Privacy Policy

1.1. This Personal Data Processing Policy (hereinafter the "Policy") sets out the manner, scope, purposes, legal bases and conditions under which the company Fúú.digital, s. r. o., Company ID (IČO): 54782945, with its registered office at Trojičné námestie 191, 027 44 Tvrdošín, Slovenská republika, registered in the Commercial Register of the District Court Žilina, Section Sro, Insert No. 80258/L (hereinafter the "Controller"), processes the personal data of natural persons in connection with the operation, use and content of the web platform www.blyzer.net (hereinafter the "Platform" or the "Website").

1.2. This Policy provides Users (hereinafter the "User") with clear information about the scope of the processing of personal data, the purposes for which and the legal basis on which personal data are processed, how long they are retained, to whom they may be disclosed, and what rights Users have as data subjects under the generally binding legal regulations of the Slovak Republic and the European Union.

1.3. The Controller processes personal data in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, integrity and confidentiality set out in Article 5 of the GDPR. Personal data are processed only to the extent necessary for predetermined and lawful purposes and only for the period of time that is necessary to achieve those purposes.

1.4. The Controller acts as an independent controller within the meaning of Article 4(7) of the GDPR. If the User uses the services of third parties (for example, payment gateways, advertising and marketing platforms, social networks or external website analytics tools), such entities act as independent controllers that process personal data in accordance with their own privacy policies and bear their own responsibility for such processing.

1.5. This Policy is publicly available on the website www.blyzer.net/ochrana-osobnych-udajov and forms part of the Controller's internal documentation system for the purpose of demonstrating compliance with Article 24 of the GDPR and the principle of "accountability".

2.1. The controller of personal data is the commercial company:
Fúú.digital, s. r. o.
Registered office: Trojičné námestie 191, 027 44 Tvrdošín, Slovenská republika
Company ID (IČO): 54782945
Tax ID (DIČ): 2121814025
VAT ID (IČ DPH): SK2121814025
Registered in the Commercial Register of the District Court Žilina, Section: Sro, Insert No. 80258/L
E-mail: info@blyzer.net
Website: www.blyzer.net

2.2. The Controller has not appointed a person responsible for overseeing the protection of personal data (Data Protection Officer – DPO), as this obligation does not apply to it under Article 37 of the GDPR. For any questions regarding the processing of personal data, the exercise of data subjects' rights, or other related matters, the Controller may be contacted directly by e-mail at: info@blyzer.net.

2.3. Supervisory authority:
Úrad na ochranu osobných údajov Slovenskej republiky (the Slovak Office for Personal Data Protection)
Address: Hraničná 12, 820 02 Bratislava 2
Phone: +421 2 3231 3220
E-mail: statny.dozor@pdp.gov.sk
Website: www.dataprotection.gov.sk

2.4. The Controller guarantees that all questions and requests relating to the protection of personal data will be handled without undue delay, no later than within 30 days of their receipt, in accordance with Article 12(3) of the GDPR.

3.1. The Controller processes personal data only to the extent necessary to achieve specific, explicitly determined and legitimate purposes. Every processing operation is carried out in accordance with one of the legal bases set out in Article 6(1) of the GDPR.

3.2. The Controller does not process special categories of personal data under Article 9 of the GDPR (e.g. health data, biometric data, religious beliefs).

3.3. An overview of the purposes of processing, legal bases and retention periods is set out in the following table:

3.4. The Controller processes personal data only for the purposes stated above and never further processes it in a manner incompatible with the original purposes under Article 5( 1)(b) of the GDPR.

3.5. Where processing is to be based on the User's consent, such consent is always requested freely, unambiguously and separately from other actions (e.g. by ticking a box during registration). The User has the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

3.6. Categories of data processed. The Controller processes in particular the following categories of personal data:

• identification data: first name, surname, nickname, age, gender, nationality,
• contact data: e-mail, telephone, IP address, login credentials,
• billing data: company name, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH), bank details,
• data on the User's activity: teams, tournaments, leagues, game results, statistics,
• technical and analytical data: cookies, logs, device data, geolocation,
• communication data: messages, support tickets, feedback, consents.

The Controller does not process special categories of data under Art. 9 of the GDPR (e.g. data on health, religious belief, political opinions).

4.1. The Controller processes personal data only to the extent necessary that is appropriate to the purpose for which the personal data are collected. Personal data are processed in a lawful and transparent manner and kept up to date and accurate throughout the entire period of processing.

4.2. The Controller does not process special categories of personal data under Article 9 of the GDPR, such as data on racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data concerning health.

4.3. Personal data are generally obtained:

• directly from the User upon registration, completion of forms, placing an order or communication with the Controller,
• automatically through cookies, logs and analytics tools (e.g. Google Analytics, Meta Pixel),
• from third parties, if the User uses linked services (e.g. logging in via a Google or Facebook account), in which case the User is always informed in advance about the transfer of data in accordance with Article 14 of the GDPR.

4.4. The Controller does not obtain data from public registers or from other entities without a legal basis. In the event that data are obtained from sources other than the User (e.g. a referral from a partner or team manager), the Controller shall inform the data subject no later than within 30 days of obtaining the data, in accordance with Article 14(3) of the GDPR.

The Controller does not transfer personal data outside the EU/EEA, except where it uses tools provided by entities established in the USA that participate in the EU–US Data Privacy Framework, or that have entered into Standard Contractual Clauses (SCCs) approved by the European Commission. In such cases an adequate level of data protection is guaranteed in accordance with Articles 45 and 46 of the GDPR.

6.1. The portal www.blyzer.net uses cookies and other online identifiers to ensure the proper functioning of the website, for analytical purposes, to customise the user environment, and to display personalised content and advertising.

6.2. Necessary cookies are technical files required for the website to function properly and are stored without the need for the User's consent. Analytical and marketing cookies are used only on the basis of the User's prior consent, given via the cookie banner on the first visit to the website.

6.3. The User may change or withdraw their consent at any time via the "Cookie settings" link on the website or via the settings of their internet browser. Withdrawal of consent does not affect the lawfulness of the processing of data carried out before its withdrawal.

6.4. The cookies used may also come from third parties (e.g. Google Analytics, Meta Pixel, YouTube, Stripe), and the processing of such data is governed by the privacy policies of those entities.

6.5. Detailed information about individual cookies, their purpose, retention period and legal bases is set out in a separate document, the "Cookie Policy", which is published on the Controller's website.

7.1. The data subject (User) whose personal data are processed by the Controller has, within the meaning of Chapter III of the GDPR and Sections 21 to 28 of Act No. 18/2018 Z. z., the following rights:

1. The right of access to personal data (Art. 15 GDPR) – to obtain confirmation as to whether the Controller processes personal data, and if so, to obtain access to that data and information about the processing.
2. The right to rectification of personal data (Art. 16 GDPR) – to request the rectification of inaccurate personal data or the completion of incomplete personal data.
3. The right to erasure of personal data ("the right to be forgotten") (Art. 17 GDPR) – to request the erasure of personal data where the purpose of processing has ceased to apply, consent has been withdrawn, or the processing is unlawful.
4. The right to restriction of processing (Art. 18 GDPR) – to request the temporary suspension of processing where its lawfulness or the accuracy of the data is contested.
5. The right to data portability (Art. 20 GDPR) – to receive personal data in a structured, commonly used and machine-readable format or to have it transmitted to another controller.
6. The right to object to processing (Art. 21 GDPR) – in particular to processing based on legitimate interest or carried out for the purposes of direct marketing.
7. The right to withdraw consent (Art. 7(3) GDPR) – where processing is based on consent, it may be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal.
8. The right to lodge a complaint – with the Úrad na ochranu osobných údajov Slovenskej republiky (the Slovak Office for Personal Data Protection), Hraničná 12, 820 02 Bratislava 2, e-mail: statny.dozor@pdp.gov.sk, website: www.dataprotection.gov.sk.

7.2. A request to exercise these rights may be sent: by e-mail to info@blyzer.net, or in writing to the Controller's registered office address.

7.3. Before handling a request, the Controller is entitled to reasonably verify the identity of the requester in order to prevent unauthorised access to personal data. A response to the request will be provided without undue delay, no later than within 30 days of its receipt. In justified cases, this period may be extended by a further two months, of which the User will be informed in advance.

8.1. The Controller has adopted appropriate technical and organisational measures that correspond to the risks arising from the processing of personal data, and take into account in particular:

1. the nature, scope, context and purposes of the processing,
2. the likelihood and severity of the risks to the rights and freedoms of natural persons,
3. the current state of the art and the costs of implementing the measures.

These measures are designed to ensure an appropriate level of protection of personal data and to demonstrate compliance with the GDPR.

8.2. The main technical and organisational measures include in particular:

1. encryption of data transmissions using an SSL/TLS certificate,
2. pseudonymisation and minimisation of data,
3. management of access rights limited to authorised persons who are bound by confidentiality,
4. multi-factor authentication and the use of strong passwords,
5. regular backup of data and verification of recoverability,
6. system updates, antivirus and anti-malware protection,
7. physical protection of servers at the contracted hosting provider,
8. training of employees and collaborators on their personal data protection obligations.

8.3. The Controller regularly tests, assesses and evaluates the effectiveness of the measures adopted in order to be confident that processing is carried out in accordance with the requirements of the GDPR and that the level of protection is appropriate to the risks. These processes also include an internal assessment of incidents and the adoption of corrective measures.

8.4. In the event of a personal data breach that could lead to a risk to the rights and freedoms of natural persons:

1. the Controller shall, without undue delay and no later than 72 hours after becoming aware of the incident, notify this fact to the Office for Personal Data Protection of the SR,
2. and if there is a high risk to the data subjects, it shall also inform those persons in a manner appropriate to the nature of the breach (e.g. by e-mail or by a notice on the website).

8.5. The Controller keeps an internal record of all security incidents and the measures adopted to resolve them. These records are retained for the purpose of demonstrating accountability within the meaning of Article 5(2) of the GDPR.

The Controller does not carry out automated decision-making or profiling under Article 22 of the GDPR that would produce legal effects or significantly affect the User.
Should such processes be introduced in the future, the Controller will implement them only on the basis of a lawful ground, with full respect for the User's rights, in particular the right to human intervention, to express a point of view and to contest the decision. Users will be informed of any such changes in advance through an update to this Policy.

The Controller reserves the right to update or amend this Policy at any time, in particular in the event of a change in legislation, technology or the manner of processing personal data. The current version of the Policy is always published on the website www.blyzer.net/ochrana-osobnych-udajov. The Controller will inform Users in advance, in an appropriate manner, of any material changes that may affect them (e.g. by a notice on the website or by e-mail).
Date of last update: 5 November 2025