This document explains what personal data Brand Force s.r.o. processes, why it processes it and what rights you have. It is divided by product type, because desktop applications, mobile applications, web applications, websites and web portals process different data and in different roles.
The controller is Brand Force s.r.o., registered office Gunduličova 899/1, 811 05 Bratislava, Slovak Republic, Company ID 52415325, Tax ID 2121044783, VAT ID SK2121044783, registered in the Commercial Register of the Municipal Court Bratislava III.
We are not legally required to appoint a Data Protection Officer under Art. 37 GDPR and have not appointed one. Data protection matters are handled by company management at the e-mail address above.
2. In what role we act
This is the most important part of this document. Under the GDPR we act in two distinct roles, and this determines who you should contact to exercise your rights.
Controller (we determine purpose and means)
We are the controller for data we process for ourselves: visits to our own websites, contact forms, enquiries, commercial and contractual records of our customers and suppliers, and job applicants. In these cases you exercise your rights directly with us.
Processor (we process on the customer's instructions)
For data held in the information systems we operate for our customers (municipalities, public undertakings and companies), we act as a processor. The controller is our customer — for example the employer who granted you access, or the municipality maintaining the records. We handle such data solely on their documented instructions, under a data processing agreement pursuant to Art. 28 GDPR.
In practice: if you are an employee, citizen or client and want to know what data about you is held in a system, contact the organisation that granted you access or that maintains the records. We may not handle such a request on their behalf, but we will give them full assistance. If you are unsure who that is, write to us and we will point you in the right direction.
3. Desktop applications
This covers native Windows and Linux applications we supply to our customers (for example information systems of municipalities and their companies, trading, logistics and customs systems). They are work tools — you sign in with credentials issued by your employer or the system operator. For the content you work with in them, we act as a processor as described in section 2. A macOS version is in preparation; once released, this section applies to it in the same way.
What the application stores on your device
Sign-in tokens — in the operating system credential store (Windows Credential Manager, libsecret on Linux). If no such store is available, an encrypted fallback file readable only by your user account is used; if that also fails, tokens are not retained at all and you sign in again after closing the application.
Application log — rotating text files (up to ~2 MB in total) in your user profile. They are used for troubleshooting, remain on your device and are never sent anywhere automatically. If you send us a log when reporting a fault, you do so knowingly and yourself.
Interface settings — chosen language, colour scheme, panel layout. These contain no personal data.
What the application sends
Data you enter — sent to the information system server of your employer or the system operator. Transfer is always encrypted (HTTPS/TLS).
Update check — the application asks our update server whether a newer version exists. As with any internet connection, the server records the IP address and the application and version identifier. Update packages are signed and the signature is verified before installation.
Crash reporting — only if you enable it. It is off by default. If you approve sending diagnostics after a crash, only the technical stack trace and the system type and version are sent. Variable contents and any data you were working with are deliberately excluded. Diagnostics go to our own server, not to a third party, and you can change the setting at any time.
Qualified electronic signature
Where the application supports signing documents with an eID card or another qualified device, the entire signing operation runs locally on your computer via the card reader and the PKCS#11 interface. You enter the PIN directly into the card driver and it never leaves your device — it is not sent to us and we do not store it. Only the resulting signed document is sent to the server; it contains your signing certificate, which is inherently part of the signature.
Desktop applications contain no analytics, advertising or behavioural tracking. We do not measure which features you use, how long you work, or when you launch the application.
4. Mobile applications
This covers our Android applications for field staff (for example apps for employees of municipalities and their companies). They are corporate applications — your account is created by your employer, who is also the data controller. We distribute them through Managed Google Play as a private application, or directly from our own update channel; they are not published in the public store. iOS applications are in preparation; once released, this section applies to them in the same way.
What data the application processes
Category
Specific data
When collected
Identity and sign-in
e-mail, password, optionally a two-factor code; alternatively sign-in by scanning a QR code from a computer
at sign-in
Location
device geographic coordinates
only during a specific action — submitting a job photo, recording arrival / break / transfer, a help request (SOS), or reporting a vehicle fault or route change. Never in the background and never continuously. If you decline the permission, the application keeps working and no location is sent.
Photographs
photos of the state before work, after work and at an incident; photo of a cash receipt
when you take the photo yourself. The application has no access to your gallery — it does not request media read permission and works only with images captured within it through the system camera.
Work records
timesheets (date, hours, description, issues), arrival, break and transfer times, dispatch messages, help requests, vehicle logbook and odometer readings
when you enter them
Device
phone manufacturer and model, application version, Android version and a randomly generated channel identifier for delivering notifications
when notifications are enabled — so dispatch knows which device to deliver an alert to
What the application does not do
Does not collect an Advertising ID, IMEI or phone number. It contains no advertising and data is not used for marketing or profiling.
Contains no analytics or third-party tracking — no Firebase, Google Analytics, Crashlytics, Sentry or advertising SDKs. Notifications are delivered by our own server, not Firebase Cloud Messaging.
The only Google library used is the QR code scanner, which runs entirely on the device and sends nothing. It is used to sign in by scanning a code.
Does not track location in the background. The application does not even request the corresponding system permission, so it is technically incapable of doing so.
Security on the device
All communication uses HTTPS only and is pinned to our certificate authority, so it cannot be intercepted with a forged certificate.
Sign-in tokens are encrypted with a key held in the device hardware keystore (Android Keystore). If you enable biometric unlocking, the token is bound to your fingerprint or face.
Application content is protected against screenshots and is not shown in the recent apps overview. Cloud backup of application data is disabled.
While you are offline, pending records and photos wait in a queue on the device and are sent once you reconnect. This queue relies on full-device storage encryption, which is standard on current Android systems — we therefore recommend keeping a screen lock enabled on your phone.
Signing out deletes sign-in tokens, downloaded data and the pending queue from the device, and unregisters it from notifications.
Account and data deletion
Your application account is created and closed by your employer, who is the controller. Requests to close an account and delete data should therefore be addressed to them; as processor we will delete the data on their instruction. You may also send the request to us at info@brandforce.sk — we will forward it to the controller without delay and let you know. You can uninstall the application at any time, which removes all data stored on the device.
5. Web applications
This covers information systems accessible in a browser after signing in (for example information systems of municipalities and their companies, trading and customs systems, document processing systems and internal systems). They are work tools for authorised users. For the content they hold we act as a processor — the controller is the organisation using the system.
Cookies and local storage
Web applications use strictly necessary technical cookies only. Signing in and maintaining a secure session is impossible without them, so no consent is required under Art. 5(3) of the ePrivacy Directive. We use no analytics or marketing cookies.
Cookie
Purpose
Attributes and lifetime
…_token
access token of the signed-in session in the information system for municipalities and their companies (the cookie name starts with the system's identifier)
HttpOnly, Secure, SameSite=Lax; approximately 30 minutes
refresh_token
extends the session without re-entering your password
HttpOnly, Secure, SameSite=Lax, restricted to the auth endpoint; days
session_hint
a flag with the value “1” telling the interface whether to attempt session restore; contains no information about you
Secure, SameSite=Lax; same lifetime as the refresh token
bf_session
session in internal and business systems
HttpOnly, Secure, SameSite=Lax; 2 hours
bf_csrf_cookie
protection against cross-site request forgery
HttpOnly, Secure, SameSite=Strict; 2 hours
bf_theme_pref
remembers the light or dark appearance; contains no personal data
Secure, SameSite=Lax; 1 year
In browser local storage some applications keep the sign-in token and your display preferences — sidebar collapse, table density, language, appearance. Signing out removes this data.
WiseLogic CZ (wiselogic.cz)
The WiseLogic CZ web application at wiselogic.cz converts export accompanying documents (VDD) into transit documents (T2) and keeps a record of them. We create the accounts; public registration is disabled. For the content of the documents, what is stated above for web applications applies.
Account: e-mail, username, first and last name, password (stored only as an irreversible bcrypt hash), active and administrator flags, time of creation and change. We keep it until we close the account; closing the account also deletes its documents.
Documents: uploaded VDD XML files and the T2 XML created from them, including the data they contain (document numbers, MRN, customs offices, seals and other consignment data), status and processing time. An ordinary user sees only their own documents, an administrator sees all. A document stays in the record until the user or an administrator deletes it; no automatic deletion is set up.
Backups: the daily database backup is kept for 14 days, server backups for at most about 2 years (14 daily, 8 weekly, 12 monthly and 2 yearly). A deleted document or account may therefore remain in backups until they are overwritten.
Technical logs: the web server records the IP address, time, requested address and browser type; the logs are kept for 14 days.
In the browser: the sign-in token (valid for 8 hours) and your chosen appearance in local storage; signing out removes the token. The application uses no cookies and loads fonts and icons from our own server.
Map data
Where an application displays a map, map tiles are loaded through our server, not directly from the map service. This means your IP address never reaches the map data provider (OpenStreetMap, or ZBGIS operated by the Slovak Geodesy, Cartography and Cadastre Authority). We do not use Google Maps.
6. Websites
This covers the public presentation websites we operate (brandforce.sk and the sites of our brands and projects). Here we act as the controller.
Contact form
If you write to us through a form, we process your name, e-mail, optionally a phone number, and the message content. The legal basis is our legitimate interest in answering your enquiry and establishing a business relationship (Art. 6(1)(f) GDPR); if a contract results, the basis becomes its performance (Art. 6(1)(b) GDPR). We keep the message for no more than 12 months from the last communication, or in line with accounting and tax rules if a business relationship arises. The message is also delivered to our mailbox.
Along with the message we record the sender's IP address and browser identifier to protect the form against abuse and bulk submissions. On our sites the IP address is never stored in readable form — only a salted, irreversible fingerprint remains, from which the original address cannot be recovered. The legal basis is our legitimate interest in security (Art. 6(1)(f) GDPR).
Cookies and audience measurement
brandforce.sk sets no cookies, which is why you will not find a cookie banner on it — there is nothing to consent to. Local storage holds only your chosen light or dark appearance.
On wiselogic.sk, alicon.sk and wiselogic.cz we measure traffic with Umami running on our own server — not Google Analytics or any other external service. The measurement uses no cookies and stores nothing on your device, which is why these sites have no cookie banner. Your IP address is not stored: it is used only to determine the country and city, and a visit is distinguished by an irreversible fingerprint salted with a daily-changing value, so you cannot be identified or tracked across days. We record the page visited (without URL parameters), where you came from, the type of browser, operating system and device, and the language. If your browser sends “Do Not Track”, we do not measure you at all. The legal basis is our legitimate interest in operating and improving the websites (Art. 6(1)(f) GDPR). We keep the measurement records for 36 months, after which they are deleted automatically. We do not share the data with anyone.
On other sites we operate that have a cookie banner, we use our own measurement running on our server — not Google Analytics or any other external service. Measurement starts only after your consent in the cookie banner, and your IP address is not stored: it is converted into an irreversible fingerprint salted with a daily-changing value, so it cannot identify you or track you across days. You can change your consent at any time.
We do not use Google Analytics, Google Tag Manager, Meta pixel, Hotjar, or any advertising or remarketing tools. Fonts are hosted on our own server, not loaded from a third-party CDN.
On one of the sites we operate, fonts and icons are still loaded from the external Google Fonts and Cloudflare networks, which exposes your IP address and browser details to them. We are removing this dependency by moving the files to our own server; until then we disclose it openly here.
7. Web portals
By portal we mean the sign-in area for customers and business partners — where you view documents, price lists, orders or documentation relating to your relationship with the portal operator (for example client zones and partner portals).
We process sign-in credentials, your organisation's identification and records of what you opened or downloaded in the portal. These records serve security and accountability purposes, not profiling.
Portals use strictly necessary technical cookies only (session, CSRF protection, access to embedded files and previews). They contain no analytics or marketing cookies.
Where we operate a portal for a customer, we are the processor of its content and that customer is the controller. Where the portal is our own, we are the controller.
8. Managing clients' social media
This section applies when a client (a company, municipality or other organisation) engages us to manage its business profiles on social networks: a Facebook Page, a professional Instagram account, a Threads profile, a LinkedIn Page or a Google Business Profile. We do not manage personal profiles.
The client is the controller, we are the processor
For data from the managed profiles, the client is the controller and we are its processor under Art. 28 GDPR, on the basis of a data processing agreement. We process the data only on the client's instructions and only for the purposes listed below. If you have commented on, messaged or reviewed a client's profile, please direct requests for access to your data to the client first (see section 2). You can also ask us directly to delete the data we hold (section 9).
How we obtain access
Access is granted by the client itself, using each network's official method: signing in and consenting via OAuth (for example “Continue with Facebook”), adding Brand Force as a partner in its Meta business portfolio, as an admin of its LinkedIn Page or as a manager of its Google Business Profile.
We never ask for or store the passwords to the client's accounts.
The client may revoke access at any time; see section 9 for how.
What data we process
Profile content and details — posts, photos and videos including scheduled ones, the profile description, opening hours and the business's contact details.
Statistics — aggregate reach and engagement figures that the network provides to the profile's administrator.
Public comments and reviews on the client's profile — the author's name and profile identifier as shown by the network, the text, time and rating.
Private messages (Messenger, Instagram Direct) that someone sends to the client, and the replies to them.
Access tokens issued to us by the network once access is granted. We store them encrypted.
We obtain nothing about people who interact with the client's profile beyond what the network shows with their comment, message or review. We do not process friend lists or followers' private profiles.
What we use the data for
Preparing, scheduling and publishing posts on the client's behalf.
Replying to comments, messages and reviews and moderating them (hiding, deleting) according to the client's instructions.
We do not sell social media data, do not use it for advertising or for profiling people, do not combine it with other clients' data and do not use it to train artificial intelligence models. We store it on our servers in Slovakia; encrypted backups are kept in Germany (see section 10).
Network operators
Posts and replies we publish on the client's behalf are also processed by the network operator under its own terms and privacy policy. The networks act as independent controllers, not as our processors. For users in the European Union these are Meta Platforms Ireland Limited (Facebook, Instagram, Threads), LinkedIn Ireland Unlimited Company and Google Ireland Limited. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep the data
Data
Retention period
Access tokens
Until access is revoked or the contract with the client ends.
Copies of posts, media, comments, private messages and reviews
For the duration of the contract with the client, and no longer than 12 months from their creation.
Aggregate profile statistics
For the duration of the contract with the client.
Record of how a deletion request was handled (without the deleted content)
3 years, so that we can demonstrate that the request was handled.
When the contract with the client ends or access is revoked, we delete all of the above data, except the record of a handled deletion request, within 30 days. Encrypted backups have a retention cycle of at most 2 years (14 daily, 8 weekly, 12 monthly and 2 yearly backups).
9. Deleting social media data
This is how to revoke our access to a social media profile and have the data we obtained through that access deleted (section 8). It applies to clients and to people who have interacted with a client's profile.
Revoking access (client)
Facebook, and Instagram connected through Facebook — in Facebook settings, under Apps and websites or Business integrations, select our app and remove it. If you added Brand Force as a partner in your Meta business portfolio, remove it under Partners in the portfolio settings.
Instagram with Instagram login — in Instagram settings, under Website permissions → Apps and websites, remove our app.
LinkedIn — remove Brand Force from your Page admins and, in your account settings under Data privacy → Permitted services, remove our app.
Google — at myaccount.google.com/connections remove our app's access, and in your Google Business Profile remove Brand Force under People and access.
Once access is revoked, we receive no new data from the network. If Meta sends us a deletion request after you remove our app, we handle it in the same way as a request sent by e-mail.
Requesting deletion
Write to info@brandforce.sk with the subject “Data deletion – social media”. Tell us which profile or Page the request concerns and how we can find you on the network (your name or a link to your profile). We may ask for additional details to verify your identity, but we never ask for passwords.
What we delete and when
Within 30 days of access being revoked or of receiving the request, we delete the access tokens and copies of posts, comments, messages, reviews and statistics obtained through that access. If you are asking as the author of a comment, message or review, we delete your data.
We confirm the deletion by e-mail. For a request sent to us by Meta, you receive a confirmation code from Meta, which you can quote to us to learn the status of your request.
Data disappears from encrypted backups as they are routinely overwritten, within 2 years at the latest. Backups are not used for day-to-day work; if we ever restored one, we would remove the deleted data again.
Deletion on our side does not cover content published directly on the social network, such as a comment on Facebook. Its author or the client can delete it on the network itself; we can also do so on the client's instructions.
10. What applies to all products
Server logs
Every connection to our servers is recorded in the web server log: IP address, time, requested address, status code and browser identifier. This serves security and troubleshooting purposes (legitimate interest under Art. 6(1)(f) GDPR). We keep these logs for 14 days, after which they are deleted automatically.
Where your data is stored
We operate our own server infrastructure located in the European Union. We do not use public cloud platforms to store customer data. Backups are encrypted.
Recipients and sub-processors
Infrastructure providers — the data centre and connectivity provider and the provider of storage for encrypted backups, both within the European Union.
Proton AG (Switzerland) — delivery of part of our e-mail communication. Switzerland is recognised by a European Commission adequacy decision as providing an adequate level of protection, so this is not a risky transfer outside the EEA.
Public authorities — only where required by law.
We do not sell personal data, do not share it with advertising networks or data brokers, and do not use it for automated decision-making with legal effect or for profiling. We do not transfer data outside the EEA except as stated above.
Security
Encrypted transport (HTTPS/TLS) across all products without exception.
Role- and permission-based access, with two-factor authentication where the controller requires it.
Separation of individual customers' data, encrypted backups and regular security updates.
Access and change logs, so it can be demonstrated retrospectively who worked with the data.
11. Your rights
Under the GDPR you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
Send your request to info@brandforce.sk. We will respond within one month; for complex or repeated requests this may be extended by two months, of which we will inform you. There is no charge. If the request concerns a system we operate for a customer, we will forward it to them as controller without delay and let you know — see section 2.
Supervisory authority
If you believe our processing of your data infringes the law, you may lodge a complaint with a supervisory authority. Our competent authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk. You may also complain to the supervisory authority in the Member State of your habitual residence or place of work.
12. Children
Our products are business and work tools. They are not directed at children and we do not knowingly process data of persons under 16. If we learn that we have obtained such data without the necessary legal basis, we will delete it.
13. Changes to this policy
We may update this policy when our products or the law change. The current version is always published at this address together with its version number and effective date. For material changes affecting your rights we will also notify users directly within the products concerned.
8. Managing clients' social media
This section applies when a client (a company, municipality or other organisation) engages us to manage its business profiles on social networks: a Facebook Page, a professional Instagram account, a Threads profile, a LinkedIn Page or a Google Business Profile. We do not manage personal profiles.
The client is the controller, we are the processor
For data from the managed profiles, the client is the controller and we are its processor under Art. 28 GDPR, on the basis of a data processing agreement. We process the data only on the client's instructions and only for the purposes listed below. If you have commented on, messaged or reviewed a client's profile, please direct requests for access to your data to the client first (see section 2). You can also ask us directly to delete the data we hold (section 9).
How we obtain access
What data we process
We obtain nothing about people who interact with the client's profile beyond what the network shows with their comment, message or review. We do not process friend lists or followers' private profiles.
What we use the data for
We do not sell social media data, do not use it for advertising or for profiling people, do not combine it with other clients' data and do not use it to train artificial intelligence models. We store it on our servers in Slovakia; encrypted backups are kept in Germany (see section 10).
Network operators
Posts and replies we publish on the client's behalf are also processed by the network operator under its own terms and privacy policy. The networks act as independent controllers, not as our processors. For users in the European Union these are Meta Platforms Ireland Limited (Facebook, Instagram, Threads), LinkedIn Ireland Unlimited Company and Google Ireland Limited. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep the data
When the contract with the client ends or access is revoked, we delete all of the above data, except the record of a handled deletion request, within 30 days. Encrypted backups have a retention cycle of at most 2 years (14 daily, 8 weekly, 12 monthly and 2 yearly backups).