Privacy Policy

Version effective as of: October 12, 2026

This Privacy Policy (“Policy”) applies to the processing of personal data by bonet.systems, s.r.o., with its registered office at Binárium, Staré Grunty 18, 841 04 Bratislava – Karlova Ves district, Slovak Republic, Company ID (IČO): 47258837, registered in the Commercial Register of the Bratislava III Municipal Court, Section: Sro, Insert No.: 111224/B (hereinafter “BONET”, “we”, “controller”) for the purpose of enabling BONET to contact you, in particular but not exclusively in the form of informational, educational and promotional marketing materials, newsletters and emails from BONET. This Policy also applies to the processing of personal data in connection with registration for and attendance at webinars and the sending of confirmations, organizational information, reminders and webinar recordings.

This Privacy Policy applies to both natural persons and legal entities, including commercial companies and other organizations. This Policy takes into account Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”), and the relevant provisions of Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (hereinafter the “Act”).

BONET respects and protects the personal data of the data subjects it comes into contact with. In this Policy, we provide all the information you need to understand what personal data we collect, for what purposes we process it, with whom we share it, what rights you have and how you can contact us with further questions about the processing of personal data.

We will inform you of any changes to the processing of personal data by updating this Policy published on our website https://bonet.systems. We therefore recommend that you visit our website regularly and familiarize yourself with the current version of the Policy.

We will process the information we collect about you for the period necessary for the purposes for which it is processed. On the basis of the consent you give us to process your personal data for marketing purposes, we will process your personal data for these purposes for a maximum of 10 years from the date the consent was given, but no longer than until it is withdrawn or the relevant purpose of processing ceases, whichever occurs first. You may withdraw your consent at any time via the unsubscribe link in a marketing email or by contacting BONET using the contact details set out in this Policy. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The ten-year period does not apply to the processing of personal data for the purposes of webinar registration and attendance. The retention periods for such data are set out separately in the webinar section of this Policy.

We do not intend to process special categories of data, such as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or to process genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, unless the natural person has given explicit consent to the processing of such data.

We take appropriate measures to help protect information about data subjects against loss, theft, misuse and unauthorized access, disclosure, alteration and destruction.

1. Data Controller

The controller of personal data is:

Company name: bonet.systems, s.r.o.
Registered office: Binárium, Staré Grunty 18, 841 04 Bratislava – Karlova Ves district, Slovak Republic
Company ID (IČO): 47258837
VAT ID (IČ DPH): SK2120277632
Website: https://bonet.systems
Email: support@bonet.sk

2. What Personal Data We Process and Why

Personal data is any information relating to an identified or identifiable natural person — that is, a specific individual who can be identified directly or indirectly, for example by name, email address or telephone number.

We also obtain personal data through contact and registration forms on our website, registration forms (Lead Ads) displayed in advertisements on Facebook and Instagram, in communication with us and when you register for or attend a webinar. We process personal data only to the extent necessary and to achieve a specific purpose of processing. This purpose is always defined before the personal data is obtained, and this legitimate purpose could not be achieved without processing the personal data.

3. Purpose and Legal Basis of Processing

We process your personal data exclusively for the following purposes and on the basis of the relevant legal bases under Art. 6 GDPR.

We process your personal data on the following legal bases:

Article 6(1)(a) GDPR – Consent – consent is given by a clear affirmative act constituting a freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data.
Article 6(1)(c) GDPR – processing is necessary for compliance with our legal obligation. We may also process and archive your personal data because we are directly required to do so by law.
Article 6(1)(b) GDPR – processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract.
Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by your rights and freedoms.

a) Handling inquiries via the contact form

Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR) and pre-contractual relations (Art. 6(1)(b) GDPR)
Data processed: first name, last name, email address, telephone number, company name, subject of interest
Retention period: 3 years from the last communication or until an objection is raised

b) Analytics and traffic measurement

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR)
Tools: Google Analytics 4, Google Tag Manager, LinkedIn Insight Tag, Meta Pixel and Conversions API (Meta Platforms Ireland Limited)
Data processed: IP address, cookie and device identifiers, website behavior, demographic data, conversion measurement, measurement of advertising campaign effectiveness and personalization of displayed ads

Detailed information about all current cookies, their use and how to give or withdraw consent can be found in our Cookie Policy.

For Meta Business Tools (Meta Pixel, Conversions API), we are joint controllers with Meta for the collection of data and its transmission to Meta; further processing of this data by Meta for its own purposes is governed by its Privacy Policy (https://www.facebook.com/privacy/policy/).

c) Registration for and attendance at webinars

We use the data from the registration form to process your registration, to send you a confirmation, organizational information and reminders about the webinar, and to send you the webinar recording if we state at registration that it will be sent.

Legal basis: BONET's legitimate interest in organizing professional webinars and related organizational communication (Art. 6(1)(f) GDPR), following a legitimate interest assessment.
Data processed: name, email address, company name and any other data you provide in the form, such as job title or a question for the presenters; registration and attendance data necessary to organize the webinar.
Retention period: we retain registration and organizational data for 12 months from the date of the webinar, after which we delete or anonymize it, unless we need it longer to handle a request or legal claims.

If the webinar is recorded, the recording contains the video and audio of the presenters and the shared presentation. We will send the recording to registered participants.

Registration via an advertisement on Facebook or Instagram (Meta Lead Ads). If you register for a webinar via a form in our advertisement on Facebook or Instagram, the data you enter in the form (in particular name, email address and, where applicable, company name and job title) is displayed and stored on the Meta platform, and we then transfer it to our systems to process your registration. Meta Platforms Ireland Limited processes this data on our behalf as a processor; Meta is responsible as an independent controller for any further processing for its own purposes in accordance with its data policy. We process data from the lead form for the same purpose, on the same legal basis and for the same period as for registration via our website (see above). You can edit or delete any data that Meta pre-fills from your profile before submitting the form.

d) Newsletter and marketing emails

We use your email address to send you our email newsletter, professional news, invitations to further webinars and information about our services and offers only if you have given separate consent to this. If you have provided us with your telephone number and your consent also covers telephone contact, we may also contact you by telephone for the same purpose.

Legal basis: your consent under Art. 6(1)(a) GDPR and the applicable rules on electronic communications for direct marketing purposes.
Data processed: email address and, where applicable, name if we use it to personalize the greeting; telephone number, if you have provided it.
Retention period: we use the data for this purpose until you withdraw your consent, but for no longer than 10 years from when it was given. We keep a record of the giving or withdrawal of consent for as long as necessary to demonstrate consent and respect your choice.

You may withdraw your consent at any time by clicking the unsubscribe link in an email or by contacting BONET at support@bonet.sk. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.

Giving consent for marketing purposes is voluntary. Without it, we will not send you newsletters or marketing emails; we will respond to your inquiry even without this consent.

4. Recipients of Personal Data

We may share your data with the following categories of recipients:

Google LLC (Google Analytics, Google Tag Manager) – traffic measurement and tag management
LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag) – provision of the LinkedIn Insight Tag service for measuring conversions and advertising effectiveness. LinkedIn processes this data as an independent controller, including for its own purposes, in accordance with its privacy policy.
Zoom Communications, Inc. – provision of the webinar platform
Meta Platforms Ireland Limited (Facebook, Instagram – Meta Lead Ads, Meta Pixel, Conversions API) – collection of registrations through advertising forms and measurement of advertising effectiveness
Sendinblue SAS (trading as Brevo) – contact management and sending of newsletters and other marketing emails on behalf of BONET.
Website hosting provider
Competent public authorities, where we are required by law to disclose personal data

We do not sell or rent your personal data. We make subscriber data available to the Brevo service provider to handle communication on behalf of BONET, not for sending that provider's own marketing offers. Where a recipient processes personal data on our behalf as a processor, the processing is governed by a contract under Art. 28 GDPR and our instructions.

5. Transfers to Third Countries

Your personal data is transferred, processed and stored on servers located in Germany and the Slovak Republic. When using the services of Google, LinkedIn, Meta, Zoom and Brevo, data may also be processed or transferred outside the European Economic Area (“EEA”).

In the case of Brevo, according to the provider, databases are stored on servers in the European Union, specifically in France, Germany and Belgium. The location of databases in the EU does not in itself rule out the possible processing of or access to personal data from countries outside the EEA by Brevo group companies or its other processors. The US company Sendinblue, Inc., operating as Brevo USA, declares certification under the EU–US Data Privacy Framework. If personal data is transferred to it and the transfer falls within the scope of its valid certification, the transfer may take place on the basis of the relevant European Commission adequacy decision under Art. 45 GDPR.

In the case of Zoom, personal data may be transferred to the USA and other countries outside the EEA. Zoom Communications, Inc. participates in the EU–US Data Privacy Framework. Transfers to the USA that fall within the scope of its valid certification take place on the basis of the relevant European Commission adequacy decision under Art. 45 GDPR. For other transfers where necessary, Zoom provides in its contractual documents for the use of standard contractual clauses adopted by the European Commission.

When using the services of Google and LinkedIn, personal data may be transferred to the USA. Google LLC and LinkedIn Corporation are certified participants in the EU–US Data Privacy Framework. Transfers that fall within the scope of their valid certification take place on the basis of the relevant European Commission adequacy decision under Art. 45 GDPR.

When using Meta services, personal data may be transferred to the USA. Meta Platforms, Inc. participates in the EU–US Data Privacy Framework, and transfers that fall within the scope of its valid certification take place on the basis of the European Commission adequacy decision under Art. 45 GDPR.

We may also make personal data available to recipients whose registered office or servers are located outside the European Economic Area. We carry out transfers outside the EEA only where the conditions of Chapter V GDPR are met.

Where a transfer is not covered by a European Commission adequacy decision, we will ensure appropriate safeguards under Art. 46 GDPR, in particular standard contractual clauses and, where necessary, supplementary measures.

Upon request, we will provide information on the safeguards applied to a specific transfer and on how to obtain a copy of them via the contact details set out in this Policy.

6. Rights of Data Subjects

As a data subject, you have the following rights under the GDPR:

Right of access to personal data (Art. 15 GDPR) – you have the right to obtain confirmation as to whether or not we process your personal data and, where that is the case, the right to access that personal data. You will be provided with a copy of the personal data being processed.
Right to rectification (Art. 16 GDPR) – you have the right to have inaccurate personal data concerning you rectified without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure — right to be forgotten (Art. 17 GDPR) – you have the right to have your personal data erased and no longer processed:

a) where the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

b) where you have withdrawn your consent or objected to the processing of personal data concerning you; or

c) where the processing of your personal data does not comply with the Personal Data Protection Act for other reasons; or

d) where the personal data must be erased for compliance with a legal obligation.

Right to restriction of processing (Art. 18 GDPR) – you have the right to have us restrict processing where:

a) you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;

b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;

c) we no longer need your personal data for the purposes of the processing, but you require it for the establishment, exercise or defense of legal claims;

d) the data subject has objected to processing, pending verification of whether our legitimate grounds override those of the data subject.

If you have obtained a restriction of processing, we will inform you before the restriction of processing is lifted.

Right to data portability (Art. 20 GDPR) – where the processing of personal data is carried out by automated means, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, machine-readable and interoperable format. You also have the right to ask us to transmit your personal data to a controller of your choice.

In this context, please note that we are not responsible for how you, or the company receiving the personal data, will process it. Data portability does not automatically result in the erasure of data from our systems and does not affect the original retention period applicable to the transmitted data.

Right to object to processing (Art. 21 GDPR) – you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you.
Right to object to direct marketing (Art. 21(2) and (3) GDPR) – where we process your personal data for direct marketing purposes, you have the right to object to such processing at any time. Once you object, we will no longer process your personal data for this purpose.
Right to withdraw consent – you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Please send requests to exercise your rights electronically to support@bonet.sk with the subject line “Data Protection”; or by registered post to the controller's registered office: bonet.systems, s.r.o., Binárium, Staré Grunty 18, 841 04 Bratislava – Karlova Ves district, or in person at the controller's registered office. We will respond to your request without undue delay and at the latest within one month. We may extend this period by a further two months where justified.

All your other rights and BONET's obligations in processing your personal data, even if not explicitly stated in this Policy, are governed by the Act and the GDPR, with which BONET strictly complies.

You also have the right to lodge a complaint if you believe that we are processing your personal data in breach of applicable law, by contacting the supervisory authority for personal data protection. This is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Galvaniho Business Centrum III, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic, tel.: +421 2 3231 3214, www.dataprotection.gov.sk, email: statny.dozor@pdp.gov.sk, zodpovednaosoba@pdp.gov.sk

7. Data Security

We apply appropriate technical and organizational measures to protect your personal data against unauthorized access, loss or destruction, including SSL/TLS encryption, access rights management and regular security audits.

Despite our security measures and efforts to protect your information, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals or other unauthorized third parties will not defeat our security and unlawfully collect, access, steal or modify your data.

You should only access the website in a secure environment.

8. Changes to This Policy

We reserve the right to update this Policy at any time. We will inform you of any changes by publishing an updated version on the website with a new effective date.

9. Contact Information

You may send questions or comments regarding this Policy to support@bonet.sk or by post to BONET's registered office as controller, as set out in Section 1 of this document.

This Privacy Policy is available on the website at https://bonet.systems/en/privacy-policy/.