Qasida

GDPR overview

Asseco Solutions publishes a GDPR compliance declaration and names a data protection officer, Ing. Miroslav Majtáš, MBA, reachable at gdprsk@assecosol.com. Read it for what it is, though: the document is an employer's information notice addressed to the company's own staff, not a product privacy policy — and the site publishes no separate one. The contractual GDPR substance sits elsewhere, in the licence terms, which embed a data processing agreement based on Regulation (EU) 2016/679: the customer is the controller, Asseco Solutions the processor, transfers outside the EU require the controller's documented instruction, and breach notification is provided for. The declaration still cites Okresný súd Bratislava I as registry court where the register now shows Mestský súd Bratislava III, which suggests it has not been refreshed.

Who owns the data?

The cloud terms define the stored Data as data owned by the user and placed on the provider's server: Asseco Solutions supplies the infrastructure but claims no ownership over what the customer puts on it. Clause 6.7 makes the customer fully responsible for the content it stores. The licence terms restate the same split in GDPR language — the customer is the controller, Asseco Solutions the processor, acting only on the controller's documented instructions. Confidentiality obligations extend to the publisher's employees, subcontractors and cooperating third parties and survive the end of processing. One exception is worth knowing before signing: clause 17 lets the publisher cite the customer as a reference, using its trade name and logo on the website.

Reuse rights

Because the customer owns its data and acts as controller, it can export, reuse and delete its own records without asking the publisher for permission; nothing in the contract restricts what a business does with its own content. The publisher's own use is bounded: processing takes place solely to deliver the service, on documented instructions, through the operations listed in the licence terms — collection, recording, storage, erasure and so on — over a defined set of personal data categories, which for the QASIDA/HORECA scope extend as far as driving licence number and category. Backups of the data placed on the server are permitted. Transfers to a third country are possible only on the controller's documented instruction. No collected source mentions customer data being used to train AI models: there is neither a commitment not to, nor an opt-out.

Data retention & training

Hosting summary

The cloud terms define the "Server" as a server operated by the provider, carrying the user's data and located in the European Union. That is the entirety of the published commitment: no country is named, no data centre is named, and no third-party hosting provider is named, so only the EU region is recorded and no hosting country is claimed. No list of subprocessors is published either — subcontractors appear solely in the confidentiality clauses. The terms otherwise describe a standard cloud arrangement in which servers, storage and software are supplied as a service and reached over the internet. One distinction matters: the marketing website itself resolves to an address operated by WebSupport s.r.o. in Bratislava, but that concerns the website, not the platform holding customer data, and nothing in the sources connects the two. On the legal side, the licence terms add a processing agreement under which transfers to a third country are possible only on the controller's documented instruction.