Privacy Policy

This policy explains how GURUPU, s.r.o. processes the personal data of visitors to www.gurupu.sk and of people who contact us. We act in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the “GDPR”) and Slovak Act No. 18/2018 Coll. on the protection of personal data.

1. Controller

The controller of personal data is GURUPU, s.r.o., with its registered office at Súľovská 5806/9, 040 11 Košice, Slovakia, Company ID (IČO): 52 306 216, registered in the Commercial Register of the Municipal Court Košice, Section Sro, File No. 48244/V (the “controller”, “we” or “us”).

Contact for data protection matters: info@gurupu.sk, +421 917 925 854, or by post to our registered office. We have not appointed a data protection officer as we are not required to do so by law.

2. What data we process, for what purpose and on what legal basis

2.1 Contact forms and communication with us

If you contact us via the form on the Contact or For partners and investors pages, by e-mail or by phone, we process your name, e-mail address, phone number and the content of your message. We use the data only to handle your question or enquiry and to reply to you.

Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to messages received (Art. 6(1)(f) GDPR).

Retention period: while your request is being handled and then for no more than 2 years after the last communication, unless a contractual relationship arises from it.

Submitting a form does not mean you consent to receiving marketing messages. We will only send you marketing messages if you give us separate and explicit consent.

2.2 Job applications

If you apply for a position via the form on the Vacancies page, we process your first name and surname, e-mail, phone number, the position selected, your message and the data you provide in your CV.

Purpose: assessing your application and conducting the selection procedure. Positions are filled by companies of the GURUPU group (for example DOKELU, the KERUJ driving school or the ZOOMZOOM agency). We may therefore pass your application to the group company filling the position, which becomes the controller of your data for the purposes of the selection procedure.

Legal basis: steps taken at your request prior to entering into an employment relationship (Art. 6(1)(b) GDPR).

Retention period: until the end of the selection procedure, but no longer than 6 months from receipt of the application. We will retain your data for longer, for example for future selection procedures, only with your separate consent, which you may withdraw at any time.

Please do not include special categories of data (for example about health, religion or political opinions) or your birth number in your CV unless strictly necessary.

2.3 Protecting forms against spam

The form on the Vacancies page is protected by Google reCAPTCHA, which assesses whether the form is being completed by a human or by an automated program. This involves processing mainly your IP address and data about your behaviour on the page. Legal basis: our legitimate interest in protecting the website against misuse (Art. 6(1)(f) GDPR).

2.4 Cookies and website analytics

We use strictly necessary cookies without which the website would not work properly and, with your consent, statistical and other cookies (in particular Google Analytics via Google Tag Manager). Strictly necessary cookies are used on the basis of Section 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications and our legitimate interest. Other cookies are used only with your consent (Art. 6(1)(a) GDPR), which you give, change or withdraw at any time via the “Manage consent” banner. For details see our Cookie Policy.

2.5 Compliance with legal obligations

If we enter into a contract with you, we process the data necessary to comply with obligations under specific legislation, in particular Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax (Art. 6(1)(c) GDPR), for the period required by that legislation (usually 10 years).

3. Recipients of personal data

We disclose your data only to the extent necessary to the following recipients:

• Websupport s.r.o., Slovakia (website and e-mail hosting) as a processor,
• Google Ireland Limited (Google reCAPTCHA, Google Analytics, Google Tag Manager, Google Fonts, Google Maps),
• companies of the GURUPU group, if you apply for a position with one of them or where necessary to handle your request,
• our contracted advisers (for example accountants and lawyers), who are bound by confidentiality,
• public authorities, where required by law.

We do not sell or publish your data.

4. Transfers outside the EU

When Google services are used, data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework, on the basis of which the European Commission has adopted an adequacy decision. Standard contractual clauses approved by the European Commission apply in addition.

5. Your rights

In connection with the processing of your personal data, you have the right:

• of access to your data (Art. 15 GDPR),
• to rectification of inaccurate data (Art. 16 GDPR),
• to erasure (Art. 17 GDPR),
• to restriction of processing (Art. 18 GDPR),
• to data portability (Art. 20 GDPR),
• to object to processing based on legitimate interest (Art. 21 GDPR),
• to withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal (Art. 7(3) GDPR).

You can exercise your rights by e-mail at info@gurupu.sk or in writing to our registered office. We will reply without undue delay and at the latest within one month.

If you believe that the processing of your data is unlawful, you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

6. Obligation to provide data

Providing personal data is voluntary. Without it, however, we cannot handle your request or assess your job application.

7. Automated decision-making

We do not carry out automated individual decision-making or profiling that would have legal effects on you or similarly significantly affect you (Art. 22 GDPR).

8. Data security

We have taken appropriate technical and organisational measures to protect personal data, in particular an encrypted connection (HTTPS), access restricted to authorised persons bound by confidentiality, and regular system updates and backups.

9. Changes to this policy

We may update this policy, for example when legislation or the way we process data changes. The current version is always published on this page.

This policy is effective from 27 October 2026.