PERSONAL DATA PROCESSING POLICY
for the website www.carpcup.app

I.
Basic Provisions and Status of the Controller

This Personal Data Processing Policy (hereinafter referred to as the "Policy") bindingly, transparently, and comprehensively governs the method, scope, and purposes of processing personal data of natural persons by the company MIBO-SPRINGS s. r. o. in connection with the offer and sale of a software service (SaaS) through the main presentation and sales website www.carpcup.app, through electronic (B2B) communication, as well as during the administration of the overarching pan-European competition "Carp Cup Cup".

In relation to the personal data collected and processed directly through the aforementioned website and related communication channels, the entity acting in the capacity of the Controller (the entity determining the purposes and means of processing) is the company:

MIBO-SPRINGS s. r. o.
Registered Office: Jablonica 340, 906 32 Jablonica, Slovak Republic
Company ID (IČO): 57 573 361
Tax ID (DIČ): 212 283 1392
Registration: Commercial Register of the District Court Trnava, Section: Sro, Insert No. 62928/T
Website: https://carpcup.app
E-mail: [email protected]
Phone: +421 948 20 88 99
(hereinafter referred to as the "Controller")

The Controller processes personal data in strict compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as the "GDPR"), Act No. 18/2018 Coll. on Personal Data Protection, and other relevant legal regulations of the Slovak Republic and the European Union.

NOTICE REGARDING THE DIVISION OF ROLES: This Policy applies exclusively to the main domain carpcup.app. The processing of personal data of anglers and visitors directly on the dedicated subdomains of local competitions (e.g., nazov.carpcup.app) is governed by the separate privacy policy of the respective local Organizer. In such case, the local Organizer acts as the sole Data Controller, whereas the company MIBO-SPRINGS s. r. o. acts on the subdomains exclusively in the capacity of a technical Data Processor.

II.
Purposes and Legal Bases for Personal Data Processing

Personal data are always processed for predetermined, explicitly stated, and legitimate purposes, and to the extent necessary to achieve them. The purposes and legal bases for processing are as follows:

a) Handling of inquiries and performance of a contract (B2B/B2C software sales): Processing of data from contact and order forms on the website, subsequent e-mail communication, preparation of price quotations, technical setup of the Service (deployment of a subdomain), access management, and provision of support during testing (UAT).
Legal basis: Processing is necessary for the performance of a contract and in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) of the GDPR).

b) Fulfillment of tax and accounting obligations (Invoicing): Issuance of pro-forma invoices, standard tax documents, verification of VAT ID validity within the EU (via the VIES system), recording of payments, and legally required archiving of documents.
Legal basis: Compliance with a legal obligation to which the Controller is subject (Art. 6(1)(c) of the GDPR) in conjunction with tax regulations and the Accounting Act.

c) Central competition "Carp Cup Cup" (Hall of Fame): Software transfer, permanent publication, and retention of data and photographs of the heaviest catches in the pan-European digital Hall of Fame on the carpcup.app domain. Following their prior and irreversible anonymization, these data also serve for subsequent data analysis and the training of future AI models.
Legal basis: Explicit and separate consent of the data subject granted at the local competitions through a "Double Opt-in" mechanism (Art. 6(1)(a) of the GDPR).

d) Marketing, B2B references, and brand building: Publication of the logo, trade name of the Client (Organizer), or the name of their competition in the reference section of the carpcup.app website for the purpose of B2B promotion of the platform.
Legal basis: Consent of the Client granted by active acceptance of the General Terms and Conditions (Art. 6(1)(a) of the GDPR). The Client has the right to withdraw their consent at any time.

e) Protection of legitimate interests and security: Defense and exercise of legal claims, debt recovery, logging of system incidents to ensure network security, and prevention against cyber attacks.
Legal basis: Legitimate interests pursued by the Controller (Art. 6(1)(f) of the GDPR).

III.
Categories of Data Subjects and Processed Personal Data

The Controller processes personal data of the following categories of data subjects to a strictly minimized extent:

a) Clients (Competition Organizers) and their representatives: Identification data (first name, surname, title, job position), contact data (e-mail address, phone number), billing data (company name, registered office/residence address, Company ID, Tax ID, VAT ID, bank details), data concerning the content of B2B communication, technical materials supplied by the Client, and provided reference logos.
b) Participants of the Carp Cup Cup competition (Anglers): Data transferred from subdomains exclusively within the following scope: first name and the initial of the surname (e.g., "Jozef K."), name of the competition team, weight of the catch, and the visual likeness of the natural person captured on the submitted photograph of the catch (UGC).
c) Visitors to the carpcup.app website: Technical and operational data (IP address, time of access, device type), data from cookies managed through a separate cookie banner.

IV.
Source of Personal Data

The Controller primarily obtains personal data directly from the data subjects – B2B clients (Organizers) through the completion of contact and order forms and through e-mail communication.
In the case of participants in the central Carp Cup Cup competition, personal data are obtained indirectly – via their technical transfer from the databases of local Organizers; however, this transfer occurs legitimately and exclusively on the basis of an explicit "Double Opt-in" consent, which the data subject personally provided directly at the local competitions.
In B2B relations, the Controller may also obtain data from publicly accessible sources (Commercial Register, Trade Register, portal of the Financial Administration of the Slovak Republic, VIES) to verify the accuracy of billing data.

V.
Retention Period of Personal Data

Personal data are retained only for the period necessary to achieve the purpose:

a) Tax and accounting documents (Invoices): Retained in accordance with the Accounting Act for 10 years from the end of the accounting year in which they were issued.
b) Contractual B2B documentation and communication: Data associated with the sale of the software are retained for the entire duration of the provision of the Service and subsequently during the course of general statutory limitation periods (standardly 4 years) for the purposes of defending potential legal claims. Inquiries that do not lead to the conclusion of a transaction are deleted without undue delay (generally within 1 year).
c) Marketing references (Logos of B2B clients): Processed on the website until the moment of demonstrable withdrawal of consent (request for logo removal by the Client).
d) Data in the Carp Cup Cup competition (Hall of Fame): Retained publicly in the historical Hall of Fame on a long-term basis, until the moment the granted consent is withdrawn (Opt-out) by the angler in accordance with the Competition Statute. (The Contracting Parties expressly acknowledge that the right to erasure cannot be technologically enforced on already trained AI models and deep analytical outputs into which these data have been incorporated in their irreversibly anonymized form).

VI.
Recipients of Personal Data and Transfer to Third Countries

For the purpose of ensuring the proper operation of the Service, the Controller shares personal data to the necessary extent with verified sub-processors who meet strict security standards:
a) IT infrastructure and web hosting providers: Particularly the company WebSupport, s.r.o. (Company ID: 36 421 928), which provides servers, databases, e-mail operations (SMTP), and technological encrypted backups.
b) Providers of accounting, tax, and legal services bound by statutory and contractual confidentiality.
c) Public authorities and law enforcement agencies: To the extent necessary for compliance with legal obligations.

All servers, production databases, and technological backups are located exclusively within the territory of the European Union (EU). In the event of using international analytical and marketing tools (e.g., Google Analytics based on consent via cookies), transfers to third countries (USA) are protected by an adequacy decision of the Commission (EU-U.S. Data Privacy Framework).

VII.
Rights of Data Subjects

Under the provisions of the GDPR, every data subject has the following rights vis-à-vis the Controller:

Right of access: The right to obtain confirmation as to whether or not personal data concerning them are being processed, and to obtain a copy thereof.

Right to rectification: The right to request, without undue delay, the rectification of inaccurate personal data or to have incomplete personal data completed.

Right to erasure (Right to be forgotten): If the data are no longer necessary in relation to the purposes for which they were collected, if consent has been withdrawn (e.g., a request to remove a photograph from the Hall of Fame), or upon a successful objection. (This right does not apply to data required for compliance with a statutory accounting obligation).

Right to restriction of processing.

Right to data portability.

Right to object: In particular, against processing carried out on the basis of the legitimate interests of the Controller.

Right to withdraw consent at any time: If the legal basis for processing is consent, the data subject may withdraw it at any time and free of charge, without affecting the lawfulness of processing based on consent before its withdrawal.

VIII.
Exercise of Rights and Contact Details of the Supervisory Authority

The data subject may exercise their rights electronically by sending a request to the e-mail address: [email protected] or in writing to the postal address of the Controller's registered office. For security reasons, the Controller reserves the right to reasonably verify the identity of the applicant prior to processing the request. Requests are processed free of charge and without undue delay, no later than within one (1) month.

If the data subject believes that there has been a violation of their rights to the protection of personal data, they have the right to lodge a complaint with the competent supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic (Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk).

IX.
Security of Personal Data and Technological Backups

The Controller has implemented strict technical and organizational security measures to protect data. Communication on the website is conducted via the encrypted HTTPS protocol. To ensure business continuity (Disaster Recovery), comprehensive automated encrypted backups are performed within the hosting framework. Data subjects acknowledge that upon exercising their right to erasure, the data will be immediately removed from the public website and active databases; however, for technological reasons, the data may temporarily (generally 14 to 30 days) remain in these passive security backups until they are automatically overwritten by the retention cycle.

X.
Final Provisions

This Policy is publicly and permanently accessible on the carpcup.app domain. The Controller reserves the right to unilaterally amend and supplement this Policy at any time, in particular in response to legislative developments or innovations in the IT architecture of the platform. Changes shall become effective upon their publication.

In Jablonica, on 14.09.2026