Privacy Policy

1. Introductory provisions

1.1. Purpose of this Policy. The purpose of this privacy policy (the "Privacy Policy") is to inform you about the processing of personal data in connection with the operation of the core3 cloud service (the "Service") and the www.core3.digital website including its language versions (the "Website").

1.2. About the Service. core3 is business software provided as an online service that lets companies manage attendance and planning, projects, human resources (HR), customer relationships (CRM), finance, ticketing and automations in one place, and work with company data using artificial intelligence features (the "AI features"). The Service is intended for businesses and organisations (the "Customer").

1.3. Legal framework. We provide the information in this Privacy Policy under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (the "GDPR") and Slovak Act No. 18/2018 Coll. on the protection of personal data (the "Data Protection Act").

1.4. Who is a data subject. Every natural person whose personal data we process is a data subject within the meaning of the GDPR (the "Data Subject" or "you").

1.5. Terms. Capitalised terms have the meaning given in this Privacy Policy or in the core3 Terms of Service published on the Website (the "Terms of Service"). Unless stated otherwise, terms defined in Article 4 GDPR have the same meaning as in the GDPR.

1.6. Related documents. The use of cookies and similar technologies is governed by the Cookie Policy. Rights and obligations when using the Website, the Demo Environment and the Service are governed by the Terms of Service. The processing of data that the Customer enters into the Service is also governed by the data processing agreement concluded with the Customer.

1.7. Availability. We publish this Privacy Policy on the Website so that you have continuous access to it and can save and reproduce it.

2. Who we are

2.1. Company. The Website is operated and the Service is provided by: Company name: IGT Systems s. r. o. Registered office: Sliačska 1234/34, 831 02 Bratislava - Nové Mesto, Slovakia Company ID (IČO): 46 239 553 Tax ID (DIČ): 2023298134 VAT ID: SK2023298134 Registration: Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No.: 74177/B E-mail: core@igt-systems.com Phone: +421 902 180 600 (the "Company" or "we")

2.2. Data protection officer. The Company has not appointed a data protection officer (DPO), as it is not legally required to do so. In all data protection matters, please contact the Company directly as described in Article 13 of this Privacy Policy.

3. What is our role in processing personal data?

3.1. The Company as controller. The Company is the controller of personal data it processes for its own purposes, in particular:

• a) operating and securing the Website;
• b) handling enquiries sent through the contact form, by e-mail or by phone and arranging consultations;
• c) creating and operating a Demo Environment registered on the Website;
• d) concluding and performing contracts with Customers, including managing Customer accounts, invoicing and customer support;
• e) securing the Service and preventing its misuse;
• f) sending information about core3 news and offers;
• g) handling Data Subject requests and establishing or defending the Company's legal claims.

3.2. The Company as the Customer's processor. Data that the Customer or its users enter into the Service (for example employee data in the HR and attendance modules, customer contacts in the CRM, project and financial data or ticket content) is processed on behalf of and on the instructions of the Customer. For this data, the Customer is the controller and the Company is its processor within the meaning of Article 28 GDPR. This processing is governed by the data processing agreement between the Company and the Customer and by the Customer's instructions.

3.3. Customer responsibility. Where the Company acts as a processor, the Customer is responsible for having a legal basis for the processing and for informing the Data Subjects. If you are an employee or a client of one of our Customers and have questions about the processing of your data in core3, please contact that Customer first. We will assist them on request.

4. Whose personal data do we process?

4.1. Data Subjects. In connection with the Website and the Service, we process as controller the personal data of, in particular:

• a) Website visitors;
• b) prospective customers who contact us through the contact form, by e-mail or by phone;
• c) prospective customers who create a Demo Environment on the Website;
• d) contact persons, statutory representatives and users of Customers for whom we set up and manage access to the Service;
• e) contact persons of the Company's suppliers and business partners.

4.2. Scope of processing. The purposes of processing, categories of personal data, legal bases and retention periods for each category of Data Subjects are set out in Article 5 of this Privacy Policy.

5. Purposes, categories of personal data, legal bases and retention periods

5.1. Overview of processing activities. Below is an overview of the processing activities for which the Company is the controller. A limitation or preclusion period means the period under the applicable laws for the claims concerned.

Processing activity No. 1: Handling contact form enquiries and arranging consultations

Categories of personal data: Name and surname, company name, e-mail address, phone number and message content.

Legal basis: Taking steps at the request of the Data Subject prior to entering into a contract (Article 6(1)(b) GDPR); where the Data Subject acts on behalf of another entity, the Company's legitimate interest in responding to the enquiry (Article 6(1)(f) GDPR).

Retention period: For the time needed to handle the enquiry and then four (4) years from the last communication, unless a contractual relationship arises.

Statutory/contractual requirement and consequences: Providing the data is voluntary, but without it we cannot respond to the enquiry.

Processing activity No. 2: Creating and operating a Demo Environment

Categories of personal data: Name and surname, e-mail address, phone number, organisation name, chosen Demo Environment domain, preferred language, time zone, selected organisation type, optional organisation description, login credentials and records of Demo Environment usage.

Legal basis: Performance of the contract for the provision of the Demo Environment under the Terms of Service or taking steps prior to entering into a contract (Article 6(1)(b) GDPR).

Retention period: For as long as the Demo Environment exists. If the Demo Environment capacity is full, we keep the registration in the queue until the Demo Environment is created or the request is withdrawn. After the Demo Environment ends, we keep the contact details for another four (4) years for communication under activity No. 4, unless a contractual relationship arises.

Statutory/contractual requirement and consequences: Providing the data is a contractual requirement. Without it, the Demo Environment cannot be created and the access details cannot be delivered.

Processing activity No. 3: Concluding and performing the contract with the Customer

Categories of personal data: Name and surname, position, e-mail address and phone number of the Customer's contact persons and statutory representatives, identification and billing details, login credentials and user account settings, details of subscribed plans and modules.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR); where the Data Subject is not a party to the contract, the Company's legitimate interest in concluding and performing the contract with the Customer (Article 6(1)(f) GDPR). For billing and accounting data, compliance with legal obligations under accounting and VAT laws (Article 6(1)(c) GDPR).

Retention period: For the term of the contract and then for the limitation or preclusion period. Accounting documents are kept for the period required by accounting and tax laws (usually 10 years from the end of the year to which they relate).

Statutory/contractual requirement and consequences: Providing the data is a contractual and statutory requirement. Without it, the contract cannot be concluded or performed.

Processing activity No. 4: Communication and customer support

Categories of personal data: Name and surname, e-mail address, phone number, content of communication and data needed to resolve the request.

Legal basis: The Company's legitimate interest in effective communication with prospects and Customers (Article 6(1)(f) GDPR); for support provided under a contract, performance of the contract (Article 6(1)(b) GDPR).

Retention period: Four (4) years from the last communication.

Statutory/contractual requirement and consequences: Providing the data is voluntary. You may object to the processing.

Processing activity No. 5: Securing the Website and the Service and preventing misuse

Categories of personal data: IP address, device and browser data, the result of the bot-protection check on forms, records of logins and activity in the Service and records of security events.

Legal basis: The Company's legitimate interest in protecting the Website, the Service, Customers and the Company against misuse, spam and security incidents (Article 6(1)(f) GDPR).

Retention period: One (1) year from the creation of the record; in the event of a detected security incident, for the time needed to resolve it and then for the limitation period of related claims.

Statutory/contractual requirement and consequences: The data is collected automatically when using the Website and the Service. You may object to the processing.

Processing activity No. 6: Sending information about core3 news and offers

Categories of personal data: Name and surname, e-mail address.

Legal basis: For Customers, the Company's legitimate interest in promoting its own similar products and services (Article 6(1)(f) GDPR) in conjunction with Section 116(15) of Slovak Act No. 452/2021 Coll. on electronic communications. For other persons, the Data Subject's consent (Article 6(1)(a) GDPR).

Retention period: Five (5) years from the last business relationship or from the consent, or until earlier unsubscription or withdrawal of consent.

Statutory/contractual requirement and consequences: Providing the data is voluntary. You can opt out at any time using the link in each message or by e-mail.

Processing activity No. 7: Establishing and defending legal claims

Categories of personal data: Identification and contact details, details of the contractual relationship and other data needed in the proceedings concerned.

Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR) and the Company's legitimate interest in establishing and defending its legal claims (Article 6(1)(f) GDPR).

Retention period: For the limitation or preclusion period, or ten (10) years from the final conclusion of the proceedings.

Statutory/contractual requirement and consequences: Without this data, legal claims cannot be established or defended.

Processing activity No. 8: Handling Data Subject requests

Categories of personal data: Name and surname, contact details, the right exercised, the content of the request and how it was handled.

Legal basis: Compliance with legal obligations under the GDPR and the Data Protection Act (Article 6(1)(c) GDPR).

Retention period: Five (5) years from the end of the year in which the request was handled.

Statutory/contractual requirement and consequences: Without this data, the request cannot be handled.

Processing activity No. 9: Contact persons of suppliers and business partners

Categories of personal data: Name and surname, job title, e-mail address, phone number and content of communication.

Legal basis: The Company's legitimate interest in concluding and performing contracts with suppliers and business partners (Article 6(1)(f) GDPR); where the supplier is a natural person, performance of a contract and legal obligations (Article 6(1)(b) and (c) GDPR).

Retention period: For the term of the contractual relationship and then for the limitation period, or for the period required by accounting and tax laws.

Statutory/contractual requirement and consequences: Without this data, the contractual relationship cannot be concluded or performed.

Processing activity No. 10: Website traffic analysis

Categories of personal data: Online identifiers stored in cookies, device and browser data, approximate location derived from the IP address (country, city), pages visited, traffic source, time and length of the visit.

Legal basis: The Data Subject's consent given in the cookie banner (Article 6(1)(a) GDPR in conjunction with Section 109(8) of Slovak Act No. 452/2021 Coll.).

Retention period: Cookies for at most 2 years; data in Google Analytics for at most 14 months. We remember the consent for 12 months.

Statutory/contractual requirement and consequences: Providing the data is voluntary. You can use the Website without consenting. You can withdraw consent at any time via the "Cookie settings" link in the Website footer.

5.2. Special categories of personal data. For the purposes described in this Article, we do not require special categories of personal data within the meaning of Article 9 GDPR. If the Customer enters such data into the Service (for example data on employees' sick leave in connection with attendance), we process it as the Customer's processor under clause 3.2 and the Customer is responsible for the legal basis.

6. Where do we obtain personal data from?

6.1. Directly from you. We obtain most personal data directly from you, in particular when you fill in the contact form or the Demo Environment registration, communicate with us or conclude a contract.

6.2. Automatically. When you use the Website and the Service, we collect technical data, in particular your IP address, device and browser data and activity records. If you consent to analytics cookies, we also collect data about your visit to the Website through Google Analytics. More information is provided in the Cookie Policy.

6.3. From the Customer. We may obtain data about users of the Service from the Customer who sets up their access (for example an employee's name and work e-mail address). In that case we have not obtained your data directly from you, and we provide the information required by Article 14 GDPR through this Privacy Policy, to which we will draw your attention no later than in our first communication with you.

6.4. From public sources. Where justified, we also obtain data from publicly available registers, in particular the commercial and trade registers, to verify Customer details or to establish legal claims.

7. To whom do we disclose personal data?

7.1. General. We disclose your personal data to third parties only where necessary to achieve the purpose of processing, where required by law or where you have given your consent. We have concluded agreements under Article 28 GDPR with processors who process personal data on behalf of the Company.

7.2. Categories of recipients. Your personal data may be disclosed or made available in particular to the following categories of recipients:

• Cloud and hosting providers – operating the Website and the Service, storing and backing up data. Possible transfer outside the EEA: yes.
• Cloudflare, Inc. – protecting Website forms against automated bots (the Cloudflare Turnstile service) and securing network traffic. Possible transfer outside the EEA: yes.
• Google Ireland Limited (Google Analytics, Google Tag Manager) – Website traffic analysis, only with consent. Possible transfer outside the EEA: yes (Google LLC, USA).
• AI model providers – processing questions and company data when AI features of the Service are used on the Customer's instructions. Possible transfer outside the EEA: yes.
• E-mail and communication service providers – delivering e-mails, access details and notifications. Possible transfer outside the EEA: yes.
• IT service and technical support providers – developing, maintaining and securing the Website and the Service. Possible transfer outside the EEA: yes.
• Accounting firms and tax advisers – bookkeeping. Possible transfer outside the EEA: no.
• Law firms, bailiffs, notaries and court experts – legal advice and enforcement of claims. Possible transfer outside the EEA: no.
• Banks – executing payments. Possible transfer outside the EEA: no.
• Public authorities – compliance with legal obligations, in particular towards tax authorities, courts and law enforcement authorities. Possible transfer outside the EEA: no.

7.3. Specific recipients. We will provide a list of specific processors on request as described in Article 13 of this Privacy Policy.

7.4. Transfer of business. In the event of a transfer of the Company's business or part of it, or a transfer of the Service, your personal data may be disclosed to the acquirer to the extent necessary to continue operating the Service. We will inform you of any such disclosure.

8. Do we transfer personal data to third countries?

8.1. Processing in the EU first. We aim to process personal data primarily within the European Union. However, as we also use providers established outside the European Economic Area (the "EEA"), transfers to third countries may occur, in particular for bot protection on forms, Website traffic analysis, AI features, e-mail delivery and technical support.

8.2. Safeguards. We transfer data to a third country only on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified recipients), appropriate safeguards under Article 46 GDPR, in particular standard contractual clauses, or one of the derogations under Article 49 GDPR.

8.3. Information on transfers. We will provide information on specific transfers and a copy of the safeguards applied on request.

9. Do we carry out automated decision-making and profiling?

9.1. Automated decision-making. The Company does not carry out automated individual decision-making that produces legal effects concerning you or similarly significantly affects you.

9.2. AI features. The AI features of the Service process the Customer's company data on the Customer's instructions in order to answer users' questions and prepare summaries, calculations or overviews. The outputs of the AI features are input for users' decisions; any decision concerning specific persons is always made by the Customer.

9.3. Security. To protect the Website and the Service, we automatically evaluate technical data about devices and logins in particular. If such an evaluation leads to restricted access, the final decision is made by an authorised person of the Company.

10. How long do we keep personal data?

10.1. General rule. We keep personal data only for as long as necessary to achieve the purpose for which it was collected, or for the period required by law. Specific periods are set out in Article 5 of this Privacy Policy.

10.2. Consent. Where processing is based on consent, we keep the data until consent is withdrawn, but no longer than the period stated in Article 5. After consent is withdrawn, we delete the data without undue delay unless there is another legal basis for processing it.

10.3. Customer data in the Service. Data we process as a processor is kept for the term of the contract with the Customer and then returned or deleted according to the Customer's instructions in accordance with the data processing agreement.

10.4. After the retention period. We securely delete or anonymise personal data so that you can no longer be identified from it.

11. How do we protect personal data?

11.1. Measures. We have taken appropriate technical and organisational measures proportionate to the risk, in particular:

• a) encryption of data in transit between your device and our systems;
• b) storing passwords only in a form that does not allow them to be recovered;
• c) separation of individual Customers' data within the Service and role-based access control;
• d) regular data backups and verification that backups work;
• e) ongoing software updates and remediation of security vulnerabilities;
• f) training of persons with access to personal data and their confidentiality obligations;
• g) assessing the security of service providers before starting cooperation.

11.2. Personal data breach. If a personal data breach occurs, we assess it without undue delay and, where required by the GDPR, notify the Office for Personal Data Protection of the Slovak Republic and, where applicable, you. If the breach concerns data we process as a processor, we inform the Customer without undue delay.

11.3. Your cooperation. Data security also depends on you. Use a strong and unique password, do not share your login details with third parties and report any suspected unauthorised access to us immediately.

12. What are your rights as a data subject?

12.1. Overview of your rights. The GDPR and the Data Protection Act grant you in particular the following rights:

• a) Right of access. You have the right to obtain confirmation as to whether we process your personal data and, if so, access to it and information about its processing, including a copy.
• b) Right to rectification. You have the right to have inaccurate personal data corrected and incomplete personal data completed.
• c) Right to erasure. You have the right to have personal data erased if one of the grounds under Article 17 GDPR applies, for example if it is no longer needed for the purpose for which it was collected or if you withdraw your consent.
• d) Right to restriction of processing. You have the right to restrict processing in the cases under Article 18 GDPR, for example while the accuracy of the data is being verified.
• e) Right to data portability. Where processing is based on consent or a contract and is carried out by automated means, you have the right to receive the data you provided to us in a structured, machine-readable format.
• f) Right to object. You have the right to object at any time to processing based on legitimate interest and to processing for direct marketing.
• g) Right to withdraw consent. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing before the withdrawal.
• h) Right to lodge a complaint. You have the right to lodge a complaint with the supervisory authority and the right to an effective judicial remedy.

12.2. Time limit and free of charge. We will respond to your request without undue delay and no later than one (1) month after receiving it; where justified, we may extend this period by a further two (2) months and will inform you accordingly. Handling a request is free of charge unless it is manifestly unfounded or excessive.

12.3. Identity verification. If we have reasonable doubts about your identity, we may ask you for additional information needed to verify it.

12.4. Data in a Customer's Service. If your request concerns data that we process as a Customer's processor, we will forward it to the Customer concerned without undue delay and assist them in handling it.

13. How can you contact us and lodge a complaint?

13.1. Contacting the Company. In data protection matters you can contact us:

• a) by e-mail at core@igt-systems.com;
• b) by post at Sliačska 1234/34, 831 02 Bratislava, Slovakia.

Please use "Personal data protection" as the subject and include your identification and contact details and the right you are exercising.

13.2. Supervisory authority. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Hraničná 4826/12, 820 07 Bratislava, www.dataprotection.gov.sk. Before lodging a complaint, we recommend contacting us first – we can resolve most issues directly.

14. Changes to this Privacy Policy

14.1. Reasons for changes. We may change this Privacy Policy in particular when laws change, when the purposes or scope of processing change, when new features of the Service are introduced or when service providers change.

14.2. Notice of changes. The current version is published on the Website. We will also inform Customers of material changes by e-mail reasonably in advance. If a change requires your consent, we will ask for it separately.

14.3. Effective date. This Privacy Policy takes effect on 1 October 2026.