This English translation is provided for your convenience. The Slovak version is legally binding.
Last updated: October 2026
Rosi Group, s. r. o., with its registered office at Pažiť 5, 958 03 Pažiť, Slovakia, Company ID (IČO): 44 502 885, Tax ID (DIČ): 2022724341, VAT ID (IČ DPH): SK2022724341 (“Quotioo”), provides online software for creating and managing construction budgets and related project documents.
This document explains how we process the personal data of website visitors, prospective customers, Quotioo users and the contact persons of our customers. It also explains our role in relation to the data that customers themselves enter into their projects.
1. Who is responsible for processing the data
When operating the website, managing user accounts, concluding contracts, invoicing, providing support and carrying out its own communication, Quotioo determines the purposes and means of processing. In these cases it is the controller of the personal data.
A customer may enter into Quotioo data about their projects, budgets, quotes and the people they work with on a construction project. Where the customer determines the purpose of processing this personal data and Quotioo processes it while providing the service on the customer’s instructions, the customer is the controller and Quotioo is the processor. The terms of such processing are to be governed by a contract under Article 28 of the GDPR.
The mere fact that data is stored in Quotioo does not determine our legal role. That depends on the specific purpose of processing.
2. What data we process
Depending on how the service is used, we may process in particular:
- account and user data: first name, surname, job title, e-mail address, telephone number, login details and account settings;
- contractual and billing data: customer identification details, details of the customer’s contact person, billing address, and data about the service ordered, payments and invoices;
- communication data: the content of messages, support requests and related communication;
- technical and security data: IP address, device and browser data, login time, service usage logs and security logs to the extent necessary to operate and protect the service;
- content entered by the customer: data in projects, construction budgets, quotes, attachments and shared documents. Its exact scope is determined by the customer according to what they enter into the service.
If a customer enters the personal data of other people into a project, the customer is responsible for having an appropriate legal basis for processing it and for providing those people with the necessary information. Users should not enter into the service any personal data that they do not need for the purposes of the construction project.
3. For what purposes and on what legal basis we process data
| Purpose | Legal basis where Quotioo processes data as controller |
|---|---|
| Creating an account and providing the service to a natural person who is our contracting party | Performance of a contract under Article 6(1)(b) of the GDPR |
| Managing the accounts of employees and other persons acting on behalf of a customer that is a legal person | Our legitimate interest in providing the service to the customer and managing access under Article 6(1)(f) of the GDPR |
| Handling enquiries, communicating with prospective customers and customer support | Depending on the circumstances, steps taken prior to entering into a contract, performance of a contract, or our legitimate interest in responding to requests and providing support |
| Invoicing, accounting and compliance with legal obligations | Compliance with a legal obligation under Article 6(1)(c) of the GDPR |
| Securing the service, preventing misuse and dealing with incidents | Our legitimate interest in protecting the service, user accounts and data under Article 6(1)(f) of the GDPR |
| Establishing, exercising and defending legal claims | Our legitimate interest in protecting our rights under Article 6(1)(f) of the GDPR |
| Sending marketing messages | The legal basis depends on the specific way in which we contact you; where consent is required, we send messages only on the basis of consent, and consent may be withdrawn |
For data that a customer enters into projects and in respect of which Quotioo acts as a processor, the purpose and legal basis of processing are determined by the customer as controller. Quotioo does not determine its own legal basis for this processing in place of the customer.
4. How long we keep data
We keep personal data only for as long as is necessary for the relevant purpose or as required by law.
- We keep data needed to manage the account and provide the service for as long as the service is used. After the contract ends, we delete or anonymise it, unless further retention is required by law or for the protection of legal claims.
- We keep invoices and accounting documents for the periods laid down by the applicable legislation.
- We keep communication and support requests while the request is being handled and then for a reasonable period needed for follow-up support or the protection of legal claims.
- We keep security logs for a period appropriate to their purpose.
- We keep data processed on the basis of consent until consent is withdrawn or until the purpose for which it was given ends.
- We keep the content of customer projects in respect of which we act as a processor in accordance with the contract and the customer’s instructions, including the rules for deleting or returning data after the service ends.
5. Who may have access to the data
To the extent necessary, the data may be accessed by authorised persons at Quotioo and by the service providers we use for operation, security, support, invoicing or communication. Depending on the circumstances, these may in particular be providers of hosting and infrastructure, payment and accounting services, communication tools and technical support.
Where we entrust such a provider with processing personal data on our behalf, we govern the relationship in accordance with the requirements of Article 28 of the GDPR. We may also disclose data to public authorities where required to do so by law.
6. Cookies and analytics
The website and the service may use cookies or similar technologies necessary for their operation and security. Where we also use analytics or marketing technologies, we provide information about them, their purpose, their duration and your choices in the . There you can give, change or withdraw your consent at any time.
The cookies SM, MR, SRM_B, MUID and ANONCHK are set by Microsoft as part of the Microsoft Clarity tool. We do not run advertising campaigns on the website.
Choosing the language of the website. So that the website can offer you pages in a suitable language when you visit, it determines from your IP address the country you are connecting from. The country is looked up directly on our server in a local database; for this purpose, your IP address is not sent anywhere or stored. The website remembers the language you choose, or the one it offers you, in the quotioo_locale cookie. The country database is provided by IP Geolocation by DB-IP under the CC BY 4.0 licence.
7. Rights of data subjects
Where Quotioo acts as controller, you may ask us for access to your data, its rectification or erasure, or the restriction of its processing. Under the conditions laid down in the GDPR, you also have the right to data portability and the right to object to processing based on legitimate interest. Where we process data on the basis of consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.
These rights are not absolute, and we will assess any request to exercise them according to the specific purpose and legal basis. You can send your request to the contact address given below.
Where the data was entered into a project by one of our customers, please contact that customer first, as the controller. If you contact us, we will help the customer with your request to the extent of our obligations as a processor.
You also have the right to lodge a complaint (a petition to initiate proceedings) with the Office for Personal Data Protection of the Slovak Republic.
8. Data security
To protect personal data, we take appropriate technical and organisational measures in view of the nature of the processing and the related risks. These include in particular access management, protection of user accounts, secure data transmission, backups and procedures for dealing with security incidents. We continuously adapt the specific measures to the risks and to the development of the service.
9. Contact
Rosi Group, s. r. o.
Pažiť 5, 958 03 Pažiť, Slovakia
E-mail for data protection enquiries: gdpr@quotioo.com
10. Changes to this document
We may update this document, in particular if the way the service works, the providers we use or the legal requirements change. We will publish the current version and the date of its last update on this page.