Privacy Policy

01

Definitions

For clarity, here are the terms we use throughout this policy:

GDPR

Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data.

The Act

Act No. 18/2018 Coll. on the Protection of Personal Data and on amendments to certain acts.

EEA

European Economic Area.

Personal data

Any information about a natural person by which they can be identified, directly or indirectly.

Controller

The entity that, alone or jointly with others, determines the purposes and means of processing personal data. In relation to your data, that is us — Samuel Mruk / AI Inovator.

Processor

An entity that processes personal data on behalf of the Controller under a written contract.

Processing

Any operation performed on personal data — its storage, sharing, deletion or modification.

Data subject

The natural person to whom the personal data relates — a customer, a prospective customer or a visitor to the website.

Special category

Sensitive personal data under Art. 9 GDPR (health, ethnic origin, biometric data, etc.). We do not process such data.

02

Core processing principles

Your privacy matters to us. We only ask for the personal data strictly necessary to provide our services. Our processing meets the standards required by the GDPR and by Act No. 18/2018 Coll.

Where justified, we use artificial intelligence — chatbots, voice agents and automations. We do not use it for automated decision-making or profiling within the meaning of Art. 22 GDPR. All processing is subject to human oversight.

We process personal data solely for defined purposes, to the extent necessary and for no longer than necessary.

03

Our role in relation to personal data

AI Inovator as a controller

In relation to website visitors and to customers with whom we enter into a contract, we act as the Controller — we decide on the purposes and means of processing personal data.

AI Inovator as a processor

When delivering our services (chatbots, voice agents) we may process the personal data of our customers' customers. In such cases we act as a Processor and process the data solely on your instructions under a Data Processing Agreement (DPA).

If you are a customer or another data subject whose data is processed by one of our clients, please contact that client directly.

04

What personal data we process

We only process the personal data necessary to achieve a specific purpose:

First and last name, and where applicable Company ID and address
Contact details — email, phone number
Billing and payment details for bookkeeping
Data from enquiries sent via the contact form or by email
Cookies, IP address and website activity data
Operational logs on the use of AI services (event time, technical records)

We do not process special categories of personal data

05

Purposes and legal bases of processing

Website visitors

Purpose	Data	Method	Retention
Website operationCore website functions. Legal basis: legitimate interest (essential cookies), consent (analytics cookies).	IP address, device type, time and manner of visit.	Cookies and tracking technologies.	Varies — some cookies only during the session, others longer.
Handling an enquiryContact via the form or email. Legal basis: performance of a contract / legitimate interest.	First name, last name, email, phone and any other details you provide.	Communication by email or phone.	Closed enquiries deleted within 3.5 years of submission.

Customers

Purpose	Data	Method	Retention
Entering into and performing a contractLegal basis: performance of a contract.	First name, last name, email and any other identifying details.	You provide the data when entering into the contract.	For the term of the contract + 3.5 years after it ends.
Delivering AI servicesChatbots, voice agents, automations. Legal basis: performance of a contract.	Name, Company ID, email, phone, job title and possibly IP address.	Processed as part of delivering the agreed services.	For the term of the contract + 3.5 years after it ends.
Accounting and tax obligationsLegal basis: legal obligation.	Billing details — name, address, email, details of the service.	We create and archive invoices.	As required by law — 3 to 10 years.

06

Processors

We use only vetted processors with whom we have a written contract in place. All of them provide at least the same level of personal data protection as we do.

Processing purpose	Processor
Web hosting	WebSupport, a.s.
Database and data storage	Supabase Inc.
Chatbot and voice AI agent	Voiceflow Inc.
Process automation	Make (Celonis SE)
Large language models	OpenAI, L.L.C.
Large language models	Anthropic, PBC

Besides the processors listed above, we may disclose personal data to third parties where required by law or by a lawful request from a public authority or a court.

07

Security measures

We take the security of your personal data seriously. When choosing our measures we consider the scope of processing, the level of risk and the current state of the art.

Technical measures

Regular data backups
Encryption of transmission using SSL/TLS
Secure HTTPS protocol
Access permissions managed at the individual level
Development with privacy by design in mind

Organisational measures

Collaborators and suppliers are bound by confidentiality
System access is personalised and protected by secure passwords

08

Your rights

Send your request to samuel@aiinovator.sk. We will respond within one month. To verify your identity we may ask you for additional information.

Right of access

We will confirm whether we process your personal data and provide information on the purposes, categories, recipients and retention period.

Right to rectification

You may request the correction of inaccurate or incomplete personal data.

Right to erasure

Where there is no legal ground for further processing, we will delete or anonymise the data in question.

Right to restriction

Contact us if you believe we are processing your data incorrectly — whether as to the grounds or the scope.

Right to portability

We will provide your data in a structured, machine-readable format to you or to another controller.

Right to object

Where we process your data on the basis of a legitimate interest, you may object. If your objection is upheld, we will stop the processing.

Withdrawal of consent

You may withdraw consent given for marketing or other purposes at any time, without giving a reason.

⚖️

If you are not satisfied with how your request is handled, you may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27 — dataprotection.gov.sk

09

Closing provisions

This policy may only be amended in writing. We will inform you of any change via the website. By continuing to use our services after the changes are published, you agree to the updated wording.

Any further questions can be directed to samuel@aiinovator.sk.