Privacy notice for portal accounts

This notice explains how personal data are processed when a user registers for and uses an account on the LEVÁDA Vehicle Approval Portal. It applies to account administration and security logs. Separate data entered by a user into a technical tool may be governed by the information displayed in that tool.

1. Controller

OZ LEVÁDA · official register entry ↗ · levada.sk ↗ · info@levada.sk

Questions and requests concerning personal data may be sent to the email address above.

2. Data, purposes and legal bases

Registration and account

Name, email address, optional organisation, password hash, account status, role and assigned modules. Purpose: assess the access request, create and operate the account. Legal basis: Article 6(1)(b) GDPR — steps taken at the user’s request and provision of portal access under the terms of use.

Security and administration

Login times and counts, last activity and module, limited user-agent data, pseudonymised IP address, failed attempts and administrator audit events. Purpose: protect accounts, prevent abuse and investigate incidents. Legal basis: Article 6(1)(f) GDPR — the controller’s legitimate interest in secure and accountable operation of the portal.

Rights requests and legal claims

Data necessary to receive, verify and handle a request. Legal basis: Article 6(1)(c) GDPR where processing is necessary to meet GDPR obligations; where required, Article 6(1)(f) for the establishment, exercise or defence of legal claims.

The registration checkbox confirms that this notice has been read. It is not consent used as the legal basis for account operation.

3. Required and optional data

Name, email address and password are required to submit and secure an account request. Organisation is optional. Without the required data, an account cannot be created. No automated decision-making or profiling determines approval; an administrator reviews the request.

4. Recipients and hosting

Data may be accessed only by authorised LEVÁDA administrators and, to the necessary extent, providers of server hosting and technical maintenance acting under contractual and confidentiality obligations. Registration data are not provided to the optional OpenAI assistant. No intentional transfer of account data outside the European Economic Area is planned.

5. Retention

• Unverified, incomplete or rejected registration: no more than 90 days after the last relevant action.
• Active account: for the duration of account use.
• Deletion request: access is disabled immediately; the account is deleted or anonymised within 30 days.
• Security and audit events: normally 90 days.

A limited record may be retained longer only where necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.

6. Security and cookies

Passwords are stored only as one-way Argon2ID hashes. Access is controlled by individual accounts, module permissions, secure session cookies, rate limits and audit records. The essential session cookie is used only to authenticate and secure the signed-in session; the portal does not use it for advertising.

7. Your rights

Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests. Where processing is based on consent for a separate optional purpose, consent may be withdrawn without affecting earlier lawful processing. Identity may be verified before a request is fulfilled.

A signed-in user can request account deletion under My account. Other requests may be sent to info@levada.sk.

8. Complaint and legal text

You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic or another competent supervisory authority. dataprotection.gov.sk ↗

Legal source: Regulation (EU) 2016/679 (GDPR) ↗

Effective date: 21 July 2026. Material changes will be published on this page.

Important legal and professional notice for portal content and tools →