Privacy Policy (GDPR) | Terradron.sk

Privacy Policy

This privacy policy explains how we process personal data when providing our services within the company Terradron s.r.o., registered office: Kostiviarska cesta 4, Banská Bystrica 974 01, Company ID: 50 358 499, registered in the Commercial Register of the District Court Banská Bystrica, Section: Sro, Insert No. 30002/S (hereinafter the "controller" or "we"). Your point of contact for any questions regarding personal data protection or for receiving and handling data subject requests is the following contact details:

E-mail: matus@terradron.sk

Telephone number: +421 910 866 822

Postal address: Kostiviarska cesta 4, Banská Bystrica 974 01

This privacy policy serves primarily to fulfil our information obligations under Articles 13 and 14 of the GDPR towards the data subjects whose personal data we process. These are typically employees of our business partners, clients or suppliers. When processing personal data, we are governed primarily by the EU General Data Protection Regulation ("GDPR"), which also governs your rights as a data subject, by those provisions of Act No. 18/2018 Coll. on Personal Data Protection (hereinafter the "Personal Data Protection Act") that apply to us, as well as by other legislation. If you do not fully understand any information set out in this policy, please do not hesitate to contact us.

Why do we process personal data?

Processing personal data is necessary on our part mainly so that we can:

provide our services and products and, for this purpose, process the personal data of our clients, suppliers, business partners, employees and other persons;
manage our human resources effectively;
fulfil various legal and contractual obligations; and
protect our legitimate interests.

For what purposes and on what legal bases do we process personal data?

We process personal data for the following purposes on the following legal bases:

	Purpose of personal data processing	Legal basis
1.	Concluding contractual relationships and handling orders in connection with the provision of services such as aerial mapping, scanning, thermal imaging, etc.	Performance of a contract
2.	Establishing, exercising or defending legal claims (legal agenda)	Legitimate interest
3.	Data subject rights agenda	Compliance with legal obligations
4.	Operating profiles on social networks	Legitimate interest
5.	Accounting and tax purposes	Compliance with legal obligations
6.	Archiving purposes and records management	Art. 89 GDPR
7.	Statistical purposes	Art. 89 GDPR

If we process your personal data on the basis of law, this mainly concerns the following specific regulations:

Act No. 395/2002 Coll. on Archives and Registries and amending certain acts;

Act No. 431/2002 Coll. on Accounting, as amended;

Act No. 595/2003 Coll. on Income Tax;

Act No. 222/2004 Coll. on Value Added Tax;

Act No. 40/1964 Coll., the Civil Code, as amended,

Act No. 108/2024 Coll. on Consumer Protection and amending certain acts,

Act No. 372/1990 Coll. on Misdemeanours, as amended,

Act No. 18/2018 Coll. on Personal Data Protection and amending certain acts,

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

Act No. 22/2004 Coll. on Electronic Commerce and amending Act No. 128/2002 Coll. on State Control of the Internal Market in Consumer Protection Matters

and amending certain acts, as amended by Act No. 284/2002 Coll.,

Act No. 391/2015 Coll. on Alternative Resolution of Consumer Disputes and amending certain acts,

Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft,

Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and on third-country operators of unmanned aircraft systems,

Act No. 143/1998 Coll. on Civil Aviation (the Aviation Act) and amending certain acts.

What legitimate interests do we pursue when processing personal data?

For the following purposes we rely on the legal basis of legitimate interest under Article 6(1)(f) of the GDPR. Below you will find a more detailed explanation of these purposes and legitimate interests:

Establishing, exercising or defending legal claims (legal agenda)	In rare cases we have to establish, exercise or defend our legal claims in or out of court, or we have to report certain facts to public authorities, which we consider to be our legitimate interest.
Operating and managing profiles on social networks, including discussion forums	Where we operate our own profiles on social networks (LinkedIn), we rely on our legitimate interest, which is raising awareness of our company in the online environment.

What personal data do we process about you?

Ordinary personal data such as billing details, delivery details, details of representatives of business partner companies such as name and surname, contact details (telephone number and e-mail), and purchased services.

Who do we share your personal data with?

We take the confidentiality of personal data very seriously, which is why we have adopted internal policies ensuring that your personal data is shared only with authorised employees of our company or vetted third parties. Our employees and staff may access your personal data exclusively on a "need-to-know" basis, i.e. only authorised employees of the specific department related to the processing of personal data may have authorised access, and this access is typically limited by the position, function and job description of the specific employee. We provide the personal data of our clients, employees, business partners and other natural persons only to the extent necessary to the following categories of recipients:

our vetted and duly legally bound processors;
our professional advisers (e.g. lawyers, auditors);
payroll and accounting companies (such as 6 SENSE s.r.o.);
providers of software and cloud services (such as Websupport s.r.o.);
providers of technical (IT) and organisational (event agencies) support to our company (such as Birdline s.r.o.);
the Social Insurance Agency, pension fund management companies, supplementary pension companies, health insurance companies, and the Office of Labour, Social Affairs and Family;
postal and courier services;
employees of the above-mentioned persons.

Where we use a processor to process personal data, we always verify in advance that the processor meets the organisational and technical requirements for ensuring the security of the processing of your personal data. Where we use our own recipients (internal staff of our company) to process personal data, your personal data is always processed on the basis of authorisations and instructions by which we instruct our recipients not only about the internal rules of personal data protection but also about their legal liability for breaching them. If we are requested by a public authority to disclose your personal data, we examine the statutory conditions for disclosure and do not provide your personal data without verifying that the conditions are met. If you would like information about our current processors, please do not hesitate to contact us.

To which countries do we transfer your personal data?

By default, we restrict any cross-border transfers of personal data to third countries outside the European Economic Area (EU, Iceland, Norway and Liechtenstein) unless necessary. However, some of our subcontractors or recipients of personal data may have their registered office or servers located outside the European Economic Area, in particular in the United States of America.

In such cases we ensure that the transfer of personal data takes place in accordance with Chapter V of the GDPR – i.e. only where:

the European Commission has decided that the third country, territory or specific sector ensures an adequate level of personal data protection (e.g. the United States of America for entities participating in the EU–US Data Privacy Framework), or

appropriate safeguards for the protection of personal data have been adopted under Article 46 of the GDPR, for example through standard contractual clauses approved by the European Commission.

All such transfers are carried out only to the extent necessary and with appropriate technical and organisational measures to ensure the protection of personal data.

How long do we retain your personal data?

We retain personal data for no longer than is necessary for the purposes for which the personal data is processed. In general, the retention period follows from legislation. Where it does not follow from legislation, we determine the retention period of your personal data in relation to specific purposes through our group internal policy and/or our records management plan. If we process your personal data on the basis of consent, after its withdrawal we are obliged not to process the personal data further for that purpose. However, this does not exclude that we may continue to process your personal data on another legal basis, in particular to comply with legal obligations.

The general retention periods for personal data for the processing purposes we have defined are as follows:

Purpose	General retention period for personal data
Concluding contractual relationships and handling orders in connection with the provision of services such as aerial mapping, scanning, thermal imaging, etc.	For the duration of the contractual relationship.
Establishing, exercising or defending legal claims (legal agenda)	Until the legal claim becomes time-barred.
Data subject rights agenda	Until the legal claim becomes time-barred.
Operating profiles on social networks	Until the post is removed by the data subject, removed by us, our profile is removed, or the data subject requests the erasure of personal data.
Accounting and tax purposes	For ten years following the accounting year to which the accounting documents, accounting books, lists of accounting books, lists of numerical codes or other symbols and abbreviations used in accounting, depreciation plan, inventory lists, inventory records and chart of accounts relate.
Archiving purposes and records management	For the retention periods set out in the records management plan.
Statistical purposes	For the duration / existence of other processing purposes.

The retention periods above are only general periods during which personal data is processed for the given purposes. In practice, however, we delete or anonymise personal data before these general periods expire if we no longer consider the personal data necessary for the above processing purposes. Conversely, in some specific situations we may retain your personal data longer than stated above if required by law or by our legitimate interest. If you would like information about the specific retention period for your personal data, please do not hesitate to contact us.

How do we obtain personal data about you?

We most often obtain your personal data directly from you. In such cases, providing personal data is voluntary. You can provide your personal data to our company in various ways, e.g.:

in the process of concluding a contract with our company;
by communicating with you;
by participating in events organised by our company;
by participating in our company's activities on social networks;
by sending a contact form with your comments, enquiries or questions.

However, we may also obtain your personal data from your employer or from the company in connection with which we process your personal data. This most often occurs when we conclude or negotiate a contractual relationship or its terms with that company. If obtaining personal data relates to a contractual relationship, it is most often a contractual requirement or a requirement necessary to enter into a contract. Failure to provide personal data (whether yours or your colleagues') may have negative consequences for the organisation you represent, as the contractual relationship may not be concluded or performed. If you are a member of the statutory body of an organisation that is our contracting party or with which we are negotiating a contractual relationship, we may obtain your personal data from publicly available sources and registers. We never further systematically process any incidentally obtained personal data for any processing purpose we have defined.

What rights do you have as a data subject?

"If we process your personal data on the basis of your consent to the processing of personal data, you have the right to withdraw your consent at any time. However, its withdrawal does not affect the lawfulness of the processing of personal data before its withdrawal. You have the right to effectively object at any time to the processing of personal data for direct marketing purposes, including profiling."

"You also have the right to object to the processing of your personal data on the basis of the legitimate interests we pursue, as explained above. You also have this right with regard to the processing of personal data on the legal basis of public interest, which, however, we do not carry out."

If you exercise this right, we will be happy to demonstrate how we assessed these legitimate interests as overriding the interests, rights and freedoms of data subjects.

The GDPR sets out the general conditions for exercising your individual rights. However, their existence does not automatically mean that we will comply with them when they are exercised, as exceptions may apply in a specific case or some rights are tied to specific conditions that may not be met in every case. We will always deal with your request concerning a specific right and examine it in terms of the legislation and our internal policy for handling data subject requests. As a data subject you have in particular:

The right to request access to the personal data we process about you under Article 15 of the GDPR. This right includes the right to confirmation of whether we process personal data about you, the right to access this data and the right to obtain a copy of the personal data we process about you, where technically feasible;
The right to rectification and completion of personal data under Article 16 of the GDPR if we process inaccurate or incomplete personal data about you;
The right to erasure of your personal data under Article 17 of the GDPR;
The right to restriction of processing of personal data under Article 18 of the GDPR;
The right to data portability under Article 20.

If you believe that we process inaccurate personal data about you with regard to the purpose and circumstances and you cannot change such personal data through the functions of the application, account or website, you can request the rectification of inaccurate or completion of incomplete personal data using the supplementary statement below (all information is voluntary) and/or contact us via our contact details:

Supplementary statement on the rectification of personal data
Your name and surname:
Contact details:
Relevant processing purpose:	Please state which processing purpose your request relates to.
Context or relationship between you and our company:	Please state whether you are our employee, business partner, job applicant, etc.
Nature of your rectification:	Please explain whether you are requesting the rectification of inaccurate personal data or the completion of incomplete personal data.
Background to your rectification request:	Please explain why you believe we process inaccurate or incomplete personal data about you.
Rectification:	Please state which specific personal data you want rectified or completed.
Please send this supplementary statement on the rectification of personal data to us via the contact details

You also have the right to lodge a complaint at any time with the Office for Personal Data Protection of the Slovak Republic or to bring an action before the competent court. In any case, we recommend resolving any disputes, questions or objections primarily by communicating with us.

Is there any automated individual decision-making?

No, we currently do not carry out any processing operations that would result in a decision with legal effects or a similarly significant impact on you based solely on fully automated processing of your personal data within the meaning of Article 22 of the GDPR.

External websites

Our websites may contain links to other websites and/or services of other providers (e.g. reCAPTCHA from Google Inc.). We are not responsible for the content and management of the websites or services of other providers to which we link. This privacy policy does not apply to the processing of personal data while you are browsing other websites.

How do we protect your personal data?

It is our duty to protect your personal data appropriately, and for this reason we pay due attention to its protection. Our company has implemented generally accepted technical and organisational standards to maintain the security of the personal data processed, in particular against loss, misuse, unauthorised modification, destruction or other impact on the rights and freedoms of data subjects. In situations where sensitive data is transmitted, we use encryption technologies, e.g. communication with a payment gateway. Your personal data is stored on our secure servers or on the servers of the operators of our websites located in data centres in the Slovak Republic. Where third-party analytics tools are used, the data is stored on third-party servers (see cookies).

Cookies

Cookies are small text files that improve the use of a website, e.g. by making it possible to recognise previous visitors when logging into the user environment, remembering a visitor's choice when opening a new window, measuring website traffic or how the website is used in order to improve it for users. Our website uses cookies mainly to measure its traffic. If we are able to identify a visitor to our website when recording, this constitutes the processing of personal data. We must have a legal basis for such processing. One legal basis may be your consent as a data subject. If we process your data on the basis of your consent, this consent can be withdrawn at any time.

You can control or delete cookies as you wish. For details, see aboutcookies.org. You can delete all cookies stored on your computer, and most browsers can be set to prevent cookies from being stored.

Cookies are useful as long as website owners do not misuse them for unauthorised data collection. If you do not trust the cookie functionality, you can delete them from your disk regularly. In some cases, information obtained through cookies may be recorded incorrectly, resulting in problems logging in, e.g. to our web applications. Instructions for removing all cookies, including incorrectly recorded ones, can be found below. Instructions for deleting cookies in individual web browsers

Internet Explorer™

https://support.microsoft.com/sk-sk/help/278835/how-to-delete-cookie-files-in-internet-explorer

Safari™

https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Opera™

https://www.opera.com/help/tutorials/security/privacy/

Mozilla Firefox™

https://support.mozilla.com/sk/kb/odstranenie-cookies

Google Chrome™

https://support.google.com/chrome/answer/95647?hl=sk&hlrm=en

Social networks

We recommend that you familiarise yourself with the privacy policies of the social media platform providers through which we communicate with each other. Our privacy policy explains only the basic issues relating to the management of our profiles or the profiles of our clients. We have only typical administrator rights when processing your personal data through our or client profiles. We assume that by using social networks you understand that your personal data is primarily processed by the social network platform providers (such as LinkedIn) and that we have no control over, and are not responsible for, this processing, the further provision of your personal data to third parties and cross-border transfers to third countries carried out by those social network platform providers.

Changes to the privacy policy

Personal data protection is not a one-off matter for us. The information we are obliged to provide to you in relation to our processing of personal data may change or cease to be up to date. For this reason, we reserve the right to amend and change this policy at any time and to any extent. If we change this policy in a material way, we will bring the change to your attention, e.g. by a general notice on this website or by a specific notice by e-mail.

Terradron s.r.o.

Banská Bystrica, 13 October 2025