Privacy policy
This policy explains how Sunalytiq s.r.o. processes the personal data of website visitors, prospective clients, clients, pilot programme participants, client portal users and suppliers' contact persons. Processing is governed by Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the processing of personal data.
1. Data controller
The controller of personal data is Sunalytiq s.r.o., company ID (IČO) 29725771, with its registered office at Děčínská 552/1, Střížkov, 180 00 Prague 8, entered in the Commercial Register maintained by the Municipal Court in Prague.
If you have any questions about data protection, contact us at info@sunalytiq.com. We have not appointed a data protection officer, as the GDPR does not require us to do so.
2. What data we process
Contact form and email
First name and surname, company name, email address, phone number, the topic of your enquiry, any additional details you choose to give us (for example the plant location, your role or an invoice number) and the content of your message.
Protecting the form against spam
When you submit the form, we evaluate technical signals that distinguish a person from a bot: how long the form took to fill in, a hidden verification field, the number of links in the text and the number of submissions per hour. Where Cloudflare Turnstile verification is in use, Cloudflare also processes your IP address and technical data about your browser for this purpose.
Services, pilot programme and client portal
Users' contact and login details, records of logins and activity in the portal, plant operating data (for example output and equipment status) and communication about service cases, warranty claims and insurance claims. Plant operating data are usually not personal data. They may be personal data if the plant is operated by a natural person.
Suppliers and third parties
Contact details of staff at service, inspection and other companies with which we coordinate on-site work, and the data needed to order that work and document that it has been carried out.
Visiting the website
Technical data recorded automatically by the server and the content delivery network: IP address, browser type, the page requested and the time of access.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and negotiating a business relationship | Steps taken prior to entering into a contract, Art. 6(1)(b) GDPR. For enquiries with no commercial intent, legitimate interest, point (f). |
| Providing our services, the pilot programme and the portal | Performance of a contract, Art. 6(1)(b) GDPR |
| Coordinating service work, warranty claims and insurance claims | Performance of the contract with the client; for third-party contacts, legitimate interest; Art. 6(1)(b) and (f) GDPR |
| Protecting the form and the website against spam and attacks | Legitimate interest, Art. 6(1)(f) GDPR |
| Complying with legal obligations, for example in accounting | Legal obligation, Art. 6(1)(c) GDPR |
| Securing the website and the portal; protecting legal claims | Legitimate interest, Art. 6(1)(f) GDPR |
| News about our services for existing clients | Legitimate interest under Section 7(3) of Czech Act No. 480/2004 Coll.; every message includes a one-click opt-out |
We do not use personal data for automated decision-making or profiling. Providing your details in the form is voluntary, but without contact details we cannot reply to you.
4. Data we process for clients
Where, in providing our services, we process personal data for which the client is responsible, for example data about a plant operator who is a natural person, we act as a processor under Art. 28 GDPR. We process such data only on the client's instructions and under the conditions agreed in the contract and in our terms of service. In such cases, please direct any questions to the client, as the controller, in the first instance.
5. How long we keep data
- Enquiries that do not lead to a business relationship: up to 12 months from the last communication.
- Data of clients and pilot programme participants: for the term of the contract and thereafter for as long as necessary to protect legal claims, for no more than 3 years.
- Records of logins and activity in the portal: up to 12 months.
- Anti-spam signals: up to 30 days; in the browser, no more than one hour.
- Accounting records: for the period set by Czech Act No. 563/1991 Coll., on accounting.
- Technical server logs: only for as long as strictly necessary, usually a matter of weeks.
6. Who we share data with
- Providers of hosting, content delivery network, email and IT services, who process the data under a contract pursuant to Art. 28 GDPR. These are, in particular, Cloudflare (hosting, form processing and spam protection) and Resend (sending emails from the form).
- Accounting and legal advisers who are bound by confidentiality.
- Service and inspection companies, manufacturers, suppliers and insurers, only to the extent needed for on-site work or a claim approved by the client.
- Public authorities, where the law requires us to.
We do not sell personal data.
7. Transfers outside the EU
We aim to process data within the European Union. If a provider processes data outside the European Economic Area, the transfer is based on a European Commission adequacy decision (such as the EU–US Data Privacy Framework) or on standard contractual clauses.
8. Security
The website and the client portal communicate over encrypted HTTPS connections. Only authorised persons have access to the data, to the extent they need it for their work, and they are bound by confidentiality. We use access control, backups and activity logs. If a security breach occurs that could put your rights at risk, we will report it to the Czech Office for Personal Data Protection within 72 hours and, where the risk is high, to you as well.
10. Your rights
You have the right to access your data and to have it rectified or erased, the right to restrict its processing and the right to data portability. You may also object to processing based on legitimate interest. Simply write to info@sunalytiq.com. We will reply without undue delay, and within one month at the latest.
To avoid disclosing data to the wrong person, we may ask you to verify your identity. We handle requests free of charge; for manifestly unfounded or repetitive requests, we may charge a reasonable fee or refuse to act on the request.
If you believe that we process data unlawfully, you may lodge a complaint with your national supervisory authority or with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
Our services are not intended for persons under 16, and we do not knowingly process their data.
11. Changes to this policy
We may update this policy, for example when we add a new service. The current version is always available on this page.