Privacy Policy

We value your privacy and transparently inform you about how we process your personal data.

1. General Information

1.1. This is the policy on the processing of personal data (hereinafter referred to as the "Policy") of ElevAIton s. r. o., with its registered office at Kubačova 7482/13, Bratislava - Rača municipal district 831 06, Company ID No.: 57 143 544, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 190941/B (hereinafter referred to as "ElevAIton").

1.2. This Policy serves to inform Data Subjects about how ElevAIton handles their data, what rights Data Subjects have, and how Data Subjects may exercise their rights in relation to Personal Data.

1.3. Personal Data means any information relating to an identified or identifiable natural person.

1.4. Special Categories of Personal Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.

1.5. Data Subject means an identified or identifiable natural person whose Personal Data are processed.

1.6. Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

1.7. Processor means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.

1.8. Recipient means a natural or legal person, public authority, agency or another body to which Personal Data are disclosed, whether a third party or not.

1.9. Automated Decision-Making means decision-making based solely on automated processing of Personal Data, including Profiling, whereby such data are processed solely by technical or software means (including, for example, algorithms, information systems, artificial intelligence or automated databases), without direct or ongoing human involvement in the decision-making process, and which produces legal effects concerning a Data Subject or similarly significantly affects him or her.

1.10. Profiling means any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

1.11. Applicable Law means all valid and effective legal rules applicable to the processing of Personal Data by ElevAIton, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation ("GDPR"), Act No. 18/2018 Coll. on Personal Data Protection, as amended, and other applicable laws of the Slovak Republic and the European Union.

1.12. Umami Analytics is an analytics tool used to obtain basic statistical information on website traffic and use. In the configuration used by ElevAIton, Umami Analytics is operated as a self-hosted solution on infrastructure under the control of ElevAIton, does not use cookies, does not store IP addresses of Data Subjects, does not track Data Subjects across websites, and is not used for Profiling or Automated Decision-Making. Data obtained through Umami Analytics are technical and statistical in nature and do not enable the direct or indirect identification of a specific natural person.

2. Services

ElevAIton provides services directly to Data Subjects in accordance with Annex No. 1, Purposes of Personal Data Processing, which contains a list of ElevAIton's processing operations.

3. Position under the GDPR

3.1. Processor: When providing services, consultations or licences to its programs, ElevAIton acts as a Processor. In such case, ElevAIton provides services, consultations or software in accordance with the documented instructions of the customer, while ElevAIton reserves the right to refuse to carry out any instructions that conflict with generally binding legal acts, in particular those governing the protection of Personal Data. ElevAIton does not back up Personal Data with which it comes into contact in its capacity as Processor, nor does it create personal databases. Personal Data are processed according to the customer's instructions and subsequently handed over to the customer. Given that ElevAIton does not create backups of Personal Data, the Data Subject cannot/is unable to exercise his or her rights against ElevAIton in its capacity as Processor. If a Data Subject exercises their rights under the Applicable Laws, ElevAIton will provide assistance in handling the request or refer the Data Subject, together with their request, to the Controller.

3.2. Controller: When carrying out its own activities, ElevAIton acts as a Controller. This means that ElevAIton is the Controller of Data Subjects when providing services pursuant to Section 2 of this Policy, when carrying out Marketing activities pursuant to Section 9 of this Policy, and when processing Personal Data for the purpose of improving its services pursuant to Section 11 of this Policy.

4. Lawfulness of Personal Data Processing

4.1. ElevAIton processes Personal Data of Data Subjects only where there is a lawful and appropriate legal basis for the processing. Processing may be carried out:

4.1.1. where processing is necessary for compliance with a legal obligation to which ElevAIton is subject under applicable law;

4.1.2. where processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract;

4.1.3. where processing is necessary for the purposes of the legitimate interests pursued by ElevAIton.

4.2. ElevAIton gives preference to processing Personal Data on the basis of the Data Subject's explicit consent, where possible.

4.3. Where processing is based on the legitimate interests pursued by ElevAIton or by a third party, ElevAIton identifies such legitimate interests in Annex No. 1 and assesses whether they are overridden by the interests or fundamental rights and freedoms of the Data Subject.

4.4. Detailed information on the legal bases for processing individual categories of Personal Data and the purposes thereof is set out in the section "Purposes of Personal Data Processing".

5. Data Processing

5.1. ElevAIton provides services in the field of data analysis and data processing, including Personal Data. When providing such services for the benefit of third parties, ElevAIton does not collect data on Data Subjects. Data and Personal Data are provided by the customer of the service, who is also the Controller of such Personal Data. Unless expressly agreed otherwise in writing with the customer and/or subject to the Controller's instructions, the services provided by ElevAIton do not involve Automated Decision-Making or Profiling within the meaning of the GDPR. The services consist of technical analysis, structuring or categorisation of data and do not, by themselves, produce legal effects concerning Data Subjects or similarly significantly affect them.

5.2. When providing services for the benefit of Data Subjects in which ElevAIton itself acts as the Controller, ElevAIton always processes only Personal Data that are necessary and only for the period necessary to provide the service or to fulfil the legitimate interest pursued by ElevAIton. The specific scope of Personal Data processing can be found in the section Purposes of Personal Data Processing.

6. How We Use Personal Data

6.1. Personal Data obtained from Controllers are processed exclusively in accordance with their instructions and in compliance with Applicable Law. After the service has been provided to the Controller, ElevAIton does not retain or back up any of the data provided.

6.2. ElevAIton, as Controller, processes Personal Data both manually and by automated means.

6.3. Where ElevAIton processes Personal Data as Controller, it does not carry out Automated Decision-Making, including Profiling, which would produce legal effects concerning the Data Subject or similarly significantly affect him or her.

7. Data Processing Period

7.1. ElevAIton, in its capacity as Processor, processes Personal Data of Data Subjects exclusively during the provision of the agreed service for the benefit of the customer, who is the Controller of the Personal Data concerned; after the service has been performed, ElevAIton does not retain any Personal Data about Data Subjects.

7.2. ElevAIton, in its capacity as Controller, retains Personal Data of Data Subjects for the period specified in the section Purposes of Personal Data Processing.

7.3. Where specific retention periods are not expressly stated, ElevAIton retains Personal Data only for as long as necessary to fulfil the relevant processing purpose, to comply with legal obligations, or to establish, exercise or defend legal claims.

8. Recipients of Personal Data

8.1. Personal Data processed by ElevAIton in the capacity of Controller will not be provided, sold or otherwise made available to third parties. ElevAIton, acting as Controller, will not share Personal Data with other entities or transfer them abroad, unless it is required to do so pursuant to Applicable Law or a decision of a competent public authority. ElevAIton may disclose Personal Data to third parties or other Recipient solely to the extent strictly necessary for the provision of its services. ElevAIton does not sell Personal Data to third parties.

9. Marketing

9.1. For marketing purposes and the development of business relationships, ElevAIton maintains an internal database of its contractual partners to whom it provides services and/or licences to software and applications created by it.

9.2. This database also contains Personal Data of contact persons of contractual partners, in the following scope: name, surname, title, if applicable, job position within the company, e-mail address, telephone number, and link to a LinkedIn social network profile.

9.3. In the same database, ElevAIton also processes Personal Data of third parties who have granted ElevAIton, as Controller, explicit consent to such processing. These data are processed in the same scope as in the case of contact persons of contractual partners (name, surname, title, if applicable, job position, e-mail address, telephone number, link to a LinkedIn profile), solely for the purposes of marketing communication, sending offers, news and information about the services and products of ElevAIton or its affiliated companies.

9.4. ElevAIton may send Data Subjects direct offers of its products and services or a newsletter only on the basis of explicit consent granted by the Data Subject voluntarily and separately.

9.5. Consent may be withdrawn at any time, through the unsubscribe link included in each e-mail sent or by sending a request to the e-mail address elevaiton@elevaiton.com.

10. Website Traffic Analytics without the Use of Cookies – Umami Analytics

10.1. ElevAIton uses the Umami Analytics analytics tool on its websites to obtain basic statistical information on website traffic and use.

10.2. Umami Analytics is operated as a self-hosted solution, i.e. on infrastructure under the control of ElevAIton. Data obtained through this tool are not provided to Umami, operators of advertising systems or other third parties for their own purposes.

10.3. In the configuration used by ElevAIton, Umami Analytics does not use cookies, does not store IP addresses of Data Subjects, does not track Data Subjects across different websites, does not create user profiles, and is not used for remarketing or behavioural advertising.

10.4. Through Umami Analytics, only technical and statistical data on website use are processed, in particular information on pages visited, page title, referrer, browser type, operating system, device type, screen resolution, browser language, approximate location at country, region or city level, UTM parameters and basic interactions with the website.

10.5. Data processed through Umami Analytics are not, in the configuration used by ElevAIton, capable of directly or indirectly identifying a specific natural person who uses ElevAIton's websites. It is not possible to determine from the data available in Umami Analytics which specific Data Subject visited or used the websites.

10.6. Names, surnames, e-mail addresses, telephone numbers, customer identifiers, user IDs, order numbers, login credentials, authorisation or authentication tokens, internal personal identifiers or other data attributable to a specific natural person are not sent to Umami Analytics.

10.7. Data obtained through Umami Analytics are used exclusively for the purposes of measuring traffic, evaluating website use, improving website content and user experience, and technically optimising the websites.

10.8. The use of Umami Analytics does not involve Automated Decision-Making, including Profiling, in relation to the Data Subject. Data obtained through Umami Analytics are not used to evaluate personal aspects of the Data Subject, to predict his or her behaviour, interests, preferences, location or movements, or to make decisions that would produce legal effects concerning the Data Subject or similarly significantly affect him or her.

10.9. Since Umami Analytics in the configuration used by ElevAIton does not use cookies, does not store identifiers of Data Subjects, does not track Data Subjects across websites, and the data available in this tool are not capable of identifying a specific natural person, its use does not constitute the use of analytical and/or marketing cookies requiring the Data Subject's consent through a cookie banner. ElevAIton regularly reviews this configuration and will update this Policy if the configuration or legal assessment changes.

10.10. When using Umami Analytics, ElevAIton acts in compliance with Applicable Law and ensures that no Personal Data, nor any data which, either alone or in combination with other data available to ElevAIton, would enable the identification of a specific natural person, are transmitted to this tool.

11. Personal Data Protection

11.1. In processing Personal Data of Data Subjects, ElevAIton has implemented all appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with the GDPR and Applicable Law.

11.2. Such measures include, in particular:

  • prevention of unauthorised or accidental access to Personal Data, alteration, destruction, loss, unauthorised transfer, other unauthorised processing or misuse thereof;
  • storage of Personal Data exclusively on ElevAIton's own hardware and regular backup thereof on its own physical storage media;
  • strict limitation of access rights to Personal Data, whereby only authorised persons have access to Personal Data to the extent necessary for the performance of their employment or contractual duties;
  • implementation of an access management system and control of user rights and roles;
  • ensuring that all persons who come into contact with Personal Data are bound by a statutory or contractual duty of confidentiality.

11.3. These measures are continuously reviewed and updated to correspond to the level of risks associated with the processing of Personal Data. The duty of confidentiality and the obligation to protect Personal Data continue even after the processing has ended, i.e. even after the Data Subject ceases to use ElevAIton's services.

12. Transparent Information on the Processing of Personal Data

12.1. Whenever a Data Subject provides Personal Data through services provided by ElevAIton, ElevAIton informs him or her of:

  • the purpose of processing such data;
  • who the Controller is and who the Recipient of the Personal Data is;
  • the ways in which the Personal Data will be used.

12.2. Basic information is always accessible directly when data are entered, while more detailed information is provided in the following documents:

12.2.1. Privacy Policy – describes the processing of Personal Data obtained in the provision of services.

12.2.2. Consent – a document by which the user grants consent to the processing of his or her Personal Data for specific purposes, available in electronic or paper form. Consent may be withdrawn at any time.

12.2.3. Personal Data Processing Policy – a text containing information on data processing, available electronically or in paper form.

12.2.4. List of Processors – where ElevAIton uses processors or discloses Personal Data to recipients, the relevant information is provided in Annex No. 1 or otherwise made available at https://elevaiton.com/en/. If ElevAIton does not use any processors for a particular processing activity, this is stated in Annex No. 1.

12.3. Where ElevAIton has not obtained Personal Data directly from the Data Subject, ElevAIton provides the Data Subject with information required under Article 14 GDPR within the applicable statutory period, unless an exemption under the GDPR applies. Such Personal Data may be obtained, in particular, from contractual partners, business communication, publicly available professional sources, LinkedIn profiles or other lawful sources. The categories of such Personal Data and the relevant sources are specified in Annex No. 1.

12.4. ElevAIton hereby ensures that all information on the processing of users' Personal Data is clear, transparent and easily accessible.

13. Rights of Data Subjects

13.1. The Data Subject may exercise his or her rights by sending an e-mail to elevaiton@elevaiton.com or by letter sent to the address: Kubačova 7482/13, Bratislava - Rača municipal district 831 06. ElevAIton may request additional information necessary to verify the identity of the Data Subject where there are reasonable doubts concerning the identity of the person making the request.

13.2. ElevAIton ensures that Data Subjects may exercise their rights under the GDPR. The rights are divided as follows:

13.2.1. Right of access: The Data Subject has the right to obtain from the Controller confirmation as to whether or not Personal Data concerning him or her are being processed and, where that is the case, access to the Personal Data.

13.2.2. Right to rectification: The Data Subject may request the rectification of inaccurate Personal Data and the completion of incomplete Personal Data. ElevAIton will carry out the rectification without undue delay, taking into account technical limitations. Data may also be updated through the available software functions of the services.

13.2.3. Right to erasure ("right to be forgotten"): The Data Subject may request the erasure of Personal Data if:

  • the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • he or she has withdrawn consent on which the processing is based and there is no other legal ground for the processing, or he or she has objected to processing and there are no overriding legitimate grounds for the processing;
  • the Personal Data have been unlawfully processed; or
  • the Personal Data have to be erased for compliance with a legal obligation.

The "right to be forgotten" is not absolute – ElevAIton may retain data where processing is necessary for compliance with a legal obligation (e.g. accounting) or for the establishment, exercise or defence of legal claims.

13.2.4. Right to restriction of processing: The Data Subject may request restriction of processing of Personal Data instead of erasure if:

  • he or she contests the accuracy of the Personal Data (the restriction applies for a period enabling verification);
  • the processing is unlawful and the Data Subject opposes the erasure of the Personal Data;
  • ElevAIton no longer needs the Personal Data for the purposes of the processing, but the Data Subject requires them for the establishment, exercise or defence of legal claims; or
  • the Data Subject has objected to processing based on legitimate interests pending the verification whether the legitimate grounds of ElevAIton override those of the Data Subject.

13.2.5. Right to data portability: The Data Subject may request to receive Personal Data concerning him or her, which he or she has provided to ElevAIton, in a structured, commonly used and machine-readable format, and may request their transmission to another Controller, where the processing is based on consent or on a contract and is carried out by automated means, provided that the rights and freedoms of others are not adversely affected.

13.2.6. Right to object: The Data Subject may object, on grounds relating to his or her particular situation, at any time to the processing of Personal Data based on the legitimate interests pursued by ElevAIton or by a third party, including Profiling based on those provisions. If ElevAIton does not demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, the processing will be terminated without undue delay. Where Personal Data are processed for direct marketing purposes, the Data Subject has the right to object at any time to such processing, including Profiling to the extent that it is related to such direct marketing. Objection to marketing is also possible through the unsubscribe link in marketing communications, by ticking the relevant box when entering data, or by e-mail with the subject "STOP".

13.2.7. Right to withdraw consent: If data are processed on the basis of consent, the Data Subject may withdraw his or her consent at any time. Withdrawal does not affect the lawfulness of processing carried out before its withdrawal.

13.2.8. Right to lodge a complaint with a supervisory authority: The Data Subject may lodge a complaint with the supervisory authority in his or her country, including the Office for Personal Data Protection of the Slovak Republic, with its registered office at Námestie 1. mája 18, 811 06 Bratislava.

13.2.9. Right to an effective judicial remedy: The Data Subject has the right to an effective judicial remedy against ElevAIton or a Processor if he or she considers that the processing of Personal Data infringes the GDPR.

13.3. In the case of manifestly unfounded or excessive requests, in particular because of their repetitive character, ElevAIton is entitled to charge a reasonable fee or refuse to act on the request, of which it will inform the Data Subject in advance.

13.4. ElevAIton will provide information on action taken on a request of the Data Subject without undue delay and in any event within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. ElevAIton will inform the Data Subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

14. Contact Details

14.1. Requests may be sent to the e-mail address elevaiton@elevaiton.com or by post to: Kubačova 7482/13, 831 02 Bratislava – Rača municipal district.

15. Final Provisions

15.1. ElevAIton reserves the right to amend this Policy on the Processing of Personal Data depending on changes to the Services provided and/or if there is a change in Applicable Law requiring relationships to be regulated differently.

15.2. Minor amendments, such as formatting, correction of typographical errors or clarification of the text, may be made without the need to change the date of the last update.

15.3. Specific processing purposes set out in overview tables may be updated, and therefore we recommend that you occasionally review the Privacy Policy.

15.4. In accordance with the guidelines of the European Data Protection Board, we will notify Data Subjects of significant or material changes/processes that could be surprising or unexpected, by e-mail if ElevAIton has it available.

15.5. Policy on the Processing of Personal Data: