Privacy policy | Alar, s. r. o.

We take the protection of your personal data seriously. This policy explains what personal data we process, why, for how long and what rights you have. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the “GDPR”) and the Slovak Act No. 18/2018 Coll. on personal data protection.

This is an English translation for convenience. In case of any discrepancy, the Slovak version prevails.

1. Data controller

The controller of your personal data is:

Alar, s. r. o.
Nejedlého 20, 841 02 Bratislava - Dúbravka, Slovakia
Company ID (IČO): 47 002 662
Registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 87143/B
E-mail: info [at] alar.sk

We have not appointed a Data Protection Officer (DPO), as we are not legally required to do so. You can direct any questions regarding personal data to the e-mail address above.

2. Scope of this policy

This policy applies to the processing of personal data:

when you visit the website alar.sk,
when you contact us via the contact form, e-mail or phone,
when concluding and performing contracts with our customers and suppliers,
in mobile apps and web services that we operate and publish under our own name (see section 4).

When we develop an app or website for a client, the controller of the personal data of its users is usually our client, and we act as a processor. In that case, the client’s own privacy policy applies.

3. Purposes and legal bases of processing

Contact form and communication

When you contact us, we process your name, e-mail address, phone number (if provided) and the content of your message. We use this data solely to handle your request and to communicate with you, for example to prepare a quote.

Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR), or our legitimate interest in replying to messages we receive (Art. 6(1)(f) GDPR).

When the form is submitted, we also record the IP address and time of submission to protect against abuse (spam). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Performance of contracts

If we work together, we process the identification and contact details of the customer or its contact persons to the extent necessary to conclude and perform the contract. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Accounting and taxes

We process data stated on invoices and accounting documents to comply with obligations under accounting and tax laws. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

Website operation and security

The server hosting the website automatically records technical access data (IP address, date and time, requested page, browser type). These records are used to keep the service running and to protect it against attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Legal claims

Where necessary, we may also process data to establish, exercise or defend legal claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Providing personal data is voluntary, but without it we cannot handle your request or conclude a contract. We do not carry out automated decision-making or profiling that would have legal effects on you.

4. Mobile apps

In mobile apps that we publish under our own name on the App Store and Google Play, we follow the principle of data minimisation – we process only what is necessary for the app to work.

Depending on the specific app and the features you use, we may process:

account data – e.g. e-mail and name, if you create an account in the app,
content you enter into the app – e.g. texts, photos or records you store in it,
technical device data – device model, operating system and app version, language,
diagnostic data – anonymised crash and error reports that help us fix bugs,
a push notification identifier, if you allow notifications,
location data – only if a feature of the app requires it and only with your consent given in the device settings.

The app always requests access to sensitive device features (location, camera, photos, microphone, contacts, notifications) through the system dialog. You can withdraw this permission at any time in your device settings.

Legal basis: performance of a contract – providing the app’s service under its terms of use (Art. 6(1)(b) GDPR), our legitimate interest in keeping the app stable and secure (Art. 6(1)(f) GDPR), and your consent for location access and other optional features (Art. 6(1)(a) GDPR).

We do not sell personal data from our apps and do not use it for targeted advertising. If a specific app has its own supplementary privacy policy, it takes precedence for matters concerning that app; you will find a link to it in the app and on its store listing.

Deleting your account and data: if you have created an account in one of our apps, you can delete it directly in the app (where supported) or ask us by e-mail at info [at] alar.sk. We will delete the account and related data without undue delay, at the latest within 30 days, except for data we are required by law to keep.

5. Recipients of personal data

We share personal data only to the extent necessary with the following categories of recipients:

our web hosting and e-mail service provider,
providers of cloud and backend services for our apps (e.g. database hosting, push notification delivery and error reporting services),
Apple Inc. and Google LLC as operators of the app stores and notification platforms,
an external accounting and tax firm,
public authorities, where required by law.

We have contracts in place with all processors that oblige them to protect personal data and to process it only on our instructions.

6. Transfers outside the EU

We process personal data primarily within the European Union and the European Economic Area. If any of our providers processes data outside the EU/EEA (e.g. in the USA), the transfer takes place only on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission.

7. Retention periods

Contact form messages and e-mail communication – for as long as needed to handle the request, at most 2 years after the last communication if no contract is concluded.
Contracts and related communication – for the duration of the contractual relationship and then for the statutory limitation periods (usually 4 years).
Accounting documents – 10 years under the Slovak Accounting Act.
Server logs – usually no longer than 90 days.
Data used to protect the form against spam – the IP address in an irreversibly hashed form, for no longer than 1 hour.
Data in mobile apps – for as long as your account exists or you use the app; diagnostic data for no longer than 90 days.

Once the retention period expires, we delete or anonymise the personal data.

8. Cookies

Our website does not use any analytics, marketing or other third-party tracking cookies. On the contact form page we store only one strictly necessary technical cookie (the session identifier PHPSESSID), which protects the form against abuse. This cookie is deleted when you close your browser. As it is necessary for a service you have requested, your consent is not required.

We remember your choice in the cookie banner (accept all, necessary only or reject) in the cookie_consent cookie for 12 months, so that we do not have to ask you on every visit. You can change your choice at any time via the cookie icon in the bottom left corner of every page. Should we start using analytics or marketing cookies in the future, we will only do so with your consent.

On your first visit we select the website language based on your browser settings and remember the chosen language in the lang cookie for 12 months. This is a functional cookie used only to show the website in your preferred language.

You can block or delete cookies at any time in your browser settings; the contact form may then not work correctly.

9. Your rights

In connection with the processing of your personal data, you have the right:

of access – to confirmation of whether we process your data and to a copy of it,
to rectification of inaccurate or incomplete data,
to erasure (“right to be forgotten”) where there is no longer a reason to process it,
to restriction of processing,
to data portability in a structured, machine-readable format,
to object to processing based on legitimate interest,
to withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing before it,
to lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

You can exercise your rights by e-mail at info [at] alar.sk or in writing at our registered office. We will reply without undue delay, at the latest within one month. We may ask for additional information to verify your identity.

10. Security

We have adopted appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. Communication with the website is encrypted (HTTPS), only authorised persons have access to the data, and data in our apps is transmitted in encrypted form.

11. Children

Our website and services are not intended for children under 16 and we do not knowingly collect their personal data. If we find that we have collected such data without the consent of a legal guardian, we will delete it without delay.

12. Changes to this policy

We may update this policy from time to time, for example when legislation or our services change. The current version is always published on this page together with its effective date. We will also inform you directly in the app about material changes concerning our apps.