Privacy Policy

1. Data Controller

LEOVAC Digital s. r. o.

Galvaniho 19057/33A, 821 04 Bratislava, Slovakia

Data Protection Officer: [email protected]

Supervisory Authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, Slovakia -- dataprotection.gov.sk

2. Scope and Roles

Zayoto as Data Controller: We control personal data of Tenant account holders (agency owners, staff), platform usage data, website visitor data, and billing/payment data.

Zayoto as Data Processor: We process End User data (your customers' reservations, contact details) strictly on your behalf and according to your instructions.

Tenant as Data Controller: Each Tenant is an independent data controller for their End Users' personal data and is responsible for providing their own privacy policy, obtaining consents, and responding to data subject requests.

3. Personal Data We Collect

Tenant Account Data

Identity data: Full name, business name, OIB/tax ID
Contact data: Email address, phone number, business address
Authentication data: Email, hashed password
Billing data: Plan selection, billing address, payment history
Payment data: Stripe customer ID, last 4 digits of card (via Stripe)
Usage data: Features used, login frequency, vehicle count

End User Data (processed on behalf of Tenants)

Full name, date of birth, contact details, reservation data, payment references, driver's license information

Website Visitor Data

IP address, browser type, pages visited, cookie data, contact form submissions

4. Purposes and Legal Basis

Purpose	Legal Basis (GDPR Art. 6)
Account creation and management	Contract performance
Subscription billing and invoicing	Contract performance
Security and fraud prevention	Legitimate interest
Platform improvement and analytics	Legitimate interest
Legal compliance (tax, accounting)	Legal obligation
Marketing communications	Consent (opt-in)

5. Data Sharing

We may share data with the following sub-processors:

Stripe, Inc. -- Payment processing (USA, EU-US Data Privacy Framework)
Postmark (ActiveCampaign) -- Transactional email delivery (USA, SCCs)
Hetzner Online GmbH -- Infrastructure hosting (Germany, EU)

Zayoto does NOT sell, rent, or trade personal data to third parties for marketing or advertising purposes.

Each Tenant's data is logically isolated in our multi-tenant architecture. No Tenant can access another Tenant's data.

6. Data Retention

Data Category	Retention Period
Active Tenant account data	Duration of Subscription + 30 days
Billing and invoice records	11 years (tax law)
End User data (as processor)	As instructed by Tenant
Support correspondence	3 years after resolution
Website visitor logs	90 days
Audit logs	7 years

7. Your Rights

Under the GDPR, you have the following rights:

Right of Access (Art. 15) -- Obtain a copy of your personal data
Right to Rectification (Art. 16) -- Correct inaccurate data
Right to Erasure (Art. 17) -- Request deletion of your data
Right to Restriction (Art. 18) -- Restrict processing in certain circumstances
Right to Data Portability (Art. 20) -- Export your data in machine-readable format (CSV/ZIP)
Right to Object (Art. 21) -- Object to processing based on legitimate interests
Right to Withdraw Consent (Art. 7) -- Withdraw consent at any time

To exercise your rights: use the Platform's data export feature (Settings > GDPR Export) or email [email protected]. We will respond within 30 days.

If you are an End User (a customer of a Tenant), please direct your data requests to the Tenant that collected your data.

8. Data Security

We implement appropriate technical and organizational measures including: encryption in transit (TLS 1.2+) and at rest, role-based access control, password hashing (bcrypt), database-level tenant isolation, audit logging, regular encrypted backups, and EU-based hosting.

In the event of a data breach, we will notify the relevant supervisory authority within 72 hours and affected data subjects without undue delay where required.

9. Contact

LEOVAC Digital s. r. o.

Galvaniho 19057/33A, 821 04 Bratislava, Slovakia

Data protection: [email protected]
General inquiries: [email protected]
Support: [email protected]