Privacy Policy

This Privacy Policy (the “Policy”) provides information on how Sloneek Europe s.r.o. collects, processes, protects, and stores your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR) and related legislation. It applies to all users of the website www.sloneek.com (the “Website”).

Contents

1. Information About the Data Controller

2. What Personal Data We Process

3. Purposes of Personal Data Processing and Their Legal Bases

4. Retention Period for Personal Data

5. To Whom We Disclose Personal Data

6. Rights of Data Subjects regarding the processing of Personal Data

7. Transfer of Personal Data to Third Countries

8. How to Contact Us and How to Exercise Your Rights

The data controller — that is, the entity responsible for protecting your personal data — is:

Sloneek Europe s.r.o., with its registered office at Táborská 8, 040 01 Košice – Juh District

Company ID No.: 53 319 737

registered in the Commercial Register of the Municipal Court in Košice, Section Sro, File No. 49934/V

(Company)

The Company has appointed a Data Protection Officer (DPO) in accordance with Article 37 of the GDPR. The DPO can be contacted at jan.verespej@sloneek.com regarding any matters relating to the processing of your personal data.

The Company operates the online platform – the website – through which it provides software services in the areas of human resources management, time and attendance, scheduling, and the management of labor-law documentation. As part of providing these services, we process the following categories of personal data:

When creating a user account, including a user account created for a trial period, on our platforms, we collect the following required data:

When our customers (employers) use our services, we process the following data regarding their employees:

When a Customer (employer) enters into an agreement with us to use our services, we process the personal data of the individual who concludes the agreement on the Customer’s behalf or is otherwise authorised to represent the Customer in connection with the agreement (e.g., a statutory representative or an authorised contact person). This includes:

We process this data in order to conclude, administer and perform the agreement with the Customer, including invoicing and ongoing account management.

When you browse or interact with our Website, we may automatically collect certain technical, device and usage information, including:

We use cookies and similar technologies to collect some of this information. Depending on the technology and your choices, these may be used to operate the Website, analyse its use, measure the effectiveness of our marketing activities and provide or measure personalised advertising. For more information about the cookies and similar technologies we use and how you can manage your preferences, please see Section 8 of this Policy.

If you contact us — in writing, by email, by phone, via online chat, or by any other means — we will retain the content of that communication along with the contact information you provided to us.

To improve our services, we may contact you at the contact information you provided, including to send you satisfaction surveys.

If you are a registered user or have given us your consent, we may process your contact information to send you marketing messages, including newsletters, text messages, and display ads. The terms and options for unsubscribing are described in detail at Section 3.

We always process your personal data based on one of the following legal bases:

3.1 Performance of a contract (Article 6(1)(b) of the GDPR)

On this legal basis, we process the personal data necessary to provide our services, in particular:

3.2 Legal obligation (Article 6(1)© of the GDPR)

We process personal data on this legal basis when required to do so by law, in particular:

3.3 Legitimate interest (Article 6(1)(f) of the GDPR)

We process personal data on this legal basis when it is necessary to protect our legitimate interests and these interests do not override your rights and freedoms, in particular:

You may object at any time to the processing of your personal data based on a legitimate interest. For more information about this right, including how to exercise it, please see Section 6 of this Policy (Rights of Data Subjects).

3.4 Consent (Article 6(1)(a) of the GDPR)

We process personal data on this legal basis only if you have given us your explicit consent, in particular:

You may withdraw your consent to marketing communications at any time by contacting support of Sloneek.

Information about cookies and your options for managing them, including how to grant or withdraw consent, can be found in a section 8.

We retain personal data only for as long as is strictly necessary to achieve the purposes for which it was collected, or for as long as required by applicable laws. Upon expiration of this period, the data is promptly deleted or anonymized.

We retain data associated with your account (email, password, profile information, login history) for the entire duration of your account’s existence. After your account is closed — whether at your request or due to prolonged inactivity — we retain the necessary identification data for an additional 30 for the purpose of potentially asserting or defending legal claims (legitimate interest pursuant to Article 6(1)(f) of the GDPR).

If the customer does not upgrade to a paid version after the trial period ends, we delete their personal data within 30 days of the end of the trial period.

We retain records of communications with customer support (emails, messages, complaint records) for 5 years after the request has been resolved, in case we need to prove or defend legal claims.

We process contact information for the purpose of marketing communications (newsletters, SMS) based on your consent or our legitimate interest (for existing customers). We retain this data for 5 years from the date of consent or the date of your last purchase, or until consent is withdrawn or an objection is successfully raised — whichever occurs first.

We retain technical records of platform usage (IP addresses, login and logout records, security logs) for a period of 5 years

The current list of specific cookies, including their exact retention periods, is provided in section 8.

We share your personal data only with partners who guarantee adequate protection of personal data.

We work with payment gateway providers to process card payments and bank transfers. Payment transactions take place exclusively in the secure environment of the relevant bank or payment gateway.

To operate and secure our platform (website, databases), we primarily use the services of IT service providers, cloud infrastructure providers, and hosting providers. These intermediaries have access to personal data only to the extent necessary to ensure technical operations.

We use an external provider of email and SMS communication to send bulk messages, important operational and system notifications, and any marketing messages. This provider processes the recipient’s email address and phone number solely for the purpose of delivering the message.

To measure traffic, analyze user behavior, and target marketing campaigns, we collaborate with providers of analytics tools, advertising platforms, and marketing agencies.

To track technical errors and ensure the stability and security of the Website, we use third-party tools that process technical data (e.g., error logs, IP addresses) necessary for diagnosing and resolving issues.

If we use an external help desk or CRM system to manage customer requests and communicate with customers, that provider has access to the data you provided to us as part of your communication with customer support.

To provide AI features as part of the services we offer (e.g., intelligent analysis of HR data), we use an artificial intelligence technology provider that processes the submitted data solely for the purpose of providing this functionality.

You have the following rights under the GDPR with respect to your personal data. Some rights may not apply in your specific situation — this depends on the legal basis and purpose of the processing. A description of the procedure for exercising your rights and contact information can be found in Section 9.

You have the right to obtain confirmation from us as to whether we are processing your personal data, and if so, you have the right to access that data and to receive information about the purposes, categories, recipients, retention periods, and your rights. Upon your request, we will provide you with a copy of the personal data we process. You can find most of this information directly in your user account.

You have the right to request that we correct, without undue delay, any inaccurate or incomplete personal data we hold about you. You can correct basic information such as your name, email address, or preferences directly in your user account settings.

You have the right to request that we erase your personal data, for example, if the data is no longer necessary for the purpose for which it was collected, if you have withdrawn your consent and there is no other legal basis for processing, or if you have successfully objected to the processing. Submit your request by contacting us (Section 8); simply deleting your account may not result in the erasure of all your data, as we are required by law to retain certain data for a longer period.

You have the right to ask us to restrict the processing of your data, for example, if you dispute the accuracy of the data we have on file — in which case we will restrict processing while we verify its accuracy. You may also request restriction if the processing is unlawful and you request restriction instead of erasure, or if we no longer need the data but you need it to assert legal claims. We will inform you of the start and end of the restriction.

You have the right to receive the personal data you have provided to us and that we process by automated means on the basis of a contract or consent (e.g., data from your user profile or order history) in a structured, commonly used, and machine-readable format. You also have the right to request that we transfer this data directly to another controller, if technically feasible.

You have the right to object at any time to the processing of your personal data that we carry out based on our legitimate interest (Article 6(1)(f) of the GDPR). In such a case, we may continue processing only if we demonstrate compelling legitimate grounds that override your interests or rights, or if the data is necessary for the establishment, exercise, or defense of legal claims.

In particular, if we process your data for direct marketing purposes (e.g., newsletters, SMS messages), you have the right to object at any time and without providing a reason — in which case we will immediately cease processing your data for these purposes.

If we process your data based on your consent (e.g., marketing communications, analytical or advertising cookies), you may withdraw this consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out prior to its withdrawal. You can withdraw your consent to marketing by unsubscribing from messages or in your account settings; you can change your consent to cookies in the cookie settings on the website.

We process your personal data primarily within the European Union and the European Economic Area. We do not actively transfer your personal data to third countries outside the EU/EEA. However, some of our partners with whom we collaborate in processing personal data may also process your data on servers located in the United States of America (USA). The EU – US Data Privacy Framework is a certification framework approved by the European Commission that ensures that certified providers in the U.S. provide an adequate level of protection for personal data within the meaning of the GDPR. In cases where the transfer is not covered by DPF certification, we will ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Article 46(2)© of the GDPR.

8.1 We use cookies and similar technologies on our websites, the Sloneek Service, and, where applicable, in our electronic communications and online advertising.

8.2 These technologies may include cookies, pixels, tags, web beacons, local storage, software development kits and other similar technologies that store or access information on a user’s device or enable us and our partners to recognise a browser or device.

8.3 We may use these technologies for the following purposes:

8.4 Preference and functionality technologies

8.5 Analytics and performance technologies – These technologies help us understand how our websites and Services are used, measure traffic and engagement, identify technical issues and improve performance, content and user experience.

8.6 Marketing and advertising technologies

8.7 Some of these technologies may be provided by third parties acting on our behalf or, where applicable, for their own purposes in accordance with their respective privacy terms.

8.8 Where required by applicable law, we use non-essential cookies and similar technologies only after obtaining the user’s consent. Users may accept, reject or customise non-essential technologies and may change or withdraw their choices at any time through the cookie settings available on our website.

8.9 More detailed and up-to-date information about the technologies we currently use, including their providers, purposes, categories and retention periods, is available in our cookie settings or cookie list.

8.10 The technologies used in the authenticated Sloneek Service may differ from those used on our public websites, as certain technologies are required for account authentication, security, session management and provision of the Service.

If you have any questions regarding the processing of your personal data, wish to verify what data we hold about you, or wish to exercise any of your rights listed in Section 6, please contact us using the following contact information:

To help us process your request as quickly as possible, please include your name, the email address associated with your account, and the right you are exercising (e.g., access to data, deletion, correction). We will respond to your request without undue delay, but no later than one month after receiving it. In justified cases (due to the complexity or number of requests), we may extend this period by an additional two months.

If you are not satisfied with how we have handled your request, or if you believe that we are processing your personal data in violation of applicable regulations, you have the right to file a complaint with the supervisory authority — the Office for Personal Data Protection of the Slovak Republic, whose contact information can be found at www.dataprotection.gov.sk.

The Privacy Policy is effective as of 25.9.2026.

Sloneek Europe s.r.o.