Privacy Policy

Controller

Business name: adcore s.r.o.
Registered office: Svätojurská ulica 6153/2, 902 01 Pezinok
Office: Dunajská 12, 811 08 Bratislava
Company ID (IČO): 51285495
Tax ID (DIČ): 2120671608
VAT ID (IČ DPH): SK2120671608
Registration: company registered in the Commercial Register of the Bratislava III Municipal Court, Section: Sro, Insert No. 125650/B
E-mail for personal data protection enquiries: hello@qzila.com
Data Protection Officer (DPO): Michaela Demovič, e-mail: dpo@qzila.com
E-mail for reporting security incidents: incident@adcore.sk
Website: qzila.com

adcore s.r.o. is the operator of the website qzila.com, the sign-in service identity.qzila.com and the tools interface tools.qzila.com, and the provider of the qzila service.

The sign-in service identity.qzila.com is also used for the gen360 service (data.qzila.com), which is likewise operated by adcore s.r.o.

1. Introductory Provisions

1.1adcore s.r.o. processes personal data in accordance with Regulation (EU) 2016/679 (hereinafter the “GDPR”) and Act No. 18/2018 Coll. on Personal Data Protection. This Privacy Policy explains what personal data we process, for what purposes and on what legal basis, to whom we disclose it, how long we retain it and what rights data subjects have.

1.2This Privacy Policy applies to the website qzila.com, the sign-in service identity.qzila.com, the interface tools.qzila.com and each tool on its own subdomain (for example dns-monitor.tools.qzila.com), and covers website visitors, persons who contact us or complete the partner form, qzila account holders, members of organisations, billing contacts, recipients of service e-mails and alerts, and persons whose data a customer enters into the tools.

2. Role of adcore s.r.o. in Data Processing

2.1In respect of the data of website visitors, prospective partners, account holders, members of organisations, billing contacts, recipients of service e-mails and users of cookies, adcore s.r.o. is the controller.

2.2adcore s.r.o. is the developer and owner of the qzila service and operates it itself. However, the purpose of processing the data that the customer or its users enter into the qzila tools is determined by the customer, and adcore s.r.o. therefore acts in respect of such data as a processor within the meaning of Art. 4(8) GDPR, that is, it processes such data on behalf of and on the instructions of the customer; this does not constitute commercial agency. Such data include, for example, data about colleagues in the IAM, People Lifecycle, Formulator or Time Tracking tools, addresses, URLs and files checked by the customer, or recipients of alerts.

2.3Such processing is governed by the data processing agreement (DPA), which forms part of the Terms and Conditions of the qzila service (Article 10) at qzila.com/terms. The customer is responsible for the purpose and legal basis of such processing.

3. What Personal Data We Process

The controller processes personal data only to the extent necessary for the relevant purpose. This may include, in particular, the following categories of data:

3.1 Website Visitor Data

Technical data received by every web server, in particular the IP address, browser type and requested page. In addition, the visitor’s choice in the cookie settings and, only where the visitor has given consent, data from the analytics and advertising tools Google Tag Manager, Google Analytics 4 and Google Ads.

3.2 Partner Form and Communication Data

Company name, country, name, e-mail address, website, profile and message content from the partner form. A submitted form is not stored in a database; its content is sent by e-mail to hello@qzila.com and technical records of the submission (recipient, subject and sender’s e-mail address) are retained for 30 days. In addition, the content of e-mail communication with the controller, support requests and records of their handling.

3.3 qzila Account Data

E-mail address, which also serves as the username, password stored exclusively in the form of a one-way hash, optional telephone number, language, sign-in method (password or Google, Microsoft or GitHub), two-step verification settings, identifiers of the browsers from which the user has signed in, and session data, that is, when and from which browser the user is signed in.

Each qzila tool receives only the user’s e-mail address and language from the account.

3.4 Organisation Data

The user’s membership of an organisation, the user’s role (owner, administrator, member) and information on who invited the user to the organisation.

3.5 Billing and Payment Data

The organisation’s billing profile, that is, company name, address, billing e-mail and, optionally, Company ID (IČO) and VAT ID (IČ DPH), as well as the organisation’s usage of individual tools, invoices and accounting documents. The customer enters payment card details directly into the Stripe service, which processes them as an independent controller in accordance with its own privacy policy. The controller sees only the card brand, its last four digits and its expiry date.

3.6 Service E-mails and Alerts

Data necessary for delivering sign-in codes, alerts set up by the customer, invoices, invitations and account notices, for example regarding an expiring card. Notices can be unsubscribed from with a single click.

3.7 Data Entered into the qzila Tools

Depending on the tools used, this includes in particular domains, URLs and hosts that the customer monitors or checks, files uploaded to the Safe Check or Secure Storage tools, screenshots and page text captured by the Snapshots and Typosquat Monitor tools, leaked e-mail addresses of the customer’s domain returned by the Have I Been Pwned service (Breach Monitor), persons, roles and contacts in the IAM tool, time records and absences in the Time Tracking tool, onboarding cases and personnel files in the People Lifecycle tool, form responses in the Formulator tool and recipients of alerts. We process these data as a processor in accordance with Article 2.

3.8 Technical and Security Data

Server logs including IP addresses, data necessary to secure the service and data processed by bot protection, that is, the IP address and browser signals received by the Cloudflare Turnstile service at registration and, once consent has been given, by the Google reCAPTCHA service in the partner form.

In order to resolve a support request, an authorised employee of the controller may sign in to a user’s account (so-called impersonation) only on the basis of an express request or consent of the owner or an administrator of the organisation, and only to the extent and for the time strictly necessary to resolve the request. In respect of data entered into the tools, this constitutes processing on the customer’s instructions under the DPA. Each such sign-in is recorded (who, when, to which account and for what reason), the record is retained for 12 months and the customer has access to it on request.

3.9 Special Categories of Personal Data

The controller does not require special categories of personal data (Art. 9 GDPR), data relating to criminal convictions and offences (Art. 10 GDPR) or birth numbers, and entering such data into the qzila tools is excluded unless separately agreed otherwise with the customer in writing. If the customer nevertheless enters such data, the customer is responsible for the existence of an appropriate legal basis and for fulfilling information obligations towards data subjects. An exception is information on an employee’s sick leave (incapacity for work) in the Time Tracking tool. This is health data which the customer, as employer, records in order to fulfil obligations in the field of employment and social security law under Art. 9(2)(b) GDPR. Only the fact and period of incapacity for work may be recorded, not the diagnosis or any other data on health status.

4. Purposes of Processing, Legal Bases and Retention Periods

5. Legitimate Interests of the Controller

Where we process personal data on the basis of legitimate interest, this concerns in particular the operation and security of the website and the service, protection against cyber threats, bots and misuse, communication with prospective customers, customers and partners, customer support and account notices, and the protection of legal claims. The data subject has the right to object to such processing.

6. Sources of Data

We obtain personal data directly from the data subject, from the sign-in provider (Google, Microsoft or GitHub) if the user chooses one, from the customer or a member of the organisation who invites the user or enters data into the tools, from Stripe to the extent set out in clause 3.5, automatically when the website and the service are used (logs, cookies) and from public and external sources used by the tools when performing checks, for example the Have I Been Pwned service.

7. Recipients of Personal Data

7.1We do not sell or trade personal data and we do not use it to train artificial intelligence models.

7.2Personal data may be disclosed only to the extent necessary to the following recipients:

7.3In the processing of data entered into the qzila tools, personal data may be disclosed to sub-processors only to the extent and under the conditions agreed with the customer in the DPA.

7.4We will provide information on changes to the list of recipients by updating this Privacy Policy.

8. Transfer of Personal Data outside the European Union and the European Economic Area

8.1We operate the qzila service in the European Union on Amazon Web Services infrastructure: the qzila tools in the Frankfurt (Germany) region, and the website qzila.com and the processing of the partner form in the Ireland region. Data, including backups, are stored in the EU. The website is delivered to visitors via the Amazon CloudFront network, which processes technical request data (in particular the IP address) on the server nearest to the visitor.

8.2Some of the recipients listed in Article 7 have their registered office or infrastructure outside the EU/EEA, in particular in the United States of America, or operate globally.

8.3Where personal data are transferred outside the EU/EEA, we ensure that the transfer takes place only where an appropriate legal mechanism exists, in particular:

a)on the basis of an adequacy decision of the European Commission,

b)for certified recipients in the USA, on the basis of the EU-U.S. Data Privacy Framework,

c)on the basis of standard contractual clauses approved by the European Commission,

d)on the basis of other appropriate safeguards under the GDPR.

8.4For individual recipients, transfers are safeguarded as follows:

8.5The list of companies certified under the EU-U.S. Data Privacy Framework is published at dataprivacyframework.gov. A copy of the standard contractual clauses may be obtained from dpo@qzila.com.

9. Cookies and Similar Technologies

9.1The storing of information in, and access to information stored in, terminal equipment is governed by Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications. The website qzila.com and the qzila service use the following cookies:

9.2Strictly necessary cookies are required for the proper functioning of the website or the service and are used without the visitor’s consent.

9.3We use analytics and advertising cookies and the Google reCAPTCHA service only on the basis of the visitor’s consent given in the cookie settings.

9.4The visitor may change or withdraw their consent at any time via the “Cookie settings” link in the website footer or in their browser settings.

9.5The website and the tools also store minor settings, such as the language or the selected organisation, in the browser’s local storage (local storage and session storage). These data do not leave the user’s device.

9.6The fonts used on the website and in the tools are hosted on our servers; no data are transmitted to Google or any other third party when they are loaded. The Google reCAPTCHA service, which protects the partner form against misuse, is loaded only once consent has been given in the cookie settings. If the visitor does not give consent, they may contact us by e-mail at hello@qzila.com instead of using the form.

10. Security of Personal Data

10.1The controller adopts appropriate technical, organisational and personnel measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.

10.2The measures adopted include in particular:

a)encryption of communications (TLS 1.2 and higher, HSTS),

b)encryption of databases, backups and files (AES-256), key management in AWS KMS and a separate key for each vault in the Secure Storage tool,

c)storage of passwords exclusively in the form of a scrypt hash,

d)a verification code sent by e-mail or SMS when signing in from a new browser,

e)roles within the organisation (owner, administrator, member), least privilege and logical separation of the data of individual organisations,

f)a strict Content Security Policy and a web application firewall,

g)logging and monitoring,

h)continuous database backup with point-in-time recovery to any moment within the last 35 days, with backups stored in the EU,

i)regular risk assessment and regular testing, assessing and evaluating the effectiveness of the measures (Art. 32(1)(d) GDPR),

j)confidentiality, instruction and security training of authorised persons.

11. Automated Processing and Profiling

11.1The qzila tools automatically check domains, servers, pages, files and configurations; their assessments relate to technical systems, not to natural persons. We do not carry out decision-making based solely on automated processing, including profiling, which produces legal or similarly significant effects within the meaning of Art. 22 GDPR.

12. Obligation to Provide Personal Data

12.1The provision of data necessary for creating an account and for billing is a contractual requirement; without such data it is not possible to create an account or provide the service. Consent to analytics and advertising cookies is voluntary and refusing it does not affect the use of the website or the service.

13. Rights of the Data Subject

13.1The data subject has the right of access to their personal data, the right to rectification and erasure, the right to restriction of processing, the right to data portability, the right to object to processing based on legitimate interest, the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal and the right not to be subject to a decision based solely on automated processing, in each case under the conditions laid down in the GDPR.

13.2The data subject may exercise their rights by e-mail at hello@qzila.com or directly with the Data Protection Officer at dpo@qzila.com. It is best to send the request from the e-mail address that is the username of the qzila account. Exercising rights is free of charge; we may charge a fee only for manifestly unfounded or excessive requests under Art. 12(5) GDPR.

13.3In response to a request for access or portability, we will provide the personal data in a structured, commonly used and machine-readable format (JSON or CSV). In response to a request for erasure, we will close the account and erase the personal data from active systems within 30 days and from backups within 35 days; data that we are required to retain by law (in particular invoices and accounting documents) will be erased after the statutory period has expired. We will confirm in writing that the request has been handled.

13.4We will respond to a request without undue delay and no later than within one month; in justified cases this period may be extended by a further two months. Where there are reasonable doubts, we may request verification of identity. Requests concerning data in respect of which we act as a processor will be forwarded to the relevant customer.

14. Right to Lodge a Complaint with a Supervisory Authority

14.1If the data subject considers that the processing of their personal data infringes the law, they have the right to lodge a complaint or a petition to initiate proceedings with the supervisory authority.

Supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Slovak Republic

E-mail: statny.dozor@pdp.gov.sk
Web: dataprotection.gov.sk

15. Retention and Erasure of Data

15.1We retain personal data only for the period specified in Article 4 and then erase or anonymise them. We may retain them for longer where necessary to protect legal claims, comply with a legal obligation or resolve a security incident.

15.2Backups may contain personal data for no more than 35 days after their erasure; access to backups is restricted and they are not used for ordinary processing.

16. Processing of Children’s Data

16.1The website and the qzila service are not intended for children and we do not knowingly collect personal data from them. If we discover that we have obtained such data without a legal basis, we will erase them.

17. Changes to this Privacy Policy

17.1We may update this Privacy Policy, in particular in the event of changes to legislation, tools, recipients or the manner of processing. The current version is always available at qzila.com/privacy; we will give notice of material changes on this page and, to account holders, also by e-mail before they take effect.

In Pezinok, 20 October 2026
adcore s.r.o.