Translation Notice: This English translation was produced with the assistance of artificial intelligence (LLM) and is provided for informational purposes only. In the event of any discrepancy between the English and Slovak versions, the Slovak version shall prevail. The relationship is governed by the law of the Slovak Republic.
The legally binding version is available at: /sk/legal/privacy
Effective: 07.07.2026 · replaces the version of 01.04.2026
Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on personal data protection require controllers to inform data subjects of the purposes of processing, including where data is not obtained directly from the data subject.
2.1 Controller
DDN Consulting s.r.o., registered office Bodíky 222, Bodíky 930 31, IČO 55 879 128, registered with the District Court Trnava, Section Sro, File No. 55445/T. General contact: [email protected]. Data-protection contact: [email protected].
2.2 What Data We Collect
The scope of processing depends on the specific service:
- Paid services (e.g. AI Foundation Audit): company identification data (name, company ID, VAT ID, registered office); contact person's data (name, email, phone); process data provided during the audit; technical data (IP address, browser type, cookies).
- Free online tools (e.g. EU AI Act): the contact email entered when requesting the output, and information about the company's systems or activities entered into the questionnaire. These tools are designed not to require personal data beyond the contact email; users are prompted not to enter personal data or confidential details into free-text fields.
- Outreach to prospective clients: as set out in the "Prospective Clients' Data" section below.
The audit does NOT collect: financial statements or accounting data; the company's own customers' personal data; internal secrets and business strategies; system credentials (passwords, API keys); employee data (salaries, personal data).
2.3 Purpose of Processing
Provision of the service; invoicing and tax obligations; communication with the Client; quality improvement (anonymised data).
2.4 Legal Basis
Art. 6(1)(b) GDPR (performance of a contract); Art. 6(1)(c) GDPR (legal obligation — invoicing, taxes); Art. 6(1)(f) GDPR (legitimate interest — service improvement, direct B2B marketing).
2.5 Retention Period
- Audit process data (AI Foundation Audit): 90 days after report delivery, then automatically deleted or anonymised.
- Questionnaire inputs and generated outputs of free tools (e.g. EU AI Act): 12 months from generation, then deleted or anonymised (aggregated, non-identifying statistics may be retained further). Within this period, re-access and updating of the output via the emailed link also function; after it, this option ceases.
- Invoices and accounting documents: 10 years (legal obligation).
- Contact data and marketing consent: until consent is withdrawn.
- Prospective-client outreach data: 6 months absent a response (details below).
2.6 Rights of the Data Subject
You have the rights of access, rectification, erasure, restriction, objection (including an absolute right to object to direct marketing), data portability, and withdrawal of consent, as well as the right to information about the source of data not obtained from you, under the conditions of Articles 13–21 GDPR. You may lodge a complaint with a supervisory authority: the Slovak Office for Personal Data Protection, Galvaniho Business Centrum II, Galvaniho 7/B, Bratislava. If the processing concerns a data subject in the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO), ico.org.uk. For data subjects in the EU/EEA, the competent authority is the Slovak Office or the authority in the data subject's Member State of habitual residence.
2.7 Processors and Third Parties; AI Tools
Data is NOT used to train AI models and is NOT shared with third parties for marketing.
The Provider uses the following categories of processors and technical tools: (i) a provider of an AI model for generating the text of outputs, (ii) a provider of AI-assisted office tools for creating and processing text, and (iii) a tool for searching and selecting contacts in prospective-client outreach. These processors process personal data under a data processing agreement and solely for the purpose of providing the service. The Provider operates email communication on its own email infrastructure within the easy-audit.ai domain. The Provider: does not use client inputs to train AI models and contractually requires the same from its processors; does not enter personal data into AI tools beyond what is necessary and in line with its internal AI use policy; where a processor processes personal data outside the European Economic Area (EEA), ensures such transfer on the basis of a European Commission adequacy decision or standard contractual clauses under Article 46 GDPR.
2.8 Transfers to Third Countries
Within the Provider's services, no personal data is transferred to third countries or international organisations, except where a processor (the AI tools under section 2.7) processes data outside the EEA; in that case the transfer is based on an adequacy decision or standard contractual clauses under Article 46 GDPR. The Provider operates email communication on its own email infrastructure within the easy-audit.ai domain.
Prospective Clients' Data
If easyAI contacted you by email without you providing your data directly, this section explains how we process your data and your rights, under Article 14 UK GDPR / EU GDPR.
Controller. DDN Consulting s.r.o., Bodíky 222, 930 31 Bodíky, Slovakia (IČO 55 879 128), operating the easyAI brand. Data-protection contact: [email protected].
Data we hold. Your name, job title, work email address, employer, the public source where we found your data, and a business signal relevant to your role that prompted our outreach. We hold no special categories of personal data.
Purpose. Relevant business-to-business (B2B) outreach regarding our service, addressed to the relevant decision-maker in your organisation.
Legal basis. Legitimate interest (Art. 6(1)(f)) in relevant B2B direct marketing of our professional services (Recital 47). We have conducted a legitimate-interest assessment (dated 21 June 2026); a summary is available on request.
Source. Public company websites, public professional profiles, and the UK Companies House register. Some work email addresses are derived using standard patterns, not copied from a published page.
Use of AI tools in outreach. We use an AI-assisted tool to search for and select relevant contacts. The outreach itself (drafting and sending the email) is not generated by AI — it is performed by a human. The AI tool therefore serves solely as a supporting tool for finding contacts; it does not conduct automated communication with you and does not carry out automated individual decision-making producing legal or similarly significant effects concerning you. You have the right to object at any time and the right to human intervention — contact [email protected].
Recipients. We operate email communication on our own email infrastructure within the easy-audit.ai domain. We do not sell or share your data with third parties for marketing.
Retention. If you do not respond, we delete or block your record within 6 months. If you object, we keep a minimal record (email + date + "objected") indefinitely, solely to respect your objection (Art. 6(1)(c) / Art. 17(3)(b)).
Your rights. Access, rectification, erasure, restriction, portability (where applicable), and — for direct marketing — an absolute right to object. To opt out, reply "remove" to our email or contact [email protected]; we will cease processing immediately and permanently.
Complaints. You may complain to a supervisory authority — the UK ICO (ico.org.uk) or the Slovak Office for Personal Data Protection (dataprotection.gov.sk).
(For UK recipients: UK GDPR as amended by the Data (Use and Access) Act 2025. For EU/EEA recipients: Regulation (EU) 2016/679 (GDPR).)