Privacy policy

The short version

• The website uses no analytics, no advertising and no cookies, and loads nothing from other servers.
• Our server keeps a short access log for security and operation, for up to 30 days.
• The contact form sends nothing to us. It opens your own email program with your message filled in.
• The demo Viallo Club card holds no personal data, and we learn nothing when you add or use it.
• Our demonstration beacons count devices anonymously. They never store or send a device address.
• Our servers and our email are in the European Union. We never sell personal data.

Who is responsible

The controller of your personal data is Viallo s. r. o., Šustekova 3697/49, 851 04 Bratislava – Petržalka, Slovakia, IČO 57 859 043, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 203877/B (“Viallo”, “we”).

Write to us about anything in this policy at hello@viallo.solutions. We have not appointed a data protection officer, as the law does not require one for what we do.

This policy covers the website viallo.solutions, the files offered on it, our demonstration beacons and messages you send us. Booking Desks and Routava, the products we run, have their own privacy policies on their websites.

Visiting the website

When your browser asks for a page, our web server (nginx) writes a line to its access log: your IP address, the date and time, the address requested, the page you came from, whether the request succeeded and how much was sent, and what your browser reports about itself (its name, version and operating system).

We use the log only to run the site and keep it secure: to find errors, spot attacks and abuse, and investigate them. The legal basis is our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR). The log is deleted after 30 days at the latest, unless we need part of it longer to investigate a specific security incident.

The site runs on a virtual server we rent from INTERNET CZ, a.s. (Forpsi) in the European Union. Forpsi processes the data only as our hosting provider. Every connection to the site is encrypted (HTTPS).

No analytics, no third parties

The website uses no analytics, statistics, advertising or tracking tools, no social media plugins and no embedded videos or maps. Everything it loads, including its fonts and its one script library, comes from viallo.solutions itself, so visiting it tells no other company that you were here.

The site links to other websites, such as LinkedIn, Booking Desks, Routava and articles we cite. When you follow a link, that website’s own privacy policy applies.

Browser storage

The website sets no cookies. It stores one thing in your browser, and only when you use the language switch:

• viallo-lang in your browser’s local storage, with the value en or sk. It remembers the language you picked, so the site shows that language next time instead of following your browser’s settings. It stays in your browser until you clear the site’s data, and it is never sent to us.

This entry is strictly necessary for a function you ask for, so it needs no consent (§ 109(8) of the Slovak Electronic Communications Act, No. 452/2021 Coll.).

Two more things happen only in your browser and send nothing to us: the home page reads your browser’s preferred languages to show Slovak and Czech visitors the Slovak page, and the “Copy” buttons put text on your clipboard when you press them.

Writing to us

The contact form has no server behind it. When you press “Send message”, the page writes an email from what you filled in (your name, email address, company, the services you ticked and your message) and opens your own email program with it, addressed to hello@viallo.solutions. Nothing reaches us until you send that email yourself. If no email program opens, the page offers to copy the text so you can send it another way. The site does not store what you type.

When you write to us, by the form or directly, we receive your email address, your name and whatever you put in the message. We use it to answer you, prepare an offer and, if we agree on work, to carry out the contract. The legal basis is steps taken at your request before a contract (Art. 6(1)(b) GDPR) or, for other messages, our legitimate interest in replying (Art. 6(1)(f) GDPR). Giving us these details is up to you, but without an email address we cannot reply.

Our mailbox is hosted by Websupport, s. r. o. in Slovakia, which processes the messages only as our email provider. Your own email provider handles the message on your side, under its own terms.

We keep correspondence for as long as the enquiry and any contract that follows need it, and then for as long as the law requires us to keep business records (for example, ten years for accounting documents under the Slovak Accounting Act, No. 431/2002 Coll.). If no contract follows, we delete the correspondence within three years of our last contact.

The demo Wallet card

The Viallo Club card offered on the site is a demonstration. It is one static file, the same for everyone, with made-up details (a demo member, demo points and a demo store) and no personal data. Downloading it is an ordinary request to our server and appears in the access log like any page.

When you add it, Apple Wallet stores it on your iPhone. The card names a beacon identifier: when your iPhone is near a Viallo beacon, iOS shows the card on your lock screen. Your iPhone decides that on its own, under Apple’s rules. Viallo receives nothing from it, neither that you added the card nor when or where it appeared. You can remove the card in Wallet at any time.

Cards that receive updates

The demo card on this site has no update service, so this section does not apply to it. It applies to Wallet cards whose back says that the card receives updates.

For such a card, the wallet app sends Viallo the details needed to deliver updates and messages to it:

• Apple Wallet: an identifier of the device’s Wallet, a push token and the card’s serial number;
• Google Wallet: the identifier of the card object.

These details are used only to deliver card updates and messages, and are removed when you remove the card. You can switch messages off for each card in your wallet app’s settings for that card.

Demonstration beacons

At demonstrations and trials, Viallo’s beacons count the Bluetooth devices nearby, such as phones, watches and headphones, to show how footfall can be measured. They count; they do not identify anyone.

Every Bluetooth device broadcasts an address, which many phones change every few minutes. A beacon keeps the addresses it hears in its memory for one 10-second window only, and never stores or sends a device address. For each window it sends the number of devices it heard and a short code for each device. The code is made from the address with a key that changes every window and comes from a key that changes every day; the daily keys are deleted when their day ends. We use the codes only so that a device heard by several beacons at once is counted once, and then keep the counts alone.

This is anonymous counting. A code cannot be turned back into an address, and the codes of one window cannot be linked to the next. The only thing the receiving system could do with a code is check whether it matches a device whose Bluetooth address it already knows. It does not do that, and we keep no list of addresses. We work this way because a count is all a demonstration needs.

To the extent that briefly handling a broadcast address inside a beacon counts as processing personal data, we rely on our legitimate interest in demonstrating and measuring footfall (Art. 6(1)(f) GDPR), with the safeguards above. If you would rather not be counted at all, turn Bluetooth off on your devices.

Companies that use Viallo Beacons

When a company uses Viallo Beacons for its loyalty cards, card messages or store counting, that company is the controller of its members’ and customers’ data, and Viallo processes the data only on its behalf and on its instructions. The company’s own privacy notice applies, and a data processing agreement is part of each contract. Questions about such a card or store go to the company first; we help it answer.

Who else sees data

Two providers named above, each for its own task: INTERNET CZ, a.s. (Forpsi) for hosting and Websupport, s. r. o. for email. Both are in the European Union and work under contracts that meet the GDPR.

For cards that receive updates, the update itself travels through the wallet maker's service: Apple's push service for Apple Wallet and Google's Wallet service for Google Wallet. They receive the card's push token or card identifier to deliver it, may process it outside the European Union, and do so under their own terms and safeguards for international transfers. Apart from that, we do not transfer personal data outside the European Union.

We disclose data to authorities or courts only where the law requires it, and to our accountants and legal advisers under confidentiality. We never sell personal data and make no decisions about you by automated means.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• rectification of data that is wrong;
• erasure of data we no longer need or process unlawfully;
• restriction of processing in certain cases;
• portability of data you gave us, in a machine-readable format;
• object to processing based on our legitimate interest;
• withdraw consent at any time where processing is based on consent, without affecting what was done before.

To use any of these rights, write to hello@viallo.solutions. We answer within one month; for complex requests the law allows two more months, and we would tell you why. We may ask you to confirm who you are. Note that for the beacon counts and the access log we often cannot tell which data is yours, because it is anonymous or tied only to an IP address.

You can also complain to the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk, or to the authority in the EU country where you live or work.

Changes to this policy

We update this policy when what we do with data changes. The date at the top shows the current version.