Privacy Policy

This is an English translation provided for information purposes only; the Slovak version is binding.

Effective from: 12 October 2026

This Privacy Policy (the "Policy") explains how NUMIQ s.r.o. (the "Company" or "NUMIQ") processes personal data when operating the Website https://numiq.com/ and the NUMIQ Application and when providing the Services. The Policy has been prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR") and zákon č. 18/2018 Z. z. o ochrane osobných údajov (Act No. 18/2018 Coll. on the Protection of Personal Data).

Capitalised terms (in particular User, Client, Application, Website, Services, Account, Programme, Subscription, Payment Gateway, Calculation, Price Quote, Google Reviews, Information, Agreement and GTC) have the meaning given to them in Article I of the Company's General Terms and Conditions (the "GTC"). The term "Data Processing Agreement" means the Personal Data Processing Agreement, which forms part of the GTC.

1. Who the controller is and how to contact it

The controller of personal data is:

NUMIQ s.r.o., with its registered office at Kominárska 1552/3A, Bratislava - mestská časť Nové Mesto 831 04, Slovenská republika, IČO 55 880 592, DIČ 2122119010, IČ DPH SK2122119010, registered in the Obchodný register Mestského súdu Bratislava III (Commercial Register of the Bratislava III Municipal Court), Section: Sro, Insert No. 174081/B.

Contact for data protection enquiries and the exercise of rights:

e-mail: support@numiq.com,
postal address: Kominárska 1552/3A, 831 04 Bratislava - mestská časť Nové Mesto, Slovenská republika.

The Company has not designated a data protection officer (DPO). Should it designate one in the future, it will publish the DPO's contact details on the Website and in this Policy.

2. To whom and to what the Policy applies

The NUMIQ Services are intended exclusively for business operators (Article II, point 5 of the GTC). The Company does, however, process the personal data of natural persons who come into contact with the Services. This Policy describes processing in respect of which the Company acts as controller, i.e. determines the purposes and means of processing itself. This concerns:

Users and persons acting on their behalf (self-employed natural persons, managing directors, employees and contact persons of legal entities) who register, use an Account, pay a Subscription or communicate with support,
visitors to the Website (cookies, traffic measurement, technical data),
prospective customers (companies and sole traders in construction and related trades to whom the Company sends commercial communications).

In respect of the data of the User's Clients and the authors of the User's Google Reviews, the Company acts as a processor on behalf of the User. Such processing is governed by the Data Processing Agreement and is described in Section 12 of this Policy.

3. What data the Company processes, about whom and from which sources

Users and persons acting on their behalf

identification and contact data: first name and surname of the person completing the Registration, e-mail address and, where applicable, telephone number,
login data: password (stored exclusively in encrypted form) and, where applicable, the identifier, name and e-mail address from the Google or Apple account if the User chooses to sign in via such accounts,
data about the User's business: business name, registered office or place of business, IČO, DIČ, IČ DPH, logo, company details and references which the User includes in Price Quotes,
billing and payment data: the company's billing details, payment history, invoices and Subscription status; payment card details are entered by the User directly in the Payment Gateway (Stripe) and the Company has no access to the card number,
Application usage data: selected Programme, Account settings, Pricing Profile, Calculations, Price Quotes and other Information, login records, IP address, browser and device type, timestamps,
communications: the content of e-mails and messages sent to support, defect notifications, complaints and suggestions.

Source: the data are provided by the User during Registration, in the Account settings, in the Payment Gateway and in communications with the Company; login data may originate from Google or Apple if the User signs in via their account; technical data are generated automatically when the Application is used.

Website visitors

technical data: IP address, browser and device type, operating system, language, pages visited and Country Version, time of visit, source of visit,
cookies and similar technologies in accordance with the settings of the cookie banner (Section 5).

Source: the data are generated automatically when the Website is visited.

Prospective customers (business prospects)

first name and surname of the contact person, company name, business e-mail address, telephone number, line of business and, where applicable, response to communications sent (opening, clicking, unsubscribing).

Source: publicly available sources (in particular the commercial and trade registers, company websites, public company profiles and directories) and the Company's own prospect database compiled by the Company from those sources. The Company processes only data relating to the prospect's business activity.

The Company does not process special categories of personal data within the meaning of Article 9 GDPR and requests Users not to enter such data into the Application (Article 5, point 2 of the Data Processing Agreement).

4. Purposes and legal bases of processing

Purpose	Data	Legal basis	Retention period
Registration, maintenance of the Account and provision of the Services (including sign-in via a Google or Apple account)	identification and contact data, login data, business data, Information in the Account	performance of the Agreement (Art. 6(1)(b) GDPR); for persons acting on behalf of a legal entity, legitimate interest in performing the Agreement with the User (Art. 6(1)(f) GDPR)	for the duration of the Agreement; after the Account is closed, erasure or anonymisation within 90 days (Article XV of the GTC)
Payments, Subscription, OPEN and invoicing	company billing details, IČO, DIČ, IČ DPH, payment history, invoices	performance of the Agreement (Art. 6(1)(b) GDPR); compliance with legal obligations under tax and accounting legislation (Art. 6(1)(c) GDPR)	accounting and tax documents for 10 years from the end of the year to which they relate
Creation of Calculations and AI content	content of Calculations, imported price lists, data about the User's business, review text	performance of the Agreement (Art. 6(1)(b) GDPR)	as part of the Account, in accordance with the first row of this table
Sending service e-mails (e-mail verification, password reset, notifications, sharing of Price Quotes, notices of changes to the GTC and prices)	e-mail address, name, content of the notice	performance of the Agreement (Art. 6(1)(b) GDPR)	for the duration of the Agreement
Technical support, handling of defects, complaints and suggestions	contact data, content of communications, technical Account data	performance of the Agreement (Art. 6(1)(b) GDPR); legitimate interest in handling the request (Art. 6(1)(f) GDPR)	for the duration of the Agreement and thereafter for up to 90 days; for disputed matters until the expiry of the limitation periods
Security of the Application, protection of the Account, prevention of misuse and fraud	login records, IP address, technical device data, timestamps	legitimate interest in the security of the Services (Art. 6(1)(f) GDPR)	a reasonable period, as a rule no longer than 12 months
Measurement of Website traffic and conversions, Google advertising services	cookies, identifiers, technical data, pages visited	consent given via the cookie banner (Art. 6(1)(a) GDPR and Section 109(8) of zákon č. 452/2021 Z. z. o elektronických komunikáciách (Act No. 452/2021 Coll. on Electronic Communications))	in accordance with the cookie banner settings and the lifetime of the individual cookies
Ensuring the basic functioning of the Website and the Application (strictly necessary cookies, consent management, loading of fonts and flag images)	strictly necessary cookies, IP address	legitimate interest in the functioning and display of the Website (Art. 6(1)(f) GDPR)	strictly necessary cookies for their lifetime; IP address only for the time needed to load the content
Commercial communications to existing Users about similar Services	e-mail address, name, selected Programme	legitimate interest in direct marketing of the Company's own Services (Art. 6(1)(f) GDPR, Recital 47 GDPR) in accordance with zákon č. 452/2021 Z. z.	for the duration of the Agreement or until unsubscription or objection
Commercial communications and campaigns for business prospects (nurturing)	name, company, e-mail, telephone, response to communications	legitimate interest in B2B marketing (Art. 6(1)(f) GDPR)	until withdrawal or objection, no longer than 3 years from the last contact
Establishment, exercise and defence of legal claims	data on the Agreement, payments, communications and the Account to the extent necessary	legitimate interest in protecting the Company's rights (Art. 6(1)(f) GDPR)	until the expiry of the limitation periods or, where applicable, until the final conclusion of proceedings
Compliance with other legal obligations (e.g. cooperation with public authorities)	data to the extent required by law	compliance with legal obligations (Art. 6(1)(c) GDPR)	for the period laid down by the relevant legislation

Where the Company processes data on the basis of legitimate interest, it always assesses in advance whether its interest is overridden by the interests and rights of the data subjects. The data subject has the right to object to such processing (Section 10).

5. Cookies and analytics

The Website and the Application use cookies and similar technologies. These are divided into:

strictly necessary cookies, which are required for signing in, maintaining a session, security, selecting the Country Version and storing consent settings; these cookies are used without consent because the Website and the Application cannot function without them,
analytics and advertising cookies, which are used to measure traffic, behaviour on the Website and conversions and to evaluate advertising campaigns; these cookies are used only with the visitor's consent.

For measurement and advertising, the Company uses Google Tag Manager, Google Analytics 4 and Google advertising services (Google Ireland Ltd.). These services are configured in Google Consent Mode, with the default state set to denied. Without the visitor's consent, no analytics or advertising cookies are stored. In the no-consent mode, Google may receive only anonymous cookieless signals that are not linked to an identifiable person.

Consent management is provided by the CookieYes service (CookieYes Limited). Visitors may give, change or withdraw their consent at any time by clicking the Cookie Settings button in the footer of the Website. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Cookies may also be managed directly in the browser settings; however, restricting strictly necessary cookies may affect the functioning of the Application.

When the Website is loaded, the visitor's IP address is, for technical reasons, also transmitted to the providers of the fonts (Google Fonts) and flag images (flagcdn.com) displayed on the Website.

The lifetime of the individual cookies and a detailed list of them are available in the cookie banner after clicking Cookie Settings.

6. Recipients and processors

The Company provides the Services with the assistance of third parties (Article X of the GTC). It discloses personal data only to the extent necessary for the relevant purpose and has concluded an agreement pursuant to Article 28 GDPR with each processor. As at the effective date of the Policy, the recipients are as follows:

Supabase, Inc. (via Lovable Cloud) - database, authentication and file storage; data centre in the EU (Frankfurt).
Lovable Labs Incorporated and Cloudflare, Inc. - hosting of the Website and the Application and server functions; global network.
Google (Gemini models via Lovable AI) - processing of Calculation texts, imported price lists, data about the User's business and reviews when creating AI content.
Resend (Plus Five Five, Inc.), USA - sending of e-mails (e-mail verification, password reset, notifications, sharing of Price Quotes, commercial communications).
Stripe Payments Europe, Ltd., Ireland - Payment Gateway, invoices and customer portal; processes company billing details, IČO, IČ DPH and payment card details, to which the Company has no access. When processing payments, Stripe also acts as an independent controller under its own terms.
Google Ireland Ltd. and Apple Distribution International Ltd. - sign-in via a Google or Apple account, if chosen by the User; these companies act as independent controllers in respect of their sign-in services.
Google Ireland Ltd. (Google Tag Manager, Google Analytics 4, Google advertising services) - measurement of traffic and conversions, solely on the basis of consent.
CookieYes Limited - cookie consent management.
Google Fonts and flagcdn.com - display of fonts and flag images on the Website; they receive the visitor's IP address.
OpenStreetMap Foundation (Nominatim) and U.S. Census Bureau - geocoding of construction site addresses entered in Calculations.
SerpApi, LLC, USA - import of Google Reviews of the User's business.
Perplexity AI, Inc., USA - estimation of local labour rates; the Company transmits to this service only the postcode or country and the type of work, without any personal data.

In addition to the above recipients, the Company may disclose personal data to its legal, tax and accounting advisers and auditors and, in cases provided for by law, to public authorities (courts, law enforcement authorities, tax authorities, supervisory authorities).

The current list of processors engaged by the Company when processing Client data on behalf of the User is set out in Annex 3 to the Data Processing Agreement and on the Website.

7. Transfers outside the European Economic Area

Some of the recipients listed in Section 6 are established or process data outside the European Economic Area (the "EEA"), in particular in the United States of America. Application data are primarily stored in the EU (Frankfurt); however, transfers outside the EEA may occur in connection with hosting and server functions, sending e-mails, AI processing, geocoding, importing reviews or measuring traffic.

For each transfer to a third country, the Company ensures adequate protection in accordance with Chapter V GDPR by means of:

an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework, where the recipient is certified under that framework, or
standard contractual clauses approved by the European Commission, supplemented where necessary by additional measures.

The data subject may request information about the safeguards used or a copy thereof at support@numiq.com.

8. How long the Company retains data

The Company retains personal data only for as long as necessary to achieve the purpose for which they were collected or for the period laid down by law. The specific periods are set out in the table in Section 4. In summary:

Account data and Information: for the duration of the Agreement; after the Account is closed, the Company will erase or anonymise them within 90 days (Article XV of the GTC),
accounting and tax documents: 10 years,
prospect marketing data: until withdrawal or objection, no longer than 3 years from the last contact,
login records and security logs: a reasonable period, as a rule no longer than 12 months,
cookies: in accordance with the cookie banner settings and the lifetime of the individual cookies.

Upon expiry of the retention period, the Company will securely erase or irreversibly anonymise the data. The Company may use anonymised and aggregated data from which no person can be identified for statistical purposes and to improve the Services (Article X, point 8 of the GTC).

9. Marketing and the right to object

Existing Users. The Company may send commercial communications to the User's e-mail address about its own Services similar to those already used by the User (e.g. information on new features, Programmes or Country Versions). The legal basis is the Company's legitimate interest in direct marketing. The User may unsubscribe at any time by clicking the unsubscribe link in each e-mail or by sending an objection to support@numiq.com. Service e-mails necessary for the provision of the Services (verification, password reset, notifications, notices of changes to the GTC) are not commercial communications and are sent for the duration of the Agreement.

Business prospects. The Company also sends commercial communications and campaigns (nurturing) to companies and sole traders in construction and related trades that are not yet Users, using their business contact details obtained from public sources or from the Company's own prospect database. The legal basis is the Company's legitimate interest in offering the Services to business operators (B2B marketing). Each communication includes an unsubscribe option. A prospect may object at any time at support@numiq.com; upon receipt of the objection, the Company will no longer process the prospect's data for marketing purposes.

An objection to direct marketing is always complied with, without examination of the reasons. The Company does not sell personal data to third parties and does not provide them for the marketing purposes of other entities.

10. Rights of data subjects and how to exercise them

Under Articles 15 to 22 GDPR, every data subject has the following rights:

right of access - to obtain confirmation as to whether the Company processes their personal data and a copy of those data together with information about the processing,
right to rectification - to request the correction of inaccurate data or the completion of incomplete data; the User can correct most data directly in the Account settings or in the customer portal of the Payment Gateway,
right to erasure - to request the erasure of data where they are no longer necessary, where consent has been withdrawn, where an objection has been upheld or where the data are processed unlawfully; this right does not apply where the Company is required to retain the data by law or for the defence of legal claims,
right to restriction of processing - to request that the Company temporarily only store the data, for example while their accuracy is being verified,
right to data portability - to receive the data which the data subject has provided and which are processed on the basis of the Agreement or consent in a structured, commonly used and machine-readable format, or to request their transmission to another controller; the Application allows the export of Calculations and Price Quotes,
right to object - to object, on grounds relating to their particular situation, to processing based on legitimate interest; objection to direct marketing may be made at any time and without stating reasons,
right to withdraw consent - to withdraw consent to cookies at any time via the Cookie Settings button in the footer of the Website; withdrawal does not affect the lawfulness of processing carried out before the withdrawal,
right not to be subject to automated decision-making - the Company does not carry out such decision-making (Section 14).

How to exercise rights. Requests may be sent by e-mail to support@numiq.com or by post to the Company's registered office address. The User can exercise some rights directly in the Application (editing data, export, closing the Account). Before handling a request, the Company may ask the requester to verify their identity, in particular where the request was not sent from the e-mail address associated with the Account.

The Company will respond without undue delay and in any event within one month of receipt of the request. In the case of complex or numerous requests, it may extend this period by a further two months, of which it will inform the requester. Requests are handled free of charge; in the case of manifestly unfounded or excessively repetitive requests, the Company may charge a reasonable fee or refuse the request.

11. Complaint to a supervisory authority

If a data subject considers that the processing of their personal data infringes the GDPR, they have the right to lodge a complaint with a supervisory authority. In the Slovak Republic, this is:

Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, Slovenská republika, https://dataprotection.gov.sk.

The data subject may also lodge a complaint with the supervisory authority of the EU Member State of their habitual residence or place of work. The Company recommends contacting support@numiq.com first so that the matter can be resolved directly.

12. Data of the User's Clients - NUMIQ as processor

The User enters data about its Clients into the Application (names, contact details, construction site addresses, notes, communications relating to Price Quotes) and may import Google Reviews of its business into the Application, including the names and texts of reviewers. In respect of such data, the controller is the User, who determines why and how the data are processed and is responsible for the lawfulness of the processing and for informing Clients and other data subjects.

The Company processes such data solely on behalf of the User, on the basis of the User's instructions and for the purpose of providing the Services, as a processor within the meaning of Article 28 GDPR. The terms of this processing, including security measures, the list of sub-processors, transfers outside the EEA and the erasure of data after termination of the Agreement, are governed by the Personal Data Processing Agreement, which forms part of the GTC and is available on the Website.

Clients, reviewers and other persons whose data the User has entered into the Application should direct their questions and requests to the relevant User (the tradesperson or company that sent them the Price Quote). If such a request is received by the Company, the Company will forward it to the User without undue delay and provide the User with the necessary assistance (Article 10 of the Data Processing Agreement).

13. Obligation to provide data and consequences of failure to provide them

Providing the data required for Registration and maintenance of the Account (first name and surname, e-mail address, password) is a contractual requirement under Article III of the GTC. Without these data, it is not possible to create an Account or conclude the Agreement.

Where a Paid Programme or OPEN is selected, billing and payment data (in particular business name, registered office, IČO and, where applicable, IČ DPH) are necessary for issuing an invoice and processing payment; their provision is also required by law. Without them, the Company cannot provide a Paid Programme or OPEN.

The provision of other data (e.g. telephone number, logo, references, business details in Price Quotes) is voluntary and serves to enable full use of the Application's features. Consent to analytics and advertising cookies is voluntary, and refusal to give it does not affect the use of the Website or the Application. Receiving commercial communications is not a condition for using the Services.

14. Automated decision-making and artificial intelligence

The Company does not carry out automated individual decision-making, including profiling, which produces legal effects concerning or similarly significantly affects the data subject within the meaning of Article 22 GDPR.

The Application uses artificial intelligence tools (Kalkulant, AI content) solely to prepare draft Calculations, items, descriptions and recommendations based on the User's inputs. These outputs serve only as an aid; the User may edit or reject them and decides alone on their use in a Price Quote (Article VII, point 3 of the GTC). The AI tools do not decide on access to the Services, the Subscription price or the User's rights.

With the visitor's consent, traffic measurement and Google advertising services may create aggregate statistics and segments for advertising purposes; this does not constitute decision-making with legal effects, and consent may be withdrawn at any time.

15. Security

The Company protects personal data by appropriate technical and organisational measures pursuant to Article 32 GDPR, in particular:

encryption of data in transit (HTTPS/TLS) and at rest,
separation of the data of individual Users by means of database row-level security policies (RLS), which ensure that only the relevant User has access to the data in the Account,
access and permission management, secure storage of passwords and the option to sign in via verified Google or Apple accounts,
regular data backups and disaster recovery measures,
confidentiality obligations of persons working with the data and selection of processors with an appropriate level of security.

A more detailed description of the measures is set out in Annex 2 to the Data Processing Agreement. The User is responsible for protecting its access credentials and must notify the Company without delay of any suspected unauthorised access to the Account (Article IV of the GTC). In the event of a personal data breach that is likely to result in a high risk to the rights of data subjects, the Company will inform them in accordance with Article 34 GDPR.

16. Changes to the Policy

The Company may update this Policy, in particular in the event of changes to the Services, the engagement of new processors or changes in legislation. The current version, stating its effective date, is always available on the Website. The Company will inform Users of material changes by e-mail or by a notice in the Application before they take effect. Users are advised to review the Policy regularly.

This Policy takes effect on 12 October 2026 and supersedes all previous versions.