INFORMATION ON THE PROCESSING OF PERSONAL DATA on the website qpp.sk

Welcome to our website qpp.sk! If you are looking for reliable IT solutions for development, testing, and further growth of your business, you have come to the right place. In this document, you will learn everything you need to know about how we process the personal data you provide to us on our website www.qpp.sk or that our website collects directly. We want to assure you that your data is safe with us.

1. WHO PROCESSES YOUR PERSONAL DATA?

The controller responsible for the processing of personal data is the operator of the website www.qpp.sk (hereinafter referred to as “our website”), acting as the controller, which is our company: QPP a. s. Registered office: Svätoplukova 12, Bratislava 821 08, Slovak Republic Company Registration Number: 44 371 225 Registered in the Commercial Register maintained by the City Court Bratislava III, Section: Sa, Insert No.: 4587/B (hereinafter referred to as: “we” or “the Controller”) If you have any questions regarding the processing of your personal data, please contact us at any time at info@qpp.sk.

2. TO WHOM IS THIS NOTICE ADDRESSED?

To all visitors to our website, including (a) customers or potential customers who use our contact form to communicate with us, and (b) job applicants who send us their CV through the dedicated contact form directly on our website.

3. WHY AND FOR HOW LONG DO WE PROCESS YOUR DATA?

A) CONTACT FORM – CUSTOMERS

On our website, you have a contact form available through which you can send us your message with an enquiry regarding our services. Through the contact form, you entrust us with your contact details and the content of your message, which we will process and reply to as soon as possible. If we do not conclude a contract based on this communication, we will retain the content of our communication even after processing your request, in case you have further questions later or wish to follow up on the original communication. Legal basis: performance of measures prior to entering into a contract at the request of the data subject pursuant to Art. 6(1)(b) GDPR or our legitimate interest in the pursuit of our business activities and the conclusion of contractual relationships pursuant to Art. 6(1)(f) GDPR (where the enquirer is a person representing a potential business partner – typically an employee or statutory body of a company, etc.). If your personal data are processed on the basis of legitimate interest, you always have the right to object to such processing for reasons relating to your particular situation. For this purpose, you can contact us using the contact details provided above. Storage period: If a contractual relationship is not concluded immediately based on the communication initiated through the contact form, we retain the content of the communication for a maximum of 12 months from the processing of the original enquiry, for the purpose of possible continuation of negotiations on concluding a contractual relationship directly with the enquirer or with the company on whose behalf the enquirer is acting. If you use the contact form as a customer for questions about our services for yourself, the processing of your data is necessary within the framework of pre-contractual relations, regardless of whether we ultimately conclude a contract together or not. If you are representing another entity, the processing of your data is neither a legal nor a contractual requirement, nor is it necessary for the conclusion of a contract with you, but is carried out on the basis of our legitimate interest in concluding a contractual relationship with the entity you represent.

B) CONTACT FORM – JOB APPLICANTS

We are constantly looking for new, talented people to join our motivated team. If our vision, values and services appeal to you, we will be happy if you let us know about yourself, for example through the contact form for job applicants available on our website. We will review your CV and if your experience fits our team, we will invite you for an interview. If we do not currently have a suitable position for you, you may give us your consent to retain your data so that we can contact you in the future. For both of these purposes, we of course process the personal data you have provided. Legal basis: For the purposes of carrying out the recruitment procedure – performance of measures prior to entering into a contract at the request of the job applicant (data subject) pursuant to Art. 6(1)(b) GDPR; for the purpose of retaining data in order to contact the applicant with a suitable offer in the future – consent pursuant to Art. 6(1)(a) GDPR. Storage period: We process your communication and CVs of successful applicants for the duration of the recruitment procedure until the employment or other contract is concluded; subsequently, some data from it are retained for the purposes of concluding and performing the employment or other contract. Data of unsuccessful applicants are deleted without delay unless the applicant grants consent to the retention of their data for future contact with a suitable job offer. Such consent is valid for a maximum of 3 years from the date it is granted, unless the applicant withdraws it earlier; after that, their data will be deleted. The processing of the personal data you provide is necessary for the implementation of the recruitment procedure at your request, without which it is not possible to proceed with verifying your suitability for the position and subsequently concluding the contract establishing our employment relationship. The processing of personal data for this purpose is therefore a requirement necessary for the subsequent conclusion of the contract, regardless of whether the contract is ultimately concluded or not. The retention of personal data for the purpose of contacting you with a suitable job offer in the future is based on your voluntary consent, which you may withdraw at any time. Withdrawal of your consent does not affect the lawfulness of the processing of your data prior to its withdrawal.

C) OTHER PURPOSES

Security of systems Through our website, we also process various types of data to the necessary extent to ensure the protection and security of our information systems, including protection against cyber attacks and other events that may compromise the security of the system, personal data and commercially sensitive information, as well as the availability of the functionalities of our platform. For example, we retain information generated by our system or your device during your interaction with our website, such as information about your device and browser, IP address, and system logs, in order to identify any attempts to compromise the protection of our systems, use of malicious software, bots, DoS/DDoS attempts and other types of attacks. For these purposes, we use standard protection tools. Legal basis: our legitimate interest in ensuring the cybersecurity of our systems pursuant to Art. 6 (1) (f) GDPR. If your personal data are processed on the basis of legitimate interest, you always have the right to object to such processing for reasons relating to your particular situation. For this purpose, you can contact us using the contact details provided above. Storage period: for a maximum period of 12 months, unless these data are deleted earlier due to no longer being needed. Establishment, exercise or defence of legal claims Despite all our efforts, situations sometimes arise in which we may need to defend or assert our rights or legitimate claims, especially before the relevant authority (e.g. the Office for Personal Data Protection), but also in disputes with the data subject or the entity the data subject represents, thereby preventing damage on our side or on the side of third parties. The scope of the data processed in this way will be determined by the type of right or claim, or the type of dispute or proceedings, including the out-of-court stage, for the purposes of which these data will be processed. Legal basis: our legitimate interest or the legitimate interest of a third party in the establishment, exercise or defence of legal claims pursuant to Art. 6 (1) (f) GDPR. If your personal data are processed on the basis of legitimate interest, you always have the right to object to such processing for reasons relating to your particular situation. For this purpose, you can contact us using the contact details provided above. Storage period: We retain the data for this purpose for the period stipulated by legal regulations during which we or a third party are entitled to assert or defend rights and claims (statute of limitations or preclusion period) or during which we or a third party may bear legal consequences for failure to fulfil obligations imposed by law, e.g. in the form of a sanction imposed by public authorities, or for the duration of the relevant proceedings. Analytical purposes and statistics Our website is primarily intended for you as a presentation website so that you can learn about our company and services first-hand. We do not want to rest on our laurels, and therefore we want to continuously improve our website for you. For this purpose, we need to analyse the necessary data on the traffic of our website and interaction with its functionalities – in particular device and browser, anonymised IP address, visited subpages and time of visit, and source of visit. We collect these data through cookies used for website analytics, which may also use scripts and pixels for their proper functioning. Legal basis: consent to the use of cookies pursuant to Art. 6 (1) (a) GDPR in conjunction with Section 109 (8) of Act No. 452/2021 Coll. on Electronic Communications. Storage period: for the pre-set validity period of the cookies (maximum 2 years) or until the cookies are deleted from your browser, or until you withdraw your consent. You can withdraw your consent at any time via our cookie banner, which you can open via the website footer, or contact us at the email address above if that is more convenient for you. You can also delete all (not only our) cookies stored in your browser directly in your browser settings. The processing of personal data for the above-mentioned other purposes is neither a legal nor a contractual requirement and is not necessary for the conclusion of a contract; it is carried out on the basis of our legitimate interest or your voluntary consent.

D) COMPLIANCE WITH LEGAL OBLIGATIONS

Some personal data may also be processed for the purposes of fulfilling our legal obligations (e.g. demonstrating compliance with obligations under the GDPR, providing cooperation in response to requests from various public authorities, etc.). In such cases, the processing of your personal data is a legal requirement and without processing it we would not be able to fulfil our legal obligations. Legal basis: compliance with a legal obligation to which we are subject pursuant to Art. 6(1)(c) GDPR. Storage period: For the purposes of fulfilling legal obligations, we retain personal data for the period stipulated by law or determined on the basis of law by a public authority or by us as the Controller. The processing of data for these purposes is a legal requirement that we are obliged to fulfill; otherwise, we could be exposed to possible sanctions by public authorities.

4. WITH WHOM DO WE SHARE PERSONAL DATA?

Your personal data that you have provided to us or that have been generated by your device or our systems may be shared with our partners who assist us in operating our website and ensuring its functionalities, i.e. they process the data as our processors, on our behalf and according to our instructions. Such partners include, for example, the hosting provider, the provider of the content management system for our website, the provider of analytical services (Google Analytics, Google Tag Manager), external programmers and system security experts, and providers of other supporting activities. We always carefully select all of these partners also according to how they ensure data protection. Some personal data may also be made available to third parties who process them on the basis of law or another legal basis on their own behalf and under their own responsibility, typically for example law firms, tax advisors, public authorities if they request our cooperation in fulfilling their tasks, etc. We are not in any way responsible for the processing of data by these third parties. We do not send your personal data to third countries, i.e. outside the European Economic Area (which includes the European Union, Norway, Liechtenstein and Iceland), nor do we carry out automated decision-making or profiling with them. We store all your personal data with a trusted hosting provider whose servers are located exclusively within the European Union. 5. FROM WHICH SOURCES DO WE OBTAIN PERSONAL DATA? Primarily from you, especially if you contact us through our contact forms. Other data related to your activity on our website may be provided to us by your device or generated by our systems during your interaction with our website. We process only standard (ordinary) personal data and for none of the above-defined purposes do we collect any special categories of personal data .

6. FOR HOW LONG DO WE PROCESS PERSONAL DATA?

We always process personal data only for the necessary period. This period varies depending on the purpose for which the personal data are processed. We regularly monitor the duration of the purpose of the processing and if we find that the processing of personal data is no longer necessary and the law does not require their processing, we will delete the data even before the original period expires. Specific retention periods can be found in section 3 for the individual processing purposes.

7. WHAT RIGHTS DO YOU HAVE?

In connection with the processing of your personal data, you have the following rights against us as the Controller: a) to withdraw your consent to the processing of your data at any time (including consent to cookies); withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal, b) to request access to your personal data, c) to obtain the erasure of your personal data, d) to rectification of inaccurate personal data we process about you and to have incomplete personal data completed, e) to data portability, f) to restriction of processing of your personal data, g) the right to object to the processing of personal data on the legal basis of the legitimate interest of the controller or a third party for reasons relating to your particular situation, provided that the conditions laid down in the GDPR are met for exercising these rights. If you believe that there has been a breach of your rights in connection with the processing of your personal data, you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Park one Building, Námestie 1. mája 18, 811 06 Bratislava, website: https://dataprotection.gov.sk/uoou/ or with the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement of the Controller’s obligations.

8. HOW CAN YOU EXERCISE YOUR RIGHTS?

If you have any questions or wish to exercise your rights, please contact us: • by email at info@qpp.sk or, • in writing to the address of our registered office stated above. We reserve the right to update this notice if necessary. The current version will always be published on our website. In the case of important changes, we may also inform you by email if you have provided us with your email for communication purposes or if you are our customer. Update: 019.08.2026