1. Data controller
The controller is AMG Security s.r.o., Lieskovská cesta 6, 960 01 Zvolen, Slovak Republic, Company ID 46 268 995, Tax ID 2023307726, VAT ID SK2023307726, registered in the Commercial Register of the District Court Banská Bystrica, section Sro, file 20558/S (“AMG Security”, “we” or “controller”). Contact the app and privacy team at aplikacia@amgsecurity.sk. General contact: sekretariat@amgsecurity.sk, +421 45 5322 555.
2. Scope
This policy applies to the AMG Security iOS and Android app and its related accounts, communications and technical services. Separate notices may apply to security, cleaning and other services performed outside the app.
3. Data we process
- Identity and contact data: name, work email, phone number, role and organisation.
- Access and assignment data: user role, client and site membership, assigned site manager and services.
- Communication content: private messages, complaints, service orders, comments, read state and resolution status.
- Attachments: complaint and work-evidence photos, PDF quotes, invoices and related documents.
- Technical and security data: account identifier, timestamps, audit and abuse-prevention records, diagnostic information and push-notification device token.
- Request data: password recovery, support, account change and deletion requests.
4. Purposes and legal bases
We process data to create and secure authorised accounts; provide private communication between the customer, assigned manager and authorised management; receive, document and resolve complaints and orders; deliver notifications; prevent abuse and investigate incidents; audit sensitive administrative actions; and comply with contractual and legal duties.
Depending on the circumstances, processing is based on performance of a contract or related steps, legitimate interests of AMG Security and its client in secure service management and documentation, compliance with law, and the user’s consent or active request where a feature is optional. When you use the app as an employee or representative of a client, some processing also arises from the service relationship between AMG Security and that client.
5. Access and recipients
Private content is accessible to its author, the specifically assigned site manager and authorised higher management where needed for supervision, control or escalation. Other customers at the same site and unrelated site managers cannot access that private content.
Data may be processed as necessary by vetted database and file hosting, email, technical support and notification providers, including Google Firebase Cloud Messaging and Apple Push Notification service. Public authorities may receive data when required by law.
6. Device permissions and notifications
If notifications are enabled, we store a technical device token to deliver alerts about messages and status changes. The token is not message content. Notification permission can be changed in iOS or Android settings. Camera or gallery access is only required to attach a photo selected by the user; the app does not browse photos the user has not chosen.
7. Retention
Operational data is kept for the active contractual or user relationship and then only as long as required for legal duties, legal claims and security. Administrative audit records are normally deleted after 24 months. Short-lived rate-limit records and unused upload permissions are removed after their security purpose expires.
Following a verified deletion request, access is disabled and private account content is deleted within 30 days, except data that must be retained by law or for legal claims. Retained data is separated from ordinary use and accessed only for that purpose.
8. International transfers
Some technology providers, particularly Google and Apple, may process technical data outside the European Economic Area. Transfers rely on a mechanism recognised by EU law, such as an adequacy decision or Standard Contractual Clauses, with appropriate safeguards.
9. Security
We use role- and membership-based access controls, encryption in transit, time-limited file links and upload permissions, session revocation following sensitive changes, administrative audit trails and abuse-prevention controls. No electronic service can nevertheless be described as entirely risk-free.
10. Your rights
Subject to the GDPR, you may request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. We normally respond within one month and may reasonably verify identity first.
Send requests to aplikacia@amgsecurity.sk. Delete your account inside the app through Account & privacy → Delete account, or use our public account deletion page.
You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.
11. Children
This is a workplace client portal and is not intended for anyone under 16. Accounts are created only by authorised managers or administrators for people involved in receiving or providing services.
12. Changes
We will update the effective date and appropriately notify users of material changes. The current version remains publicly available at this URL.