Privacy notice

1. Who we are

Lintejas Company s.r.o., [[COMPANY_ADDRESS]], Zvolen, Slovakia, IČO [[ICO]] ("Lintejas", "we"), operates romlet.tech and provides the RomLet service. For the public website and the contact form we are the controller. For data inside a customer's RomLet account we are the processor; the customer plant is the controller (see section 4).

Contact: [email protected]. Security: [email protected].

2. The public website

Visiting romlet.tech sets two technical cookies: a session cookie and a CSRF token. They live for two hours and are used only so that the contact form can be submitted safely. We run no analytics and set no tracking cookies.

Our hosting and edge providers (Railway, Cloudflare) keep technical request logs, including IP addresses, for a limited time for security and operation of the service. We do not use them to profile visitors.

3. The contact form

When you send the contact form we store your name, work email, plant or company, the tier you are interested in, your message, the language you used, a hashed form of your IP address and your browser identifier. We use this to reply to you and to prevent abuse of the form.

Legal basis: your consent (the box you tick) for contacting you about RomLet, and our legitimate interest in preventing abuse. You can withdraw consent at any time by writing to [email protected].

Retention: contact requests are kept for 24 months after the last contact, or deleted earlier on request.

The request is emailed to [email protected] and stored in our database on Railway (United States). See section 6 on transfers.

4. Data inside a RomLet account

If you use RomLet as an employee of a customer plant, your employer decides what is recorded about you (competencies, assessments, training records and certificates, development plans, safety observations, permits) and why. Your employer is the controller; we process the data under a Data Processing Agreement and only on its instructions.

To exercise your rights on data in a RomLet account, contact your employer. We will assist your employer in answering you.

RomLet has no fields for payroll, bank, health or biometric data.

5. Who receives data

Our subprocessors are listed on the Security page: Railway (hosting, database, cache; United States) and Cloudflare (DNS, TLS, edge delivery). An email relay will be added to that list before we use one. We do not sell data and we do not train AI models on it.

6. Transfers outside the EEA

Our hosting provider stores data in the United States. Transfers rely on the European Commission's Standard Contractual Clauses in our agreement with the provider [[TRANSFER_MECHANISM — confirm the Railway data processing terms and whether the EU-US Data Privacy Framework applies]]. EU-region hosting is available for pilot sites on request.

7. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability, within the limits of the GDPR. Write to [email protected]; we answer within one month.

You can complain to the Slovak supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.

8. Changes

We will post changes to this notice on this page with a new version and date. This is draft 0.1.

Questions about this document: [email protected]