Privacy policy

This policy explains how startIT s. r. o., as the operator of the Silný rod service (the “controller”, “we”), processes personal data under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection. We have not appointed a data protection officer, as we are not required to; please send any questions to info@silnyrod.sk.

1. Controller

startIT s. r. o.
Registered office: Ožvoldíkova 4, 841 02 Bratislava – mestská časť Dúbravka
Company ID (IČO): 52 275 043
Registration: Commercial Register of the Bratislava III Municipal Court, Section: Sro, Insert No. 136212/B
Data protection contact: Dominika Vovková, e-mail info@silnyrod.sk, phone +421 919 271 987

2. What data we process

– Client contact data: name, e-mail, phone, where applicable billing and delivery address.
– Questionnaire and communication data: information about your family that you give us, messages in the client area, user name (passwords are stored only in irreversibly encrypted form – as a hash).
– Attachments: photographs and documents you send or upload.
– Payment and accounting data: invoices, payments received.
– Technical data: IP address at login and security events (audit log), a derived fingerprint (hash) of the IP address when a questionnaire is submitted (abuse protection), technical server logs at the hosting provider.

Data about ancestors – deceased persons – are not personal data under the GDPR. We nevertheless treat them confidentially and do not publish them without your consent.

Data on living relatives: if you give us data on living persons (e.g. siblings, children, cousins), we process it only to the extent necessary to compile the family tree (usually name, year of birth and relationship), never publish it and leave it out of samples. Please provide only what is needed and let your relatives know. We do not ask for special categories of data (e.g. health).

3. Purposes and legal bases

– Handling the intake questionnaire and preparing an offer – steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
– Performance of the contract – research, family tree, book, online tree, client area and communication with you (Art. 6(1)(b) GDPR).
– Data on living relatives provided by the client – the legitimate interest of the client and ours in compiling a complete family tree, with data minimisation (Art. 6(1)(f) GDPR).
– Accounting and tax obligations and handling complaints (Art. 6(1)(c) GDPR, in particular Act No. 431/2002 Coll. on Accounting and Act No. 108/2024 Coll.).
– Security of the website and client area – login, rate limiting, audit log (Art. 6(1)(f) GDPR).
– Establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).

Providing data is voluntary, but without contact data we cannot prepare an offer or perform the contract. We do not use data for marketing, profiling or automated decision-making.

4. Retention

– A questionnaire that did not lead to a contract: 12 months from submission, then deleted.
– Project data (materials, outputs, communication, client account): for the duration of the contract and 5 years after its fulfilment (complaints, legal claims, reprints of the book). At your request we delete it earlier unless we need it to meet a legal obligation or to protect legal claims.
– Accounting documents: 10 years after the year to which they relate (Section 35 of the Accounting Act).
– Security records: failed login attempts 24 hours, audit log no longer than 12 months, technical server logs according to the hosting settings.

5. Recipients

– Web hosting and server provider (processor) – the website, database and files are stored on a server in the European Union.
– Archives, registry offices, parish offices and other institutions – only to the extent of a specific record request (usually data on an ancestor; your name only if the institution requires it from the applicant).
– Printer and courier – when printing the book, to the extent needed for production and delivery.
– External accountant – accounting documents.
– Providers of artificial-intelligence tools – as described in Article 6.
– Public authorities – only where required by law.

We do not sell data or share it with third parties for marketing.

6. Artificial-intelligence tools

In our research we use artificial-intelligence (AI) tools, mainly to read and transcribe old handwriting, search digitised archival sources and sort findings. They work mostly with publicly available historical records of deceased persons.

We do not enter your contact data into AI tools. We enter data on living persons only to the extent necessary to find connections (usually name and year of birth). We prefer services whose provider's contractual terms state that entered data is not used to train models. Some AI providers are based outside the EU (e.g. in the USA); in such cases data is transferred only on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

Every AI result is verified by a person in the original source. AI does not make any decisions about you.

7. Transfers to third countries

The website, database and files are stored in the European Union. Fonts and scripts are loaded from our own server – we do not use Google Fonts, external CDNs, analytics or social networks, so your IP address is not sent to third parties when you visit the website. A transfer outside the EU may occur only with AI tools under Article 6, with appropriate safeguards.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interest (Art. 21). If we processed any data based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Send requests to info@silnyrod.sk. We handle them free of charge within one month (in complex cases extended by a further two months, of which we will inform you). We may verify your identity first.

If you believe our processing violates the law, you may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk.

9. Security

– The website communicates only over an encrypted connection (HTTPS).
– The client area and administration are password-protected; passwords are stored only as hashes, login attempts are limited and you are logged out after 2 hours of inactivity.
– Client accounts are separated – each client sees only their own projects and files.
– Uploaded files are not publicly accessible; the application serves them only after checking authorisation.
– Only authorised persons bound by confidentiality have access to the data.

10. Cookies

We use only strictly necessary cookies (session and login, form protection, language choice). We do not use analytics, advertising or tracking cookies, so we do not show a consent banner.

Detailed list of cookies

11. Changes

We may update this policy, e.g. when our services or the law change. The current version is always published on this page; we will inform clients of material changes.