Privacy policy

1. Controller

The controller of personal data is IP Industries s. r. o., Hlavná 6/11, 919 26 Zavar, Slovakia, Company ID 36 240 184, Tax ID 2020165708, VAT no. SK2020165708, registered in the Commercial Register of the District Court Trnava, Section Sro, File No. 30398/T (“we”).

Contact for data protection questions: email obchod@lockout-tagout.sk, phone +421 903 15 15 19. We have not appointed a data protection officer, as we are not required to do so by law.

2. When we are a controller and when a processor

Depending on the processing, we act in one of two roles:

• As a controller we process data of website visitors, data from inquiries, quotes and orders, data of contact persons and company account users of our customers, billing data, records of concluded agreements and data of our staff in the administration. We decide on the purposes and means of this processing.
• As a processor we process data of our customers’ employees and contractors in the online LOTO training (personal links and QR sheets, progress, test, signature, certificate, record of instruction, invitations and reminders) and data the customer provides for the LOTO work instruction and LOTO boards. In these cases the customer – the employer – is the controller. We process the data only on its instructions and under a data processing agreement (Art. 28 GDPR), which the employer accepts before it starts using the online training. See section 5.

We do not use online training data for our own purposes, for marketing or for sales offers.

3. What data we process as a controller and where it comes from

• Request for a quote: name, email, phone, company name, company ID, number of machines, interest in a site visit, note and selected products. An inquiry sent by a signed-in company account user is linked to their company.
• Quote and order: company billing details (name, address, company ID, tax ID, VAT no.), contact person, email, phone, customer PO number, delivery address, payment method, note, content of the quote and order and time of confirmation.
• Company account: name, email, company, password (stored only as a cryptographic hash), account creation time, sign-in data (IP address, browser type, session validity), a temporary password-setup link and records of sign-in attempts (protection against password guessing). Accounts are created by invitation only – self-registration is not possible.
• Acceptance of the data processing agreement: agreement version, date and time, name and email of the person who accepted it, their user account and company; where the agreement was accepted outside the website (signed document, email), a note by our staff on how it was accepted.
• Training summary emails to company account users (whose training validity is ending).
• Access to the administration (our staff and the website administrator only): name, email, role, password hash, sign-in data.
• Technical data when you visit the website: IP address, time and address of the request in server logs; when the inquiry or quote confirmation form is submitted, also browser and device properties needed to tell humans from automated bots (see section 9).
• Source of data: where we did not obtain the data from you, it comes from your employer or a colleague (invitation to a company account, contact person in an inquiry or order), from our business records (customer directory in the Flovie stock system – company name, contact persons, their roles, emails and phones) or from public registers (commercial and trade register).

4. Purpose and legal basis (where we are the controller)

We process data for the following purposes:

• Handling your inquiry and preparing a quote – steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for contact persons of a company, our legitimate interest in communicating with the customer (Art. 6(1)(f) GDPR).
• Concluding and performing the contract (goods and services incl. online training, complaints) – performance of a contract (Art. 6(1)(b) GDPR); for contact persons and account users of a corporate customer, legitimate interest (Art. 6(1)(f) GDPR).
• Company account (sign-in, overview of the company’s quotes, orders and inquiries, training management) – performance of the contract with the customer and our legitimate interest in giving its authorised persons secure access (Art. 6(1)(b) and (f) GDPR).
• Record of acceptance of the data processing agreement – obligation to demonstrate that processing for the customer is governed by a contract (Art. 28(3) and (9) GDPR; Art. 6(1)(c) GDPR) and legitimate interest in defending legal claims (Art. 6(1)(f) GDPR).
• Issuing and archiving accounting documents – legal obligation under the Slovak Accounting Act No. 431/2002 Coll. and VAT Act No. 222/2004 Coll. (Art. 6(1)(c) GDPR).
• Security of the website and accounts, protection of forms against misuse (including automated bot detection), limiting sign-in attempts, fixing technical errors – legitimate interest (Art. 6(1)(f) GDPR).
• Proving performance of contracts and defending legal claims – legitimate interest (Art. 6(1)(f) GDPR).

Providing data is voluntary, but without it we cannot handle your inquiry, order or account access. We do not make automated decisions with legal or similarly significant effects and do not carry out profiling (for test evaluation in the training see section 5). We do not use the data for advertising and we do not sell it.

5. Online LOTO training, work instruction and LOTO boards (we are a processor)

Who is the controller. We provide the online LOTO training to companies (employers). The employer enrols its employees and contractors, decides on the scope of data and uses the results to meet its duty to demonstrably instruct employees on health and safety rules and procedures (Section 7 of Slovak Act No. 124/2006 Coll.). The employer is therefore the controller and we are its processor. Information under Art. 13 and 14 GDPR is provided to participants by the employer; on its behalf we show a short notice on the training start page and in the invitation. This section supplements it.

• Participant data: name, personal number (if entered by the employer – used to verify the participant at the start), email (optional – only for the invitation and reminders), for contractors the name of their company, the selected course.
• Progress: personal link and QR code, start time, completed modules, test questions and answers including failed attempts, result (score, pass), number of attempts (max. 3, then the course is repeated), version of the course content.
• Confirmation of instruction and a finger-drawn signature (PNG image), date of completion and validity of 24 months; the certificate (PDF) and the record of instruction (PDF listing participants, results and signatures) downloaded by the employer.
• Emails: invitation, a reminder if the participant has not started within 7 days of the invitation (once) and a reminder 30 days before validity ends (once). Reminders and summaries are sent only while the service is active.
• LOTO work instruction: questionnaire answers (in particular names and departments of the author and of the persons who reviewed and approved the document, and roles of responsible persons). LOTO boards: photos and sketches of machines and the company logo. Machine photos should not show people; if someone appears, we edit or discard the photo.
• Test evaluation: the test is evaluated automatically by the number of correct answers (passed with at least 80 %). Any consequences of the result, such as work assignment, are decided by the employer, not by the system.
• Signature: we store only the image of the signature, without data on how it was written (speed, pressure, stroke order), and do not subject it to specific technical processing allowing unique identification. It is not biometric data (Art. 4(14) and Art. 9 GDPR).
• Access: training data are visible to the users of the employer’s company account and, in our administration, only to administrators with the admin role. Files (signatures, PDF and Word instructions, photos, sketches and logos) are kept in non-public storage and made available only through our server after checking authorisation. Via the personal link, a participant can access only their own training and certificate.
• Retention and deletion: we keep training data for the duration of the online training service. The service ends on the activation end date; if none is set, when we deactivate the service or the contract ends. We email the company account users 30 and 7 days before deletion so they can download the records. 60 days after the service ends, participant data including signature images are deleted automatically and personal links stop working. The employer may remove a participant’s record earlier – itself in the company account while the service is active, otherwise by email request; removal also deletes the signature image. These periods follow from the data processing agreement with the employer, who may instruct earlier deletion.
• Your rights as a training participant should be exercised with your employer. If you send a request to us, we will forward it to the employer within 5 working days and help it respond.

6. How long we keep data

We keep data only as long as necessary for the purpose:

• Inquiries and quotes that did not lead to an order: 3 years from sending the inquiry or issuing the quote, then we delete them.
• Orders, accepted quotes, invoices and supporting documents: 10 years from the end of the year they relate to (Section 35 of the Accounting Act, Section 76 of the VAT Act).
• Other contractual correspondence (e.g. complaints, emails about an order): 4 years after performance of the contract (Section 397 of the Commercial Code); where a claim has been raised or proceedings started, until they end and the limitation period expires.
• Contact details of business customers: during the business relationship and 3 years after.
• Company account (name, email, credentials): until access is removed at the customer’s request or when cooperation ends. We may close an account nobody has signed in to for 24 months after prior notice by email. Company documents follow the periods in this section.
• Record of acceptance of the data processing agreement: for the term of the agreement and 4 years after it ends.
• Sign-in: the cookie is valid for 7 days; after expiry, the session record with IP address and browser type is deleted in the daily automated clean-up.
• Password-setup link (valid for 3 days) and sign-in attempt records: deleted in the daily automated clean-up after they expire.
• Server logs at the hosting provider: short-term, at most 30 days.
• Staff accounts in the administration: until the account is closed.
• Online training (we are a processor): for the duration of the service and 60 days after it ends, then automatic deletion (section 5); in database backups they expire when the backup cycle ends, at the latest within 30 days.
• Work instruction and LOTO boards (we are a processor) – questionnaire answers, photos, sketches, logo: during cooperation on the documentation and its updates; after the contract ends or on the customer’s instruction we delete them within 60 days.

How long the employer keeps evidence of health and safety instruction is the employer’s decision and obligation. Before deletion the employer should therefore download the record of instruction and certificates and keep them in its own documentation – a certificate may still be valid at that time.

7. Who we share data with

Data are also processed by our contracted suppliers acting as our processors, who are contractually bound to protect them (in the online training with the employer’s consent in the data processing agreement). They fall into these categories of recipients:

• the supplier developing, operating and technically administering the website,
• providers of hosting, compute functions, non-public file storage (participant signatures, work instructions, boards, logos, photos and sketches of machines) and bot protection for forms,
• the database provider,
• the provider sending emails from the website and our email mailbox provider,
• carriers delivering goods and our external accountant, to the extent necessary for their work,
• public authorities where required by law. We will provide the list of specific suppliers on request.

8. Transfers outside the EU

The database, application functions and file storage are located in the EU (Frankfurt); public page content may be delivered by the hosting provider’s network from the nearest location.

Some of our suppliers are based outside the EU (mainly in the USA). They may access data when operating and supporting the service, and emails may be sent via servers outside the EU. Transfers are based on the European Commission adequacy decision (EU-US Data Privacy Framework) where the supplier is certified, otherwise on standard contractual clauses approved by the European Commission.

9. Cookies and browser storage

We do not use analytics or advertising cookies, so we do not show a consent banner. We only use the following technical tools, which are strictly necessary to provide a service you explicitly request (Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications):

• better-auth.session_token (with the __Secure- prefix on secure connections) – sign-in to the company account or administration; only for signed-in users, valid for 7 days or until sign-out. Scripts on the page cannot read it (HttpOnly).
• loto-dopyt-v1 (localStorage) – inquiry list; the products you select are stored only in your browser and reach us only when you send the inquiry. It is cleared after the inquiry is sent or when you clear your browser data.
• Bot protection for forms – when the inquiry or quote confirmation form is submitted, a script reads browser and device properties (e.g. browser type and settings and how it processes the page) and assesses whether the form is being sent by a human or an automated bot. It may store a technical value in the browser (name and lifetime set by the provider, usually short-term). We use the result solely to protect the form you are submitting against misuse (legitimate interest, Art. 6(1)(f) GDPR); we do not use it for tracking or advertising.

10. Security

The website runs over encrypted connections only (HTTPS). Company accounts and the administration are protected by passwords (at least 10 characters, stored as a hash), sign-in attempt limits and role-based access. Company account users see only their own company’s data. Files containing personal data are kept in non-public storage and made available only after checking authorisation.

A training participant can access only their own training via a personal, randomly generated link; while their record exists, they can download their certificate through it. The link and QR code should therefore be protected like a password. Outside production, no emails are sent to customers or participants.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. Send your request to obchod@lockout-tagout.sk; we will handle it without undue delay and within one month at the latest. For the online training and other services where we are a processor, we forward the request to the employer (section 5).

If you believe that we process your data unlawfully, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk.

12. Changes

We update this policy when the website’s features, our providers or the law change. The current version is always on this page with the date of the last update.