1. Controller and contact details
The controller is CREALAB s.r.o., Terézie Vansovej 1167/1, 050 01 Revúca, Slovak Republic, Company ID No. 50 156 896, Tax ID No. 2120193977, VAT ID No. SK2120193977, registered in the Commercial Register of the District Court Banská Bystrica, Section Sro, Insert No. 29215/S.
You can send privacy questions and requests to support@reevals.com or by post to our registered office marked for the attention of Privacy. CREALAB has not appointed a data protection officer under Articles 37 to 39 of the GDPR.
2. Scope and our role
This policy applies to the public Reevals website, registration, user accounts, delivery of the service, billing, support, security and operational records, business communication and the management of cookie preferences.
CREALAB acts as a controller for data needed to manage the website, accounts, contractual relationship, payments, support, security and its own communications. If a customer submits personal data to Reevals or makes it available through an integration and CREALAB processes it only on the customer's instructions when delivering the service, the customer is the controller and CREALAB is the processor. Such processing is governed by the DPA.
This policy does not constitute consent to the processing of personal data. We request consent separately only where it is the legal basis for a specific optional processing activity, such as analytics or marketing cookies.
3. Categories of personal data
- Identification and contact data, in particular first name, last name, business email, telephone number and job title.
- Company and billing data, in particular company name, registered office, Company ID No., Tax ID No., VAT ID No., billing address, plan, orders, invoices and payment status.
- Account and permission data, in particular login identifier, password hash, role, company membership, settings, language and account status.
- Contractual and evidentiary data, in particular the accepted version of the Terms, time of acceptance, version of the displayed privacy notice, IP address and user agent used during registration.
- Operational and security data, in particular IP address, access time, device and browser type, session identifiers, API calls, audit events, error logs and security logs.
- Communications and support data, in particular message content, attachments, requests, feedback and records of incident or support resolution.
- Service usage data, in particular functions used, configurations, volumes, workflows, approvals and interactions needed to operate and protect the service.
- Integration data, in particular connected-account identifiers, permission scopes, encrypted tokens and technical metadata where the customer expressly activates an integration.
- Preferences and consents, in particular cookie choices, marketing preferences and evidence that consent was given or withdrawn.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Displaying the website, securing transmission and necessary cookies | IP address, technical logs, session and security identifiers | Legitimate interest in secure operation. Necessary storage of data on a device is covered by the statutory exemption for a service expressly requested by the user. |
| Registration, account and delivery of Reevals | Identification, contact, company, account and operational data | Performance of a contract for a natural person acting as an entrepreneur. Legitimate interest in entering into and performing a B2B contract for a customer's employees and representatives. |
| Proving acceptance of the Terms | Document versions, time, IP address and user agent | Legitimate interest in proving the formation and content of the contractual relationship and protecting legal claims. |
| Billing, accounting and payments | Company, billing, transaction and contact data | Performance of a contract and compliance with legal obligations relating to accounting and tax. |
| Support and operational communication | Contact details, request content, attachments and technical data | Performance of a contract and legitimate interest in resolving requests and improving support. |
| Security, fraud prevention and protection of the service | Logins, IP addresses, logs, audit events and abuse signals | Legitimate interest in protecting customers, the service, networks and CREALAB's rights. Legal obligation where imposed by specific legislation. |
| Defending and enforcing legal claims | Contractual, communication, payment and audit data | Legitimate interest in establishing, exercising and defending legal claims. |
| Optional website product analytics | Online identifiers and interaction data | Consent. Google Analytics 4 measures website traffic and use in production only after analytics cookies are allowed. Advertising personalization and Google signals are disabled. |
| Optional marketing and personalisation | Contact data, preferences and marketing interactions | Consent, where requested. Unsubscribing does not affect service, security and contractual messages. |
| Customer-activated integrations | Account identifiers, scopes, encrypted tokens and transmitted data | Performance of a contract and legitimate interest in providing the requested integration. Where CREALAB acts as a processor, the customer's instruction and the DPA apply. |
5. Sources of data
We obtain data directly from you when you register, communicate with us and use the service. We may also obtain data from the customer or organisation that created your account. Some data is collected automatically from your device and use of the service. We may receive data from payment and integration providers and from public registers where needed to verify company data.
If a customer provides the personal data of other persons, the customer is responsible for ensuring that it may lawfully provide the data and has given the data subjects the necessary information.
6. Recipients and service providers
We disclose personal data only to the extent necessary to authorised CREALAB personnel, the customer's organisation, hosting and infrastructure providers, email and support service providers, payment providers, security and professional advisers, providers of customer-activated integrations and public authorities where required by law.
External services currently used or conditionally available are listed at /subprocessors. Payment providers may act as independent controllers for their own processing under their terms.
Access within CREALAB is based on a need to know and appropriate permissions. We do not sell personal data.
7. Transfers outside the European Economic Area
We prefer processing within the European Economic Area. If an activated service or provider requires a transfer to a third country, we use an appropriate mechanism under Chapter V of the GDPR, in particular an adequacy decision or standard contractual clauses, and supplementary technical and organisational measures where needed.
Information about the relevant mechanism may be requested at support@reevals.com. Customers activate some integrations in their own accounts with third parties. In that case, the privacy terms of the relevant third party also apply to the customer's relationship with that third party.
8. Retention periods
| Category | Period or criterion |
|---|---|
| Account and contractual documentation | For the term of the contract and then for the period needed to export data, settle the contract and protect legal claims. |
| Invoices and accounting records | For the period required by accounting and tax law, generally ten years after the year to which the record relates. |
| Evidence of acceptance of the Terms | For the term of the contract and the applicable limitation or archiving period needed to prove the contract. |
| Support and business communication | While resolving the request and then according to the significance of the communication, contractual periods and the need to protect legal claims. |
| Security and operational logs | For a period proportionate to the purposes of security, diagnostics and auditing. Records relevant to an incident are retained for longer, until it is resolved and related claims are closed. |
| Marketing consent and preferences | Until consent is withdrawn or the relevant marketing purpose ends. A record of withdrawal may be retained to demonstrate that the choice was respected. |
| Cookie choices | For no more than 180 days from storage of the choice, after which the user is asked to choose again. A new settings version may trigger an earlier request. |
| Customer Data processed as a processor | In accordance with the contract, the DPA and the customer's instructions. After termination, the agreed export and deletion process applies, taking secure backups and legal obligations into account. |
After the relevant period expires, we delete or anonymise the data. Backup copies are retired through the normal secure rotation cycle where earlier selective deletion is not reasonably possible.
9. Requirement to provide data and automated decision-making
We need data marked as required during registration or ordering to create an account, verify the B2B customer, enter into or perform the contract and issue invoices. Without it, we may be unable to provide the service. Optional data and optional consents may be withheld without losing basic access to the website or the contracted service.
In its role as controller, CREALAB does not carry out solely automated decision-making with legal or similarly significant effects under Article 22 of the GDPR. The service's price recommendations, matching and AI outputs are tools for the customer and not CREALAB decisions about a data subject.
10. Cookies and local storage
We use necessary cookies for secure sessions, login, remembering expressly selected functionality and storing cookie choices. Optional preference, analytics and marketing technologies must not be activated before the relevant user choice.
Details, the current list of technologies and instructions for changing your choice are provided in the Cookie Policy at /cookies. Google Analytics 4 is enabled only in production and only with analytics consent. Google Tag Manager containers and marketing trackers are not installed.
11. Security
We use technical and organisational measures appropriate to the risk. These include access control, separation of customer accounts, encryption in transit, protection of login credentials, audit and security records, vulnerability management, backups, recovery, incident management and contractual obligations for persons with access to data.
No service is completely secure. Customers must protect their accounts, use unique passwords, restrict permissions and report suspected misuse without delay.
12. Your rights
- The right to obtain confirmation and access to personal data.
- The right to correct inaccurate or incomplete data.
- The right to erasure where the legal conditions are met.
- The right to restrict processing.
- The right to data portability for processing based on consent or a contract and carried out by automated means.
- The right to object to processing based on legitimate interests, including direct marketing.
- The right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
- The right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic or another competent supervisory authority.
Send your request to support@reevals.com. Before responding, we may reasonably verify the requester's identity and authority. If a request concerns data that we process only as a processor for a customer, we will forward it to the customer or direct you to the relevant controller.
13. B2B service and minors
Reevals is intended exclusively for business and professional use. We do not knowingly offer the service to children or create accounts for persons under 18. If you believe a minor has provided data to us, please contact us.
14. Changes and effective date
We may update this policy when the service, legal requirements or processing practices change. We will always state the version and effective date on this page. We will inform existing users of a material change in an appropriate manner. If new processing requires consent, we will request it before the processing begins.
Version 1.1 is effective from 13 October 2026. The binding published version is the Slovak-language text.