according to Art. 18 GDPR:

The data subject has the right for the controller to limit the processing of his or her personal data if any of the cases listed in Art. 18 GDPR (e.g. if the data subject challenges the correctness of personal data during the period for verifying their correctness). If the processing was limited in accordance with Art. 18 par. 1 GDPR, such personal data are processed, with the exception of storage: a) only with the consent of the data subject, or b) to demonstrate, exercise or defend legal claims, or c) to protect the rights of another individual or legal person, or d) for reasons of important public interest of the Union or a member state.

The right to object under Art. 21 GDPR:

If the processing is based on legitimate interests (Article 6(1)(f) GDPR), the data subject has the right to object at any time for reasons related to his/her specific situation to the processing of personal data concerning him/her, including objection to profiling based on the provisions of Art. 6 par. 1 letter f) GDPR. In such a case, the controller may not further process personal data, unless he proves the necessary legitimate reasons that prevail over the interests, rights and freedoms of the data subject, or reasons for proving, exercising or defending legal claims.

The right to submit an initiative or complaint to the Office for Personal Data Protection:

You may at any time file a petition to initiate a personal data protection proceeding regarding the processing of your personal data with the supervisory authority, i.e. the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, tel.: +421 2 3231 3214, www.dataprotection.gov.sk.

Rýchly kontakt - rýchle odpovede

V čom Vám poradíme?

Quick contact - fast answers

What can we advise you on?