In regards to GDPR and Data Protection, please contact gdpr@alvao.com.
In regards to IT security, please contact infosec@alvao.com.
ALVAO is fully committed to upholding its obligation to protect personal data. ALVAO continuously improves its Information Security Management System and holds the international ISO/IEC 27001 certification. Your personal data will be processed by ALVAO in accordance with applicable legislation, including the General Data Protection Regulation (GDPR).
This statement provides detailed information about how ALVAO processes your personal data.
This Declaration applies to the processing of personal data we collect if:
ALVAO s.r.o., with its registered office at Hlohová 1455/10, 591 01 Žďár nad Sázavou, Company ID: 25561561, Tax ID: CZ25561561, registered in the Commercial Register maintained by the Regional Court in Brno, file no. C 33290 (hereinafter as “ALVAO”), as the Controller, hereby informs you about the processing of your personal data and about your rights in accordance with the GDPR.
We process your data transparently, appropriately, in accordance with GDPR and generally binding legal regulations. We do not use personal data for automated decision-making.
You have the right to obtain confirmation as to whether or not your personal data is being processed, and if processing is taking place, you have the right to obtain access to such personal data and other information under the GDPR, in particular as to the purpose of their processing, the categories of personal data concerned, the categories of recipients to whom they have been or will be disclosed, and the planned period for which they will be stored. You also have the right to request the rectification of inaccurate personal data about you.
You have the right to request the erasure of personal data about you subject to one of the reasons listed in Art. 17 GDPR. For example, if the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed, or if you withdraw your consent to its processing as described below.
You have the right to request that ALVAO restricts the processing of your personal data if one of the cases specified in Art. 18 GDPR, in particular if you contest the accuracy of the personal data being processed.
If the processing of your personal data is in ALVAO’s legitimate interest, you have the right to object to such processing.
You also have the right to obtain your personal data processed by ALVAO in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller.
If you believe that the processing of your personal data violates the GDPR, you have the right to file a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection with its registered office at Pplk. Sochora 27, 170 00 Prague 7.
If you need to exercise any of your rights under the GDPR or the provision of information regarding the processing of personal data, please contact us by e-mail gdpr@alvao.com or in writing at the address given in the contacts section. You can submit the request in paper or electronic form, or in person. Verification of your identity is essential for the processing of your request. Always provide your current contact details for us to handle your request. The legitimacy of any request will be assessed within one month of its receipt. Given the complexity and number of requests, ALVAO is entitled to extend this deadline by another two months. You will be informed of any extension of the deadline immediately, but no later than one month after receiving the request, together with the reasons for such postponement.
If your personal data is processed on the basis of your consent, you are entitled to withdraw this consent at any time, electronically to e-mail gdpr@alvao.com or in writing to the address of the ALVAO registered office listed in the Contacts section. Consent can also be withdrawn via a link in the newsletter. If you withdraw your consent and there is no other legal reason for processing your data, ALVAO will delete your personal data or anonymize it.
If ALVAO does not process personal data itself, the processing may only be carried out on behalf of ALVAO by data processors based on a data processing agreement concluded with ALVAO in accordance with the GDPR (e.g. Microsoft Corporation, Google LLC, October CMS, HubSpot, and other providers of cloud services or software tools).
If you access social networks (such as Facebook, Instagram, LinkedIn) or the YouTube platform via our website, activating the respective button will automatically transmit your personal data to the relevant service provider. The scope of personal data transmitted is determined by the respective provider, who is also responsible for the protection of the personal data you have shared.
ALVAO will not transfer personal data to countries outside the European Union or to international organizations. However, this is with the exception of possible storage of data within cloud storage on servers in countries outside the European Union, which cannot be ruled out with regard to the conditions of the cloud storage operator. In such a case, the security of personal data will be ensured on the basis of the relevant adequacy decision of the European Commission, or by the use of standard contractual clauses issued by the European Commission in Decision 2021/914 of 4 June 2021, or according to the relevant subsequent implementing decision of the European Commission. Personal data may also be disclosed to the following third parties (recipients):
If you are a legal entity, this information applies to the processing of personal data if you transfer personal data of natural persons to ALVAO. Please refer to the section “Personal data of third parties”.
ALVAO, as a personal data controller, will process the personal data specified in the contract made between you and ALVAO, or in other documents prepared by the parties in connection with this contract, as well as personal data that ALVAO may obtain in connection with the performance of the contract or its conclusion. In particular, the following personal data will be processed:
ALVAO will process personal data for the following purposes:
a) For entering into a contract, i.e. for the implementation of measures prior to concluding a contract, within the meaning of Art. 6 para. 1 (b) GDPR. For this purpose, personal data will be processed until the Contract is entered into or until there is absolutely no doubt that the Contract will not be entered into.
b) For the performance of the rights and obligations of the Controller arising from the Contract within the meaning of Art. 6 para. 1 (b) GDPR. For this purpose, personal data will be processed for the duration of the contractual obligations.
c) For the purposes of the legitimate interest of the Controller within the meaning of Art. 6 para. 1 (f) of the GDPR to protect ALVAO’s rights related to the contract, its conclusion and performance, in particular to be able to demonstrate, if necessary, how and to what extent the contract was performed. For this purpose, personal data may be processed for the duration of the obligations arising from the contract and further for the period corresponding to the relevant limitation periods, usually for a maximum period of another 11 years from the termination of the obligations under the contract. This period is suspended if you exercise any right related to the contract with ALVAO or a public authority, until the substantive decision of the competent public authority on the exercise comes into force. You can object to the processing of personal data for this purpose in accordance with Art. 21 GDPR.
You are not legally obligated to provide ALVAO with personal data for the purposes listed above. However, if the personal data are not provided, it will not be possible to enter into and properly perform the contract and the related obligations and rights of the Controller.
Personal data of third parties
Thereto, ALVAO asks you to ensure that if you transfer personal data of a third natural person to ALVAO, such as your employee, who is to be the contact person for the purpose of performing the contract, that the personal data is transferred to ALVAO in accordance with the GDPR. In particular, it is necessary to ensure that this third party is informed in accordance with the GDPR that their personal data will be transferred to ALVAO and for what purpose.
The Controller will process these personal data for the purpose for which they were transferred to him, for example, for the purpose of communicating with you in the case of personal data of a contact person, for the necessary period of time to achieve the purpose of processing.
The Provider uses Microsoft Corporation as a cloud technology provider (Microsoft Azure Services) for the Online Application including the involvement of Microsoft tools using artificial intelligence, in particular Microsoft Azure AI services and Microsoft Copilot for Microsoft 365. Accordingly, any Personal Data stored or processed through the Online Application shall be processed through Microsoft Corporation and, where applicable, its subcontractors.
The Contracting Parties agree that when providing the Services to the Client, the Provider is bound by the obligations under Article 15 of this Contract only to the extent that Microsoft Corporation is bound to the Provider under the Microsoft Corporation License Terms, in particular, but not exclusively, under the Universal License Terms for Online Services (General License Terms for Online Services), accessible under the Microsoft Corporation website, currently: https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all. The Client agrees to the involvement of Microsoft tools using artificial intelligence (in particular Microsoft Azure AI Services and Microsoft Copilot for Microsoft 365) and acknowledges that the responsibility for the processing of data and Personal Data in such case lies with Microsoft Corporation. The Provider undertakes to use Microsoft Corporation's services in accordance with their terms and conditions published on Microsoft Corporation's website, in particular the Provider shall use the Azure OpenAI Service in accordance with the Code of Conduct for Microsoft Azure OpenAI Service available on Microsoft Corporation's website, currently: https://learn.microsoft.com/en-us/legal/cognitive-services/openai/code-of-conduct.
Cookies:
Our website uses cookies. Information on how we process cookies can be found here: Cookies and similar technologies
ReCAPTCHA
Our website may use the reCAPTCHA service provided by Google LLC (“Google”) to protect against automated spam and abuse. ReCAPTCHA is a security feature that ensures our website interacts only with real users, not automated bots.
You will be informed in the relevant section of our website when reCAPTCHA is in use. If you fill out a form or interact with a field secured by the reCAPTCHA service, you consent to the processing of additional personal data, particularly your interaction with our website (e.g. mouse movements and clicks), technical data about your device and browser (including your IP address), and a risk assessment generated by the reCAPTCHA service, which helps determine whether the user is likely a bot or a genuine user.
Personal data processed by the reCAPTCHA service is handled by Google in accordance with its Privacy Policy and Terms of Service.
Consent to commercial and marketing communication:
If you grant us consent to process your personal data for the purposes of commercial and marketing communication, we will use your data to contact you with offers of our products and services, including through targeted email campaigns, newsletters, phone calls, or via LinkedIn. Your personal data may also be corrected, supplemented, or updated using publicly available sources.
This processing of personal data is not time-limited and will continue until the consent is withdrawn.
You may withdraw your consent at any time by following the instructions provided in the received commercial message, by emailing us at gdpr@alvao.com, or in writing to the registered address of ALVAO listed in the Contacts section. If you withdraw your consent and no other legal basis for processing your data exists, ALVAO will delete or anonymize your personal data.
Newsletter:
By subscribing to our newsletter on our website, you give us your consent to receive commercial and marketing communication, in particular to use the following personal data for the purpose of sending commercial and marketing messages related to our products and services:
The aforementioned processing of personal data is not time-limited and ends with the withdrawal of consent to processing (see Consent to commercial and marketing communication).
E-books, demos and webinars:
If you request an e-book, demo or webinar on our website, we will process the following personal data:
We will process this personal data to fulfil ALVAO’s rights and obligations arising from the contract within the meaning of Art. 6 para. 1 (b) GDPR. For this purpose, personal data will be processed for the duration of the obligations under the contract (i.e. until the delivery of the requested e-book, demo or webinar).
Thereto, you give us your consent to use the personal data provided for the purpose of sending commercial and marketing communications related to our products and services. The aforementioned processing of personal data is not time-limited and ends with the withdrawal of consent to processing (see Consent to commercial and marketing communication).
Contact form:
If you contact ALVAO via the contact form on our website, you give us your consent to process the following personal data for the purpose of handling your request, inquiry or other information provided via the contact form:
Thereto, you give us your consent to use the personal data provided for the purpose of sending commercial and marketing communications related to our products and services. The aforementioned processing of personal data is not time-limited and ends with the withdrawal of consent to processing (see Consent to commercial and marketing communication).
4. If you seek employment
If you apply for a job in ALVAO, we will process the following personal data:
The provision of this personal data is voluntary. In this case, the legal basis for the processing of your data for the duration of the application procedure is the pre-contractual measures within the meaning of Art. 6 para. 1 (b) GDPR. We will process personal data for this purpose for the duration of the selection procedure.
If you provide your consent, we may retain and process your personal data for up to three years after the conclusion of the recruitment process, in order to contact you about potential future job opportunities that match your profile. You may withdraw your consent at any time (see Consent to the processing of personal data and its withdrawal).
5. If you are reporting under the Whistleblower Protection Act
If you use the option to file a report under the Whistleblower Protection Act, ALVAO will process your personal data to the extent specified in your report (usually your name, surname, e-mail address and telephone contact). These personal data will be processed only for the purpose of handling your report and for the period necessary to fulfil this purpose and further for the period stipulated by the Whistleblower Protection Act for the archiving of such data. Access to your personal data will only be given to a competent person within the meaning of the Personal Data Protection Act, unless otherwise provided by law.
6. Reporting the Presence of Illegal Content under the Digital Services Act
If you choose to report the presence of illegal content under the Digital Services Act, ALVAO will process your personal data to the extent provided in your report (typically your name, surname, and email address). This personal data will be processed for the purpose of fulfilling a legal obligation applicable to ALVAO, in accordance with Art. 6 para. 1 (c) GDPR, specifically to address your report. The data will be retained only for the time necessary to fulfil this purpose. Access to your personal data will be restricted to ALVAO employees authorized to handle reports of illegal content.
ILLEGAL CONTENT
Company ALVAO s.r.o. (hereinafter referred to as „Company“) ensure that its practices in providing hosting services comply with the Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (hereinafter referred to as “Digital Services Act”). The Company provides hosting services in particular in relation to provision of its products in form of Online application service.
An illegal content pursuant to the Digital Services Act means any information that, in itself or in relation to an activity, including the sale of products or the provision of services, is not in compliance with Union law or the law of any Member State of the European Union which is in compliance with Union law, irrespective of the precise subject matter or nature of that law.
For more information on illegal content please see the terms of Online application service, which are available here: https://www.alvao.com/en/licensing.
NOTICE ON ILLEGAL CONTENT
If any person or entity believes (the „notifier“) that the Online application service or any other hosting service of the Company contains illegal content, the notifier may submit a notice through e-mail address infosec@alvao.com to the Company. The notice must always contain following elements:
a) a sufficiently substantiated explanation of the reasons why the notifier alleges the information in question to be illegal content;
b) a clear indication of the exact electronic location of that information and, where necessary, additional information enabling the identification of the illegal content adapted to the type of content and to the specific type of hosting service;
c) the name or business name and e-mail address of the notifier submitting the notice, except in the case of information considered to involve one of the offences referred to in Articles 3 to 7 of Directive 2011/93/EU (i.e. offences concerning sexual abuse, sexual exploitation, child pornography, solicitation of children for sexual purposes, incitement, aiding and abetting, and attempt for mentioned offences); and
d) a statement confirming the bona fide belief of the notifier submitting the notice that the information and allegations contained therein are accurate and complete.
The Company shall investigate the information contained in the notice, assess their soundness and take a decision if there is a presence of illegal content and on the possibilities for redress in respect of that decision. If the notice is not sufficiently precise and adequately substantiated to enable the Company, upon careful examination, to discover the illegality of the activity or information in question without detailed legal review, the Company is not obligated to address it.
If the notice contains electronic contact information of the notifier, the Company shall, without undue delay, inform the notifier of the decision in respect of the information to which the notice relates, providing information on the possibilities for redress in respect of that decision.
The Company does not use automated processes while administrating the notice or taking decision on the notice.
Upon receipt of the notice, the Company may collect and process personal data of the notifier stated in the notice and of persons concerned in order to assess the soundness of the notice also without their consent. Information on personal data processing related to the notice and information on rights of subjects of data processing are contained in Company’s information on personal data processing available in section Privacy statement.
SINGLE POINT OF CONTACT
The company designates a single point of contact in order to communicate with EU Member States’ authorities, the Commission and European Board for Digital Services regarding Digital Services Act agenda through following e-mail address: infosec@alvao.com.
English and Czech language can be used to communicate with the above-mentioned single point of contact.
The company designates a point of contact in order to communicate with the customers regarding Digital Services Act agenda through following e-mail address: infosec@alvao.com.
TRANSPARENCY REPORTING OBLIGATIONS
The Company is not obliged to publish any report on any content moderation.
ALVAO s.r.o. is committed to protecting confidential information, business secrets, and personal data. Protecting the information of our customers, suppliers, employees, or jobseekers is included in our contracts or is enforced by the laws and/or regulations of the Czech Republic and the EU. We refer to all such data as a protected information. Every one of our staff is therefore obligated to protect this information and to do everything possible to prevent any of it from leaking out. The Company’s management undertakes that the Company will comply with ISO/IEC 27001:2014 accordingly to meet the goals of your organization, the risk level, and asset importance:
For ALVAO as a SaaS, we allow you to choose to store your data in one of three Microsoft Azure cloud data centers based on your preferred location - US, UK and EU. This choice allows you to meet your specific data storage needs and requirements in accordance with your security and privacy policies.
The company ALVAO s.r.o., with registered office Hlohová 1455/10, Žďár nad Sázavou 5, 591 01 Žďár nad Sázavou, ID number: 255 61 561, registered in the commercial register maintained by the Regional Court in Brno under sp. C 33290 (hereinafter referred to as "ALVAO") with effect from 20/09/2022 adopted the Whistleblowing Protection Directive, updated with effect from 01/09/2023.
The directive has been adopted in accordance with Act No. 171/2023 Coll., on the protection of whistleblowers (hereinafter "Whistleblower Act"). Although the implementation of an internal reporting system is voluntary for ALVAO, ALVAO has decided to implement the system in order to ensure a healthy work environment and workplace relations.
In accordance with the provisions of § 9 letter b) Whistleblower Act hereby ALVAO provides you with the following information:
You may make a notification if you are in the position of:
ALVAO excludes receiving notifications from persons who do not perform work or other similar activities for ALVAO according to § 2 paragraph 3 letter a), b), h) or i).
You can direct your notifications to the so-called Competent Person, which is:
You can submit a notification to the Competent Person in writing to his/her e-mail address, verbally via telephone contact, or at your request in person.
You also have the option of contacting the Ministry of Justice instead of the Competent Person, either in writing or verbally at the address provided for filing notifications, or by using the online form available here: Notifier - Ministry of Justice (justice.cz).
You can also submit a notification anonymously. If you decide to submit a notification anonymously, you can contact the person in charge in writing at his/her e-mail address or verbally by telephone.
ALVAO has a zero-tolerance approach to modern slavery, and we are committed to acting ethically and with integrity in all our business dealings and relationships and to implementing and enforcing effective systems and controls to ensure modern slavery is not taking place anywhere in our own business or in any of our supply chains. The Board of Directors and All employees are reminded annual of their obligations to this policy with training provided as required To ensure all those in our supply chain and contractors comply with our values we have in place a supply chain compliance program. All suppliers when reviewed (Either annually\new contract or prospective stage) are engaged to ensure that they to achieve the same ethical standards as ourselves.
Cookies are small text files placed on your device to store data that can be recalled by a web server in the domain that placed the cookie. We use cookies and similar technologies for storing and honoring your preferences and settings, enabling you to sign in, providing interest-based advertising, combating fraud, analyzing how our products perform, and fulfilling other legitimate purposes.
We also use “web beacons” to help deliver cookies and gather usage and performance data. Our websites may include web beacons, cookies, or similar technologies from third-party service providers.
You have a variety of tools to control the data collected by cookies, web beacons, and similar technologies. For example, you can use controls in your internet browser to limit how the websites you visit are able to use cookies and to withdraw your consent by clearing or blocking cookies.
Alvao uses cookies and similar technologies for several purposes, depending on the context or product, including:
Some Alvao webpages contain electronic tags known as web beacons that we use to help deliver cookies on our websites, count users who have visited those websites, and deliver co-branded products. We also include web beacons or similar technologies in our electronic communications to determine whether you open and act on them.
Finally, Microsoft products often contain web beacons or similar technologies from third-party analytics providers, which help us compile aggregated statistics about the effectiveness of our promotional campaigns or other operations. These technologies enable the analytics providers to set or read their own cookies or other identifiers on your device, through which they can collect information about your online activities across applications, websites, or other products. However, we prohibit these analytics providers from using web beacons on our sites to collect or access information that directly identifies you (such as your name or email address You can opt out of data collection or use by some of these analytics providers by visiting any of the following sites: Google Analytics (requires you to install a browser add-on).
In compliance with Regulation (EU) 2023/2854 (Data Act), we hereby inform our customers from EU/EEA countries about the available options for switching to another data processing service provider and provide additional information required under the Data Act.
If a customer chooses to switch to another data processing service provider, we provide individual assistance in accordance with the applicable service agreement. At this time, we do not offer self‑service automated switching tools.
When switching providers, exportable data is made available in the form of a standard SQL database backup or another commonly used machine‑readable format. Current details regarding data structures and formats are available in the Online Application documentation at: https://doc.alvao.com.
We do not charge any fees for providing cooperation during the switching process. If a fixed‑term agreement is terminated early as a result of the switch, we will require the customer to reimburse the discount granted from the standard service price for the entire period of service provision up to the early termination.
The information and communication technology infrastructure used for data processing within our services is subject to the jurisdiction of the state where the customer has chosen to store their data (see Microsoft Azure storage locations).
To prevent unlawful international access by public authorities to non‑personal data processed within our services, or its transfer, we apply the following measures:
We are certified under the ISO 27001 Information Security Management Standard.
In accordance with Article 37(12) of the Data Act, we designate the following entity as our legal representative: Feichtinger Žídek Fyrbach advokáti s.r.o., Company ID No. 29304873, with its registered office at Česká 154/12, Brno‑město, 602 00 Brno, Czech Republic, attorneys‑at‑law qualified to practice in the Czech Republic.