1. Data Controller

The data controller is Elidat Technologies, s.r.o., Company ID: 223 91 223, registered at No. 125, 289 03 Sloveč, Czech Republic (hereinafter "Controller").

Contact email for data protection matters: stepan@elidat.com

2. Scope and Purpose of Data Processing

The Controller processes personal data of Users to the extent necessary for providing the Elidat service — a web application for creating AI-powered property video tours. Personal data is processed for the following purposes:

Purpose	Data Scope	Legal Basis	Retention Period
Registration and account management	Name, surname, email, phone, company name, company ID	Contract performance (Art. 6(1)(b) GDPR)	Duration of account + 30 days
Service provision (video creation)	Property photographs, addresses and GPS coordinates, text descriptions	Contract performance (Art. 6(1)(b) GDPR)	Duration of account + 30 days
Voice cloning	Voice recordings provided by User	Consent (Art. 6(1)(a) GDPR)	Duration of consent, max until account deletion + 30 days
Billing and payments	Billing details, payment history, bank account number	Legal obligation (Art. 6(1)(c) GDPR)	10 years from transaction
Marketing communications	Email address	Legitimate interest / consent (Art. 6(1)(f) or (a) GDPR)	Until consent withdrawal or unsubscription
Analytics and service improvement	IP address, browser type, application usage data, cookies	Legitimate interest (Art. 6(1)(f) GDPR)	26 months
Technical support	Support communications, issue details	Contract performance / legitimate interest	3 years from last contact
Team management (Office plan)	Names and emails of team members, assigned roles	Contract performance (Art. 6(1)(b) GDPR)	Duration of account + 30 days

3. Recipients and Data Processors

The Controller may transfer personal data to third parties only to the extent necessary for providing the Service. These include: cloud hosting and server infrastructure providers, payment service providers, satellite and map data providers, artificial intelligence service providers, and analytics tool providers.

The Controller has data processing agreements with all processors in accordance with Art. 28 GDPR.

Personal data may be transferred to third countries (outside EEA) only with adequate protection measures, particularly based on standard contractual clauses under Art. 46(2)(c) GDPR.

4. Data Subject Rights

As a data subject, you have the following rights under GDPR:

Right of access — you have the right to obtain confirmation of whether your personal data is being processed and access to that data.
Right to rectification — you have the right to request correction of inaccurate personal data and completion of incomplete data.
Right to erasure — you have the right to request deletion of your personal data under the conditions of Art. 17 GDPR.
Right to restriction — you have the right to request restriction of processing under the conditions of Art. 18 GDPR.
Right to data portability — you have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to object — you have the right to object to processing based on legitimate interest at any time.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint — you have the right to lodge a complaint with the supervisory authority (Office for Personal Data Protection, Czech Republic, www.uoou.cz).

To exercise your rights, contact the Controller at stepan@elidat.com. The Controller will process your request within 30 days.

5. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies for functionality, analytics, and improving user experience.

Necessary cookies — ensure basic Platform functionality (login, security). Cannot be declined.
Analytics cookies — used for traffic analysis and Platform usage. Processed based on User consent.
Marketing cookies — used for displaying relevant advertising. Processed based on User consent.

Users can manage cookie preferences through the cookie banner on the Platform or through browser settings.

6. Data Security

The Controller implements appropriate technical and organizational measures to protect personal data, including: data encryption in transit (TLS/SSL) and at rest, least-privilege access control, regular data backups, access monitoring and logging, and regular security reviews.

In case of a personal data breach, the Controller will notify the supervisory authority within 72 hours and inform affected data subjects if there is a high risk, in accordance with Art. 33 and 34 GDPR.

7. Processing of Third-Party Data

If a User uploads photographs or other content containing personal data of third parties, the User acts as the data controller for such data. The User must ensure they have an appropriate legal basis and that third parties are informed in accordance with GDPR.

8. Automated Decision-Making

The Service uses automated data processing through AI algorithms for generating Video Outputs. This processing does not have legal effects or similarly significant impact on Users within the meaning of Art. 22 GDPR.

9. Changes to Privacy Policy

The Controller reserves the right to update this Policy at any time. Users will be informed of significant changes via email and/or Platform notification at least 30 days in advance.

10. Contact Information

Elidat Technologies, s.r.o.

Company ID: 223 91 223

Registered office: No. 125, 289 03 Sloveč, Czech Republic

Email: stepan@elidat.com

This Privacy Policy is effective from March 20, 2026.