Privacy Policy

Who is responsible

Valistros, s. r. o., with its registered office at Karadžičova 8/A, 821 08 Bratislava, Slovak Republic, IČO 55 901 174, DIČ 2122124059, IČ DPH SK2122124059, registered with the Municipal Court Bratislava III, Section Sro, File No. 174312/B, is the operator of this website and the controller for website administration and advisory enquiries. Email: advisory@valistros.com. Telephone: +421 2 3307 0890.

Valistros Fondacija, with its registered office at Svetozara Radića 7, 11102 Belgrade, Republic of Serbia, PIB 108463123, MBR 28827725, registered with the Serbian Business Registers Agency, is the controller for personal data provided in foundation-specific enquiries. Email: foundation@valistros.com. Telephone: +381 11 3343 999.

The relevant entity is responsible for the relationship or communication in which the data is processed. The entity in whose name an outbound communication is initiated is the controller for that correspondence. The two entities are separate legal persons, as explained in the Legal Notice.

Personal data processed

The website has no enquiry form, account system or newsletter registration. If a visitor chooses an email or telephone link, Valistros may receive the contact details, affiliation, message content and any other information the visitor provides through that separate communication channel.

Where either entity, or representatives acting on its behalf, initiates professional correspondence, the relevant entity may process the recipient's name, professional contact details, role, organisation, correspondence and related delivery or security metadata. These data may originate from an existing relationship, prior correspondence, an introduction or referral, the recipient's organisation, or publicly available professional sources.

In operating professional productivity, communication, document-collaboration, file-storage, videoconferencing and scheduling services, the relevant entity may process professional contact details, affiliations, correspondence, calendar entries, invitation and attendance information, meeting details, documents, comments, shared-file content and associated technical metadata.

Where Valistros, s. r. o. is the controller, processing is subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as "GDPR").

Where Valistros Fondacija is the controller, processing is subject to the Law on Personal Data Protection ("Official Gazette of the Republic of Serbia", No. 87/2018) (hereinafter referred to as "LPDP").

Website infrastructure may process limited technical data needed to deliver and secure the site, such as an IP address, request time, requested resource, browser or device information and security events. A first-party privacy-preference record stores selected categories, the choice date, policy version and renewal date. See the Cookie Policy.

Providing information by email or telephone is voluntary. Without sufficient contact information, Valistros may be unable to respond to the enquiry.

Valistros does not use automated decision-making or profiling in connection with website visitors, enquiries or professional operations. Operational automation used to carry out authorised communications, document-collaboration, file-management or scheduling instructions does not evaluate individuals, make decisions about them or profile them, and does not constitute automated decision-making or profiling.

Purposes and legal bases

Personal data is processed only to the extent necessary for the following purposes. The applicable legal basis depends on which entity controls the relevant enquiry, correspondence, engagement or record. References below to GDPR apply to processing by Valistros, s. r. o.; references to LPDP apply to Valistros Fondacija:

• Enquiries and prospective engagements. Contact details and correspondence are used to respond to requests, assess a possible mandate and take steps requested before an agreement is entered into. The applicable legal bases are Article 6(1)(b) GDPR and Article 12(1)(2) LPDP.
• Professional correspondence and relationship management. Contact details, correspondence and related records may be used to initiate, respond to and maintain proportionate professional communications, preserve relationship continuity and administer engagements, including organising or transmitting communications, coordinating meetings and invitations, managing shared materials and maintaining collaboration, storage and scheduling records. These activities may be carried out through operational automation under Valistros's authorisation and configured instructions. The applicable legal bases are Article 6(1)(f) GDPR and Article 12(1)(6) LPDP. Where contact details were obtained indirectly and used to initiate communication, Articles 14 and 21 GDPR and Articles 24 and 37 LPDP apply.
• Website, communications security and integrity. Limited technical data is processed to deliver the website, protect communications, prevent misuse, investigate security events and maintain reliable operation. The applicable legal bases are Article 6(1)(f) GDPR and Article 12(1)(6) LPDP.
• Legal and regulatory compliance. Records may be retained or disclosed where required by law or where necessary to establish, exercise or defend legal claims. The applicable legal bases are Articles 6(1)(c) and 6(1)(f) GDPR and Articles 12(1)(3) and 12(1)(6) LPDP.

The legitimate interests pursued are effective professional communication and coordination, continuity of relationships, efficient administration of meetings and shared materials, website security and protection of Valistros's legal position. Valistros determines the purposes and scope of any operational automation used for these activities. Those interests are considered against the rights and reasonable expectations of the individuals concerned.

No optional analytics or marketing technologies are currently used. If introduced, they will remain disabled unless the visitor gives consent, which may be withdrawn at any time.

Recipients

Access is limited to the relevant Valistros personnel and service providers needed for the relevant purpose. Website hosting and network delivery are provided by OpenAI Ireland Limited and its web-hosting subprocessor Cloudflare, Ltd. Professional productivity, communication, document-collaboration, file-storage, videoconferencing and scheduling services are provided by Google Cloud EMEA Limited and its subprocessors. In providing those services, Google Cloud EMEA Limited may process professional contact details, affiliations, correspondence, calendar entries, invitation and attendance information, meeting details, documents, comments, shared-file content and associated technical metadata. These providers act under contractual data-protection and confidentiality obligations.

Domain registration, DNS and apex-domain forwarding are provided by GoDaddy.com, LLC, which may process limited technical data, including IP addresses and request metadata, to provide those services.

When specifically authorised by Valistros, OpenAI Ireland Limited may process relevant professional information and interact with connected business services to organise or transmit communications, manage shared materials, schedule meetings and issue calendar invitations. These actions may be performed automatically under Valistros's authorisation and configured instructions. Valistros determines their purposes and remains responsible for them.

Information may also be shared with legal or professional advisers and public authorities when required by law or necessary to establish, exercise or defend legal claims. Valistros does not sell personal data.

International transfers

Website request data is processed through hosting supplied by OpenAI Ireland Limited, with Cloudflare, Ltd. providing web hosting and content delivery at infrastructure locations determined by the service, ordinarily including the data centre nearest the visitor. The hosting service does not currently provide a data-residency commitment. Processing may therefore occur within or outside the European Economic Area, including in the United States where OpenAI affiliates provide technical and operational support.

Domain registration, DNS and apex-domain forwarding are provided by GoDaddy.com, LLC. Its processing may occur in the United States.

Professional productivity, communication, document-collaboration, file-storage, videoconferencing and scheduling services are handled by Google Cloud EMEA Limited. Depending on service configuration and operational requirements, Google Cloud EMEA Limited and its subprocessors may process the professional information described in this policy in the EEA and in other countries where they maintain facilities, including the United States.

The transfer arrangements described in this section also apply where OpenAI Ireland Limited and its affiliates or subprocessors process relevant professional information or interact with connected business services under Valistros's authorisation and configured instructions.

Where a transfer is made to a country without an applicable adequacy decision, the providers use the European Commission’s Standard Contractual Clauses incorporated into their data processing terms and supplementary measures where required. Current information is available in the data-processing terms applicable to OpenAI Ireland Limited, the subprocessor information applicable to OpenAI Ireland Limited, the service terms applicable to OpenAI Ireland Limited, the business-data privacy information applicable to OpenAI Ireland Limited, the data-processing terms applicable to Google Cloud EMEA Limited, and the privacy information applicable to Google Cloud EMEA Limited, and the data-processing terms applicable to GoDaddy.com, LLC. A person may also request information about the safeguards relevant to their data using the contact details below.

Retention

Enquiry data is retained only for as long as needed to respond, evaluate a possible engagement, manage an existing relationship and meet legal, accounting or dispute-related obligations. The necessity of continued retention is reviewed by reference to the status of the enquiry or engagement and applicable limitation and statutory record-keeping periods.

Professional correspondence, calendar records, invitation and attendance information, meeting details, documents, comments, shared materials and associated metadata are retained only for as long as needed for the relevant professional relationship, engagement, operational continuity or applicable legal, accounting and dispute-related obligations. Where these records are held in systems provided by Google Cloud EMEA Limited or OpenAI Ireland Limited, they are also subject to Valistros's configured retention and deletion settings and the providers' applicable backup and deletion cycles.

Routine website request logs and security-event logs available to Valistros through the current hosting configuration are retained for a maximum of seven days. Valistros does not keep a separate copy beyond that period. Privacy preferences expire after six months.

Visitor rights

Subject to applicable law, visitors may request access, correction, erasure or restriction of personal data, object to processing based on legitimate interests, request portability where applicable, and withdraw consent at any time without affecting earlier lawful processing. Identity may need to be verified before a request is completed.

Recipients may object at any time to non-essential professional outreach. Where correspondence constitutes direct marketing, Valistros will stop using the relevant contact details for that purpose. These rights arise under Article 21 GDPR for processing by Valistros, s. r. o. and Article 37 LPDP for processing by Valistros Fondacija.

Complaints

Complaints concerning Valistros, s. r. o. may be made to the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic. Valistros Fondacija-related complaints may be addressed to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, Bulevar kralja Aleksandra 15, 11000 Belgrade, Republic of Serbia. Visitors may also contact the data-protection authority in their habitual EU residence or workplace where that right applies.

Security

Valistros uses proportionate technical and organisational measures intended to protect website and enquiry data against unauthorised access, alteration, disclosure or loss. No internet transmission or storage system can be guaranteed to be completely secure.

External links

Links to Google Maps, LinkedIn and Instagram do not load those services inside this website. Following a link transfers the visitor to an independently operated service whose privacy terms apply.

Policy updates

This policy may be revised when website operations, legal requirements or processing practices change. Material changes affecting optional consent will trigger a renewed privacy choice before the relevant technology is used.

Contact

For website, advisory or data-protection enquiries, contact advisory@valistros.com or +421 2 3307 0890. For foundation-related matters, contact foundation@valistros.com or +381 11 3343 999. Complete registration and postal details appear in the footer below.