Otto AI, s. r. o.
Effective from 1 October 2026 · Version 1.1
This is a translation. The Slovak version is legally binding.
1. Who we are
The controller is Otto AI, s. r. o., with its registered office at Veľká okružná 17, 010 01 Žilina, Company ID (IČO): 57 769 354, Tax ID (DIČ): 2123095227, VAT ID (IČ DPH): SK2123095227, email: podpora@ottoai.sk (“we” or “Otto”).
This policy describes how we process personal data in cases where we act as controller.
2. Otto's two roles
- Controller: for the data described in this policy, namely the data of clients (users who register for and use the Service) and of visitors to our website ottoai.sk.
- Processor: for the personal data of visitors to the client's website, which we process on behalf of the client when operating the chat. This processing is governed by the Data Processing Agreement (DPA), not by this policy.
3. What data we process (as controller)
- Registration and account data: full name, email, company name, Company ID, login credentials.
- Billing and payment data: billing details and information about payments (payments are processed by Stripe, the payment gateway provider; we do not handle full card details).
- Communication data: the content of communications with our support team.
- Technical data about website visits: IP address, browser type, cookies (as set out in the Cookie Policy).
- Phone call data: if you call our customer line, we process your phone number, the date and time of the call, the voice-menu option you selected and whether the call was successfully put through. We do not record calls and we do not retain voicemail messages.
4. Purposes and legal bases for processing
- Provision of the Service and performance of a contract (Article 6(1)(b) GDPR): registration, operation of the account, invoicing, support.
- Compliance with a legal obligation (point (c)): in particular, accounting and tax obligations.
- Legitimate interest (point (f)): securing and improving the Service, protection against misuse, and direct communication with clients about the Service. This also includes handling a phone enquiry and a call-back if we were unable to answer the call in time, and protecting the line against misuse, including blocking numbers that repeatedly tie it up.
- Consent (point (a)): where it is required. This mainly covers audience measurement on ottoai.sk via Google Analytics 4, which we switch on only after your consent and which you can withdraw at any time in the website footer, and any marketing communications.
5. Recipients and processors
We make personal data available, only to the extent necessary, to providers that help us operate the Service, in particular:
- Stripe: payment processing,
- Contabo GmbH (Germany, EU): infrastructure hosting,
- Twilio Inc. (USA): running the voice menu and connecting calls on our customer line,
- DIDWW Ireland Limited (Ireland, EU): provider of the phone number and of the connection to the telephone network,
- Google Ireland Limited (Ireland, EU): audience measurement on ottoai.sk (Google Analytics 4), only if you have given your consent.
In operating the chat itself for the client, we use further sub-processors named in the list at ottoai.sk (this concerns data processed in our role as processor; see the DPA).
6. Transfers to third countries
We process the data of clients and of visitors to our website primarily within the EU. Should a transfer outside the EU/EEA take place in a particular case, we will ensure it is covered by appropriate safeguards under Article 46 GDPR (e.g. Standard Contractual Clauses or the EU-US Data Privacy Framework).
For audience measurement (Google Analytics 4), the contracting party is Google Ireland Limited in the EU; Google may also process data on servers in the USA. This transfer is covered by the EU-US Data Privacy Framework, under which Google is certified, and by Standard Contractual Clauses. Measurement takes place only with your consent.
7. Retention period
We retain personal data for the duration of the contractual relationship and thereafter for the period required by law (in particular, accounting records) or, where applicable, for the period necessary to protect our legitimate interests. We retain data processed in our role as processor in accordance with the DPA (for no more than 24 months, or for a shorter period on request). We retain records of phone calls (phone number, time of the call and the menu option selected) for 24 months; we retain blocked phone numbers for as long as the block remains in place. We retain the record of consent given, when the account was created, to the terms and conditions and to the processing of personal data (email, document versions, IP address and time) on the basis of our legitimate interest in being able to prove that the contract was concluded, and we do so even after the account has been closed, for no longer than 4 years from its closure.
8. Data security
We implement appropriate technical and organisational measures to protect personal data, in particular encrypted transmission (HTTPS/TLS), encryption of personal data, access control and regular backups.
9. Your rights
As a data subject, you have the right of access to your data and the rights to rectification, erasure, restriction of processing and data portability, as well as the right to object and the right to withdraw consent. You can exercise your rights by email at podpora@ottoai.sk.
10. Supervisory authority
You have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk).
11. Cookies
The use of cookies is governed by the separate Cookie Policy.
12. Changes to this policy
We may update this policy; the current version is always published at ottoai.sk. We will give advance notice of material changes.