1. Controller identification and contact details
The controller of your personal data is:
Mladí programátori s. r. o.
Trieda Andreja Hlinku 606/39
949 01 Nitra, Slovak Republic
Company ID: 55 655 203
Tax ID: 2322051602
Registered in the Commercial Register of the District Court Nitra, Section Sro, Insert No. 55656/N
Contact details:
If you have any questions regarding the protection of your personal data, you can contact us at:
admin@berelevant.now
https://berelevant.now
2. Purpose and legal basis for processing personal data
We process your personal data only on the basis of a valid legal basis.
What data we process
Depending on how you use the platform, these are the categories of data involved:
- • Identification and contact data: e-mail, first and last name and company name (both optional), password in hashed form.
- • Billing data: name or company name, address, company ID, tax ID, invoice history. We do not store card numbers; Stripe processes them.
- • Service-related data: monitored brand URL, keywords, account settings and preferences.
- • Technical data including online identifiers: IP address, browser and device type, platform usage data, cookies.
- • Communication data: the content of customer support communications, and the audio and transcript of a conversation if you start the voice assistant.
- • To create and manage a user account, provide services, process payments and provide customer support - legal basis: Art. 6(1)(b) GDPR - performance of a contract.
- • For invoicing and compliance with legal obligations - legal basis: Art. 6(1)(c) GDPR in conjunction with Act No. 431/2002 Coll. on Accounting - compliance with a legal obligation of the controller.
- • For technical operation and security of the platform - legal basis: Art. 6(1)(f) GDPR - legitimate interest.
- • For analytics and marketing communications - legal basis: Art. 6(1)(a) GDPR - consent of the data subject.
Legitimate interest
Our legitimate interest consists of protection against misuse of the service, internal controls, and protection of the network and information systems against unauthorised access and cyber attacks.
Right to object to processing (Art. 21 GDPR)
In accordance with Art. 21(1) GDPR, the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them which is carried out on the basis of legitimate interest. The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to such processing; once you object, your data will no longer be processed for that purpose. You can object by e-mail at admin@berelevant.now.
Withdrawal of consent:
Where the legal basis is your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw consent in your account settings or via the e-mail address admin@berelevant.now.
3. Recipients of personal data and transfers to third countries
A recipient is any party to which personal data are disclosed, whether or not it is a third party (Art. 4(9) GDPR). We disclose your personal data to the following recipients:
3.1 Processors (subcontractors)
We work with processors to provide our services. We have data processing agreements under Art. 28 GDPR in place with all of them:
Stripe, Inc.
Payment processing
USA (certified under the EU-U.S. Data Privacy Framework)
Standard Contractual Clauses (SCC)
Functional Software, Inc. (Sentry)
Error monitoring and application diagnostics
USA (certified under the EU-U.S. Data Privacy Framework)
Data Processing Addendum (DPA)
Cloudflare, Inc. (Turnstile)
Bot protection (processes the IP address and request metadata)
USA/EU (certified under the EU-U.S. Data Privacy Framework)
Standard Contractual Clauses (SCC)
Google LLC (Google Tag Manager)
Tag management and loading of analytics scripts (only with your consent)
USA (certified under the EU-U.S. Data Privacy Framework)
EU Data Processing Terms
ElevenLabs, Inc.
AI voice assistant (processes the audio a visitor speaks into the microphone and the conversation transcript; processing starts only after the visitor starts a conversation)
USA (certified under the EU-U.S. Data Privacy Framework)
Standard Contractual Clauses (SCC)
Prebi (api.prebi.eu)
Operation of the voice assistant backend issuing a short-lived session credential (receives the visitor's IP address to protect the service against misuse)
EU
Data Processing Agreement (DPA)
OpenAI, L.L.C.
AI API for ChatGPT queries. A query contains the monitored brand URL and keywords; where the brand is a natural person's name, these are personal data.
USA (certified under the EU-U.S. Data Privacy Framework)
Data Processing Addendum (DPA)
Anthropic PBC
AI API for Claude queries. A query contains the monitored brand URL and keywords; where the brand is a natural person's name, these are personal data.
USA (certified under the EU-U.S. Data Privacy Framework)
Data Processing Addendum (DPA)
Google LLC (Gemini API)
AI API for Gemini queries. A query contains the monitored brand URL and keywords; where the brand is a natural person's name, these are personal data.
USA (certified under the EU-U.S. Data Privacy Framework)
EU Data Processing Terms
Our own infrastructure
We run the platform on our own infrastructure (VPS and Docker in the EU), including the database and the job queue. No personal data are disclosed to another party there, which is why our infrastructure is not listed among the recipients.
3.2 Transfers of personal data to third countries
Some of our processors are established in the USA. Transfers of personal data to the USA are safeguarded by:
EU-U.S. Data Privacy Framework (DPF)
Stripe, Cloudflare, Sentry, Google, OpenAI, Anthropic and ElevenLabs are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection of personal data (Commission Implementing Decision (EU) 2023/1795). The list of certified organisations is publicly available at https://dataprivacyframework.gov/list.
Standard Contractual Clauses (SCC)
As an additional safeguard we use the Standard Contractual Clauses approved by the European Commission under Art. 46(2)(c) GDPR.
Compliance with Chapter V of the GDPR
All transfers of personal data to third countries are carried out in accordance with the requirements of Chapter V of the GDPR.
3.3 Public authorities
We are obliged to disclose personal data to public authorities (e.g. the police, courts, tax authorities) where required by law. A public authority processing personal data under a specific legal provision or an international treaty is not regarded as a recipient (Art. 4(9), second sentence, GDPR).
4. Retention periods
We retain personal data only for as long as necessary to fulfil the purposes for which they were obtained, or for the period required by law:
- Active account:
- For the duration of the contractual relationship (while the account is active)
- After account closure:
- We delete the data without undue delay after the contractual relationship ends. Data needed for the establishment and defence of legal claims are retained for 4 years from the end of the contractual relationship (3 years for consumers); if either party asserts a claim, until the proceedings have concluded with final effect and the enforcement period has expired.
- Invoices and accounting records:
- 10 years following the year to which they relate (Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax for VAT payers)
- Marketing consents:
- Until the user withdraws consent
- Analytics data:
- 14 months from your last activity, the period needed to evaluate year-over-year and seasonal traffic trends, or until consent is withdrawn
- Technical logs (IP addresses, security):
- 12 months from the moment they are recorded
- Customer support communications:
- 3 years from the closure of the request
Deletion of data and backups
Once the retention period expires, or once you exercise the right to erasure, we remove your personal data from active systems without undue delay. Data are removed from backup systems at the next backup rotation, no later than 30 days. During that time the backups are secured against any further processing.
5. Your rights under the GDPR
As a data subject you have the following rights under the GDPR:
- • Right of access to personal data (Art. 15 GDPR)
- • Right to rectification (Art. 16 GDPR)
- • Right to erasure, the 'right to be forgotten' (Art. 17 GDPR)
- • Right to restriction of processing (Art. 18 GDPR)
- • Right to be notified of rectification, erasure or restriction of processing (Art. 19 GDPR)
- • Right to data portability (Art. 20 GDPR)
- • Right to object to processing (Art. 21 GDPR)
- • Right to withdraw consent at any time (Art. 7(3) GDPR)
You also have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR - see section 9 for details.
How to exercise your rights
- • By e-mail at: admin@berelevant.now
- • In your account settings you can directly update your details and communication preferences
- • We will respond to your request within one month of receiving it. In justified cases we may extend this period by a further two months, and we will inform you if we do.
6. Security of personal data
We take the security of your personal data very seriously. We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or unauthorised disclosure:
Encryption and storage of data
- • Data in transit between your device and our platform is encrypted (TLS/HTTPS)
- • Passwords are stored in hashed form only, never in readable form
Access control
- • Only a limited group of authorised people can access personal data
- • Access rights are assigned by role and limited to what is necessary
- • Signed-in sessions are time-limited and can be invalidated
Infrastructure security
- • Operated on infrastructure located in the European Union
- • Regular data backups
- • Monitoring of errors and security incidents
Organisational measures
- • People with access to personal data are instructed on their obligations and bound by confidentiality
- • Internal procedures for processing personal data
- • Processor agreements containing data security guarantees (Art. 28 GDPR)
7. Cookies and similar technologies
Our website uses cookies and similar technologies. Detailed information about cookies, their types and how to manage them can be found in our separate Cookie Policy.
Quick overview:
- • Necessary cookies: Used for the basic functioning of the site (login, security, CSRF protection). No consent required.
- • Functional cookies: Remembering preferences (language, theme). Consent required.
- • Analytics cookies: Measuring traffic and use of the site. Consent required (since 1 January 2024 in Slovakia under Act No. 452/2021 Coll.).
- • Marketing cookies: Advertising campaigns and retargeting. Consent required.
Managing cookies
You can change your cookie preferences at any time using the "Cookie settings" button in the footer of our site or in your browser settings.
Read our full Cookie Policy8. Changes to this privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational or regulatory reasons.
Notification of changes
We will inform you of any material changes:
- • By e-mail to your registered e-mail address (for material changes)
- • By publishing a notice on our website
- • By updating the "Last updated" date at the top of this document
Agreement with changes
Material changes take effect on the date stated. If you do not agree with them, you can stop using the platform, contact us, or close your account.
9. Lodging a complaint and the supervisory authority
If you believe that the processing of your personal data infringes the GDPR or Act No. 18/2018 Coll. on Personal Data Protection, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). In the Slovak Republic, the supervisory authority is the Office for Personal Data Protection of the Slovak Republic.
Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic
Phone: +421 2 32 31 32 14
E-mail: statny.dozor@pdp.gov.sk
https://dataprotection.gov.skForms for electronic communication with the authorityBefore contacting the authority, you can reach us directly at admin@berelevant.now. The controller's contact details are in section 1.