Privacy Policy

1. Controller

The controller of the personal data processed in the RA.sk | Rýchla adresa service (including the domains qli.cz, qli.hu and qli.fr – QLI Quick Link) is:

• DAKA Rental s. r. o., registered office at Cintorínska 333/1, 900 43 Hamuliakovo, Slovakia
• Company ID (IČO) 54130549, Tax ID (DIČ) 2121580021
• registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 155761/B
• e-mail: info@ra.sk, website: https://ra.sk

No data protection officer (DPO) has been designated. For matters relating to personal data protection, please contact us at info@ra.sk.

2. What data we process

• Account: e-mail, password (stored only as a hash), organisation name.
• Billing data: name or business name, address, country, company ID (IČO), VAT ID.
• Payment data: processed by Stripe. RA.sk stores only the customer and card identifiers at Stripe, not the card number.
• Content: links, their targets and tags.
• Technical security records: sessions (only a hash of the session token is stored in the database); rate limits (a key derived from the IP address is used temporarily, with IPv6 truncated to /64, at most until the time window expires; the IP address is not stored permanently).
• Server access logs: the server keeps technical access logs (IP address, time, page address) to ensure security; they are retained for no more than 2 days.
• Registration source: when an account is created, we store where you came from – the campaign parameters in the link (utm_source, utm_medium, utm_campaign), the domain of the website you came from, and the first RA.sk page you visited. This serves to evaluate promotion; we do not store your IP address or the full addresses of the pages you visited. Until registration, this information is kept only in the memory of the open browser tab (sessionStorage), not in cookies.
• Analytics of short link visitors: without the IP address and user agent; we store the country from the proxy header, the device group, the referrer domain and UTM parameters. The data are aggregated; details are retained for 90 days, aggregates for 2 years.

3. Purposes and legal bases

• Provision of the service, management of the account and subscription – performance of a contract (Art. 6(1)(b) GDPR).
• Bookkeeping and retention of invoices – legal obligation (Art. 6(1)(c) GDPR); we retain invoices for 10 years in accordance with the Accounting Act.
• Security of the service and prevention of abuse (e.g. rate limits, handling of phishing reports) – legitimate interest (Art. 6(1)(f) GDPR).
• Evaluation of the promotion of the service (registration source) – legitimate interest (Art. 6(1)(f) GDPR); this information is retained for the lifetime of the account and is removed when the account is deleted.

4. Recipients and processors

• Hosting provider – the server is located in the EU.
• Stripe Payments Europe, Ltd. (Ireland) – payment processing. Stripe may transfer data to the USA on the basis of the EU-US Data Privacy Framework or standard contractual clauses.

We do not sell data or provide them for advertising purposes.

5. Cookies

We use only strictly necessary cookies:

• ra_sid – session of the logged-in user,
• ra_csrf – form protection,
• ra_locale – selected language.

We do not use third-party analytics or advertising cookies.

6. Retention period

• We retain account data and content for the lifetime of the account. After the account is deleted, the data are anonymised.
• We retain invoices and payment records for the period required by law.
• We retain server access logs for no more than 2 days.
• Analytics details for 90 days, aggregates for 2 years.
• Keys for rate limits only until the relevant time window expires.

7. Your rights

• Right of access – you can download your data in your account via “Data export” (API: GET /v1/me/export).
• Right to rectification.
• Right to erasure – you can delete your account in the settings.
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing based on legitimate interest.
• Right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk.

Please send requests to info@ra.sk.

8. Automated decision-making

We do not carry out automated decision-making with legal effects. The exception is the automatic quarantine of a link upon repeated phishing reports; such a quarantine is subsequently reviewed by a moderator.

9. Changes to this policy

We may update this policy. We will inform you of material changes by e-mail. This policy is effective from 7 November 2026.