1.Controller and contact
The controller of personal data is Active life Int., s.r.o., with its registered office at Tomášikova 28D, 821 01 Bratislava, company ID (IČO) 48 108 456 (the “Controller”).
Contact for personal data protection matters: e-mail [email protected], address Tomášikova 28D, 821 01 Bratislava. Data protection officer (DPO): not appointed.
2.What data we process
| Category | Examples of data |
|---|---|
| Registration data | First name and surname, e-mail, telephone number, login credentials. |
| Identity verification (KYC) data | Identity document, date of birth, address, information needed for AML checks. |
| Communication data | Content of e-mail and other communication with the Controller. |
| Technical data | IP address, device and browser type, login and 2FA logs. |
3.Purpose and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Registration and account management, access to the investor zone | Performance of a contract / steps prior to entering into a contract — Art. 6(1)(b) |
| Identity verification (KYC) and AML checks | Compliance with a legal obligation — Art. 6(1)(c) |
| Platform security, prevention of misuse | Legitimate interest — Art. 6(1)(f) |
| Communication and answers to enquiries | Legitimate interest / performance of a contract |
| Marketing communication (if provided) | Consent — Art. 6(1)(a) |
4.Retention period
We retain personal data only for as long as necessary to achieve the purpose:
- Registration and account data — for the duration of the account and thereafter for a reasonable period to assert legal claims.
- KYC/AML documents — for the period required by anti-money laundering regulations (generally at least 5 years from the end of the relationship, or as required by applicable legislation).
- Technical logs — for a limited period for security purposes.
- Data processed on the basis of consent — until the consent is withdrawn.
5.Recipients and processors
Personal data may be made available to trusted processors who provide services for us, in particular:
- hosting and IT infrastructure providers;
- providers of KYC/AML verification services;
- legal, tax and accounting advisers;
- public authorities, where required by law.
We have data processing agreements with our processors pursuant to Art. 28 GDPR.
6.International transfers
We process personal data primarily within the European Economic Area (EEA). Should a transfer to a third country take place, we will ensure appropriate safeguards under the GDPR (in particular an adequacy decision or standard contractual clauses). [VERIFY CURRENT PROVIDERS.]
7.Rights of the data subject
In connection with the processing of personal data, you have the following rights:
- Right of access to your data and to information about the processing.
- Right to rectification of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”) in cases provided by law.
- Right to restriction of processing.
- Right to data portability.
- Right to object to processing based on legitimate interest.
- Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
You can exercise your rights using the contact details in section 1. Some rights may be limited by the legal obligation to retain KYC/AML data.
8.Complaint to the supervisory authority
If you believe that the processing of your data has violated your rights, you may lodge a complaint with the supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava, Slovak Republic
web: dataprotection.gov.sk
9.Data security
We apply appropriate technical and organizational measures to protect data, including encrypted transmission, access rights management and two-factor authentication (2FA) at login to the investor zone.
10.Changes to the policy
We may update this policy from time to time. The current version, with its effective date, is always available on the platform.