Privacy notice
Effective from 13 September 2026
Spravca is the portal in which a Manager Organisation runs its buildings and Residents report Issues, read Notices and answer Polls. This notice says which personal data the portal keeps, why, for how long, who receives it and what you can do about it. It describes what the portal actually does.
Who is responsible
The operator of this portal is the controller of your Person Account, your sign-ins and the security log:
- Operator
- Spravca s.r.o.
- Company ID (IČO)
- 123
- Registered office
- Sidlova 5
- Contact for privacy questions
- lala@linuxor.sk
The Manager Organisation that runs your building (its administrator or owners' association) is the controller of the data about that building: your Residencies, the Issues you report there with their comments and photos, and the Poll answers of your Unit. The operator processes that data on its behalf, as its processor. Please send questions and requests about that data to your Manager Organisation.
What we process, why and on what basis
Your Person Account
Your name, your email address, your password (stored only as a one-way hash, never readable), your language and which notifications you get by email and by push.
So that you can sign in, use the portal and receive the emails you did not turn off. Legal basis: performance of a contract, the use of the portal you signed up for (Art. 6(1)(b) GDPR).
Sign-ins and the security log
Successful and failed sign-ins with the address that was typed, password and email changes, rejected Residency codes, and who did what and when in an organisation — for example approving a Residency, changing an Issue's status or uploading a Document. The portal records no IP address with them.
To protect accounts against misuse, to slow down password guessing and to show an organisation's Owner who did what. Legal basis: the legitimate interest of the operator and of the Manager Organisation in a secure portal (Art. 6(1)(f) GDPR).
Your building
Your Residencies (the Unit, the role, whether a Manager approved it and the Manager's note), the Issues you report with their comments and photos, the public Issues you marked as affecting you (the other Residents are told only how many; the Managers of the building see your name and your Unit, and the mark is deleted when your account is erased), your Unit's Poll answers, and for Managers their membership of the organisation. Photos are converted when uploaded, which removes their location and camera data.
So that your Manager Organisation can run the building: confirm who lives where, deal with Issues and ask Residents in Polls. Legal basis: the Manager Organisation decides it as the controller, and the operator processes this data only on its instructions (Art. 28 GDPR).
What you have seen
Which Notices, Events, Documents, Polls, Poll results and changes on your Issues you have opened or marked as seen, and when. Nobody else sees it: not your Manager Organisation, not its Owners, not the other Residents, not as names and not as counts.
So that your Notice Board shows you what is new for you and leaves out what you have already seen. Legal basis: performance of a contract, the use of the portal you signed up for (Art. 6(1)(b) GDPR). It is kept while your Person Account exists and deleted when the account is erased, or with the item it marks.
Push notifications
For each device on which you turned push on: the address the browser's push service gave for it, the two keys that notifications to it are encrypted with, the browser and system (for example "Chrome, Android", never more of what the browser says about itself), when you turned it on and when a notification last reached it. For each push notification, as for an email: what it is about and whether it was sent. A push notification carries only a fixed title, such as "New notice at Hlavná 12", and a link into the portal, never text anybody wrote.
To deliver the notifications you chose to get by push. Legal basis: performance of a contract, the use of the portal you signed up for (Art. 6(1)(b) GDPR). A device is kept until you remove it in your profile, sign out everywhere or your account is erased, or until its push service says it no longer exists.
Calendar feed
If you create a calendar feed link: the secret link itself, when you created it and when something last read it. What goes out through it is the events of the entrances you hold an approved unit in and, if you manage buildings, the events of those organisations and their inspection due dates — title, days and times, supplier, address and a link back to the portal. The description of an event is never sent.
So that your building's events show in your own calendar. The link exists only if you create it yourself. Legal basis: performance of a contract, the use of the portal you registered for (Art. 6(1)(b) GDPR). It is kept until you replace or delete it in your profile, sign out everywhere, or your account is erased.
Emails
For each email about a new Notice, Event, Document or Poll: your address, what it is about and whether it was sent. Emails confirming your address, resetting your password and inviting you are sent at once and not kept.
To deliver them. Notifications of each kind can be turned off in your profile. Legal basis: for the emails about your building, the Manager Organisation's instructions, as for the building data above; for the emails about your account, performance of a contract (Art. 6(1)(b) GDPR).
How long we keep it
The portal deletes data by itself once its period has passed; the check runs every hour.
- From your request to delete your account to its erasure (you can sign in and cancel all along): 30 days
- Sign-ins, failed sign-ins, password and email changes, rejected Residency codes: 12 months
- The record of who did what in an organisation: 36 months
- Everything in an organisation, after it was closed: 90 days
- An account whose email address was never confirmed, after signing up: 30 days
- Links from our emails (confirmation, password reset, invitation), after they were used or expired: 7 days
- A sign-in session nobody used: 14 days
- The record of a request to delete an account, after it was carried out or cancelled: 36 months
- An uploaded file nothing refers to, or an interrupted upload: 24 hours
- The photos of an Issue, after it was resolved or rejected: 24 months
- The record of an email about a Notice, Event, Document or Poll, after it was sent or given up: 30 days
Everything else is kept while your Person Account exists, and data about a building while the Manager Organisation keeps it in the portal.
When your account is erased, your name is removed, and your email address is removed from your account and from the records of what you did. The Issues, comments and Poll answers you left stay in the organisation's records under "Deleted account", because they are part of the building's history; text you wrote in them is not changed.
Who receives it
The portal and its data run on the servers of its hosting provider:
- Hosting provider
- Websupport
The mail server that delivers the portal's emails receives your address and each email sent to you.
A push notification goes to your device through the push service of your browser's maker, which receives the address of your device and the encrypted notification but cannot read it: Google (Chrome, Edge on Android, Samsung Internet, Opera), Mozilla (Firefox), Apple (Safari and the app installed on an iPhone or iPad) or Microsoft (Edge on Windows). Only if you turn push on.
If you create a calendar feed link, the events in it reach whoever hosts your calendar — Google, Apple or Microsoft, say — and they keep a copy. That recipient is one you choose, by which app you put the link into; the portal knows nothing about them. You can delete the link in your profile at any time.
Inside the portal, the Managers of the organisation that runs your building see your Residencies and the Issues you report there. Residents of your Unit see its Poll answer and who cast it. A Public Issue shows the other Residents of your Entrance its title, status, priority and date, never the Unit or who reported it.
Nothing is sold, and nothing is passed to anyone beyond the recipients named above. The portal uses no analytics and no advertising, and apart from the push services no third-party services: fonts, styles and scripts all come from the portal itself. The portal never reaches into a calendar at a provider — you put the link there and your own app reads it.
Your rights and how to use them
- Access and portability. My data shows what is tied to your account, and Download my data gives you all of it as one JSON file. Open My data
- Rectification. Change your name, email address and language in your profile. Open your profile
- Erasure. Ask for it with Delete my account on My data. Your account is erased 30 days later; until then you can sign in and cancel. Open My data
- Restriction and objection. Write to the operator, including about anything this notice does not answer. The operator's contact
- Data about your building. Ask your Manager Organisation, which decides about it; the operator helps it answer.
- Complaint. You can complain to the supervisory authority, Úrad na ochranu osobných údajov SR, Hraničná 12, 820 07 Bratislava 27: dataprotection.gov.sk
Cookies
The portal stores only what it needs to work, so it asks for no consent:
spravca_sid— keeps you signed in; it ends when you sign out or after 14 days without use._nss— lets the portal tell a form sent from its own pages from one sent by another site, which protects you against cross-site request forgery; it lasts until you close the browser.lang— remembers the language you chose, for a year.pwa-install-dismissed— not a cookie but an entry in your browser's local storage: remembers that the prompt to install the app has been shown to you, until you clear it.
An installed app keeps the portal's styles, scripts and icons on your device so that it opens quickly, never your data.