Sign up

Privacy policy

Privacy policy and data processing agreement of the IRVYS system. GDPR & DPA documentation, B2B / B2G (European Union & EEA).

This is an informative translation. In case of any discrepancy in interpretation, the Slovak version prevails. Binding Slovak version

Article I. Identification of the controller and introductory provisions

  1. This document sets out the rules for processing and protecting personal data in connection with the operation and use of the cloud broadcasting and information system IRVYS in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”) and Slovak Act No. 18/2018 Coll. on the protection of personal data, as amended.

  2. The provider and operator of the IRVYS System is the company:

    Business name
    Datawell s.r.o.
    Registered office
    Jeruzalemská 293/2, 917 01 Trnava, Slovak Republic
    Company ID (IČO)
    53983483
    Tax ID (DIČ)
    2121540751
    VAT ID
    SK2121540751
    Registration
    Commercial Register of the District Court Trnava, section: Sro, file No. 49729/T
    Contact e-mail for GDPR matters
    info@irvys.net

    (hereinafter the “Provider”).

  3. When providing the IRVYS System in the B2B and B2G segment (businesses, municipalities, schools and institutions within the EU/EEA), the Provider acts in two different legal roles under the GDPR:

    • A) The Provider as Controller (Articles II to IV): in relation to the personal data of the Client’s representatives, statutory bodies, contact persons and administrators, which it processes for the purposes of concluding the contract, invoicing, operating user accounts and customer support.
    • B) The Provider as Processor (Article V – Data Processing Agreement / DPA): in relation to the personal data of third parties that the Client itself uploads to, stores in or broadcasts through the IRVYS System as part of its broadcast Content.

Article II. Scope, purposes and legal bases of processing (Provider as Controller)

Where the Provider acts as an independent Controller (Article 4(7) GDPR), it processes the personal data of representatives and users on the Client’s side to the following extent, for the following purposes and for the stated retention period:

Purpose of processingLegal basis (GDPR)Categories of personal dataRetention period
Performance of the Contract and account management in the IRVYS System (setting up access, technical support, operational notifications)Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interest in performing the contract through the Client’s employees)First name, surname, job position, e-mail address, telephone number, login name, encrypted passwordFor the term of the Contract and 30 days after it ends (until the user account is deleted)
Accounting and tax records (issuing invoices, VAT records and EU VIES reports)Article 6(1)(c) GDPR (compliance with a legal obligation under the Accounting Act and the VAT Act)Billing details, name and surname of the contact person on the invoice, company ID, tax ID, VAT ID, payment details, payment history10 years following the year to which the accounting documents and invoices relate
Network security, fraud prevention and logging (server protection, handling incidents and notices under the DSA)Article 6(1)(f) GDPR (the Provider’s legitimate interest in cyber security and the functioning of the System)IP address, login timestamps (logs), end-device/screen identifier, records of activity in the administration12 months from the creation of the record (log), unless an incident requires longer retention
Exercise of legal claims and business communication (debt recovery, information about System updates)Article 6(1)(f) GDPR (the Provider’s legitimate interest in protecting its rights and in direct B2B marketing of its own services)Contact details of the Client’s representative, history of contractual and e-mail communication, information about the services usedFor the term of the Contract and until the limitation periods under the Slovak Commercial Code expire (usually 4 years)

Article III. Recipients of personal data and transfers to third countries

  1. The Provider discloses personal data only to the extent necessary to vetted categories of recipients and processors with whom it has concluded a data processing agreement under Article 28 GDPR:

    • providers of certified cloud, server and hosting infrastructure located in the European Union,
    • external accounting, tax and law firms bound by a duty of confidentiality,
    • external IT specialists and developers providing technical maintenance and development of the IRVYS System,
    • public authorities (e.g. the tax office, courts, law enforcement authorities) solely where required by applicable Slovak or EU law.

  2. Data location in the EU/EEA: The Provider stores and processes personal data primarily in data centres located in member states of the European Union or the European Economic Area (EEA). Personal data are not transferred to third countries outside the EU/EEA; should such a transfer exceptionally occur through the use of global communication tools, it will take place solely on the basis of a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or standard contractual clauses (SCC) under Article 46 GDPR.

  3. When processing personal data, the Provider does not carry out automated individual decision-making or profiling under Article 22 GDPR.

Article IV. Rights of data subjects in the EU

  1. A natural person whose personal data the Provider processes (hereinafter the “Data Subject”) has the following rights in accordance with Articles 15 to 21 GDPR:

    • Right of access (Article 15 GDPR): the right to obtain confirmation as to whether their personal data are being processed and to obtain a copy of those data.
    • Right to rectification (Article 16 GDPR): the right to have inaccurate personal data corrected and incomplete personal data completed without undue delay.
    • Right to erasure – “right to be forgotten” (Article 17 GDPR): the right to have personal data erased where the purpose of processing no longer applies and there is no other legal ground for keeping them (e.g. the archiving period for invoices).
    • Right to restriction of processing (Article 18 GDPR) and right to data portability (Article 20 GDPR) in a structured, machine-readable format.
    • Right to object (Article 21 GDPR): the right to object at any time to processing of personal data carried out on the legal basis of the Provider’s legitimate interest (including objecting to receiving business news).

  2. The Data Subject may exercise their rights in writing at the Provider’s registered office or electronically at info@irvys.net. The Provider will handle the request without undue delay and at the latest within 1 month of its receipt.

  3. Right to lodge a complaint with a supervisory authority: If the Data Subject believes that the processing of their personal data has infringed the GDPR, they have the right to file a complaint with the supervisory authority in the Slovak Republic, which is the Office for Personal Data Protection of the Slovak Republic (Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk), or with the competent data protection supervisory authority in the EU member state of their habitual residence or place of work.

Article V. Data processing agreement (DPA under Article 28 GDPR)

  1. Subject matter and nature of processing: This Article constitutes a binding Data Processing Agreement (Data Processing Agreement – DPA) within the meaning of Article 28(3) GDPR between the Client as Controller and the Provider as Processor. It applies where the Client uploads to the IRVYS System, stores in the cloud storage or broadcasts through end screens audio, video, text or graphic Content containing personal data of third natural persons (e.g. photos and videos of employees, residents of a municipality, pupils, performers or the Client’s customers).

  2. Responsibility of the Client as Controller: The Client is solely responsible for having a valid legal basis under Article 6 GDPR for processing and publicly disseminating the personal data contained in its Content (e.g. the data subject’s consent to publication of a photo/video, performance of a contract, performance of a task in the public interest of a municipality/school, or legitimate interest) and for having fulfilled its information obligation towards data subjects under Articles 13 and 14 GDPR.

  3. Obligations of the Provider as Processor: For the term of the main Contract for the provision of services, the Provider undertakes to:

    • process personal data contained in the Content solely on the basis of the Client’s documented instructions; uploading, storing, scheduling a broadcast and deleting a file by the Client in the user interface of the IRVYS System are considered such instructions,
    • ensure that persons authorised to process personal data on the Provider’s side (employees and administrators) are bound by confidentiality,
    • provide the Client with reasonable assistance in handling data subjects’ requests and in fulfilling obligations under Articles 32 to 36 GDPR (including notifying any personal data breach on the System’s servers without undue delay),
    • allow the Client, upon its written request, to verify compliance with the obligations under this Article by providing the relevant security documentation.

  4. Technical and organisational security measures (Article 32 GDPR): The Provider has adopted appropriate security measures to protect data in the IRVYS System, in particular encryption of data in transit (HTTPS / TLS protocols), encryption of login passwords, logical separation of individual Clients’ data in the cloud storage, access rights management and regular updates of the server infrastructure.

  5. Engagement of sub-processors: The Client grants the Provider a general written authorisation to engage sub-processors providing cloud hosting and maintenance of the System within the EU/EEA. The Provider will ensure that each sub-processor is bound by the same data protection obligations as in this DPA.

  6. Deletion of data after the Contract ends: After the main Contract for the use of the IRVYS System ends, the Client may download its data from the System within 14 days (in case of immediate termination) or before the notice period expires. No later than 30 days from the date the Contract ends, the Provider will permanently and irreversibly delete all of the Client’s Content and personal data from all production servers and backups of the IRVYS System, unless a specific EU or Slovak regulation requires them to be kept.

Article VI. Final provisions

  1. This document forms a separate part of the contractual documentation to the General Terms and Conditions for the use of the IRVYS system of Datawell s.r.o.

  2. The Provider may update this Privacy Policy in the event of changes in EU/Slovak legislation or technical changes to the IRVYS System. The current version is always published in the System interface and on the Provider’s website.

  3. This Privacy Policy and data processing agreement enter into force and take effect on 3 November 2026.

Controller / Provider: Datawell s.r.o., Jeruzalemská 293/2, 917 01 Trnava

Cookie settings

Choose what the site may store in your browser. You can change your choice at any time in the footer.