Privacy policy
How SOSBOX processes the personal data you send us through the forms on this website, and what your rights are.
Valid from 13 November 2026 (version 2026-11-13).
Controller
instarea s.r.o., Ďatelinová 5530/10, 821 01 Bratislava
Company ID (IČO) 51 642 841, Tax ID (DIČ) 2120760235, VAT ID SK2120760235
Commercial Register of the Bratislava III City Court, section Sro, insert no. 127864/B
Questions about data protection and requests under this page: peter.fusek@instarea.com, phone +421 903 124 356.
What data, for what and how long
Booking a stop of our specialist (/en/visit) and a home demo of the box
- Data
- name, phone, address or district, village, preferred time; optionally email, what interests you, a note, the box size you chose
- Purpose
- to arrange and carry out the visit you asked for
- Legal basis
- steps at your request before entering into a contract (Art. 6(1)(b) GDPR)
- How long
- 1 year from sending
Newsletter (the “Just news” form or the tick box when booking a stop)
- Data
- Purpose
- to send dates of our next visits, new kits and preparedness tips
- Legal basis
- consent (Art. 6(1)(a) GDPR): „I agree to receive emails. Unsubscribe any time.“ or „Send me news and the dates of your next visits by email.“
- How long
- until you withdraw consent, at most 3 years
Email at the “3 days without power?” checklist
- Data
- email and the number of items you already have
- Purpose
- to send a reminder and SOSBOX news
- Legal basis
- consent (Art. 6(1)(a) GDPR): „I agree to receive a reminder and SOSBOX news at this email. I can withdraw at any time.“
- How long
- until you withdraw consent, at most 3 years
Box registration (QR code on the box)
- Data
- serial number and contents version of the box, email, optionally a phone number for text messages, which reminders you want
- Purpose
- to remind you to check the contents, charge batteries, test the radio and lights and replace things before they expire
- Legal basis
- consent (Art. 6(1)(a) GDPR): „I agree to the processing of my details to send reminders about this box.“
- How long
- until you withdraw consent, at most 5 years (shelf life of the box contents)
With every consent we store which text you agreed to (its version and fingerprint), in which language and when. With a visit request we store which version of this policy was shown to you.
When the period ends, the record is moved to the trash automatically and permanently deleted 30 days later. If you withdraw consent or ask for erasure, we delete it sooner. A deleted record may remain in our encrypted backups for at most about 6 months (see below), after which it is gone for good.
Providing the data is voluntary. Without a phone number we cannot arrange a visit, and without an email we cannot send news or reminders.
Protection of the forms against abuse
So that nobody can flood the forms, the server briefly counts submissions per email, phone number or box serial number (at most one hour, in memory only). The legal basis is our legitimate interest in a secure service (Art. 6(1)(f) GDPR). The contents of the forms are never written to the server’s technical logs.
What stays only in your browser
The cart, the chosen language and country, the ticked checklist items and the check list of a registered box are stored only in your browser (localStorage) and are not sent to our server. We use no analytics or advertising cookies and no third-party tracking tools.
Where the data is stored and who has access
- Server: the controller’s own server in Slovakia (EU), no cloud hosting. The connection from your browser goes directly to our server and encryption (TLS) ends only there; we use no CDN or other intermediary server.
- Connectivity and DNS: Slovak Telekom provides the internet connection (data transport only), Websupport (Slovakia) the domain name resolution (DNS only). Neither has access to the contents of the forms.
- Backups: we back up the database daily, encrypted (AES-256), to the server’s internal disk and a second copy to an external disk at the same place in Slovakia; no backups elsewhere and none in the cloud. We keep 7 daily, 4 weekly and 6 monthly backups, so a deleted record may remain in backups for at most about 6 months, after which it is gone for good.
- Technical logs: the server keeps technical logs of requests (time, page address, result) on its own disk, short-term, for operations and security. The application stores neither the contents of the forms nor visitors’ IP addresses.
- Access: only authorised shop administrators of the controller can access the data. They sign in to the administration with a Google account (administrators only, not visitors; Google receives no form data in the process).
We do not sell the data, do not give it to other companies for marketing and do not transfer it outside the European Union. We do not use an email delivery service yet; when we introduce one, we will add it here as a processor beforehand.
Your rights
- access to your data and a copy (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16)
- erasure (Art. 17)
- restriction of processing (Art. 18)
- portability of the data you gave us on the basis of consent or before a contract (Art. 20)
- objection to processing based on legitimate interest (Art. 21)
- you can withdraw consent at any time (Art. 7(3)); this does not affect processing before the withdrawal
Just write to peter.fusek@instarea.com or call +421 903 124 356. We reply without undue delay and within one month at the latest. We make no automated decisions and no profiling.
Complaints
If you believe we handle your data unlawfully, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk.
Legislation and changes
We process data under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on personal data protection. When we change this policy, we state the new version and date here; if a consent text changes, we ask for your consent again.