NIS2 READYController of personal data
The controller of personal data responsible for processing personal data is:
ITACON s.r.o., Kominárska 2, 831 04 Bratislava – city district Nové Mesto, Company ID (IČO): 50838563, Registered in the Commercial Register of the District Court Bratislava III, Section: Sro, Insert No. 118905/B.
Contact for questions concerning personal data protection: tazilla@itacon.sk
ITACON s.r.o. acts as the data controller exclusively in relation to personal data processed for the purposes of managing user accounts, ensuring the operation of the application, billing, and compliance with legal obligations.
The Customer acts as the data controller for all personal data entered into the Tazilla application. In this case, the Provider (ITACON s.r.o.) acts as a data processor pursuant to Article 28 of the GDPR and processes the data strictly on the basis of the Customer’s instructions under a Data Processing Agreement (DPA).
What Personal Data We Process
When the Tazilla application is used and we act as the Controller, we may process the following categories of personal data:
- Identification data: user’s first and last name.
- Contact data: e-mail address, telephone number (if provided), job role or position.
- Organization data: name of the organization.
- Billing and contractual data: if the user upgrades to a paid version of the Service.
- Communication data: messages and requests submitted by email or directly through the application.
These data are processed as part of the operation of the service.
The Customer acts as the data controller for all personal data entered into the Tazilla application, that the Provider processes on the Customer’s behalf. In this case, the Provider (ITACON s.r.o.) acts as a data processor pursuant to Article 28 of the GDPR and processes the data to the following extent:
- Technical and operational data: IP address, activity logs within the application, access time, records of activities within the application necessary for its use.
- Data entered by the user in connection with the use of the Service (for example, information about users, assets, processes, security events, etc.).
Processing consists of technical administration, including:
- storing data in a database (storage),
- retaining data on servers during the use of the Service,
- technical transmission of data within the system,
- creating and maintaining backups,
- logging events,
- providing a software platform in which the Customer processes the data.
The Provider does not access the content of the data for the purpose of reading, interpreting, or reviewing it and does not process the data for its own purposes. The fact that the Provider does not actively read or substantively process the data does not affect the obligation to conclude a data processing agreement, as the GDPR considers even the mere storage and technical administration of data to constitute processing.
Purposes and Legal Bases for Processing
We process personal data for the following purposes:
| Purpose of processing and legal basis | Categories of personal data | Nature of processing | Categories of data subjects |
| Initial access credentials management based on consent or contract | Identification and contact data (first name, last name, e-mail, job role or position) | Creation of an initial user account for the purpose of first access to the application | Employees and users of the Controller and/or other third parties defined by the Controller |
| Ensuring operation and development of the application based on contract | Identification and contact data (first name, last name, job role or position), organizational data, authorization data, user-provided data within the use of the service (e.g., information about users, assets, processes, security events, certificates of individuals, etc.) | Technical processing of data entered into the application by the user | Employees and users of the Controller and/or other third parties defined by the Controller |
| Accounting and invoicing based on legal obligation | Billing and contractual data | Maintaining accounting records and issuing invoices | Selected employees and users of the Controller and/or other third parties defined by the Controller |
| Marketing communication based on consent | Identification and contact data (first name, last name, e-mail, job role or position) | Contacting customers regarding new functionalities, improvements, pricing, etc. | Selected employees and users of the Controller and/or other third parties defined by the Controller |
| Creation of an initial organization profile from publicly available sources as a basis for AI Functions (legitimate interest pursuant to Article 6(1)(f) GDPR). | Information about the organization and publicly available professional or contact details of natural persons acting on behalf of the organization. | Searching, aggregation, and automated processing of publicly available information for the purpose of generating supporting proposals or recommendations through AI Functions. | Employees, statutory representatives, contact persons of the Customer, or other persons publicly associated with the organization. |
Data Retention
- Personal data are retained only for as long as necessary for the purpose for which they were collected.
- Operational logs and application usage data: 12 months.
- Billing and accounting data: 10 years (in accordance with legal requirements).
- Data processed based on consent: until the consent is withdrawn.
Rights of Data Subjects
As a user, you have the right to:
- access your personal data,
- rectify inaccurate data,
- request erasure (“right to be forgotten”),
- restrict processing,
- object to processing based on legitimate interests,
- request data portability,
- withdraw consent for marketing communications at any time.
You may exercise your rights by contacting us at: tazilla@itacon.sk
Disclosure of Personal Data to Third Parties
Personal data may be shared with:
- providers of cloud infrastructure and technical operations,
- providers of analytical tools (e.g. web analytics),
- providers of accounting and invoicing services,
- providers of artificial intelligence services used within the AI Functions of the Service, to the extent necessary for their provision.
Tazilla Service is hosted on servers located within the European Union, in data centers certified under ISO/IEC 27001.
Transfers of personal data outside the EU/EEA may occur when using AI Functions of the Service if such functions are provided through third-party services located outside the EU/EEA. Such transfers may concern data entered by the User into AI Functions or data necessary to ensure their functionality. The Provider carries out such transfers using appropriate safeguards in accordance with GDPR, in particular Standard Contractual Clauses, where required under GDPR.
Data Security
The Controller implements appropriate technical and organizational measures (TOMs) in accordance with the Statement of Applicability (SoA), including data backups performed at least once per day. Backups are retained for 30 calendar days and subsequently securely deleted.
In operating the Tazilla platform, the Provider relies on the services of a consortium partner that holds certification for Information Security Management System in accordance with ISO/IEC 27001 and certification for a Quality Management System under ISO 9001:2015.
Complaints
If you believe that your personal data are being processed in violation of the law, you have the right to lodge a complaint with:
Office for Personal Data Protection of the Slovak Republic
Námestie 1. mája 18, 811 06 Bratislava
Website: www.dataprotection.gov.sk
Effective Date
This Privacy Policy becomes effective on the date of its publication on www.tazilla.com – 1. September 2026