This policy explains how we process the personal data of visitors to the SWIDA Innovative website, of people who contact us or request a price quote, and of newsletter subscribers. It sets out the purposes and legal bases of processing, information on recipients and data retention, and how you can exercise your rights.
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, hereinafter the “GDPR”) and the relevant provisions of Act No. 18/2018 Coll. on the Protection of Personal Data, as amended. Act No. 452/2021 Coll. on Electronic Communications, as amended, also applies to cookies and electronic marketing.
1 Who processes your data and how to contact us
The controller is SWIDA Innovative s.r.o., with its registered office at Popradská 155/56, 040 01 Košice – mestská časť Západ, Slovak Republic, Company ID (IČO) 36 194 328 (hereinafter “SWIDA” or “we”).
For matters relating to the protection of personal data and the exercise of your rights, you can contact us by e-mail at info@swida.sk or by post at our registered office address, marked “Personal Data Protection”.
Data Protection Officer contact: Ing. Monika Tajblik Löfflerová, monika.lofflerova@swida.sk, phone +421 915 931 186.
2 Which websites and processing this policy covers
This policy applies to the SWIDA Innovative corporate website on the swida.sk domain and to its language versions and subdomains on which this policy is made available and on which the processing described here takes place. The same rules apply regardless of the interface language.
It covers in particular visits to the website, the contact form, the InstaCarrier price quote form, newsletter sign-up and the use of technologies for website operation, analytics and advertising to the extent set out below.
The separate features of InstaCarrier at instacarrier.eu and of the SWIDA App client portal may involve further processing, such as registration, account management, orders or shipment tracking. Their specifics are governed by Section 6 and by the information provided when using the respective service. Merely clicking through to the application or accepting the terms and conditions does not constitute consent to marketing or to non-essential cookies.
If a link redirects you to an external website, such as the Profesia job portal, its operator informs you about its own processing. If your data subsequently reaches SWIDA, we are responsible for processing it for our purposes; we provide information for job applicants in connection with the specific recruitment procedure.
3 What data we collect and from which sources
We collect data primarily directly from you when you fill in forms, sign up for the newsletter or in subsequent communication. In the contact form, depending on the fields completed, this includes your first name, surname, work e-mail, phone number, company and the content of your message. In a price quote request, it includes your e-mail, the loading and unloading locations and the details of the requested transport that you provide to us. Data about a company, route or shipment are personal data where they relate to an identified or identifiable natural person.
When you visit the website, depending on the features used and your cookie choice, technical data are processed, in particular your IP address, the time of the request, the page visited, browser and device information, technical errors, cookie identifiers and data on interaction with the website or advertising. The record of your consent choice may include an identifier, the time, the scope of the choice and the version of the information to which the choice related.
We may also receive data about representatives and contact persons of business partners from their employer, a colleague or the person who names them in an enquiry. In such a case, this mainly includes their name, job title, work contact details and the data needed to handle the enquiry. If we obtain data indirectly, we will provide the information under Article 14 GDPR, including the specific source, within one month at the latest, or at the time of the first communication or first disclosure to another recipient, whichever occurs first, unless a statutory exemption applies.
Please do not enter health data, other special categories of personal data or copies of identity documents into the standard web forms. We do not require them to handle a standard enquiry.
4 Why we process data and on what legal basis
Contact and handling enquiries
We process personal data to receive, assess and respond to your message and for related communication. If you, as a natural person, request steps prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR. If you are acting on behalf of a legal entity or the matter is a general question, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is to handle incoming communication and to establish and maintain business relationships through contact persons.
The contact form is technically submitted via the Mailgun API and then to our designated e-mail inbox. Submitting the form does not subscribe you to the newsletter. We do not make the handling of an enquiry conditional on marketing consent.
Price quotes and related business communication
We process data from the InstaCarrier form to assess the requested transport, to prepare and deliver a price quote and to discuss it. The data are written via API into the InstaCarrier system at instacarrier.eu. For an enquiry from a natural person aimed at entering into a contract, Article 6(1)(b) GDPR applies; for contact persons of legal entities, Article 6(1)(f) GDPR applies, with the legitimate interest of handling the business enquiry and communicating with the represented partner.
Providing contact details and the information needed for pricing is necessary to handle the request. If you do not provide them, we may not be able to prepare or deliver a quote. This processing does not in itself entitle us to send you the newsletter.
Newsletter
If you subscribe, we process your e-mail address to send you news and commercial communications about SWIDA’s services and activities, as well as the data needed to demonstrate your subscription and to manage it. The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with Section 116 of Act No. 452/2021 Coll. on Electronic Communications. We use MailerLite to manage subscriptions and send mailings; the data are transferred to it via API.
Consent is voluntary and you can withdraw it at any time using the unsubscribe link in every newsletter or by sending a message to our contact e-mail. Withdrawal is free of charge and does not affect the lawfulness of prior processing. The newsletter is not a condition for handling an enquiry or providing a service.
After you withdraw consent, we do not use your data for further mailings. To the extent necessary, we retain proof of consent and of its withdrawal to comply with our obligations under Section 116(5) and (6) of Act No. 452/2021 Coll. on the basis of Article 6(1)(c) GDPR. We may retain a limited unsubscribe record on the basis of Article 6(1)(f) GDPR to ensure that your choice is respected; it is not used for marketing.
Website operation and security
We process technical data to deliver content, ensure website availability, detect and fix errors, prevent misuse and investigate security incidents. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website and the protection of our systems and their users. We rely on the same basis when handling a voluntarily submitted security report, to the extent necessary to investigate it.
Cookie choices and proof of consent
We use CookieScript to store and apply your choice. We base the necessary processing of data for managing and demonstrating consents on Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR and the relevant obligations under Act No. 452/2021 Coll. The rules on access to information on your device and the other tools are described in Section 5.
Legal obligations and protection of claims
We also process data to handle data subject requests and to comply with other specific legal obligations under Article 6(1)(c) GDPR. If an enquiry turns into an order, accounting and tax documents are subject, to the relevant extent, in particular to Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax.
We process the data needed to establish, exercise or defend legal claims under Article 6(1)(f) GDPR; our legitimate interest is the protection of our rights and the rights of data subjects. This is not a reason for the blanket retention of all data without time limitation.
5 Cookies, analytics, advertising and other tools
Cookies and similar technologies make it possible to store information on your device or to access it. Under Section 109(8) of Act No. 452/2021 Coll., consent is not required for technical storage or access carried out solely for the purpose of transmitting or facilitating the transmission of a communication, or where it is strictly necessary to provide a service that you have explicitly requested. This exemption does not in itself determine the legal basis for the subsequent processing of personal data under the GDPR.
We use analytics and advertising technologies that do not meet this exemption only after you have consented for the respective purpose. For the related processing of personal data, the legal basis is Article 6(1)(a) GDPR. Consent can be refused or changed in the cookie settings available on the website. Withdrawing consent does not affect the lawfulness of prior processing, and refusing analytics or advertising does not prevent you from using the website’s basic content and contact features.
Google Analytics is used to measure traffic and evaluate how the website is used. It may work with online identifiers, technical data and data on pages visited and interactions. Google Ads is used to measure advertising performance and, depending on the features activated, also to build audiences and personalise advertising. Consent to analytics and consent to advertising are assessed separately.
Google Tag Manager manages the deployment of tags. The scope of processing depends on the tags and on how it is deployed; its use does not replace the consent required to run individual analytics or advertising technologies.
Google Maps makes it possible to display map content. When an embedded map is loaded, Google may receive your IP address, device and request data and, depending on the configuration, other identifiers. If an embedded map requires consent, it is loaded only after consent has been given. If it is a plain link to a map page, the connection to it is made once the link is opened. Displaying a map does not in itself mean consent to determining the precise location of your device.
Google Data Studio, also known as Looker Studio, is used to build reports from connected data sources. Semrush is used to analyse and optimise the website’s search visibility and for related marketing evaluation. The mere use of these tools in the administration does not mean that every visitor is individually tracked. If data enabling the identification of a person enter these tools, the purposes, legal bases and limitations of the source processing apply; creating a report does not establish a new, unlimited purpose.
The current list of technologies, their providers, purposes and the storage period of individual cookies is available in the cookie settings and in the cookie information on the website. The period for which a cookie is stored on your device may differ from the period for which the service provider retains the data.
6 InstaCarrier and SWIDA App
The processing of an enquiry from the InstaCarrier form on the corporate website, including its transfer to the InstaCarrier system, is covered by this policy. SWIDA Innovative s.r.o. is the operator of InstaCarrier; the transfer of an enquiry to this system therefore does not in itself mean disclosure to another controller.
For registration, login, account use, ordering transport and tracking its progress, the specific information available in the respective application also applies.
7 Who we share data with
Data are accessed by authorised persons within SWIDA to the extent of their work duties. Depending on the purpose of processing, we disclose them to providers of website hosting, maintenance and security, e-mail and information services, to the providers Mailgun, MailerLite and CookieScript, and to the providers of the analytics, advertising, map and reporting services we use, to the extent of the features activated and your consent choice. For the Google services mentioned, processing may involve Google Ireland Limited and other Google group entities in accordance with the terms of the specific service.
Where a provider processes data on our behalf as a processor, its processing is subject to the requirements of Article 28 GDPR and to our instructions. Not every provider has the same role in every activity; where it determines its own purposes and means of processing, it is responsible for them as an independent controller. Where joint controllership applies to a specific feature, we will make the essence of the arrangement available under Article 26 GDPR.
To the extent necessary, recipients may also include legal and accounting advisers, auditors and persons involved in the protection of legal claims, as well as courts and competent public authorities where disclosure is required or permitted by law. For the handling of transport, recipients may be supplemented by the entities listed in the specific information of the respective service. We will provide more detailed information about the recipients of your data on request, within the scope of the right of access.
8 Transfers outside the European Economic Area
The use of international providers may involve the transfer of, or remote access to, personal data from countries outside the European Economic Area, in particular from the USA. The mere location of a server in Europe does not exclude such access.
A transfer may take place on the basis of an adequacy decision of the European Commission under Article 45 GDPR, where it covers the transfer and recipient in question. For the USA, the decision on the EU–US Data Privacy Framework applies only to recipients validly included in the relevant list and to processing covered by the certification. Where an adequacy decision cannot be relied on, the transfer requires appropriate safeguards under Article 46 GDPR, in particular standard contractual clauses and, where necessary, supplementary measures based on a transfer assessment. Ordinary cookie consent is not a substitute for these safeguards.
We will provide information on the safeguards used and on how to obtain a copy of them via the contact e-mail above; when making them available, we protect the rights of others and confidential information.
9 How long we keep data
We keep data from enquiries while they are being handled and during the related communication. After that, we keep only the data needed for specific legal obligations or for the protection of claims. We determine the length of such retention according to the nature of the document, the applicable statutory period, the creation and maturity of the specific claim and any ongoing proceedings. The mere existence of a business contact does not justify unlimited retention of all communication.
We use your e-mail address for sending the newsletter while your consent is valid and your subscription lasts. After you unsubscribe, we stop sending it. We keep proof of demonstrable consent and confirmation of its withdrawal under Section 116(5) and (6) of Act No. 452/2021 Coll. for at least four years from the withdrawal of consent. We will provide confirmation of withdrawal within 30 days at the latest; this period does not mean that we are entitled to continue sending after consent has been withdrawn.
For cookies, we distinguish between the storage period on the device, the retention period of events and identifiers in the analytics or advertising service, and separate consent records. Data that have been irreversibly anonymised so that they no longer allow a person to be identified are not personal data.
Once the relevant period has expired, we delete the data or irreversibly anonymise them. If they need to be kept longer for a specific legal claim or statutory obligation, we separate them from ordinary use and restrict processing to that reason.
10 Is providing data mandatory
Providing data when browsing the website, contacting us or subscribing to the newsletter is not a general statutory obligation. However, certain technical data are needed to make the website technically available. Data marked as mandatory in a form should be limited to what is necessary to handle the request; without the necessary contact details or description of the request, we may not be able to handle it. All other data are voluntary.
If a statutory or contractual requirement for data arises in connection with a subsequent order, we will inform you of it when collecting the data. Declining the newsletter or optional cookies does not affect your ability to request a quote or contact us.
11 Profiling and automated decision-making
With your consent, advertising features may include evaluating interests and building audiences based on activity on the website so that more relevant advertising is displayed. Such processing may constitute profiling. The scope of the features actually activated must correspond to the information provided in Section 5.
The automatic delivery of a form, adding you to a subscription list or compiling statistics is not in itself a decision within the meaning of Article 22 GDPR. The specifics of automated pricing, orders or other decisions in InstaCarrier and SWIDA App must be explained in the information of those systems under Section 6; neither the existence nor the absence of decision-making with legal or similarly significant effects can be inferred from the technical processing of an enquiry.
12 What rights you have
You have the following rights to the extent and under the conditions of the GDPR. Their exercise depends on the specific legal basis and the nature of the processing.
Access and rectification
You can request confirmation as to whether we process your data, access to the data and to information about the processing, and a copy of the data processed. You can also request the rectification of inaccurate data and the completion of incomplete data.
Erasure and restriction of processing
You can request erasure in particular where the data are no longer needed, you withdraw consent and there is no other legal basis, you successfully object to the processing or the data are processed unlawfully. Erasure is not absolute; we may continue to keep data, for example, to comply with a legal obligation or for legal claims. You can request restriction of processing in the cases set out in Article 18 GDPR, in particular while accuracy is being verified, instead of erasure in the case of unlawful processing, to protect your claims or while an objection is being assessed.
Portability
Where processing is carried out by automated means and is based on your consent or on a contract with you, you can receive the data you have provided to us in a structured, commonly used and machine-readable format and transmit them to another controller. Where the statutory conditions are met, you can also request direct transmission, where technically feasible and where it does not adversely affect the rights of others.
Objection to processing
Where we process data on the basis of legitimate interest, you have the right to object at any time on grounds relating to your particular situation, including to related profiling. We may continue processing only if we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or for reasons of legal claims.
You can object to processing for direct marketing purposes at any time and without giving reasons, including to profiling related to such marketing. After an objection, we may no longer process the data for these purposes.
Withdrawal of consent and automated decision-making
You can withdraw consent at any time as easily as it was given, in particular via the unsubscribe link, by changing your cookie settings or by contacting SWIDA. Withdrawal does not affect the lawfulness of prior processing.
Under the conditions of Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. If a permitted exemption applies, you are entitled to appropriate safeguards; for decisions necessary for a contract or based on explicit consent, at least the right to human intervention, to express your point of view and to contest the decision.
Complaints and judicial remedy
You can lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. In Slovakia, this is the Office for Personal Data Protection of the Slovak Republic, Námestie 1. mája 18, 811 06 Bratislava, website https://dataprotection.gov.sk. A petition to initiate proceedings is filed under the conditions of Section 100 of Act No. 18/2018 Coll. Contacting SWIDA first is not a condition for lodging a complaint. You also have the right to an effective judicial remedy and, where the statutory conditions are met, to compensation for damage suffered.
13 How we handle requests
You can send your request to the contacts listed in Section 1. We do not require a special form or a justification unless the GDPR requires one for the right in question. To withdraw your newsletter consent, you can use the unsubscribe link directly.
We will inform you of the action taken without undue delay and at the latest within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, we may extend this period by a further two months; we will inform you of the extension and the reasons for it within the first month. If we do not comply with a request, we will explain why and inform you of the possibility of lodging a complaint and seeking a judicial remedy.
Handling is generally free of charge. A reasonable fee or refusal is possible for manifestly unfounded or excessive requests under the conditions of Article 12(5) GDPR; a reasonable fee may be charged for further copies of personal data under Article 15(3) GDPR. Exercising a right repeatedly does not in itself automatically mean that a fee will be charged.
If we have reasonable doubts about the identity of the requester, we may ask for additional information necessary to confirm it. We do not automatically require a copy of an identity document or data that are not needed for verification.
14 Data protection and changes to this policy
We are obliged to implement appropriate technical and organisational measures corresponding to the risk of processing, to limit access to data to authorised persons and to continuously assess the adequacy of protection. If a change to a service introduces a new purpose of processing, we will provide the necessary information before it begins and, where necessary, ensure a new legal basis.
This policy applies from the date of its publication for the respective version of the website. The current version is available via the privacy link in the website footer. A change to this policy does not retroactively change the legal basis of processing already carried out, and continued use of the website does not in itself constitute consent to changed purposes.