Privacy Policy
This notice explains how RESTITUIT Holdings, SE processes personal data through the corporate website and its public and protected functions. Legal revision 2026-09-07-r1, effective 7 September 2026.
Controller, contact and scope
The controller is RESTITUIT Holdings, SE, IČO 55 946 321, registered office Bajkalská 5/A, 831 04 Bratislava-Nové Mesto, Slovak Republic. Privacy requests may be sent to info@restituit.com or by post to the registered office. The current company records used for this publication do not identify an appointed data-protection officer, and the present processing activities do not establish a mandatory designation criterion under Article 37 GDPR. If a data-protection officer is appointed or the nature or scale of processing changes, this notice and the contact route will be updated. This notice covers visits, contact enquiries, newsletter subscriptions, registration, authentication, account administration, protected investor access and administrator activity.
Data, purposes, legal bases and required fields
For secure website delivery we process session, CSRF, request and minimized security data on the basis of Article 6(1)(f) GDPR, pursuing secure and reliable operation, abuse prevention and defence of legal claims. Contact submissions contain name, e-mail, interest and message, with telephone and organisation optional; they are processed under Article 6(1)(b) for requested pre-contractual steps or Article 6(1)(f) for answering corporate enquiries. Registration requires name, e-mail, telephone, country, city, interest and reason so eligibility and secure access can be reviewed under Article 6(1)(b) and (f); without required data the request cannot be processed. Login requires e-mail and authentication/security data, without which access cannot be verified. Newsletter delivery and optional technologies rely on freely given, separate consent under Article 6(1)(a), which is not required for other services. Article 6(1)(c) applies where records must be processed to meet a legal obligation.
Recipients, transfers, retention and security
Data is available only to authorised personnel and administrators, the Hostinger group and its approved subprocessors for managed hosting and authenticated e-mail, professional advisers where necessary, and public authorities where legally required. Processor access is governed by Article 28 GDPR arrangements. Hosting or e-mail processing may involve access from or onward transfers outside the EEA. For a transfer to a country without an adequacy decision, the current Hostinger Data Processing Addendum incorporates the European Commission standard contractual clauses; information about the safeguard or a copy is available through the privacy contact on request. The launch configuration enables no optional third-country analytics, advertising or support integration. Contact content is retained for 12 months after the last relevant interaction and contact security metadata for 30 days. Pending registration data is anonymised after 90 days and rejected requests after 180 days; registration and audit security sidecars are removed after 90 days. Verification/setup links expire after 48 hours, reset links after 60 minutes, and terminal token hashes within seven days. Active account data remains while the account and documented access or claim needs exist. Newsletter e-mail addresses remain until withdrawal and are anonymised within 30 days after unsubscribe; minimum non-reversible consent, withdrawal and suppression evidence is retained for at least four years after withdrawal and reviewed thereafter. Application logs rotate after 14 days. Deletion from active systems propagates through the documented backup overwrite cycle and is re-applied after a restore. A documented legal hold may pause deletion only for its stated scope and duration.
Rights, objections, complaints and decisions
Subject to the GDPR conditions, you may request access, rectification, erasure, restriction and data portability; object at any time to direct marketing and, on grounds relating to your situation, to legitimate-interest processing; and withdraw consent without affecting earlier lawful processing. Send a request to info@restituit.com; identity may be verified before disclosure, and the company will respond within the GDPR time limits. You may complain to the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, or another competent supervisory authority. The platform does not make decisions producing legal or similarly significant effects solely by automated means. Material changes receive a new version and effective date.