Privacy Policy

How we process personal data when operating the getfittle.com website, the app.getfittle.com application and the Fittle configurator embedded in our customers' websites. Under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. Effective from 15 September 2026.

1. Whose data we process

1.1 Website visitors of getfittle.com – people reading about the service.

1.2 End customers – visitors to our customers' websites (joineries, kitchen studios, furniture retailers) who design furniture in the configurator and send an enquiry. Here we act as a processor: the controller of your data is the retailer on whose website you use the configurator and to whom you send the enquiry. You exercise your rights with them; we will gladly assist.

1.3 Account holders – joiners, retailers, decor suppliers and portals with an account in the app.getfittle.com application. Here we are the controller.

2. Visitors of the getfittle.com website

2.1 The website is static. We collect no data about visitors and use no analytics tools or third-party tracking. The language and light/dark theme setting is stored solely in your browser (localStorage) and is not sent anywhere.

2.2 The content delivery network (Amazon CloudFront) keeps technical operational records (IP address, time, requested page, browser type) for security and attack detection. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR). Retention: at most 90 days.

2.3 If you e-mail us, we process your name, e-mail and the content of the message in order to reply (Art. 6(1)(b) and (f) GDPR), for at most 12 months after the matter is closed.

3. Configurator and enquiries (end customers)

3.1 The furniture design itself takes place in your browser. The configurator sets no cookies; in localStorage it only remembers the theme and the eye height for the walkthrough. Until you send an enquiry, no personal data reaches us.

3.2 When you send an enquiry we process the data you fill in: name, e-mail, telephone, note and special requirements, photographs of the space you attach, and the design itself (dimensions, modules, decors). Purpose: delivering the enquiry to the retailer you chose and their preparation of a quotation. Legal basis on the retailer's side: steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR).

3.3 We store the enquiry and send it to the retailer by e-mail, or to their webhook or API. The retailer (and their workshop) can open the design in a 3D preview via a signed link valid for 30 days. Photographs are downscaled in the browser and stored in EU-based storage.

3.4 Retention: we keep enquiries and photographs for the retailer for the duration of their contract with us; after it ends we delete them within 30 days. The retailer may delete them earlier. Backups are overwritten in a 30-day cycle.

3.5 If you save your design as a file, the file stays only with you; if you use the “AI image prompt” function, a text is generated which you paste into an external service yourself – we send nothing to it.

4. Accounts in the application (joiners, suppliers, portals)

4.1 When you register and use an account we process: company name and contact details, e-mail and telephone, one-time login codes (OTP by e-mail or SMS, valid for 5 minutes), account settings, embed key and domains, decor and tile catalogue, support messages and billing details. Purpose: performance of the contract (Art. 6(1)(b) GDPR), accounting (point (c)) and security (point (f)).

4.2 The login is maintained by a technical session cookie (httpOnly, Secure, SameSite=Lax) valid for 30 days; it is deleted on logout. It is the only cookie we use and it is strictly necessary for logging in.

4.3 We keep a security and business audit trail (who, when, which action, IP address) – legitimate interest in protecting accounts and evidencing changes. Retention: 365 days; records of payments and licences for the period required by accounting law (10 years).

4.4 Server operational logs (IP address, time, path, response status, request identifier) are kept for 90 days.

4.5 After an account is cancelled we delete the account data within 30 days, except accounting documents and records we must retain by law.

5. Cookies and local storage

5.1 Our principle: we use cookies only where they are strictly necessary for the service you requested. We use no analytics, advertising, profiling or third-party cookies and show no cookie banner, because consent is not required (Art. 5(3) of Directive 2002/58/EC and its Slovak transposition, Act No. 452/2021 Coll.).

5.2 Overview: getfittle.com – no cookies; localStorage fittle-lang, fittle-theme (language, theme). Configurator – no cookies; localStorage hnl-theme, hnl_walk_eye (theme, eye height). app.getfittle.com – one session cookie after login (30 days), strictly necessary.

5.3 Should we ever add anything that requires consent, we will ask first and update this policy.

6. Recipients and processors

6.1 We store and process data in the infrastructure of Amazon Web Services EMEA SARL in the Frankfurt region (EU): application hosting, database, file storage, sending of e-mails (SES) and SMS codes (SNS), logs. We have a data processing agreement with AWS (AWS DPA).

6.2 End customers' enquiries are passed to the retailer the customer chose (e-mail, webhook, API). Accounting documents are processed by our accountant. We do not provide or sell data to any other third parties.

6.3 We disclose data to public authorities only where required by law.

7. Transfers outside the EU

7.1 Data is stored in the European Union. We do not transfer data to third countries; should such a transfer technically occur (e.g. support access by the infrastructure provider), it is covered by the EU standard contractual clauses.

8. Overview of retention periods

8.1 CDN and server logs: 90 days · one-time login codes: 5 minutes · login session: 30 days · account audit trail: 365 days · enquiries and photographs: for the duration of the retailer's contract + 30 days · link to the 3D enquiry preview: 30 days · account data: for the life of the account + 30 days · accounting documents: 10 years · e-mail correspondence: 12 months · backups: overwritten in a 30-day cycle.

9. Your rights

9.1 You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time.

9.2 Send your request to info@softverova-agentura.sk; we will reply within one month. Account holders can download their data and cancel the account directly in the application. End customers should contact the retailer to whom they sent the enquiry – that retailer is the controller of their data; we will help them handle the request.

9.3 You have the right to lodge a complaint with a supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk, or the supervisory authority of your country of residence.

9.4 We carry out no automated decision-making or profiling.

10. Security

10.1 Transmission is encrypted (HTTPS/TLS), login is passwordless via one-time codes, sessions are signed, infrastructure access is limited to authorised persons, and backups are versioned. We will notify a security incident affecting your rights to the supervisory authority within 72 hours and to the persons concerned without undue delay.

11. Changes to this policy

11.1 We may update this policy when the service or the law changes. The current version is always at getfittle.com/privacy.html with its effective date; account holders will be notified of substantial changes by e-mail or in the application.