This policy explains the processing of personal data when using aioness.com , user and business accounts and related functions. Separately describes the data for which Aioness determines the purpose of processing and the data it processes according to the instructions of the company you are booking or buying from.
Privacy and legal contact: privacy@aioness.com
1. Who is responsible for the data
For questions about privacy and exercise of rights you can write to privacy@aioness.com . The contact serves for requests regarding the platform. If the request relates to data that the company processes as a controller, Aioness helps the request to reach the responsible company.
Aioness is a controller for processing whose purposes and essential means it determines, such as managing its own orders, contracting and billing business packages, customer support, platform security and its own legal obligations. The controller is also referred to as the controller or controller in certain regulations.
The company where you book, buy or register for the event is usually a separate controller for the relationship with you, its records, the performance of the service, complaints and legal obligations. Aioness for technical processing under its instructions acts as a processor on the basis of a data processing contract.
Roles are determined by actual facts. The same data may be subject to different processing with different responsible parties. If the parties were to jointly determine the purposes and means, they must regulate the joint responsibility and make the essence of the arrangement accessible to persons. This policy does not declare all firms subprocessors of Aioness.
2. Territorial application and related notifications
For processing that falls under the GDPR, EU Regulation 2016/679 and relevant national regulations apply. Croatia and Slovenia are EU member states. BiH, Serbia, Montenegro and other markets in the region have their own regulations and competent authorities; harmonization of domestic law does not mean EU membership or automatic application of all EU rules.
The GDPR may also bind an operator outside the EU when the conditions of its territorial validity are met, in particular in relation to offering goods or services to persons in the EU or monitoring their behaviour in the EU. Applicable obligations are assessed according to the specific processing and market.
Before booking or buying, check the company’s information. A specific function may require additional clear notification at the time of collection. The cookie policy explains in particular the storage and reading of data on the device.
3. Data categories and sources
- Account details: first name, last name, e-mail, telephone when needed, user identifiers, authentication data and records of verification or change of account.
- Company and authorization data: business name, business contact, address, tax or registration data when necessary, role of employee or associate and assigned rights.
- Transaction data: selected service or product, term, number of participants, tickets, delivery, messages, notes, order status, payments and complaints.
- Subscription and billing data: package, billing period, amount, currency, invoice, transaction identifier, confirmation or proof of payment and data required for accounting.
- Communication and support: content queries, problem reports, relevant attachments, and information needed to respond. Do not provide unnecessary medical, identification or payment information.
- Technical and security data: IP address, request time, browser and device data, session, error, login event and records needed to protect and detect misuse.
- Choices and evidence: selected language and display, notification settings, recorded acceptance of conditions when they exist, cookie selection, identifier and time of that selection.
We receive data primarily from you, the company with which you do business or which assigns you a role, from the use of the platform and from the activated integrations to the extent necessary for a specific function. Data from public business sources can only be used for a specific legitimate purpose and appropriate information.
If the company enters your data without your direct input, it is obliged to regulate the legality and notification. When Aioness is the independent controller of the indirectly collected data, it provides information about the source and categories within the legal deadline; according to the GDPR, this is usually within a month at the latest, and earlier at the first contact or disclosure, with legal exceptions.
The selected country and currency, calculated amount, transaction currency, exchange rate or manual price, and payment information are used to display offers, perform contracts, document calculations, provide support and meet statutory accounting obligations. The selected language determines the initial package display currency on the public Aioness website, but does not establish the user’s nationality, residence or business country.
4. Purposes and legal basis
The legal basis shall be determined for each individual purpose. Acceptance of the terms does not replace consent, and consent is not used for what is really necessary for the performance of the contract or a legal obligation. The following division applies to processing for which Aioness is the controller; the company determines the basics of its processing.
Opening and using a personal account
Data necessary for your account, authentication and requested features is processed to perform a contract with you or take steps at your request before entering into a contract, where Article 6(1)(b) GDPR applies. Additional data does not become contractually necessary merely because it is mentioned in the terms.
Business package and contact persons of the company
Contractual necessity may apply to a contract with an individual acting as a sole trader. Data about employees and contacts of a legal entity is generally processed on the basis of a legitimate interest in administering the business relationship, subject to necessity and a balancing assessment. A contract with a business is not automatically a contract with each employee.
Accounts and legal records
Data needed for specific tax, accounting or other legal duties is processed on the basis of that obligation, within its prescribed scope and retention period. The applicable law and period depend on the operator and transaction and must be determined before billing starts.
Support, security and legal requirements
The execution of a support request may be necessary for a contract with the user. For the protection of the system, the prevention of fraud, limited security records and the defence of legal claims, a legitimate interest may be used, with a documented assessment, a minimum scope and an appropriate time limit. A specific legal obligation has its own legal basis.
Marketing and optional measurements
Consent is required when required for direct marketing, optional cookies and similar technologies. Any legal exemption for existing customers may only be used when all local conditions are met, with a clear and simple objection. The refusal of marketing must not prevent the use of the agreed basic service.
Language and display
An IP address may be used with a local geolocation database to estimate the country and recommend an interface language; this is not GPS location. This mechanism does not require sending the visitor’s IP address to an external geolocation service. Users can change the language manually. Storage of the choice on the device is explained separately in the cookie policy.
5. Mandatory and voluntary data
Required fields must be marked in a specific form. Without e-mail or other necessary information, it may not be possible to open an account, confirm a reservation or deliver the purchased product. Without the legally necessary data, it may be impossible to issue an appropriate invoice or execute a transaction.
Voluntary notes, profile details, and marketing choices are not mandatory just because the field is available. Enter the minimum amount of data required. When you are acting for another person, you must have the authority and provide them with the necessary information about the processing.
6. Special Categories and Children
A reservation at a particular health institution, the name of the treatment or the note can reveal health without a medical document. Such processing requires a basis from the general rules and an appropriate condition for specific categories, such as the conditions of Article 9 GDPR when applicable. Ordinary agreement with the terms of use is not enough.
General fields are not intended for medical documentation, biometrics, conviction data or other specially protected records. Prior to such use, the firm must verify that the function is supported and contracted, limit access, and conduct the necessary impact assessment and sector commitment.
Independent accounts are intended for adults. When a parent or guardian books for a child, the business should request only information needed for the service and check authority to the necessary extent. Where processing relies on a child’s consent to an online service, the relevant national age thresholds and parental-authorisation verification rules apply.
7. Who can receive the data
The data are available to Aioness authorised persons and companies in the scope of their role, to selected providers of essential services and to competent authorities when there is a valid legal basis for this. Publicly published company data is available to visitors and can be indexed by search engines; private client data may not be published as a public profile.
Possible categories of providers are infrastructure and backups, e-mail or message delivery, payment processing, support, security protection and integrations that the company or user activates. The selection of providers is ongoing. This description is not a claim that any specific service is already contracted or that any integration is active.
Before activation, the provider’s role as processor, subprocessor or independent controller must be determined, together with the data it receives, where it processes that data and the governing agreement. If a business independently connects a service, its privacy information must cover that data flow.
When you use a folder or address search function that directly loads an external service, its server may receive an IP address and technical browser data. OpenStreetMap and Nominatim services are used in the existing map code. For the activation of external content, the notifications in this function and the conditions of the respective provider are valid.
The protection of forms and other external accessories may be activated only after an assessment of necessity, legal basis and possible consent. A link to another page leads to the service for which its policies apply; the link itself is not the same as the embedded content that is loaded when visiting.
8. Processing countries and international transfers
Infrastructure locations, backups and support will depend on the final providers selected. Prior to transfer, actual storage and access states must be known and evaluated. The location of the servers in the EU does not in itself preclude a transfer if the data is accessed by a separate recipient outside the EEA.
When the GDPR applies, a transfer outside the EEA requires an appropriate mechanism: an applicable adequacy decision or other applicable safeguards, such as appropriate standard contractual clauses, with the necessary assessment and additional measures. Legal exemptions are only used in narrowly permissible circumstances.
It is not assumed the adequacy of the state because it has a law similar to the GDPR. For each specific stream, the valid decision, the scope of the mechanism and the status of the recipient are checked. In particular, domestic rules are examined when the data originates from a country outside the EEA.
Information on actual processing countries and applicable safeguards, including how to obtain a copy of the relevant safeguards with permitted redactions, may be requested at privacy@aioness.com . This information and the sub-processor register must be completed before appropriate production processing.
9. How long the data is kept
Data is not kept indefinitely simply because storage is technically possible. Retention is determined by the purpose, legal duties, risk, limitation periods for specific legal claims and, where Aioness is a processor, the business’s instructions. After the period ends, data is deleted or genuinely anonymised; removing a name alone is not anonymisation.
- Active account data: for as long as needed to use the account and complete outstanding actions; after closure, only segregated data for a specific remaining lawful purpose.
- Reservations, orders and communication of the company: according to a documented schedule established by the company for execution, complaints and mandatory records, with restrictions on processing contracts.
- Aioness invoices, payments and tax records: for the mandatory period under the applicable law. Deleting a profile must not automatically destroy records that must be retained.
- Support and complaints: until the end of the case and a reasonable period for proof or legal claim; unnecessary attachments are deleted earlier.
- Security and access records: the shortest documented period required for security and investigation; the relevant part may be set aside for a specific incident or dispute.
- Marketing consent: until withdrawal or the end of the purpose, with limited retention of evidence and a minimal suppression record where needed to honour an opt-out.
- Backups: according to a limited replacement cycle. Until removal, access is restricted and re-use is prevented; previous deletion requests should be re-applied upon renewal.
The period depends on the purpose of the processing, the type of document, the applicable legal obligations and the need to protect legal claims. You can request a specific deadline or criterion for your data at privacy@aioness.com . The data deadlines on your device are shown in the cookie policy.
10. User rights
Subject to applicable law and the conditions for each right, you may request confirmation and access, a copy of your data, correction of inaccuracies, completion, erasure and restriction of processing. Erasure is not absolute where mandatory retention, legal claims or another statutory exception applies.
When the conditions of portability are met, in particular automated processing based on consent or contract, you can obtain the data you have provided in a structured, commonly used and machine-readable form and request a direct transfer when technically possible. This is not the same as unlimited access to other people's data or to all business software.
You may object to processing based on legitimate interest because of your particular situation. The processing is then interrupted unless compelling legitimate reasons or the need for legal claims are proven. You can object to direct marketing and related profiling at any time; such processing ceases without a test of overriding interest.
You can withdraw your consent as simply as you gave it. The withdrawal does not affect the legality of the previous processing. Cookie settings are changed through the corresponding button on the page, and for other requests you can use privacy@aioness.com .
11. How to submit a request and deadline for response
Send your request to privacy@aioness.com, describing the right you wish to exercise and providing information that allows us to locate the account or matter. Do not send an identity-document copy in advance. Additional identity verification is requested only where justified and limited to what is necessary, with reasonable alternative evidence where appropriate.
For requests under the GDPR, the response is given without undue delay, at the latest within one month of receipt. In the case of complex or numerous requests, the time limit may be extended by another two months, with notification and reasons in the first month. A shorter or different mandatory local time limit applies when required by law.
As a rule, the procedure is free. Refusal or reasonable compensation is permitted only under legal conditions, such as manifestly unfounded or excessive requirements, with justification and information about the remedy. Protecting the rights of others may require redacting part of the copy rather than automatically denying everything.
If the business is the controller, we will direct or forward your request to it and assist within our role. We respond directly for data for which Aioness is the controller. Privacy requests do not depend on an active paid subscription.
12. Automated Decisions and Profiling
Technical filtering of results, display of available terms or recommendations in a language does not in itself mean a decision with legal or similar significant effect. If only automated decision-making with such effect is introduced, the legal conditions, the logic and consequences, and the applicable protective measures provided must be met before it can be applied.
Before introducing such processing, its lawfulness must be assessed and specific information provided about its logic, significance and expected consequences. Required safeguards, including human intervention and the ability to challenge a decision where applicable, must be available. A new purpose, such as using private data to train models, cannot be inferred from acceptance of general terms.
13. Security and data breaches
Protection must be risk-sensitive and include access control, separation of powers, secure communication, system maintenance, incident management, and recovery verification. The actual measures applied must be documented; this policy does not claim that the platform has an independent certificate or that no incident is possible.
If you suspect a data breach, contact privacy@aioness.com without publicly disclosing other people’s data. Where Aioness acts as a controller under the GDPR, it assesses the breach and notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.
Where a high risk is likely, affected persons shall be informed without undue delay, except for exceptions provided for by law. When Aioness acts as a processor, it notifies the company as a controller without undue delay and provides assistance; it does not wait for the controller to expire.
15. Policy changes
The policy must be up-to-date in relation to actual processing. Essential changes to the purpose, category of data, recipients or rights shall be clearly notified prior to the new processing, and new consent shall be sought when necessary. The text itself does not form a legal basis.
The version and date of application shall be shown on the document and the previous applicable versions shall be retained for verification. For clarification of this policy and the information that is in preparation please write to privacy@aioness.com .