1. What we collect
We collect the following categories of data:
- Account data — name, email, phone, password (stored only as a hash), and two-factor settings.
- Company data — company name, registration number (IČO), VAT ID, legal representative and bank IBAN, used to verify your business against the public registry. The Service is free, so we do not collect payment-card details.
- Venue data — venue name, description, address, location/geofence, opening hours, logo and photos.
- Usage & analytics — check-ins/visits, streaks, campaigns and rewards linked to your venue, and aggregated statistics.
- Technical data — log data, device/browser information and security events needed to run and protect the Service.
2. How we use it & legal bases
- To provide the Service (manage your account, venues, campaigns and analytics) — performance of a contract.
- To verify your company against the public business registry (RPO / ORSR) — legitimate interest in preventing fraud and legal obligation where applicable.
- To send service & transactional emails (verification codes, invoices, security alerts) — contract / legitimate interest.
- To send optional weekly report emails — based on your preference, which you can turn off in Settings → Preferences.
- To secure the Service (2FA, abuse and fraud prevention) — legitimate interest.
3. Verification against public registries
To confirm a venue belongs to a real, active business, we send the company registration number you provide to the public business registry API (Register právnických osôb / ORSR operated by the Statistical Office of the Slovak Republic). We store the verification result (status, matched company name and timestamp). We do not control that public registry.
4. Service providers (processors)
We use trusted providers who process data on our behalf under appropriate agreements:
- Hosting & database — to run the application and store your data (Hetzner Online GmbH, Finland — EU).
- Object storage — to store venue logos and photos.
- Email delivery — to send account, verification and report emails (Google Workspace).
- Avatar generation — a default profile image service used when no logo is set.
We do not sell your personal data.
5. International transfers
We aim to keep processing within the EU/EEA. Where a provider processes data outside the EEA, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses).
6. How long we keep it
We keep account, venue and usage data for as long as your account is active. When you delete your account, we delete or anonymise personal data within a reasonable period, except where we must retain certain records to meet legal obligations (for example, invoices for statutory accounting/tax periods).
7. Your rights
Subject to conditions in the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data and complete incomplete data;
- erase your data (“right to be forgotten”) where applicable;
- restrict or object to certain processing, including for direct marketing;
- data portability;
- withdraw consent at any time, without affecting prior processing.
You can exercise most of these directly in the portal (edit your details, manage report emails, or delete your account) or by emailing support@streekly.com. You also have the right to lodge a complaint with the Slovak data-protection authority (Úrad na ochranu osobných údajov SR) or your local supervisory authority.
8. Security
We use technical and organisational measures to protect your data, including encrypted transport (HTTPS), hashed passwords, optional two-factor authentication, access controls and audit logging. No system is perfectly secure, but we work to protect your data and to respond promptly to incidents.
9. Cookies & sessions
The portal uses strictly necessary cookies and local session storage to keep you signed in and to operate core features (for example, an authentication token cookie). We do not use these for advertising.
10. Children
The partner platform is intended for businesses and adults; it is not directed at children.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified in the portal or by email. The “last updated” date above reflects the current version.
12. Contact
For any privacy question or request, contact us at support@streekly.com.