Privacy Policy

Tento dokument je momentálně dostupný pouze v angličtině.

This Privacy Policy explains how we collect and use personal data when you visit our websites, contact us, subscribe to our newsletter or apply for a role with us. It also serves as the information notice required by Article 13 of the General Data Protection Regulation (GDPR). There is no separate data protection document; everything you need to know is set out below.

1. Who we are (controller)

The controller responsible for your personal data is:

• Company name: Axyra s. r. o.
• Registered office: Krasovského 14, 851 01 Bratislava - mestská časť Petržalka, Slovak Republic
• Company registration number (IČO): 57 083 517
• Tax identification number (DIČ): 2122570142
• VAT identification number (IČ DPH): SK2122570142
• Registered in: Commercial Register of the Municipal Court Bratislava III, section: Sro, insert no. 190181/B
• Contact e-mail: info@axyra.cloud
• Contact phone: +421 903 641 808

"Controller" means that we decide why and how your personal data is processed. Where this policy says "we", "us" or "our", it refers to Axyra s. r. o.

We are not required to appoint a data protection officer (DPO) and have not done so; please send all privacy questions, requests and concerns to info@axyra.cloud.

2. Whom and what this policy covers

This policy applies to everyone whose personal data we process in connection with our websites and our business communications, in particular:

• visitors who browse our websites;
• people who contact us through the contact form or by e-mail;
• people who subscribe to our newsletter;
• candidates who apply for a job with us;
• business contacts with whom we correspond and prepare or perform contracts.

It covers the following websites and the personal data processed through them: www.axyra.cloud and www.axyracloud.com (English), www.axyra.sk (Slovak) and www.axyra.cz (Czech), together with the apex-domain addresses that redirect to those hosts. The legal documents for www.axyra.cz are provided in English.

Our websites and services are intended for businesses and professional audiences. They are not directed at children, and we do not knowingly collect personal data from children.

We process personal data in accordance with two complementary frameworks: Regulation (EU) 2016/679 (the GDPR) and Act No. 18/2018 Coll. on the protection of personal data (zákon č. 18/2018 Z. z. o ochrane osobných údajov), as amended.

3. What we process, why, and on what legal basis

We only process personal data that we actually need, for clearly defined purposes, and always with a valid legal basis. The activities below describe what we do.

3.1 Contact form and business enquiries

When you use our contact form we process the data you enter: your name, e-mail address, an optional subject and the content of your message. If you write to us directly by e-mail, we process your e-mail address and whatever you include.

• Purpose: to receive, understand and answer your enquiry, and to follow up on it by e-mail.
• Legal basis: Article 6(1)(f) of the GDPR, our legitimate interest in responding to messages addressed to us and in maintaining business communication. Where your enquiry is aimed at entering into an engagement or contract with us, the processing is also based on Article 6(1)(b) of the GDPR (steps taken at your request prior to entering into a contract).
• Retention: for the duration of handling your enquiry and, where a business relationship or follow-up may reasonably result, for up to 24 months afterwards. After that we delete the message unless a specific legal reason requires us to keep it for longer.

3.2 Server access logs and security

Like every website, ours is served by web infrastructure that automatically records technical information about each request: the IP address, the browser or client identification (user agent), the referring page, the requested path and the date and time.

• Purpose: network and information security, protecting the service against abuse (including per-IP request rate limiting), diagnosing faults and keeping the site operational.
• Legal basis: Article 6(1)(f) of the GDPR, our legitimate interest in keeping our service secure, available and functioning correctly. Recital 49 of the GDPR expressly recognises that processing to ensure network and information security is a legitimate interest.
• Retention: access logs are kept for a maximum of 6 months and are then deleted or anonymised.

3.3 Newsletter

If you sign up for our newsletter through the footer of the website, we process the e-mail address you provide in order to send you occasional technical content.

• Purpose: to send you our newsletter with technical articles, updates and related information.
• Legal basis: Article 6(1)(a) of the GDPR, your consent, which you give by submitting your e-mail address for this purpose.
• Retention: we keep your e-mail address on the newsletter list until you unsubscribe. Every mailing we send contains an unsubscribe option, and you can withdraw your consent at any time and just as easily as you gave it. Withdrawing consent does not affect the lawfulness of any mailing sent before the withdrawal. Once you unsubscribe, we stop using your address for the newsletter.

3.4 Recruitment

When you apply for a role with us, we process the data you send us as part of your application, typically your CV and any covering message or supporting materials you choose to include.

• Purpose: to assess your application and communicate with you about the position, and, if relevant, to take the steps needed before a possible employment or engagement.
• Legal basis: Article 6(1)(b) of the GDPR, measures taken at your request prior to entering into a contract. Please send us only the data that is relevant to your application, and avoid including special categories of data (for example, information about health, religion or political views) unless it is genuinely necessary.
• Retention: until the position you applied for is filled. We keep your application for longer, in a talent pool for future opportunities and for a maximum of 24 months, only if you give us your separate consent to do so.

3.5 Business correspondence and contract preparation

In the ordinary course of business we correspond with clients, partners, suppliers and other contacts, and we prepare, negotiate and perform contracts. In doing so we process contact and identification details of the individuals involved, such as name, business e-mail address, role and the content of the correspondence.

• Purpose: to prepare, conclude and perform contracts and to maintain our business relationships.
• Legal basis: Article 6(1)(b) of the GDPR where the processing relates to a contract with you or to pre-contractual steps taken at your request, and Article 6(1)(f) of the GDPR, our legitimate interest in conducting and documenting business communication, where you act on behalf of an organisation.
• Retention: for the duration of the business relationship and thereafter for the periods required by law, typically up to 10 years for accounting and tax records under zákon č. 431/2002 Z. z. o účtovníctve and tax legislation, after which the data is deleted.

4. Where your data comes from

We obtain personal data directly from you: from what you type into the contact form, from the e-mails you send us, from your newsletter sign-up and from your job application. Where you act for a client or partner organisation, your contact details may also reach us from that organisation or from public sources such as business registers and company websites, limited to your name, role and business contact details. The server access logs described in section 3.2 are generated automatically by the technical operation of the website when your browser connects to it.

Providing your data is voluntary and is not a statutory or contractual requirement. However, some information is necessary for us to act on your request. If you do not provide it, the practical consequence is simply that we cannot do the thing you asked for: without your e-mail address and message we cannot reply to your enquiry, without your e-mail address we cannot send you the newsletter, and without the details in your application we cannot assess your candidacy.

5. Recipients and processors

We do not publish or share your personal data with the general public, and we do not sell it. We do not use your personal data for advertising, and we do not pass it to third parties for their own marketing.

To run our websites and communicate with you we rely on a small number of carefully selected service providers who process personal data on our behalf and on our instructions. They fall into the following categories:

• our hosting and infrastructure provider, which provides the cloud infrastructure on which the websites run;
• our e-mail service providers, which operate the company mailboxes through which we receive and answer messages, and deliver the messages our websites generate, such as the notification of your enquiry to our inbox;
• IT and infrastructure contractors who help us operate and maintain the platform under contract.

Each of these providers acts as a processor. We have data processing agreements in place with them under Article 28 of the GDPR, and they are bound by confidentiality and may use the data only to provide the agreed service to us, not for their own purposes.

We may also disclose personal data to public authorities where we are legally obliged to do so, for example in response to a lawful request from a court or supervisory authority.

6. Transfers outside the EU/EEA

Our websites are hosted on cloud infrastructure located in the European Union. Our aim is that personal data processed through the websites stays within the European Union and the European Economic Area (EEA).

Some of our providers are part of corporate groups headquartered outside the EEA, in particular in the United States. Where providing a service could involve access to personal data from outside the EEA, that transfer is protected by appropriate safeguards under Chapter V of the GDPR, in particular the EU Standard Contractual Clauses incorporated into the provider's data processing terms and, where the provider is certified, the EU-US Data Privacy Framework. You can ask us for more information about the safeguards that apply.

Where you interact with our company page on LinkedIn (see section 13), LinkedIn processes personal data as an independent controller under its own terms and safeguards, which are outside our control.

7. How long we keep data

We keep personal data only for as long as we need it for the purpose we collected it for, or for as long as the law requires. The table below summarises the retention periods described in section 3.

When a retention period ends, we delete the personal data or irreversibly anonymise it.

8. Your rights

Under the GDPR and Act No. 18/2018 Coll. you have the following rights in relation to your personal data:

• Right of access (Article 15): to obtain confirmation of whether we process your data and, if so, a copy of it and information about how we use it.
• Right to rectification (Article 16): to have inaccurate data corrected and incomplete data completed.
• Right to erasure (Article 17): to have your data deleted where one of the grounds in the GDPR applies, for example where the data is no longer needed or where you withdraw the consent on which the processing was based.
• Right to restriction of processing (Article 18): to have processing limited in certain circumstances, for example while we verify the accuracy of your data or the validity of an objection.
• Right to data portability (Article 20): where processing is based on your consent or on a contract and is carried out by automated means, to receive the data you provided in a structured, commonly used and machine-readable format and to have it transmitted to another controller where technically feasible.
• Right to withdraw consent: where processing is based on consent (the newsletter, and the talent-pool retention in recruitment), to withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to object (Article 21): see section 9.
• Right to lodge a complaint with a supervisory authority: see section 10.

To exercise any of these rights, contact us by e-mail at info@axyra.cloud. We may need to verify your identity before acting on a request, so that we do not disclose data to the wrong person. We will respond without undue delay and in any event within one month of receiving your request. Where a request is complex or where we receive a number of requests, we may extend that period by up to two further months and will let you know if we do. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

9. Right to object

Where we process your personal data on the basis of our legitimate interests (Article 6(1)(f) of the GDPR, which applies to the contact form and enquiries, server access logs and security, and parts of our business correspondence), you have the right under Article 21(1) of the GDPR to object to that processing at any time, on grounds relating to your particular situation.

If you object, we will stop processing your data for the purpose concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless we need the data to establish, exercise or defend legal claims. To object, write to us at info@axyra.cloud and tell us which processing you object to and why.

10. Complaints

If you believe that we process your personal data unlawfully, we would like to hear from you first at info@axyra.cloud so that we can try to resolve the matter. This does not, however, affect your right to lodge a complaint with the supervisory authority.

The competent supervisory authority for personal data protection in the Slovak Republic is:

• Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic)
• Hraničná 12, 820 07 Bratislava, Slovak Republic
• Website: https://dataprotection.gov.sk

11. No automated decision-making or profiling

We do not make decisions about you that are based solely on automated processing and that produce legal effects concerning you or similarly significantly affect you, and we do not carry out profiling within the meaning of Article 22 of the GDPR.

12. How we protect data

We apply technical and organisational measures that are appropriate to the risks of the processing described in this policy. These include encryption of data in transit (TLS) between your browser and our websites, access controls and authentication for the systems that hold personal data, the principle of least privilege so that people and services can access only what they need, per-IP rate limiting to reduce abuse, and hosting on infrastructure located in an EU region. We keep our software up to date and review our measures from time to time. No system can be guaranteed to be completely secure, and we make no claim to hold any particular security certification, but we take the protection of your data seriously and act proportionately to keep it safe.

13. Our LinkedIn page

We operate a company page on LinkedIn at https://www.linkedin.com/company/axyracloud. LinkedIn (LinkedIn Ireland / Microsoft group) acts as an independent controller for its own processing under its own privacy policy, and as a joint controller with us within the meaning of Article 26 of the GDPR only for the aggregated Page Insights statistics it makes available to page operators. For details of how LinkedIn processes personal data, and the rights you can exercise directly against it, see LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy.

14. Cookies

Our websites use cookies and similar technologies such as browser local storage. Cookies that are strictly necessary to deliver and secure the site, and storage that only remembers a choice you made yourself, are exempt from consent; all other cookies are set only with your consent, which you can change or withdraw at any time. The categories, the legal basis for each and how to control them are set out in our Cookie Policy at /legal/cookie-policy, and your use of the websites is also subject to our Terms of Use at /legal/terms-of-use.

15. International visitors (outside the EU)

Our websites are operated from the European Union and are intended mainly for a European, business audience. If you visit from the United States or from another country outside the EU, the following applies.

We process the personal data described in this policy in the European Union under the GDPR, which sets a high standard of protection that follows your data wherever you are located. We do not sell your personal data, and we do not share it for cross-context behavioural advertising, as those terms are used under United States state privacy laws. We do not use your personal data for targeted advertising and we do not profile you.

Whichever country you are in, you can contact us at info@axyra.cloud to ask what personal data we hold about you, to have it corrected or deleted, or to raise a privacy concern, and we will deal with your request. Depending on where you live, local law may give you additional privacy rights; we are happy to honour reasonable requests of this kind, whether or not a particular law formally applies to us.

16. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes in how we operate or in the law. The current version is always the one published on this page at /legal/privacy-policy. Where a change is significant, we will take reasonable steps to make it more visible. We encourage you to review this page from time to time.