Privacy policy

SNTT svetovanje nova tehnična trgovina d.o.o. (SNTT, Company, we, our, us) is a Slovenia-registered company that sells fixed-term software licenses and provides online services for open-source data retrieval to the users of Lampyre B2B (Corp) accounts at the lampyre.io website (hereinafter – Website).

General principles

This document represents our policy on processing and protection of personal data of Lampyre B2B (Corp) accounts and is located at https://lampyre.io/privacy-b2b.

We respect and value your privacy and we want to make sure that you can enjoy it in safety. The purpose of this Privacy Policy is to provide you information about how we may collect, use, or disclose your Personal Information in compliance with the national Slovenian data protection and privacy laws and privacy legislation as well as the General Data Protection Regulation (hereinafter GDPR) of the European Union. It also contains important information about your rights over your Personal Information.

By using/creating a B2B (Corp) account, you expressly accept and consent that your information may be transferred to SNTT’s affiliates, subcontractors, agents, or representatives who perform tasks related to the Website and services, and transfers for the purpose of storing the data in relevant databases. We share your information with selected third parties who perform services on our behalf, such as web hosting, data analysis, payment processing, information technology and related infrastructure provision, customer service, email delivery, and auditing services, technical support, maintenance services. These third parties are given access to personal data needed to perform their functions but are restricted from using it for other purposes. SNTT’s use and disclosure of personal information incorporated in the privacy policy may involve a transfer to other jurisdictions, which may provide for different data protection rules than your country. Appropriate contractual and other measures are in place to protect personal information when it is transferred. The relevant individual may if entitled by applicable law obtain a copy of these measures by contacting SNTT at info@osntt.com.

When you use Website, software products or services we sell or provide us with your personal data (including information that you may have shared with us via official communication channels and via our resellers/distributers), you agree to this Privacy Policy. If you do not agree with any part of this Privacy Policy, please do not provide us with personal data or use the Website, or software products or services we sell.

You should also be aware that we may make changes to our Privacy Policy in order to comply with changing legal requirements, so you should check back regularly for the most current version. However, if we make changes to this Privacy Policy that affect you directly, we will notify you of those changes. If you continue to access the Website and use products and services we sell once these changes become effective, you acknowledge and agree that your personal data will be processed in accordance with the updated Privacy Policy.

How we will contact you

We will communicate with you via email you provide when you register online and the chat room in your B2B (Corp) account on the Website.

We or our Tech support provider may email you with service, technical and other administrative messages. We may also contact you to inform about the changes in the way we provide products, to remind that soon you will be charged for the auto-renewal of your products and to warn about security issues or fraudulent activity in your account if there is any.

We may also use other forms of communication to respond to your requests. By default, we will respond to your requests using the type of communication through which we receive your request. If you wish to receive a response through any other means, please let us know in your request letter and we will try to accommodate your request, if possible.

Data controller¹

SNTT svetovanje nova tehnična trgovina d.o.o.

Registered address: Spodnja Senica 20, 1215 Medvode

Tax number: SI 59498897

Registration number: 3659500000

E-mail: info@osntt.com

Telephone: +38640240836

For inquiries specific to the GDPR, please contact us at info@osntt.com

¹ Data Tower Trade and Services L.L.C-FZ is the sole and exclusive legal and beneficial owner to sell or license Intellectual Property Right, and acts as the primary Data Controller. For B2B transactions, SNTT acts as an independent Data Controller. Data Tower may have access to certain B2B data solely for technical maintenance purposes but shall not be considered a co-controller for B2B operations.

Types of collected personal data

Within the context of this Privacy Policy, we use the terms set forth in GDPR and local privacy laws. Thus “personal data” means any information relating to an identified or identifiable natural person (“data subject”).

“Processing” means any operation or set of operations which is performed on personal data or personal data sets, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The personal data we collect includes individual information about you: your name, address, email, company data, unique computer identifier, IP address, payment history, username, password, host country, VAT ID, payment information detailed below, and any additional information that may be disclosed by you to our staff when you contact us through official channels. We do not collect personal data while you use the software we sell.

The scope of personal data collected depends on the services you order and the products and services you use, so not all pieces of information provided may be relevant to you.

We may also collect anonymized information that does not personally identify you and remains anonymous, but remains essential for analyzing the use of the site. Such anonymized information includes hardware (device) data: operating system type and version, device type (personal computer, cell phone, tablet), browser type and version, and other data transmitted by your browser depending on its settings. These anonymized data are not belonging to this Privacy Policy and not regulated by the GDPR.

We do not link anonymized data to other personal data unless you have registered for a product or service or logged in to our online service. This is intended to provide additional protection for your B2B (Corp) account against possible fraud.

We may also receive and process personal data from publicly available sources when necessary to better provide our services.

Purposes and legal basis of personal data processing

SNTT is guided by the principles of lawfulness, fairness, transparency, minimization of data processing, sufficiency, rationality and expediency of personal data processing. Your data is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. We strive for keep your personal data accurate and, where necessary, up to date.

We ensure the lawfulness of the personal data processing by the fact that the Company processes your personal data on the legal basis as follows:

• Your consent to the processing of personal data (based on the Article 6. (1) a) of the GDPR).

  In all cases, before granting consent, we shall inform you that you have the right to withdraw your consent at any time pursuant to Article 7 (3) of the GDPR. Withdrawal of consent shall not affect the lawfulness of the data processing prior to withdrawal.

• The need to process personal data based on performance of the agreement under which you are a party or to perform, on your behalf, the steps preceding the conclusion of the agreement (based on the Article 6. (1) b) of the GDPR).

  The data belonging to this legal basis are a precondition for concluding the agreement with us.

• The need to process for purposes arising from our legitimate interests or the legitimate interests of third parties, but your interests or your fundamental rights and freedoms as a data subject always take precedence over such interests (based on the Article 6. (1) f) of the GDPR).

  
  

  In the case of this legal basis, SNTT is obliged to perform a test for balance of interests. In this test, SNTT decides on the basis of objective criteria whether the B2B client’s interests over data management take precedence over the goals set by SNTT. During the interest balance test, SNTT pays special attention to the following:

  • the chosen method or individual technology by which the data processing is performed must be necessary for the legitimate interests of SNTT;

  • data management should be proportionate to the business needs, ie the purpose to be achieved;

  • data management should be carried out in a way that minimizes interference and should focus on the specific risk area.

• The need to process for fulfillment of a legal obligation. In this case we process your personal data for the purpose that SNTT fulfills its obligations (Article 6 (1) (c) GDPR).

  Examples of such legal obligations are: fulfillment of accounting obligations, fulfillment of administrative and official obligations, fulfillment of official requests.

The purpose of processing depends directly on the actual data processing related activity (e.g. distribution of software licenses). We only collect and process your personal data for purposes that cannot be achieved by other means. The detailed purposes are listed below.

We explicitly urge you to contribute to regular updating and updating of user account information.

Using cookies

The Website may collect cookies. Cookies are small files that are stored on your device and contain information about your recent activity and enable us to distinguish you from other users. We use the information we receive from cookies to make your experience with the Website, products, and services safer and more convenient and to improve our services. Cookies are used to enable you to log in and make settings, purchases, and other actions related to your account so that they can be stored. We may use temporary and permanent cookies. Temporary cookies last for only one session and are deleted as soon as you close your browser or mobile app. Persistent cookies remain on your device until they expire or you clear the system yourself.

The following tables provide information on the types of cookies we use, why we set them, and how long they last.

Essential cookies

Non-essential Cookies

Under GDPR, non-essential cookies require your consent before being placed on your device. We provide detailed information about the storage of cookies on your device when you first visit our website, along with options to accept or reject non-essential cookies.

You have the right to accept or refuse cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of our services.

To learn more about managing your cookie preferences, you can follow the instructions provided by your browser, which are typically found under the “Help,” “Tools,” or “Edit” menus.

Use common sense when it comes to using public computers. Don’t enter personal data that may be stored in cookies, and always make sure you log out of your account before you move away from the public computer. Please mind that some cookies may be created by your browser. You can always delete your browser history and cookies. For more information about controlling and setting cookies, see your browser’s help section or visit its website.

To learn more about cookies, visit https://www.aboutcookies.org or https://www.allaboutcookies.org.

Personal Data Storage Periods

We do not retain your personal data longer than is necessary for the purposes for which we process such personal data.

SNTT is committed to retaining your personal data only for as long as is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The criteria we use to determine the appropriate retention periods for different categories of personal data include:

• Nature of the Data: We consider the amount, nature, and sensitivity of the personal data. More sensitive data may require shorter retention periods or enhanced protective measures.

• Purpose of Processing: The retention period depends on the specific purposes for which the data is processed. Data needed for the fulfillment of our contractual obligations to you is retained for the duration of the contractual relationship and an appropriate period thereafter to deal with contract-related matters such as claims or queries.

• Legal Obligations: Where laws or regulations require us to retain certain information for a specific period, we comply with those requirements. For instance, financial records are typically retained for seven years to comply with tax and accounting laws.

• Consent: If we have processed data based on your consent, such as for marketing purposes, we will retain the data until you withdraw your consent.

• Statutory Limitation Periods: We retain data considering the time limits for potential legal claims. This ensures we have sufficient data to defend ourselves or to make claims.

• Operational Requirements: Some data may be retained for longer periods due to operational necessities, such as customer service, maintaining business records, managing business operations effectively, and responding to legal or regulatory inquiries or requests from competent authorities.

• Deletion Protocols: Once the retention period concludes and there is no lawful basis or legitimate business purpose for retaining personal data, the data is either securely deleted or anonymized.

Our data retention policies and procedures are regularly reviewed to ensure compliance with legal obligations and to ascertain whether there is a need to update the retention period of the data we hold. Adjustments are made based on changes in legal requirements or operational needs.

Who else can access your personal data

SNTT will never disclose your personal data to third parties unless required to fulfill contractual obligations to you, or for organizational purposes, or as a legal or regulatory requirement. We share your information with selected third parties who perform services on our behalf, such as web hosting, data analysis, payment processing, information technology and related infrastructure provision, customer service, email delivery, and auditing services, technical support, maintenance services. These third parties are given access to personal data needed to perform their functions but are restricted from using it for other purposes. SNTT’s use and disclosure of personal information incorporated in the privacy policy may involve a transfer to other jurisdictions, including the United Arab Emirates, which may provide for different data protection rules than your country. Appropriate contractual and other measures are in place to protect personal information when it is transferred. The relevant individual may if entitled by applicable law obtain a copy of these measures by contacting SNTT at info@osntt.com.

All your payments made on the Website are processed by payment provider (s) All payment data (name, surname, address, email address, phone number, bank account number, bank identification number, bank card number, account amount, currency and transaction number) are sent directly to these systems and are not processed by us. All responsibility for payment processing hold the payment provider (s). We do not store your bank card information, but we do have an access for some payment information (including the first 6 and last 4 digits of your card, your name and your email) as a result of the purchases you make.. When making any purchase on the Website, you consent to relevant payment provider’s processing of your personal data,. We recommend that you review the privacy policies of these payment providers before making a financial transaction (since processing of your personal data will be subject to their privacy policies in addition to ours) and visit their websites.

Managing technical support and maintenance services SNTT cooperates with the licensor of the Lampyre software, and acts according to Distribution Agreement and Data Protection Agreement between SNTT and DATA TOWER.

For detailed and complete information we also recommend visiting their website (https://lampyre.io) and reading their Privacy Policy.

SNTT ensures that the transfer complies with applicable data protection laws and that adequate safeguards are in place to protect the confidentiality and integrity of the data.

Cross-border data transmission

SNTT’s use and disclosure of personal information incorporated in the privacy policy may involve a transfer to other jurisdictions, , which may provide for different data protection rules than your country. When we transfer your personal data outside the EEA to countries not deemed by the European Commission to provide an adequate level of data protection, we implement one or more of the following safeguards:

• Standard Contractual Clauses: We use European Commission-approved Standard Contractual Clauses with our service providers and business partners to ensure that your personal data is treated by those third parties in a way that is consistent with and respects the EU and other applicable laws on data protection.

• Binding Corporate Rules: Where applicable, we may transfer data within our group of companies pursuant to our Binding Corporate Rules that have been approved by EU data protection authorities.

• Other Mechanisms: We may use other mechanisms under the GDPR, such as consent of the data subject, necessary for the performance of a contract, or other legally accepted bases.

Your rights

If you are an individual who uses our Website, and productsand services that we sell and provides your personal data to SNTT, you have certain rights:

1. Right to access

According to the Article 15 of the GDPR, you are entitled to receive feedback from us as to whether the processing of your personal data is in progress, and if such processing is in progress, you are entitled to have access to the personal data and the following information:

• the purpose of the processing;

• categories of your personal data;

• the recipients or categories of recipients to whom the personal data have been or will be communicated;

• where applicable, the intended period for which the personal data will be stored or, if that is not possible, the criteria for determining that period;

• to request the controller to rectify, delete or restrict the processing of personal data concerning you and to object to the processing of such personal data;

• the right to lodge a complaint with a supervisory authority;

• if the data were not collected from you, all available information on our source;

• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Your right of access:

• covers personal data concerning you as defined in Article 15 of the GDPR;

• includes pseudonymous data that can be clearly linked to you.

At your request, we shall provide access to your personal data in accordance with Article 15 of the GDPR, if:

• you request confirmation from us regarding the handling of your data; and

• we handle your personal data; and

• you request access to your personal data.

We will provide you with a copy of your personal data if:

• you request confirmation from us regarding the processing of your personal data, and

• we handle your personal data, and

• you request a copy of your personal data.

2. Right to rectification

According to the Article 16. of the GDPR, you have the right to request that we correct your personal data by submitting a request if you believe your personal data is not sufficiently accurate or reliable. You also have the right to request additional information on your personal data if you believe that the details you have provided us are not sufficiently complete.

Your right to correct inaccurate data:

• covers personal data concerning you as defined in Article 16 of the GDPR;

• includes pseudonymous data that can be clearly linked to you.

We will correct or supplement your personal data in case of the following:

• we handle your personal data, and

• the personal data concerned are inaccurate or incomplete, and

• you request the correction or the supplementation of your personal data.

You also have the right to request additional information on your personal data if you believe that the details you have provided us are not sufficiently complete.

We shall notify the recipients of the personal data (if any) of the correction of the personal data of the Customer. However, we will not notify recipients of the correction of personal information if it proves impossible or disproportionate to notify recipients. Upon request, we shall inform the Customer of the recipients.

3. Right to erasure

According to the Article 17. of the GDPR, we delete or de-identify personal data that is no longer expected to be processed.

We are obliged to delete your personal data without undue delay if:

• we handle your personal data, and

• you request the deletion of your personal data, and

• at least one of the following conditions (i-v) is met (these are collectively referred to as the "Preconditions for cancellation"):

  • the personal data are not necessary for the purposes for which they were collected by us and you don’t request a restriction on data processing instead of deletion;

  • the processing of the data is based on your consent and you withdraw this consent, and there is no other legal basis for the processing of the data;

  • you object to the processing of your data pursuant to Article 21 (1) of the GDPR and there is no priority legitimate reason for the processing of the data or the data processing for the direct acquisition of the data subject protests;

  • the personal data has been processed unlawfully (without a legal basis) by the Company and you do not request a restriction on the processing of the data instead of deleting it;

  • personal data must be deleted in order to fulfill a legal obligation under the laws applicable to the Company.

We are not obliged to delete the data even if the preconditions for Deletion exist, if the data processing is necessary for the submission, validation and protection of legal claims.

We shall notify the recipients of the personal data (if any) of the deletion of the Customer’s personal data. However, the Company will not notify recipients of the deletion of personal information if it would be impossible or disproportionate to notify recipients. Upon request, the Company shall inform the Customer of the recipients.

4. Right to restriction of processing

According to the Article 18. of the GDPR, you have the right to request to restrict the processing of your personal data. Restricting the processing of your personal data does not mean deleting it. Restricting the processing of your personal data is primarily intended to suspend further data processing and leave the data unchanged until the purposes of the restriction have been achieved. We can use tools to restrict your personal data, for instance temporarily transfer selected data to another processing system in order to make selected personal data inaccessible to users, or temporarily delete the published data from the website.

You may request a restriction on the processing of your personal data if any of the following occurs:

• you dispute the accuracy of the personal data: in this case the restriction applies to the period of time that allows us to check the accuracy of the personal data; or

• the data processing is illegal and you object to the deletion of the data and instead request a restriction on their use; or

• we no longer need personal data for the purpose of data processing, but you request them in order to submit, enforce or protect legal claims; or

• you objected to the processing in accordance with Article 21 (1) of the GDPR: in this case, the restriction shall apply for as long as it is determined whether the legitimate reasons of the controller take precedence over the legitimate reasons of the data subject.

The right to request a restriction on the processing of your personal data:

• covers personal data concerning you as defined in Article 18 of the GDPR;

• includes pseudonymous data that can be clearly linked to you.

We shall notify the recipients of the personal data (if any) of any restrictions on the processing of the Customer’s personal data. However, we will not notify recipients of such a restriction if it would be impossible or disproportionate to notify recipients. Upon request, we shall inform the Customer of the recipients.

If we restrict the processing of your personal data based on the above, we are only entitled to:

• store such personal data;

• process such personal data with your consent;

• process personal data without your consent in order to submit, enforce, protect or defend the rights of another natural or legal person.

If the processing of your data has been restricted as described above, we are obliged to inform you in advance about the lifting of the restriction.

5. Right to object

You have the right to object to the processing of your personal data at any time. You have the right to object to the use of your personal data for direct marketing purposes.

6. Right to data portability

If we process personal data relating to you by automated means, according to the Article 20 of the GDPR, you may request this data from us in a structured, commonly used and machine-readable format. You also have the right to freely transfer the specified data to another controller. Please note, however, that this right must not interfere with the rights and freedoms of others.

Your right to data portability:

• covers personal data concerning you;

• covers pseudonymous data that can be clearly linked to you.

7. Right to withdraw Consent to Personal Data Processing

You have the right to withdraw your consent to the processing of personal data at any time and we will not use the results of the withdrawn information for further processing. However, we inform you that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

8. Right to complain to the supervisory authority

Pursuant to Article 13 of the GDPR, we inform you that if, in your opinion, we did not comply with the provisions of the GDPR in its data processing and your rights have been violated in the processing of its personal data, you are entitled to file a complaint with the supervisory authority.

In order to effectively remedy the breach, we recommend you to contact us prior to making a complaint. The conduct of the conciliation does not exclude your right to complain, however, if it is successful, the dispute between the parties can be resolved directly.

Current contact details of the supervisory authority:

Informacijski pooblaščenec

Address: Dunajska cesta 22, 1000 Ljubljana, Republic of Slovenia

E-mail: prijava-krsitev@ip-rs.si

Sending requests

To implement the above rights of the subject of personal data you can form the relevant request and send it to the e-mail specified in the Contact details of this Privacy Policy.

Please note that the information you request is provided free of charge. However, we may charge you an additional fee under Article 12 (5) of the GDPR in the cases as follows:

• If you request any additional copies from us, including copies of information already provided;

• If the requirements stated in your request would be clearly excessive (including due to the frequently repeated nature of the request) or unreasonable.

Request Response Time

Estimating the time limit starts from the day of receipt of the request or, if applicable, after receiving confirmation of the identity of the person requesting the information, and is one month. We also reserve the right, under Article 12 (3) of the GDPR, to extend the response period for an additional two months due to the complexity of the request or the large number of requests, provided that we give notice of such extension and state the reasons for the delay.

We will ensure that we process your requests without undue delay and respond to them in a way that will help you exercise your rights with respect to processing personal data. We will also inform you at all times of any reasons that may prevent your request from being resolved.

Safety and our responsibility

We store personal data that we receive from you on our own or rented technical devices, and on properly protected media. We are committed to implementing appropriate technical and organizational security measures, consistent with industry standards, to protect your personal data from unauthorized or accidental disclosure, access, misuse, loss or alteration.

In some cases, SNTT may have reasonable doubt over the identity of the person making the request when processing it. In that case, we may need additional information to verify that you are the person making the request, to ensure the security of your personal data.

Please note that the provisions of this Privacy Policy apply only to use of Website by B2B customers and software products and services that are sold by SNTT through B2B (Corp) account at the Website. operated by SNTT. Our products may contain hyperlinks and banners that, when clicked on, will redirect you to third party websites. SNTT does not guarantee your compliance with this Privacy Policy by third party websites and resources and is not responsible for the content of such websites or resources. We encourage you to review the Privacy Policy and User Agreement of each web site you visit to prevent disclosure of unsolicited confidential information and/or personal data.

All data that you transmit through any of the Lampyre tools when making requests is transferred to third parties. SNTT does not verify the data you transfer through the SNTT’s services to third parties, including the results of requests.

We remind you that you should be reasonable and responsible when posting your own personal data in the public domain, including the SNTT’s Internet resources. We are not responsible for the disclosure of your personal data through your own fault.

If we are unable to prevent a breach of your personal data through no fault of your own, we will inform you as quickly as possible of all information we have about the incident and take steps to report it to the relevant regulatory authorities.

Limitations

Our websites as well as products and services we sell are only available to persons over the age of 18. If you are under the age of 18 at the time of this Privacy Policy, please do not provide us with your personal data or use our websites, software products or services.

Please note that persons who transmit in any way information to SNTT about another subject of personal data, without having any legal basis, will be liable in accordance with applicable law.

Consent to processing of personal data

Your consent to the provision of personal data to SNTT and its processing by SNTT is valid until SNTT terminates its activities or until you withdraw your consent. When you consent to the processing of personal data, you acknowledge that:

• You act voluntarily and consciously;

• You are aware that SNTT processes personal data based on the General Data Protection Regulation (GDPR);

• The personal data you provide belongs to you personally;

• You have carefully read and fully understood this Privacy Policy and the terms of processing personal data contained therein, and their further use;

• You are aware of the name of the controller and the purposes for processing the personal data you provide;

• You are aware of your rights and of the obligations and limitations concerning the protection of personal data imposed on you;

• You acknowledge and confirm that you understand all of the terms of this Privacy Policy and the terms of processing personal data;

• You agree to the terms of processing of personal data set forth in this Privacy Policy without any reservations or limitations.

Withdrawal of consent to processing of personal data

You have the right to withdraw your consent to the processing of your personal data at any time by writing to our email address listed in the Contact Details, or by deleting your B2B (Corp) Account at the Website.

Please note that withdrawing your consent to the processing of your personal data means that your account with all active licenses, subscriptions and services will be deleted without the possibility of further access.

In turn, we shall not use the results of the withdrawn information for further processing. However, we inform you that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

We delete or de-identify personal data that is no longer expected to be processed. If we de-identify personal data, we only use de-identification methods that prevent re-identification of personal data subjects.

Final Provisions

This Privacy Policy is based on the laws of the Republic of Slovenia and the European Union. All GDPR regulations have been considered and complied with when drafting this Privacy Policy and creating the personal data management procedure.

If you have any questions about this Privacy Policy or you are concerned about our procedure for managing your personal data, please contact us via the email address listed in the Contact Details. Furthermore, if you consider the procedure for managing your personal data to violate the GDPR, you can submit a complaint to the Slovenian supervisory authority Informacijski pooblaščenec

Address: Dunajska cesta 22, 1000 Ljubljana, Republic of Slovenia

E-mail: prijava-krsitev@ip-rs.si.

Applicable law

This Privacy Policy and any dispute that may arise between you and SNTT, is governed by the laws of Slovenia and the European Union, regardless of your location.

Contact details:

Website:

https://osntt.com

Email:

info@osntt.com

Telephone:

+38640240836

Mail address:

Spodnja Senica 20, 1215 Medvode