1Controller
The controller of the personal data we process when operating the ZVYQ website and service is:
- Business name
- MN DEVELOPMENT s.r.o.
- Registered office
- Bratislavská 7, 040 11 Košice
- Company ID (IČO)
- 51 403 234
- Tax ID (DIČ)
- 2120705983
- VAT ID (IČ DPH)
- SK2120705983
- Registration
- zapísaná v Obchodnom registri Mestského súdu Košice, oddiel: Sro, vložka č. 43321/V
- zvyq@easytrade.sk
- Website
- Easytrade.sk
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, the “GDPR”) and Slovak Act No. 18/2018 Coll. on the Protection of Personal Data. For any questions concerning the protection of personal data, please write to us at zvyq@easytrade.sk.
2Who this policy applies to
This policy describes how we process the personal data of:
- visitors to the ZVYQ website,
- persons who register an account in the ZVYQ app, and colleagues and guests invited to the account by the customer,
- representatives and contact persons of customers and persons who contact us.
Patient and dentist data in orders
Data that a laboratory enters into the app, such as the patient’s name, the type of dental work or details of dentists and practices, is processed by the laboratory as the controller. The same applies to the order tracking link that the laboratory may send to a patient – the page behind the link shows only the order status, the expected due date and the laboratory’s contact details, not the patient’s name or prices. We process this data only as a processor, on the laboratory’s instructions and under the conditions set out in Article 8 of the General Terms and Conditions. If this data concerns you, please contact the laboratory. Any request on this matter that we receive will be forwarded to the laboratory without undue delay.
3Purposes, data and legal bases
We process only the data necessary for the given purpose.
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Registration and account management | name, e-mail address, password (we store only its hash), company name | performance of a contract – Art. 6(1)(b) GDPR; if you create the account as a representative or employee of a company, legitimate interest in concluding and performing the contract with that company – point (f) | for the lifetime of the account; deleted within 60 days of its cancellation |
| Provision of the service | name, e-mail address and role of users in the account, account settings | Art. 6(1)(b) GDPR; for the customer’s users, legitimate interest in performing the contract with the customer – point (f) | for the lifetime of the account |
| E-mail verification, sign-in and account security | e-mail address, verification link, one-time sign-in code for two-factor sign-in, password reset link | Art. 6(1)(b) GDPR; legitimate interest in protecting the account against misuse – point (f) | verification link 48 hours, sign-in code 10 minutes, password reset link 60 minutes |
| Invitations of colleagues and guests | name and e-mail address of the invited person, role, and for a guest, where applicable, the dentist whose orders they may view | legitimate interest of the customer and of us in collaboration within the account – Art. 6(1)(f) GDPR | for the duration of access, at most for the lifetime of the account |
| Invoicing and accounting | business name, registered office, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH), name, e-mail address and telephone number of the contact person, selected plan and period, payment details (amount, date, payment method, variable symbol, masked card number for card payments), invoice number and content | compliance with a legal obligation – Art. 6(1)(c) GDPR, Slovak Act No. 431/2002 Coll. on Accounting | 10 years following the year to which the document relates |
| Communication, support and contact form | name, e-mail address, message content and attachments, and where applicable the laboratory name, its plan and subscription status; for the contact form on the website, also the IP address and time of submission (protection against spam and misuse). Artificial intelligence may assist us with support replies (see below). | Art. 6(1)(b) GDPR if the message relates to the contract or its conclusion; otherwise legitimate interest in answering enquiries – point (f) | 3 years from the last message; copies of e-mails in the customer support tool 12 months from the last message |
| Website traffic measurement | page path, referring domain, UTM parameters, device type, pseudonymous daily identifier (Article 4) | consent – Art. 6(1)(a) GDPR and Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications | 400 days |
| Security, usage overview and service improvement | date and time of the last sign-in, days and approximate time spent working in the app, which parts of the app the user opened (for example orders, CAD import, settings) and when they last did so; from the company’s data, also which setup steps it has already completed. We determine this on the server from the app’s requests, without cookies and without storing anything on the device. | legitimate interest in protecting accounts, improving the service and being able to help customers when they are unsure how to use the app – Art. 6(1)(f) GDPR; performance of a contract – point (b). You may object to this processing (Article 10). | for the lifetime of the account |
| Operation, security and troubleshooting | technical server and application records (logs): IP address, time and address of the request, browser identification and, in the event of an error, also the identifier and e-mail address of the signed-in user and of the company; the error report is sent by e-mail to the system administrator | legitimate interest in the secure and functional operation of the service – Art. 6(1)(f) GDPR | no more than 6 weeks |
Your name, e-mail address, password and company name are required to conclude the contract. Without them, we cannot create an account. Consent to traffic measurement is voluntary; if you do not give it, the website and the app work without restrictions.
The data of invited colleagues and guests is provided to us by the customer who invited them to the account. You may object at any time to processing based on legitimate interest (Article 10).
4Traffic measurement
We measure website traffic with our own tool on our server. We do not use third-party analytics tools, and the measurement does not store cookies or any other data in your browser.
Anonymous visit count. Each time a page of the website is displayed, the server adds one visit to a daily total by page, source (the domain of the link you came from, or the utm_source parameter) and device type (computer, tablet, mobile) determined from the browser identification. Only this total is stored – without the IP address, a visitor identifier or anything else that would make it possible to distinguish individual persons. These are anonymous statistical data, so no consent is required.
Registration source. If you come to the website via a link from one of our campaigns (for example from an e-mail or a post, where the link contains the utm_source, utm_medium or utm_campaign parameters), the website passes these parameters on in the links to further pages up to registration – nothing is stored in your browser in the process. If you register, we store the campaign label with your company’s account so that we know which campaign brought in the registration (legitimate interest, Art. 6(1)(f) GDPR). It is kept for the lifetime of the account.
More detailed measurement with consent. If you allow measurement, we additionally record the data described below, which enables us to distinguish individual visitors within a day.
Measurement starts only after you select “Allow measurement” in the bar on the website. You can withdraw your consent at any time via the “Cookie settings” link in the page footer. Withdrawal does not affect the lawfulness of measurement before the withdrawal.
When a page is displayed, we record:
- the path of the page visited, for example
/en/invoicing, - the domain of the page you came from,
- the UTM parameters from the link you came through (for example source or campaign),
- the device type determined by screen width,
- a pseudonymous identifier.
The identifier is created as a hash (a one-way fingerprint) of the IP address, browser identification (user agent), date and a secret key that changes every day. We do not store the IP address itself. The identifier distinguishes visits within a single day; on another day, we can no longer recognise you.
We keep the records for 400 days and use them for website traffic statistics.
5Recipients of data
We disclose personal data only to the following recipients:
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – hosting and backup provider. It operates servers in data centres in the European Union (Germany and Finland) on which the website, the app and our mail server run and on which the data and its encrypted backups are stored. It is our processor under Art. 28 GDPR.
- E-mails from the website and the app (e-mail verification, sign-in codes, password reset, invitations, invoices and subscription messages) are sent from our own mail server operated at Hetzner Online GmbH. The e-mail is then delivered by the recipient’s mailbox provider.
- Payments and invoices for the subscription are processed through our own Easytrade payment gateway (payment.easytrade.sk), and invoices are issued in our own EasyFaktúry invoicing system. When paying by card, you enter the card details directly on the website of Tatra banka, a. s. (TatraPay+ payment gateway), which processes them as an independent controller; we receive from the bank only the result of the payment and the masked card number. For payments by bank transfer (QR code), the payment is processed by your bank and our bank.
- EasyFaktúry – if a customer connects its account in the EasyFaktúry system (easyfaktury.sk) in the app, we send to it only the data that the customer selects for invoicing its own clients. Further processing is governed by the terms and privacy policy of the EasyFaktúry system.
- Anthropic (Claude language model) – for customer support e-mails received at info@zvyq.sk, our support tool may pass the text of the e-mail and the conversation history, the sender’s name and e-mail address and basic information about their account (laboratory name, plan and subscription status) to the artificial intelligence provider, which uses them to prepare a draft reply, a summary or a category. A draft is always reviewed and sent by a human; only a reply under a rule that we have approved in advance may be sent automatically, and only on the basis of the verified information contained in that rule. Anthropic is our processor under Art. 28 GDPR and, under its contractual terms, does not use this data to train models. We do not pass on to it the data that laboratories enter into the app (orders, patients).
- Public authorities – for example courts, law enforcement authorities or the tax administrator, where we are required by law to provide the data.
6Transfers outside the EU
We store the data and its backups on servers in the European Union (Germany and Finland). The only exception is the assistance of artificial intelligence with customer support e-mails (Article 5): in that case, Anthropic may also process the text of the e-mail and related data in the United States of America. The transfer is safeguarded by standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). We do not transfer the data that laboratories enter into the app outside the European Economic Area.
7Retention periods
We keep data only for as long as necessary for the purpose for which we obtained it:
| Data | Period |
|---|---|
| Account, user and guest data | for the lifetime of the account; after the account is cancelled, we delete it within 60 days, and it may remain in backups for a maximum of 6 months (Article 9) |
| Sign-in and activity records | for the lifetime of the account |
| E-mail verification link | valid for 48 hours |
| Sign-in code (two-factor sign-in) | valid for 10 minutes |
| Password reset link | valid for 60 minutes |
| Invoices and accounting documents | 10 years following the year to which they relate (Slovak Act No. 431/2002 Coll. on Accounting) |
| E-mail communication | 3 years from the last message |
| Copies of e-mails in the customer support tool (including attachments) | 12 months from the last message in the conversation; deleted from the support bin no later than after 30 days |
| Traffic measurement records | 400 days |
| Technical server and application records | no more than 6 weeks |
| Backups | daily 7 days, weekly 4 weeks, monthly 6 months (Article 9) |
If we need data to establish or defend legal claims, we keep it until the relevant proceedings have ended. After the retention period expires, we delete or anonymise the data.
8Security
Communication with the website and the app is encrypted (HTTPS). We store passwords only in hashed form and API keys for invoicing systems in encrypted form. Access to data in the account is restricted by user roles, you can protect your sign-in with two-factor sign-in, and we back up the data regularly (Article 9).
9Data backups
To protect against data loss, we create regular backups. Backups are created automatically once a day and kept for a maximum of 6 months (daily backups 7 days, weekly 4 weeks, monthly 6 months), after which they are deleted automatically.
The backups are encrypted and stored in data centres of Hetzner Online GmbH in the European Union (Germany and Finland). Only the system administrator has access to them, and they are used solely to restore the service in the event of a failure, an error or a security incident.
If you request the erasure of your data, we delete it from the active database without undue delay; it may remain in backups for a maximum of 6 months until they are automatically overwritten. During this time, it is not further processed or restored. Should it be necessary to restore the service from a backup, we will delete again the data whose erasure you requested.
10Your rights
With regard to the data we process as the controller, you have the following rights:
- Access Art. 15 GDPR
- To obtain confirmation as to whether we process your data, information about the processing and a copy of the data.
- Rectification Art. 16 GDPR
- To have inaccurate data corrected and incomplete data completed.
- Erasure Art. 17 GDPR
- To have data erased if we no longer need it, if you withdraw your consent or if we process it unlawfully. This does not apply to data we are required to keep by law.
- Restriction of processing Art. 18 GDPR
- For example, while the accuracy of the data is being verified or your objection is being assessed.
- Data portability Art. 20 GDPR
- To receive the data you have provided to us on the basis of a contract or consent in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
- Objection Art. 21 GDPR
- To object to processing based on legitimate interest. We will then no longer process the data unless we demonstrate compelling legitimate grounds.
- Withdrawal of consent Art. 7(3) GDPR
- You can withdraw your consent to traffic measurement at any time via “Cookie settings” in the website footer.
- Automated decision-making Art. 22 GDPR
- We do not make decisions based solely on automated processing, nor do we carry out profiling.
Please send your request to zvyq@easytrade.sk. We will handle it without undue delay and within one month at the latest. In complex cases, we may extend this period by a further two months, of which we will inform you in advance. If we have doubts about your identity, we may ask you to verify it. We also inform the recipients of the data of any rectification, erasure or restriction of processing (Art. 19 GDPR).
If you believe that our processing of your data infringes the law, you may lodge a petition to initiate proceedings (a complaint) with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk.
11Cookies and browser storage
The website and the app use only cookies and browser storage (localStorage) that are strictly necessary for them to function. Under Section 109(8) of Slovak Act No. 452/2021 Coll., we do not need your consent to use them. We do not use advertising or tracking cookies, and we load fonts from our own server, not from the Google Fonts service.
| Name | Type | Purpose | Expiry |
|---|---|---|---|
| Strictly necessary – no consent required | |||
zvyq-session | cookie | website session, security | 120 minutes or until the end of the session |
XSRF-TOKEN | cookie | protection against CSRF attacks (cross-site request forgery) | 120 minutes |
auth_token | localStorage | keeps you signed in to the app | until sign-out |
zvyq_consent | localStorage | remembers your choice in the cookie bar | 12 months |
| Optional – with consent | |||
| Traffic measurement | stores nothing in the browser | website traffic statistics (Article 4); starts only after you select “Allow measurement” | records on the server 400 days |
You can change your choice at any time via the “Cookie settings” link in the footer. You can also delete or block cookies and localStorage in your browser settings; however, without the strictly necessary cookies you will not be able to sign in to the app.
12Changes to this policy
We update this policy when the service, the way we process data or the law changes. The current version with its effective date is always available on this page. We inform registered users of material changes by e-mail.