EU Data Act Information

1. Scope

This page gives the information that Article 28(1) of Regulation (EU) 2023/2854 (the "Data Act") requires a provider of data processing services to make available on its website. It concerns the Vitrina Platform provided by Complete solution s. r. o. (Slovak Republic, IČO 56693371) to customers in the European Union. Each customer has a separate deployment and a separate database; the data of one customer are never stored together with the data of another.

2. Jurisdiction of the ICT Infrastructure (Article 28(1)(a))

The provider of the service, Complete solution s. r. o., is established in the Slovak Republic and is subject to Slovak and EU law. A deployment of the Vitrina Platform runs on the infrastructure of the providers listed in section 1 of our sub-processor list, in particular:

• Railway Corp. — back end and database; the processing region is selected per deployment, an EU region where the provider offers it;
• Vercel Inc. — ordering website and admin panel;
• Cloudflare, Inc. — file storage, encrypted backups, traffic proxying;
• GitHub, Inc. — weekly backup restore test on runners located in the United States.

These providers are incorporated in the United States and are therefore subject to the law of the United States in addition to the law of the country where the data are stored. The region of each provider used for a deployment is stated in Appendix IV to the customer's Data Processing Agreement.

3. Measures Against International Governmental Access to Non-personal Data (Article 28(1)(b))

To prevent international governmental access to or transfer of non-personal data held in the Union where such access or transfer would conflict with Union law or the national law of a Member State, we apply the following measures.

Technical measures

• encryption of data in transit (TLS 1.2 or higher);
• encryption of database backups (AES-256) before upload, with the key held by us and not by the storage provider;
• a separate deployment and database for each customer;
• role-based access controls and logging of administrative actions.

Organisational and contractual measures

• every request of a public authority for access to customer data is examined for its legal basis and its compatibility with Union and Member State law before any response;
• requests that conflict with Union or Member State law are refused or challenged where legally possible, and only the minimum data required are disclosed where a request is lawful;
• the customer is informed of the request before any disclosure, unless the law prohibits this;
• our infrastructure providers are bound by data processing terms, and changes of providers are notified to customers in advance under the procedure described on the sub-processor list.