Privacy policy

IRNAS Technologies d.o.o. (“IRNAS”, “we”, the controller) respects your privacy and is committed to lawful, fair and transparent processing of your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2, Official Gazette RS 163/22).

Data controller

Company	IRNAS Technologies d.o.o.
Address	Sokolska ulica 51, 2000 Maribor, Slovenia
VAT number	SI78993857
Email	tech@irnas.eu
Website	tech.irnas.eu

What data we collect

We collect only what the site actually needs. The public website has no user accounts, no newsletter and no analytics; the LoCave dashboard, used by rescue and caving organisations, does have accounts and operational data:

Enquiry form data: your name and email address, and optionally your organisation, phone number and subject, together with the content of your message and the time it was submitted.
Technical data for abuse prevention: the IP address and browser user agent recorded when a form is submitted, and a record of submission and failed login attempts. These exist to stop the form being abused, not to identify you.
Administrator account data: for the site administrator only — username, a one-way hashed password, sign-in timestamps and an audit record of administrative actions.
Cookies: a language preference cookie, an administrator session cookie and a cookie remembering that you dismissed the cookie notice. There are no analytics, advertising or tracking cookies.
Server access logs: our web server records every request — IP address, date and time, the page requested, the HTTP status, the referring page and the browser user agent. Statistics software running on the same server summarises these logs into visitor counts. This happens on our own infrastructure; no third party receives the logs or the statistics.
Dashboard account data: for users of the LoCave dashboard — name, e-mail address, a one-way hashed password, the organisations you belong to and your role in them, your language choice, sign-in timestamps, the IP address and browser of each sign-in, and an audit record of your actions. Optionally, if you set them up for alerts: a phone number (stored encrypted), a Telegram chat id and a Slack webhook address.
Operational data of your organisation: deployments (name, location, optional coordinates), the equipment registered to it, the messages exchanged between the cave nodes and the dashboard together with who sent them and when, gateway status reports (software version, connection state, IP address), SMS sent and received on your behalf (numbers stored encrypted), alert rules, notifications sent, API requests and webhook deliveries. This data is controlled by your organisation; IRNAS processes it to provide the service.

We do not collect special categories of personal data, and we do not knowingly collect data from children.

Purpose and legal basis

Purpose	Legal basis
Answering enquiries sent through the contact form	Pre-contractual measures at your request, Art. 6(1)(b); legitimate interest in business correspondence, Art. 6(1)(f)
Preventing abuse of the contact form and of the administrator login	Legitimate interest in the security and availability of the service, Art. 6(1)(f)
Operating and administering the website	Legitimate interest in running our own website, Art. 6(1)(f)
Remembering your chosen interface language	Strictly necessary for a service you explicitly requested; no consent required under the ePrivacy Directive
Keeping the server secure and understanding how the site is used	Legitimate interest in the security, availability and improvement of the service, Art. 6(1)(f). Nothing is stored on or read from your device for this, so the ePrivacy consent rule does not apply
Running the LoCave dashboard for your organisation: accounts, deployments, messages, equipment	Performance of the service contract with your organisation, Art. 6(1)(b); for the audit trail and security records, legitimate interest in the security and accountability of the service, Art. 6(1)(f)
Sending the alerts and forwarded messages you configure (e-mail, SMS, Telegram, Slack)	Performance of the service contract, Art. 6(1)(b) — each channel is switched on by you or your organisation and can be switched off at any time

How long we keep it

Retention is enforced automatically by a scheduled task, not left to memory:

Enquiries: 24 months from receipt, then permanently deleted. Deleted sooner on request.
Abuse-prevention records (submission and login attempts): 6 months.
Application logs: 6 months.
Administrative audit records: 24 months.
Administrator account: for as long as the account is in use.
Server access logs: kept on a short rolling window by the hosting platform — currently about ten days — and then deleted automatically. The monthly visitor summaries generated from them are retained for up to 14 months.
Dashboard operational data (deployments, messages, equipment, gateway reports): kept for as long as your organisation keeps the deployment, or until the retention period your organisation has chosen expires, after which a scheduled task deletes it. Accounts are kept while in use and removed on request or when the organisation ends its contract.
Notification, API and webhook records: 6 months (webhook payloads 3 months). SMS records (needed for invoicing): 24 months.

Who receives your data

We do not sell your personal data and we do not share it for advertising. This website loads no third-party scripts, fonts or trackers of any kind — everything is served from our own domain, with one exception named below (map tiles on the dashboard’s map page). Data is shared only with:

Our hosting provider — server infrastructure hosting this website and its database, located within the European Union.
Our email provider — used to deliver the notification of your enquiry to our inbox.
Competent authorities — where disclosure is required by law.
A1 Slovenija d.d. — sends and receives the SMS messages that your organisation configures (alerts and forwarded messages); receives the destination number and the text.
Telegram Messenger Inc. and Slack Technologies — only if you or your organisation choose these channels; they receive the message text and the chat or webhook you gave us.
OpenStreetMap Foundation — only on the dashboard’s map page, which loads map tiles from openstreetmap.org; their servers see your IP address and the map area you view. No other page contacts a third party.

We do not transfer personal data outside the European Economic Area. Should that ever change, we would rely on an adequacy decision or on Standard Contractual Clauses, and would say so here first.

Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you. Nothing on this website scores, ranks or classifies visitors.

Data security

We apply appropriate technical and organisational measures, including:

Encrypted transport for every page and form (TLS/HTTPS, with HSTS)
One-way password hashing for the administrator account
Credentials stored outside the web root, never in the database
Rate limiting and lockout against brute-force and form abuse
A strict Content Security Policy permitting no third-party resources
Access limited to authorised personnel on a least-privilege basis

Your rights

Under the GDPR and ZVOP-2 you have the following rights regarding your personal data:

Access (Art. 15): confirmation of whether we process your data, and a copy of it
Rectification (Art. 16): correction of inaccurate or incomplete data
Erasure (Art. 17): deletion of your data where the conditions are met
Restriction (Art. 18): restriction of processing in certain cases
Portability (Art. 20): your data in a structured, machine-readable format
Objection (Art. 21): objection to processing based on legitimate interest
Withdrawal of consent (Art. 7(3)): where processing rests on consent, you may withdraw it at any time without affecting prior lawfulness

To exercise any of these rights, write to tech@irnas.eu. We respond within one month of receiving the request, as required by Art. 12(3). There is no charge for a first request.

Providing your data is voluntary and is not a statutory or contractual requirement. Without a name and an email address, however, we have no way to answer your enquiry.

Complaint to the supervisory authority

If you believe your rights have not been respected, you may lodge a complaint with the Slovenian Information Commissioner: Informacijski pooblaščenec RS, Dunajska cesta 22, 1000 Ljubljana — www.ip-rs.si, gp.ip@ip-rs.si, +386 1 230 97 30. You may also complain to the supervisory authority in your own EU member state.

Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page, and the effective date and version at the top will be updated.

Contact

Email: tech@irnas.eu
Post: IRNAS Technologies d.o.o., Sokolska ulica 51, 2000 Maribor, Slovenia