Legal information · GDPR
Privacy notice
This is a translation for your convenience. In the event of any discrepancy between the language versions, the Slovak version prevails.
Este documento está disponible en inglés, alemán y eslovaco. La versión vinculante es la eslovaca.
1 Controller
The controller is Esentra, s.r.o., with its registered office at Levočská 7711/47, 080 01 Prešov, Slovakia, company ID (IČO): 47 183 721, registered in the Commercial Register of the District Court Prešov, section Sro, insert No. 28128/P, e-mail info@esentra.sk, telephone +421 948 479 339. For matters of personal data protection please contact us at the e-mail address above.
This notice concerns persons who have an account in the Visitics service, are contact persons of our customers or visit the pages of www.getvisitics.com. How the data of visitors of our customers' websites is processed is set out in section 10.
2 Purposes, legal bases and retention periods
| Personal data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, e-mail address, password hash (if you set a password), language, time of the last sign-in, consent to the terms and its version | Setting up and keeping the account, providing the service | Performance of a contract (Article 6(1)(b) GDPR) | For as long as the account exists; an account that is not a member of any organization and to which nobody has signed in for 12 months is deleted after a warning by e-mail and 30 days |
| Signing in with Google or Facebook, if you use it: the identifier the provider assigned to you, the e-mail address the provider gave when the method was connected, the time of connecting and of the last use; for a new account also the name from the profile | Signing in and signing up without a password, connecting and disconnecting a sign-in method, a security notice by e-mail about a new connection | Performance of a contract; legitimate interest in the security of accounts (the notice) | Until disconnected in the account settings or until the account is closed; the provider's access tokens are not stored |
| Membership in an organization, role, invitations | Access to the organization's websites | Performance of a contract | For as long as the membership lasts; invitations at most 37 days |
| Settings of e-mail reports and alerts | Sending reports and alerts about website problems | Performance of a contract | For as long as the membership lasts; one-click unsubscribe in every e-mail |
| Active sign-ins: browser, operating system, approximate place (city, country) determined from the IP address, which is not stored, time of sign-in and of the last activity | Overview of sign-ins, remote sign-out, account protection | Legitimate interest in the security of accounts (Article 6(1)(f) GDPR) | Until sign-out, at most 14 days |
| Two-factor authentication, if you switch it on: the encrypted app secret and hashes of the recovery codes | Account protection | Performance of a contract | For as long as the authentication is switched on |
| Security events of the account: sign-ins and failed sign-in attempts, a temporary block after them, switching two-factor authentication on and off, a changed password and e-mail address, connecting and disconnecting a sign-in method; for each event the device and an approximate place determined from the IP address, which is not stored | An overview for you in the account settings, account protection, handling support requests, detecting misuse (for example repeated wrong passwords) | Legitimate interest in the security of accounts and of the service (Article 6(1)(f) GDPR) | 90 days |
| Billing details of the organization, the result of the VAT ID check in the VIES system, invoices, payment requests and payments (also after the organization is deleted, with its name) | Invoicing and bookkeeping | Compliance with a legal obligation (Article 6(1)(c) GDPR) under Slovak Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax | 10 years from the end of the calendar year to which they relate |
| Transfer payments from the Fio banka statement (only payments with a variable symbol of the service): date, amount, variable symbol, name and account number of the payer, message for the payee | Matching payments and activating the plan | Performance of a contract; compliance with a legal obligation (bookkeeping) | 10 years from the end of the calendar year of the payment |
| Record of changes in the organization and in the account (who changed what and when — for changes made by the customer without the IP address), including changes made by our support | Security and tracing of changes | Legitimate interest in security and in the traceability of changes | Changes made by the customer in the organization for as long as it exists; changes made by support and changes of the account outside an organization 2 years; after the account is deleted only the account number remains in the record instead of the e-mail address |
| Consent to support looking into the dashboards and the record of the accesses: who gave or withdrew the consent, its scope and duration, the support employee, the reason, the time and the pages viewed | Access of support to the customer's data only with the customer's consent or in an emergency, and its control (clause 9.4 of the Terms, clause 7.3 of the Data processing agreement) | Performance of a contract; legitimate interest in the traceability of access to data | Consents and the overview of accesses for as long as the organization exists; the record of the pages viewed 2 years |
| Request to grant the owner role to another member of the organization: the requester, the document proving the authority to act on behalf of the customer (for example an extract from the commercial register) and the objections of the owners | Restoring the management of the organization (clause 4.6 of the Terms) | Legitimate interest of the customer and ours in restoring the management of the organization and in proving it | 2 years |
| Hash of the IP address and of the e-mail address on attempts to sign in, sign up and reset the password | Protection against misuse and password guessing | Legitimate interest in the security of the service | At most 1 day |
| Links for verifying the e-mail address, for confirming a new e-mail address and for a new password (stored only as a hash) and the new e-mail address until it is confirmed | Verifying ownership of the e-mail address; when the address is changed, a notice to the previous address | Performance of a contract; legitimate interest in the security of accounts (the notice) | 48 hours or 1 hour respectively |
| Messages in the service's inbox, including notices of changes of the terms (with the time of delivery and of reading) | Support, plan requests, notices about the service and about changes of the terms | Performance of a contract; legitimate interest in communicating with customers and in proving the delivery of notices | For as long as the account exists; they are erased when the account is deleted |
| Communication by e-mail with our support | Support and handling requests | Performance of a contract; legitimate interest in communicating with customers | During the cooperation and 4 years after it ends (limitation period under Section 397 of the Slovak Commercial Code) |
| Internal notes of support about your account or organization (for example an arrangement made in a phone call) | Continuity and quality of customer support | Legitimate interest in proper customer care | For as long as the account or the organization exists |
| Record of sent e-mails: the recipient's address, the kind and subject of the e-mail, the language, the delivery result and the mail server's message | Proving and resolving the delivery of e-mails (for example an invitation that did not arrive) | Legitimate interest in reliable delivery of e-mails and in proving the delivery of notices | 90 days |
| Addresses the mail server refused as non-existent or whose holder told us not to write to them | Protecting the deliverability of e-mails; to such an address we send only messages you have just asked for (for example a new password) and notices concerning the contract | Legitimate interest in reliable delivery of e-mails | Until removed from the list or until the account is deleted, at most 2 years |
| Consent to receive news and offers by e-mail, if you give it: the e-mail address, the time and way it was given, the wording of the consent, the time and way it was withdrawn | Sending news and offers of the Visitics service by e-mail; proving the consent | Consent (Article 6(1)(a) GDPR and Section 116(3) of Slovak Act No. 452/2021 Coll. on Electronic Communications); the record of the consent: compliance with a legal obligation (Article 6(1)(c) GDPR and Section 116(5) of the same Act) | Offers until the consent is withdrawn (in the account settings, with the link in every offer or by deleting the account); the record of the consent 4 years from its withdrawal |
| Questions to the AI Analyst | Creating the answer in the dashboard | Performance of a contract | Not stored once the answer has been created; only the number of questions in the month is recorded (the plan's quota) |
| Replies of members to requests from the AI chatbot and to feedback with a contact: the text and the member's e-mail address as the address for the visitor's reply | Contact with the visitor on behalf of the customer | Performance of a contract | According to the retention period of the website's transcripts (30 to 365 days) |
| Requests to exercise rights under the GDPR and to switch provider: the requester, how their identity was verified, dates, deadlines and the outcome | Handling the request and proving that it was handled | Compliance with a legal obligation (Article 12 GDPR, Article 25 of Regulation (EU) 2023/2854); legitimate interest in demonstrating compliance (Article 5(2) GDPR) | 5 years from handling (the period within which a fine may be imposed for an infringement, Section 106(3) of Slovak Act No. 18/2018 Coll.) |
| Record of the deletion of an account or an organization: a hash (SHA-256) of the e-mail address or the name, the date, the reason, who asked for the deletion and the categories of erased data | Proving the erasure and answering whether data was erased | Legitimate interest in demonstrating compliance (Articles 5(2) and 17 GDPR) | 5 years (Section 106(3) of Slovak Act No. 18/2018 Coll.) |
3 Source of personal data
We obtain personal data directly from you. If a member of an organization invited you, that member provided your e-mail address to us. If you sign in or sign up with Google or Facebook, Google Ireland Limited or Meta Platforms Ireland Limited, respectively, provides us at your request with the identifier, the name and the e-mail address (Google also with whether it verified the address); we do not store other profile data (for example the profile picture). We obtain payment data from the statement of our account at Fio banka and the result of the VAT ID check from the European Commission's VIES system. Notes of support arise from our communication with you. When verifying a request to grant the owner role, we may use data from public registers (for example the commercial register).
4 Obligation to provide personal data
Providing the data needed to set up an account is a contractual requirement; without it the service cannot be provided. Signing in with Google or Facebook is voluntary; you can use your account with an e-mail address and a password only. Providing billing details when ordering a paid plan is a statutory requirement; without them no invoice can be issued.
5 Recipients
Personal data is processed on our behalf by processors — providers of server hosting and of the e-mail service with their seat and data centres in the European Union.
We operate the artificial intelligence features (the AI chatbot, the AI Analyst, the weekly AI summary, the topics and draft replies of Feedback) on our own server in the European Union; we do not send questions, conversations or statistics to any external provider of artificial intelligence models. We verify the VAT ID of a customer from another member state in the European Commission's VIES system (only the VAT ID is sent). We receive payments to an account at Fio banka, a. s., a branch of a foreign bank; the service downloads the list of payments through the bank's read-only interface. We disclose data to other recipients only where required by law (for example to public authorities).
If you choose to sign in with Google or Facebook, we redirect your browser to the page of Google Ireland Limited or Meta Platforms Ireland Limited, respectively. These companies process the data about your sign-in (for example that you are signing in to Visitics) as independent controllers under their own policies (Google, Meta). When the sign-in is completed, our server gives them only the one-time code or the access token their service issued to us and the credentials of our application; we do not send them any other personal data of yours. The sign-in and sign-up pages load no content from these companies — your browser gives them data only after you click the button.
6 Transfers to third countries
Personal data is processed exclusively in the European Union and is not transferred to third countries or international organisations. This does not concern the processing that Google and Meta carry out as independent controllers when you sign in with them (Section 5); their policies describe it, including any transfer to third countries.
7 Automated decision-making
We do not carry out automated individual decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). The answers of the AI Analyst serve only as information for you. Indications of possible misuse of the service (for example repeated wrong passwords or an unusual rise in traffic) are always assessed by a support employee; only a temporary limit on sign-in attempts applies automatically.
8 Cookies and browser storage
The public pages of the service use no cookies. On the sign-in, sign-up and password reset pages and after signing in to the dashboard one strictly necessary session cookie __Host-visitics_s is used; it protects the forms against forged requests, lets a sign-in with Google or Facebook be completed securely and keeps you signed in. It expires when the browser is closed, on sign-out or after 12 hours of inactivity. After a sign-in a strictly necessary security cookie __Host-visitics_d marks the browser for 180 days as one that has signed in to the account before (a random identifier and a signature, no name or e-mail address), so that failed sign-in attempts of others cannot lock you out of your account in this browser; it stays after sign-out and you can delete it in your browser. For a password-protected shared dashboard a strictly necessary cookie __Secure-vts_… is stored after the password is entered, valid only for the address of that link. The choice of light or dark mode is stored only in your browser (localStorage) and is not sent to us. This storage is strictly necessary to provide the service you have requested (Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications). We may measure the traffic of the public pages with the Visitics service itself — without cookies and without storing the IP address.
9 Your rights
You have the right of access to your personal data (Article 15 GDPR), to its rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), portability (Article 20) and the right to object to processing based on legitimate interest (Article 21(1)). You may object to processing for direct marketing purposes at any time (Article 21(2)). You can withdraw the consent to receive news and offers at any time in the account settings or with the link in every offer; the withdrawal does not affect the lawfulness of processing before it (Article 7(3)).
You can download a copy of the personal data of your account in the account settings (a JSON file); we provide other data on request. You can delete your account yourself in the account settings; if you are the only owner of an organization with other members, first grant the owner role to another member. An organization can be deleted by its owner; it is erased after 7 days, during which the owner can restore it. Please send other requests to info@esentra.sk. We handle a request without undue delay and at the latest within one month; taking into account the complexity and number of requests we may extend this period by two further months, of which we inform you within the first month (Article 12(3) GDPR). If you consider that the processing infringes the GDPR, you have the right to file a petition to initiate proceedings under Section 100 of Slovak Act No. 18/2018 Coll. on Personal Data Protection with the Office for Personal Data Protection of the Slovak Republic, Galvaniho 7/B, 821 04 Bratislava, or to lodge a complaint with another supervisory authority in the member state of your habitual residence.
10 Visitors of our customers' websites
If you visit a website that uses the Visitics service, or write to its AI chatbot, the controller of your personal data is the operator of that website. We process the data only on its behalf as a processor under a data processing agreement. The measurement uses no cookies and stores neither the IP address nor the browser identifier; visits are counted with a fingerprint that changes every day, and raw records are deleted after 30 days. The AI chatbot introduces itself as artificial intelligence, runs on our server in the European Union, automatically masks e-mail addresses and telephone numbers in messages, and its transcripts are kept for the period set by the operator of the website (30 to 365 days) and are not used to train artificial intelligence models. The conversation is kept in the browser only after the chat has been opened, and only until the tab is closed. If you answer a survey, the answer is stored with the context of the visit (page, device, country) without a lasting identifier; e-mail addresses and telephone numbers in the text are masked and a contact is stored only with your consent. Please address requests to exercise your rights to the operator of the website; if you send them to us, we forward them to the operator without undue delay.
11 Changes
We update this notice whenever the processing changes; the current version is always published on this page together with its version number.