Legal information
PRIVACY POLICY – BILVAO s. r. o.
Valid and effective from 01.11.2025, updated 07.09.2026
This English text is a translation provided for convenience. Only the Slovak wording of this document is legally binding.
1. IDENTIFICATION OF THE CONTROLLER AND GENERAL INFORMATION
This Privacy Policy (hereinafter the “Policy”) provides information on the processing of your personal data by BILVAO s. r. o., with its registered office at Janka Jesenského 564/9, 957 01 Bánovce nad Bebravou, Company ID No.: 53 399 978, registered in the Commercial Register of the District Court Trenčín, Section: Sro, Insert No. 41118/R, which operated under the business name BJ accounting services s. r. o. until 28. 08. 2026 (hereinafter the “Controller”), which takes place on the Controller’s website at www.bilvao.com (hereinafter the “Website”), on the Controller’s social media profiles and in the course of the Controller’s business and commercial activities.
Information on personal data processing that takes place outside the Website or social media is documented by the Controller in the relevant internal policies and will be provided to you where relevant.
Through this Policy, the Controller provides you with information about why and how your personal data are processed, how long the Controller retains them, your rights in connection with the processing of your personal data, and other relevant information concerning the processing of your personal data. Through this Policy, the Controller fulfils its duty to provide information to all data subjects, both where the Controller has obtained personal data directly from you as the data subject and where it has obtained your personal data from another source.
The Controller processes your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the “Regulation”), the applicable laws of the Slovak Republic, in particular Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (hereinafter the “Act”), and other personal data protection legislation (the Regulation, the Act and the other personal data protection legislation hereinafter collectively also referred to as the “Data Protection Laws”).
You may contact the Controller in matters concerning the processing and protection of personal data at BILVAO s. r. o., Janka Jesenského 564/9, 957 01 Bánovce nad Bebravou, or by email at info@bilvao.com.
2. INFORMATION ON PROCESSING OPERATIONS – LEGAL BASES, PURPOSES OF PROCESSING, CATEGORIES OF PERSONAL DATA AND RETENTION PERIODS
The Controller processes your personal data only for justified purposes, for a limited period and using the highest possible level of security. We process your personal data in accordance with the principle of lawfulness, meaning only where an appropriate legal basis for the processing exists under Article 6(1) of the Regulation, specifically on the following legal bases:
IN CONNECTION WITH THE OPERATION OF THE CONTROLLER’S WEBSITE:
| Purpose of processing | Responding to messages and handling enquiries or requests received by the Controller through the contact form on the Website, by email, through social media messages or by telephone |
|---|---|
| Legal basis | Article 6(1)(f) of the Regulation – personal data are processed on the basis of the Controller’s legitimate interest in responding to messages received, in order to conduct business communications properly, improve the quality of the Services provided and acquire new clients. |
| Categories of personal data | first name, surname, email address, telephone number and other information stated in the message |
| Retention period | 60 days from receipt of the request or until it has been dealt with (the purpose has been fulfilled), whichever occurs first |
| Purpose of processing | Publishing reviews |
| Legal basis | Article 6(1)(a) of the Regulation – personal data are processed on the basis of the data subject’s consent |
| Categories of personal data | first name, surname and other identification details stated in the review |
| Retention period | 3 years from the date on which consent was given or until it is withdrawn, whichever occurs first |
| Purpose of processing | Managing cookies – measuring Website traffic and activity and personalising advertising through cookies |
| Legal basis | Article 6(1)(a) of the Regulation – personal data are processed on the basis of the data subject’s consent Article 6(1)(f) of the Regulation – personal data are processed on the basis of the Controller’s legitimate interest in maintaining the functionality of the Website |
| Categories of personal data | IP address, Website activity data and user preference data |
| Retention period | depending on the type of cookie used, as specified in the Controller’s Cookie Policy |
| Purpose of processing | Carrying out marketing activities, presenting goods or services, and sending information about discounts and benefits relating to the Services provided by the Controller, including subscription to the marketing newsletter |
| Legal basis | Article 6(1)(a) of the Regulation – personal data are processed on the basis of the data subject’s consent |
| Categories of personal data | email address |
| Retention period | 3 years from the date on which consent was given or until it is withdrawn, whichever occurs first |
IN CONNECTION WITH THE CONTROLLER’S BUSINESS ACTIVITIES:
| Purpose of processing | Processing accounting documents |
|---|---|
| Legal basis | Article 6(1)(c) of the Regulation – compliance with legal obligations: Act No. 431/2002 Coll. on Accounting, as amended; Act No. 595/2003 Coll. on Income Tax, as amended; Act No. 222/2004 Coll. on Value Added Tax, as amended; and Act No. 311/2001 Coll., the Labour Code, as amended |
| Categories of personal data | ordinary personal data necessary for compliance with legal obligations (first name, surname, residential address / place of business or registered office, service delivery address, contact details – telephone number and email address, bank details), and other personal data necessary for the processing of accounting records |
| Retention period | 10 years following the year to which they relate |
| Purpose of processing | Records management and the registration and handling of incoming and outgoing correspondence (including electronic communications with the competent institutions) |
| Legal basis | Article 6(1)(c) of the Regulation – compliance with legal obligations: Act No. 395/2002 Coll. on Archives and Registries and on Amendments to Certain Acts, as amended; and Act No. 305/2013 Coll. on the Electronic Form of the Exercise of Powers of Public Authorities and on Amendments to Certain Acts (the e-Government Act), as amended |
| Categories of personal data | ordinary personal data |
| Retention period | Correspondence – 5 years following the year to which it relates; other records forming part of the registry, in accordance with the applicable provisions of Act No. 395/2002 Coll. on Archives and Registries and on Amendments to Certain Acts, as amended |
| Purpose of processing | Performance of the Controller’s contractual obligations (under contracts concluded with suppliers, purchasers of goods and services, other business partners and clients who are natural persons, and the registration of service orders), including steps taken prior to entering into a contract (handling enquiries, accepting orders, processing payments, etc.) |
| Legal basis | Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract and in order to take steps prior to entering into a contract |
| Categories of personal data | ordinary personal data (first name, surname, date of birth, residential address / registered office / place of business / billing address, affiliation with or position in the company that is the client, and contact details – telephone number and email address) |
| Retention period | for the duration of the contractual relationship and, following its termination, until all contractual and other claims arising from the contractual relationship have been fully settled (generally until the expiry of the applicable limitation periods), or until the relevant natural person ceases to act as a representative of the legal person; in any event, no later than the full settlement of all legal and other claims arising from the contractual relationship |
| Purpose of processing | Registration and administration of the client account, provision of access to the functions of the Controller’s internal web application, and provision of related services |
| Legal basis | Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract and in order to take steps prior to entering into a contract |
| Categories of personal data | email address, username, password (hashed), registration/login IP address, and registration date |
| Retention period | for the duration of the contractual relationship and, following its termination, until all contractual and other claims arising from the contractual relationship have been fully settled (generally until the expiry of the applicable limitation periods) |
| Purpose of processing | Recording and managing relationships with business partners and clients, Recording and managing relationships with suppliers of services, Processing the personal data of data subjects associated with business partners and clients when providing services on the Controller’s instructions |
| Legal basis | Article 6(1)(f) of the Regulation – personal data are processed on the basis of the Controller’s legitimate interest in maintaining an overview of the Controller’s suppliers, business partners and clients, or their contact persons in contractual relationships, in order to perform contractual obligations properly, establish legal claims where necessary and conduct appropriate business communications |
| Categories of personal data | ordinary personal data (first name, surname, residential address / registered office / place of business / billing address, affiliation with or position in the company that is the client, and contact details – telephone number and email address) |
| Retention period | for the duration of the contractual relationship and, following its termination, until all contractual and other claims arising from the contractual relationship have been fully settled (generally until the expiry of the applicable limitation periods), or until the relevant natural person ceases to act as a representative of the legal person; in any event, no later than the full settlement of all legal and other claims arising from the contractual relationship |
| Purpose of processing | Handling complaints and maintaining records of complaints submitted |
| Legal basis | Article 6(1)(c) of the Regulation – compliance with legal obligations: Act No. 513/1991 Coll., the Commercial Code, as amended, and Act No. 40/1964 Coll., the Civil Code, as amended |
| Categories of personal data | ordinary personal data necessary for compliance with legal obligations |
| Retention period | 4 years following the date on which the complaint was made; in the case of natural persons who are not entrepreneurs, 3 years following the date on which the complaint was made; or, in either case, until the claims arising from the complaint have been fully settled or until the expiry of the limitation periods laid down in the applicable legislation |
| Purpose of processing | Conducting judicial and administrative proceedings |
| Legal basis | Article 6(1)(c) of the Regulation – compliance with legal obligations: the applicable legislation governing civil, criminal and administrative proceedings |
| Categories of personal data | ordinary personal data necessary for compliance with legal obligations |
| Retention period | for the duration of the relevant proceedings and until the expiry of the limitation periods (unless the applicable legislation provides otherwise) |
| Purpose of processing | Handling the exercise of data subjects’ rights |
| Legal basis | Article 6(1)(c) of the Regulation – compliance with legal obligations: Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts |
| Categories of personal data | ordinary personal data contained in the request |
| Retention period | until the request to exercise the relevant rights has been dealt with |
| Purpose of processing | Maintaining records of the rights exercised by data subjects and how those rights were dealt with |
| Legal basis | Article 6(1)(f) of the Regulation – personal data are processed on the basis of the Controller’s legitimate interest in maintaining records of rights exercised by data subjects in order to demonstrate compliance with obligations arising under the applicable personal data protection legislation |
| Categories of personal data | ordinary personal data contained in the request |
| Retention period | 5 years from the date on which the right exercised or any other request submitted was dealt with |
| Purpose of processing | Sending information about the Controller’s activities and its own Services and conducting satisfaction surveys (direct marketing to existing and former clients) |
| Legal basis | Article 6(1)(f) of the Regulation – processing is carried out on the basis of the Controller’s legitimate interest in retaining existing clients and informing them about the Controller’s current Services |
| Categories of personal data | first name, surname, email address and telephone number |
| Retention period | for one year from the date on which the contractual relationship ends or until the recipient unsubscribes, whichever occurs first |
IN RELATION TO JOB APPLICANTS:
| Purpose of processing | Conducting a recruitment process (selecting new employees) |
|---|---|
| Legal basis | Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract and in order to take steps prior to entering into a contract |
| Categories of personal data | first name, surname, email address, work experience details and other personal data stated in the CV and/or cover letter |
| Retention period | for the duration of the recruitment process, but no later than 60 days from receipt of the CV and/or cover letter, unless an employment relationship or a similar labour-law relationship is established |
| Purpose of processing | Maintaining records of unsuccessful job applicants for the purpose of contacting them in the future |
| Legal basis | Article 6(1)(a) of the Regulation – personal data are processed on the basis of the data subject’s consent |
| Categories of personal data | first name, surname, email address, work experience details and other personal data stated in the CV and/or cover letter |
| Retention period | 3 years from the date on which consent was given or until it is withdrawn, whichever occurs first |
The Controller processes only personal data that are necessary for the relevant processing operation (purpose of processing), always in accordance with the principle of data minimisation, so that we can meet contractual and legal requirements or process only personal data for which we have a legitimate interest, and only to the extent necessary to fulfil the specified purpose of processing. This means that we do not request personal data from you that are not necessary for the specific purpose of processing.
The Controller always retains personal data in accordance with the principle of storage limitation. This means that personal data are processed only for as long as it is necessary to retain them. Once that period has expired, the Controller will erase the personal data unless the law provides otherwise. The Controller has determined the retention period for your personal data in accordance with the applicable legislation, as set out above in the table of purposes.
3. BILVAO S. R. O. AS PROCESSOR
In certain cases, BILVAO s. r. o. processes your personal data in the capacity of a processor within the meaning of Article 4(8) of the Regulation. BILVAO s. r. o. processes your personal data as processor when providing the following services:
bookkeeping and tax records,
payroll and human resources administration and related administrative services,
including professional advisory services in the fields of accounting, tax, human resources, and the processing of wages and remuneration; and
consultations and analyses as part of pre-contractual cooperation for the purpose of assessing the possibility of entering into an Agreement for the Provision of Services and Bookkeeping.
Where BILVAO s. r. o. acts as processor on behalf of its business partner, that business partner determines the purposes and means of processing personal data as controller. In such a case, we will inform you who the controller of your personal data is.
4. SOURCE OF PERSONAL DATA
We obtain your personal data directly from you as the data subject where you provide them to us (when you contact us through the Website, engage in business communications, enter into a contractual relationship with the Controller or apply for a job). As a service provider, we also hold personal data relating to employees, contractual partners and other persons that our clients provide to us. In such cases, we act as processor and the controller of the personal data (the client/contractual partner) fulfils its obligations under the Regulation directly towards the data subjects.
If, in certain cases, you did not provide us with your personal data where we act as Controller, we would be unable, as Controller, to provide you with a service, enter into a contract with you, respond to your message, include you among job applicants, etc.
5. TO WHOM DOES THE CONTROLLER DISCLOSE YOUR PERSONAL DATA?
In certain cases, the Controller is required to disclose your personal data to public authorities authorised to process them, such as courts, law-enforcement authorities and authorities supervising the operation of electronic commerce (for example, the Slovak Trade Inspection).
The Controller also discloses your personal data to its processors, i.e. external entities that process your personal data on behalf of the Controller. Processors process personal data under an agreement concluded with the Controller, in which they have undertaken to implement appropriate technical and organisational measures to ensure the secure processing of your personal data. The Controller’s processors include, for example:
a processor providing IT services and the management and development of internal systems,
processors providing hosting and email-hosting services,
a processor providing marketing and newsletter distribution services,
a processor providing satisfaction-survey services and contacting prospective clients.
Recipients of your personal data also include Google Ireland Limited, which provides analytics and marketing services through cookies placed on your device by the Controller’s Website.
6. TRANSFERS TO THIRD COUNTRIES AND INTERNATIONAL ORGANISATIONS
In certain cases, your personal data may be transferred to a third country, namely the USA:
Meta Inc. and LinkedIn Corporation, for example where you contact the Controller by sending a message through the relevant social network.
The transfer of your personal data is safeguarded by appropriate measures for transfers of personal data to third countries in accordance with the Data Protection Laws, in particular by using standard contractual clauses forming part of the terms of use of the services referred to above, together with supplementary transfer safeguards adopted by the providers of those services. A transfer may occur only in exceptional circumstances and on the basis of the applicable laws in force in the relevant third country (USA) that apply to those service providers (FISA).
7. SOCIAL MEDIA, PROFILING AND AUTOMATED DECISION-MAKING
To support marketing and advertising, the Controller’s Website contains links to various social networks, such as Facebook. The Controller hereby informs you that, once you click a plug-in on the Website and proceed to a social network, the privacy policy of the operator of that social network will apply, except where you contact the Controller through a message on the social network or consent to the publication of your photograph on the Controller’s social media profiles (in which case the processing of your personal data is also governed by this Policy and your personal data are processed by the Controller in accordance with the information set out above).
Further information on the processing of your personal data by social network operators is available at the following links: (i) Facebook, (ii) Instagram and (iii) LinkedIn.
The Controller does not use profiling when processing your personal data and does not process personal data by any form of automated individual decision-making involving the evaluation of personal aspects relating to you.
8. SECURITY OF PERSONAL DATA PROCESSING
In connection with securing personal data, the Controller has adopted relevant internal documentation setting out in greater detail the appropriate security measures implemented by the Controller to secure your personal data (for example, deployment of an SSL certificate on the Website, secure access management, etc.).
The security measures adopted comply with information security standards. We also take measures to secure personal data at organisational and personnel levels, for which purpose we have adopted internal processes and procedures.
9. WHAT RIGHTS DO YOU HAVE IN CONNECTION WITH THE PROCESSING OF PERSONAL DATA?
In connection with the processing of your personal data, you have the following rights as a data subject:
| Right of access – As a data subject, you have the right to obtain confirmation from the Controller as to whether your personal data are being processed and, where that is the case, to access those personal data and the information specified in Article 15 of the Regulation. The Controller will provide you with a copy of the personal data undergoing processing. If you submit your request electronically, the Controller will provide the information in a commonly used electronic format unless you request otherwise. | Right to rectification – The Controller has taken appropriate measures to ensure that your personal data are accurate, complete and up to date. As a data subject, you have the right to have the Controller rectify inaccurate personal data concerning you or have incomplete personal data completed without undue delay. |
RIGHT TO OBJECT You have the right to object to the processing of personal data, for example where the Controller processes your personal data on the basis of a legitimate interest or where the processing involves profiling. If you object to such processing, the Controller will no longer process your personal data unless it demonstrates compelling legitimate grounds for continuing to process your personal data. |
|
| Right to erasure (the ‘right to be forgotten’) – You also have the right to obtain from the Controller the erasure of your personal data without undue delay where certain conditions are met, for example where the personal data are no longer necessary for the purposes for which the Controller collected or processed them. This right must, however, be assessed on an individual basis, as other circumstances may prevent the Controller from erasing personal data (for example, a legal obligation incumbent on the Controller). In such a case, the Controller will be unable to comply with your request for erasure of personal data. | Right to data portability – In certain circumstances, you have the right to have personal data transmitted to another controller designated by you. The right to data portability applies only to personal data processed by the Controller on the basis of consent you have given to the Controller, on the basis of a contract to which you are a party, or where the Controller processes the personal data by automated means. |
RIGHT TO WITHDRAW CONSENT Where the Controller processes your personal data on the basis of your consent, you have the right to withdraw that consent at any time in the same manner in which you gave it. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. |
|
| Right to restriction of processing – You also have the right to have the Controller restrict the processing of your personal data. This applies, for example, where you contest the accuracy of the personal data, where the processing is unlawful and you request restriction of processing, or where the Controller no longer needs your personal data for the purposes of processing but you require them for the establishment, exercise or defence of legal claims. The Controller will restrict the processing of your personal data if you so request. | Right to lodge a complaint or submit a petition – If you believe that your personal data are being processed contrary to applicable law, you may lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava; website: dataprotection.gov.sk; telephone: 02 3231 3214; email: statny.dozor@pdp.gov.sk |
You may exercise the rights set out in the table above against the Controller using the contact details provided at the beginning of this document. The Controller will respond to the exercise of your rights free of charge. In the case of repeated, manifestly unfounded or excessive requests to exercise your rights, the Controller may charge a reasonable fee for providing the information. The Controller will respond within 1 month from the date on which you exercise your rights. In certain cases, the Controller may extend this period where warranted by the number or complexity of data-subject requests, but by no more than 2 months. The Controller will always inform you of any extension.
10. VALIDITY
This Policy is valid and effective from 01.11.2025 and was updated on 07.09.2026. As the information on personal data processing contained in this Policy may need to be updated in the future, the Controller may update this Policy at any time. In such a case, however, the Controller will inform you accordingly in an appropriate manner.