Privacy Policy
This policy explains how Sunalytiq s.r.o. processes the personal data of website visitors, prospective clients, clients and their staff, client portal users, and contact persons at suppliers and service partners. Processing is governed by Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the processing of personal data.
1. Data controller
1.1 The controller of personal data is Sunalytiq s.r.o., Company ID 29725771, with its registered office at Děčínská 552/1, Střížkov, 180 00 Prague 8, entered in the commercial register kept by the Municipal Court in Prague.
1.2 Please direct any questions about personal data protection to info@sunalytiq.com or in writing to our registered office. We have not appointed a data protection officer, as we are not required to do so under the GDPR.
1.3 Our services are intended for businesses and legal entities. We therefore mostly process personal data about natural persons who act on behalf of, or communicate with us as, clients, prospective clients and suppliers.
2. What data we process
2.1 Contact form and email
First name and surname, company name, email address, phone number, the topic of your enquiry, any additional details you choose to give us (for example the plant location, your role or an invoice number) and the content of your message. A message from the form is delivered to us by email.
2.2 Protecting the form against spam
When you submit the form, on our own server and without third-party services, we evaluate technical signals that distinguish a person from a bot: how long the form took to fill in, a hidden verification field, the number of links in the text and the number of submissions from one IP address per hour. For this purpose we also process the IP address and the time of submission for a short period.
2.3 Clients and their staff
First name, surname, job title, company, work email and phone number of contact persons; for self-employed individuals, also identification and invoicing details; and further contracts, orders, invoices, payments and communication about services, service cases, warranty claims and insurance claims.
2.4 Client portal users
Name, email address, a password stored only as a cryptographic hash, two-factor authentication data and account settings. If you sign in with a Google account, we receive the account identifier, name and email address from Google. We also keep records of logins and security events, for example the time, IP address, browser type and unsuccessful login attempts.
2.5 Power plant data
Data from inverters and dataloggers, data on output and equipment status, satellite weather data, measurement results including thermography, and the findings and forecasts derived from them. This data is generally not personal data. It may be personal data if the plant is operated by a natural person or if the source material or images capture identifiable persons. In that case we protect it in the same way as other personal data and generally process it for the client under section 4.
2.6 Service partners and suppliers
Contact details of staff at service, inspection and other companies with which we coordinate on-site work and measurements, and the data needed to order and document the work carried out.
2.7 Visiting the website
Technical data recorded automatically by the server: IP address, browser type, the page requested, the referring page and the time of access.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and negotiating cooperation | Steps taken prior to entering into a contract, Art. 6(1)(b) GDPR. For company contact persons and for enquiries with no commercial intent, legitimate interest, point (f). |
| Entering into and performing contracts, communicating with the client's contact persons | Performance of a contract, Art. 6(1)(b) GDPR; for the client's staff and representatives, legitimate interest in the proper performance of the contract, point (f) |
| Operating the client portal, managing accounts, login and two-factor authentication | Performance of a contract and legitimate interest in securing access, Art. 6(1)(b) and (f) GDPR |
| Monitoring, analyses and reports in the Parhelion software, where they contain personal data | Performance of a contract, Art. 6(1)(b) GDPR, or processing for the client under section 4 |
| Coordinating service work, measurements, warranty claims and insurance claims | Performance of the contract with the client; for third-party contacts, legitimate interest; Art. 6(1)(b) and (f) GDPR |
| Invoicing, accounting and taxes | Legal obligation, Art. 6(1)(c) GDPR |
| Protecting the form, the website and the portal against spam, misuse and attacks | Legitimate interest, Art. 6(1)(f) GDPR |
| Establishing, exercising and defending legal claims | Legitimate interest, Art. 6(1)(f) GDPR |
| Anonymising data to improve models and software | Legitimate interest, Art. 6(1)(f) GDPR; thereafter we work only with anonymised or aggregated data |
| News about our services for existing clients | Legitimate interest under Section 7(3) of Czech Act No. 480/2004 Coll.; every message can be declined with one click |
3.1 Providing your details in the form is voluntary, but without contact details we cannot reply to you. The data needed to enter into and perform a contract and to sign in to the portal is necessary; without it we cannot provide the service.
3.2 We carry out processing based on legitimate interest only where your interests and rights do not override ours. You may object to such processing under section 11.
4. Data we process for clients
4.1 Where, in providing our services, we process personal data for which the client is responsible, for example data about a plant operator who is a natural person, or persons captured in source material and images from measurements, we act as a processor under Art. 28 GDPR.
4.2 We process this data only on the client's instructions and under the conditions agreed in the contract and in the data processing clause of the terms. In such a case, please direct questions and requests primarily to the client as the controller; if you contact us, we will pass your request on to them.
5. Recipients and processors
5.1 Personal data may be received by:
- the provider of web hosting, database and email services (Active24), with servers in the European Union, which processes the data as our processor under a contract pursuant to Art. 28 GDPR;
- accounting, tax and legal advisers who are bound by confidentiality, and the bank when processing payments;
- service and inspection companies, partners carrying out thermographic measurements, manufacturers, suppliers and insurers, only to the extent needed for a specific job or claim and only with the client's consent or on the client's instruction;
- Google, if you sign in to the portal with a Google account; in that case Google acts as an independent controller under its own privacy policy;
- public authorities, where the law requires us to.
5.2 Our processors may use data only in accordance with our instructions and are bound by the same personal data protection obligations as we are. We will send you a current list of processors on request.
5.3 We do not sell personal data or pass it to third parties for their marketing.
6. Transfers outside the EU
6.1 We store and process personal data on servers in the European Union. We do not transfer data to countries outside the European Economic Area and do not plan to.
6.2 If such a transfer were to take place in the future, it would happen only where the conditions of Chapter V GDPR are met, that is, on the basis of a European Commission adequacy decision or standard contractual clauses, and we would update this policy beforehand.
6.3 When you sign in with a Google account, Google processes data under its own terms, possibly also outside the European Union.
7. How long we keep data
| Data | Retention period |
|---|---|
| Enquiries that do not lead to cooperation | Up to 12 months from the last communication |
| Client data, contracts and communication | For the term of the contract and thereafter for as long as necessary to protect legal claims, usually 3 years; if a dispute is ongoing, until it is resolved |
| Client portal accounts | For the term of the contract or account; afterwards we delete or anonymise the account |
| Records of logins and security events | Up to 12 months |
| Anti-spam signals | Up to 30 days; in the browser, no more than one hour |
| Accounting and tax records | For the period set by Czech Act No. 563/1991 Coll., on accounting, and by tax regulations |
| Technical server logs | Only for as long as strictly necessary, usually a matter of weeks |
| Personal data processed for clients | As set out in the contract with the client, at the latest until it is returned or deleted after the contract ends |
7.1 Deleted data may remain in backups for a limited time until it is overwritten in the normal cycle. We do not use it from backups for any other purpose.
8. Security
8.1 We protect personal data with technical and organisational measures appropriate to the risks of processing. The website and the client portal communicate in encrypted form over HTTPS. We store passwords only as cryptographic hashes, the portal supports two-factor authentication, we limit repeated unsuccessful login attempts, and we log and evaluate suspicious events.
8.2 Only authorised persons have access to the data, to the extent they need it for their work, and they are bound by confidentiality. We use access permission management, activity logs and regular backups. The servers are located in the European Union.
8.3 If a security breach occurs that could put your rights at risk, we will report it to the Office for Personal Data Protection (ÚOOÚ) within 72 hours and, where the risk is high, to you as well.
9. Automated decision-making
9.1 We do not carry out automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR, and we do not create profiles for marketing.
9.2 The Parhelion software automatically evaluates technical data from power plants. These evaluations concern equipment, not the assessment of people. Automatic security measures, for example a temporary block on login after repeated unsuccessful attempts or the rejection of a message assessed as spam, are temporary; if they affect you, write to us and a person will review the situation.
11. Your rights
11.1 Under the GDPR you have the right to:
- access your personal data and obtain a copy of it (Art. 15);
- have inaccurate data rectified and incomplete data completed (Art. 16);
- erasure, where we no longer need the data or there is no legal basis for processing it (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you have provided to us and which we process by automated means on the basis of a contract (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent, if we were to base any processing on consent; withdrawal does not affect processing carried out before it.
11.2 You can exercise your rights by email at info@sunalytiq.com. We will respond without undue delay and no later than within one month; in complex cases we may extend this period under the GDPR by a further two months, and we will let you know.
11.3 To avoid disclosing data to the wrong person, we may ask you to verify your identity. We handle requests free of charge; for manifestly unfounded or repetitive requests, we may charge a reasonable fee or refuse to act on the request.
11.4 If you believe that we are processing your data in breach of legal regulations, you can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.
12. Children
12.1 Our services are intended for businesses and are not intended for persons under 16. We do not knowingly process their data; if we find that we have obtained it, we will delete it.
13. Changes to this policy
13.1 We may update this policy, for example when we add a new service or change a processor. The current version is always available on this page. We inform clients of material changes by email or in the client portal.
13.2 This version 3.0 applies from 18 October 2026 and replaces version 2.0, effective from 1 October 2026. We will send you the previous version on request.