Privacy policy
This Privacy Policy (hereinafter referred to as the “Policy”) explains how LEDCO s.r.o. processes the personal data of website visitors, customers, prospective customers, business partners, persons interested in our services, job applicants and other persons who communicate with us.
This Policy applies in particular to the processing of personal data through the website https://ledco.sk/en/, contact and enquiry forms, e-mail and telephone communication, newsletters and LEDCO company profiles on social media.
1. Identification of the controller
The controller of your personal data is:
Registered office: Logistická 479/11, 919 26 Zavar, Slovak Republic
Showroom, business premises and correspondence address: Logistická 11, 917 01 Trnava, Slovak Republic
Company ID No.: 45 502 030
Tax ID No.: 2023022045
VAT ID No.: SK2023022045
Registered in the Commercial Register of the Slovak Republic, Section Sro, Insert No. 25483/T
E-mail: ledco@ledco.sk
Telephone: +421 948 708 008
For matters concerning the processing and protection of personal data, you may contact us at dpo@ledco.sk or in writing at either of the addresses stated above.
The e-mail address dpo@ledco.sk serves as a contact address for privacy-related enquiries. Its publication does not in itself mean that LEDCO s.r.o. has appointed a Data Protection Officer under Articles 37 to 39 of the GDPR.
2. Applicable legislation
We process personal data primarily in accordance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”),
- Act No. 18/2018 Coll. on Personal Data Protection, as amended,
- Act No. 452/2021 Coll. on Electronic Communications, as amended,
- and other generally binding legislation applicable to our activities.
3. Principles of personal data processing
We process personal data lawfully, fairly and transparently. We collect only data that is adequate and necessary for a specific purpose, protect it against unauthorised access and do not retain it for longer than necessary.
We do not normally request special categories of personal data, such as health data, biometric or genetic data, information about political opinions or religious beliefs, through our website. Please do not send us such information unless it is necessary and has been agreed with us in advance.
4. Personal data we may process
Depending on how you communicate with us or use our services, we may process in particular:
- your first name, surname and title,
- company name, job title and information about the organisation you represent,
- e-mail address, telephone number and correspondence address,
- the content of messages, enquiries, orders and other communications,
- information about the requested project, property, installation or technical solution,
- photographs, videos, testimonials or statements provided by you or published with your permission,
- information contained in a CV or job application,
- IP address, device and browser data, website activity and other online identifiers,
- information necessary to protect the website, information systems and our legal claims.
5. Purposes, legal bases and retention periods
| Purpose of processing | Personal data processed | Legal basis | Retention period |
|---|---|---|---|
| Responding to messages, questions and enquiries submitted through forms, e-mail, telephone, chat or social media | Identification and contact details, content of the communication and information voluntarily provided by you | Article 6(1)(b) GDPR where the communication is aimed at entering into a contract; otherwise Article 6(1)(f) GDPR – our legitimate interest in responding to the communication | Generally no longer than 3 years from the last communication, unless a contractual relationship is established or a longer retention period is necessary |
| Preparing quotations and projects, entering into and performing contracts, orders, installations and service work | Identification, contact, contractual and technical data, and information about the project, property and installation | Article 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract; Article 6(1)(c) GDPR – compliance with legal obligations | For the duration of the contractual relationship and subsequently for periods required by law or necessary for the protection of legal claims |
| Sending newsletters to persons who have subscribed | E-mail address, potentially your name, records of consent and interaction with newsletters | Article 6(1)(a) GDPR – consent; relevant provisions of Act No. 452/2021 Coll. | Until consent is withdrawn or the recipient unsubscribes. Information required to demonstrate consent or its withdrawal may be retained for the period necessary to protect our rights |
| Informing existing customers about our own similar products and services | E-mail address and information about a previous purchase or service | Article 6(1)(f) GDPR – legitimate interest in direct marketing, where the conditions of Act No. 452/2021 Coll. are met | Generally no longer than 3 years from the last purchase or use of a service, or until an objection is raised or the recipient unsubscribes |
| Publishing testimonials, customer stories, photographs and videos from completed projects | Name, surname, photograph, video, voice, job title, organisation, statement and location or description of the project | Article 6(1)(a) GDPR – consent; in justified cases Article 6(1)(f) GDPR where only proportionate business partner or project information is published | For the duration of publication, until consent is withdrawn or until the agreed period expires |
| Publishing professional and business contact details of team members and cooperating persons | Name, surname, photograph, job title, business e-mail address and business telephone number | Article 6(1)(f) GDPR – legitimate interest in ensuring business and professional communication; consent where appropriate in view of the nature of the published information | For the duration of the employment or contractual relationship, or until the purpose of publication ceases to exist |
| Measuring website traffic, evaluating use of the website and personalising advertising | IP address, online identifiers, device and browser information, pages visited and interactions | Article 6(1)(a) GDPR – consent given through the cookie banner, unless the cookies are technically necessary | According to the technology used and cookie settings, for no longer than the period specified in the Cookie Policy or until consent is withdrawn |
| Website security and prevention of misuse, fraud and cyberattacks | IP address, technical and security logs, device and browser information and requests made | Article 6(1)(f) GDPR – legitimate interest in protecting the website and information systems | Generally no longer than 12 months; in the event of a security incident or legal claim, for a longer period where necessary |
| Communication and management of LEDCO profiles on social media | Information contained in your profile, comments, reactions, messages and other information provided by you | Article 6(1)(f) GDPR – legitimate interest in communication, company presentation and responding to messages; Article 6(1)(b) GDPR where applicable | Depending on the nature of the communication, generally no longer than 3 years. Information retained by the social media provider is governed by its own terms |
| Recruitment and assessment of job applicants | Information contained in a CV, cover letter, job application and related communication | Article 6(1)(b) GDPR – steps taken prior to entering into an employment contract; Article 6(1)(a) GDPR – consent where the applicant is added to a database of potential future candidates | Generally no longer than 6 months after the end of the recruitment process; where consent has been given for future opportunities, until it is withdrawn or for the stated period |
| Responding to data subject requests and recording compliance with GDPR obligations | Identification and contact details, content of the request, method used to verify identity and our response | Article 6(1)(c) GDPR – compliance with a legal obligation; Article 6(1)(f) GDPR – demonstrating compliance and protecting legal claims | Generally 5 years from the completion of the request, unless there is a reason for longer retention |
| Establishing, exercising or defending legal claims | Information connected with the relevant legal relationship, communication or dispute | Article 6(1)(f) GDPR – legitimate interest in protecting the company’s rights | For the duration of the applicable limitation periods and any judicial, administrative or other proceedings |
6. Legitimate interests
Where we process personal data on the basis of a legitimate interest, we always assess whether our interests are overridden by your interests, fundamental rights or freedoms.
Our legitimate interests include in particular:
- responding to communications and enquiries that are not directly aimed at entering into a contract,
- protecting our website, information systems, assets and legal claims,
- maintaining proportionate records of business communications,
- presenting the company, its team, professional activities and completed projects,
- direct marketing of our own similar products and services to existing customers to the extent permitted by law.
7. Sources of personal data
We obtain personal data primarily directly from you, for example when you:
- complete a contact or enquiry form,
- contact us by e-mail, telephone, chat or social media,
- request a quotation, project, service or another service,
- subscribe to our newsletter,
- apply for employment,
- give us permission to publish a testimonial, photograph or video.
Some technical information is collected automatically when you use the website. To an appropriate extent, we may also obtain information from the person or organisation you represent, from a business partner, from public registers or from publicly available professional sources.
8. Is providing personal data mandatory?
Providing personal data is voluntary unless it is required by law or necessary for entering into and performing a contract.
If you do not provide information required to respond to an enquiry, prepare a quotation, enter into a contract or deliver a service, we may be unable to process your request.
Consent to newsletters, analytical or marketing cookies, or publication of a testimonial or photograph is voluntary. Refusing consent does not affect your ability to use our other services.
9. Recipients and processors
Personal data may be made available, to the extent necessary, to our employees, contractors and suppliers who require it to perform their employment or contractual duties.
Categories of recipients and processors include in particular:
- providers of web hosting, website administration, IT support, backup and cybersecurity services,
- providers of e-mail, cloud and communication services,
- providers of newsletter distribution and marketing communication tools,
- providers of analytics, advertising and measurement tools, where you have given the relevant consent,
- operators of social networks and multimedia platforms,
- accounting, tax, legal and professional advisers,
- suppliers, installation and service companies or business partners where necessary to process your request or perform a contract,
- public authorities, courts, law enforcement authorities or supervisory bodies where required by law or a legally binding decision.
Where required by the nature of their activities, we enter into data processing agreements with processors pursuant to Article 28 GDPR. Processors may process personal data only in accordance with our instructions and must ensure an appropriate level of protection.
10. Social media
LEDCO operates company profiles primarily on Facebook, Instagram, LinkedIn and YouTube. When you visit these profiles or interact with their content, the relevant social media provider also processes personal data under its own privacy terms.
Depending on the particular function, we and the social media provider may act as separate or joint controllers, for example when generating aggregated statistics about visits to and use of a company profile.
We do not have complete control over the personal data collected by a social media provider, how it combines such data with other information or how long it retains it. We therefore recommend reviewing the privacy policy of the relevant platform.
11. Transfers of personal data to third countries
Some providers of technical, analytics, marketing, cloud or social media services may process personal data outside the European Economic Area, particularly in the United States of America.
Where personal data is transferred to a third country, the transfer is carried out only where the requirements of the GDPR are met, in particular on the basis of:
- an adequacy decision adopted by the European Commission,
- the recipient’s certification under the EU–US Data Privacy Framework, where applicable,
- standard contractual clauses approved by the European Commission,
- or another lawful transfer mechanism accompanied by appropriate supplementary safeguards.
Information about the specific transfer mechanism will be provided upon request to the extent that it relates to the processing of your personal data.
12. Cookies and similar technologies
Our website uses cookies and similar technologies. Technically necessary cookies may be used without consent because they are required for the proper operation and security of the website.
Analytics, preference and marketing cookies are used only on the basis of your consent, unless otherwise permitted by law. You may change or withdraw your consent at any time through the cookie settings available on the website.
More detailed information about the cookies used, their providers, purposes and validity periods is available in our Cookie Policy.
13. Automated decision-making and profiling
We do not carry out automated individual decision-making within the meaning of Article 22 GDPR that would produce legal effects concerning you or similarly significantly affect you.
If you have consented to analytics or marketing technologies, their providers may evaluate your activity and interests for measurement or advertising personalisation purposes. You may restrict or stop such processing by withdrawing consent for the relevant category of cookies.
14. Your rights
Subject to the conditions laid down in the GDPR, you have the following rights in relation to the processing of your personal data:
Right of access
You have the right to obtain confirmation as to whether we process your personal data and, where we do, to obtain access to the data and information about its processing. You also have the right to obtain a copy of the personal data being processed.
Right to rectification
You have the right to request the correction of inaccurate personal data and the completion of incomplete data.
Right to erasure
You have the right to request the erasure of personal data, particularly where the data is no longer necessary for the purpose for which it was collected, where you have withdrawn consent or where the data has been processed unlawfully. The right to erasure does not apply where further processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
Right to restriction of processing
You have the right to request restriction of processing, for example where you contest the accuracy of the data, the processing is unlawful or you have objected to processing based on a legitimate interest.
Right to data portability
Where processing is carried out by automated means on the basis of consent or a contract, you have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.
Right to object
You have the right to object to the processing of personal data based on our legitimate interest. Following an objection, we will no longer process the data unless we demonstrate compelling legitimate grounds that override your rights and interests or unless the processing is necessary for legal claims.
Right to withdraw consent
Where we process personal data on the basis of consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
Right to lodge a complaint
If you believe that we process your personal data in breach of applicable legislation, you have the right to lodge a complaint or submit a request for proceedings to the Office for Personal Data Protection of the Slovak Republic.
15. How to exercise your rights
You may exercise your rights:
- by e-mail at dpo@ledco.sk,
- in writing at LEDCO s.r.o., Logistická 479/11, 919 26 Zavar, Slovak Republic,
- or at our correspondence address: LEDCO s.r.o., Logistická 11, 917 01 Trnava, Slovak Republic.
Your request should contain sufficient information to enable us to identify what it concerns. Where we have reasonable doubts about your identity, we may request additional information necessary to verify it.
We will respond without undue delay and no later than one month after receiving your request. Taking into account the complexity and number of requests, this period may be extended by a further two months. We will inform you of any extension and the reasons for it within the original one-month period.
Requests are handled free of charge. Where a request is manifestly unfounded or excessive, particularly because of its repetitive nature, we may charge a reasonable administrative fee or refuse to act where permitted by the GDPR.
16. Supervisory authority
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Slovak Republic
Website: https://dataprotection.gov.sk/
E-mail: statny.dozor@pdp.gov.sk
Telephone: +421 2 32 31 32 14
17. Security of personal data
We implement appropriate technical and organisational measures to protect personal data, taking into account the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of natural persons.
These measures include access control, protection of user accounts, security updates, backups, website and network protection, security event logging, contractual confidentiality obligations and regular reviews of the adequacy of the measures implemented.
18. Additional privacy notices
Separate privacy notices may apply to certain processing activities, including:
- our Cookie Policy,
- information about personal data processing in our online store,
- information for employees and job applicants,
- information about CCTV systems where such systems are used at a particular location,
- information provided directly alongside a particular form, consent request or service.
Where a separate privacy notice differs from this Policy, the more specific notice will take precedence in relation to the relevant processing activity.
19. Effective date and amendments
This Policy is valid and effective from 29 July 2026.
We may update this Policy where appropriate, particularly following changes to legislation, technologies, service providers or methods of processing personal data. The current version will always be published on this website together with its effective date.