Skip to content
Hybrid Agency
EN

Legal information

Personal Data Processing Notice

This is a translation; the Slovak version is legally binding.

Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) and applicable data protection legislation.

This document explains what personal data we process, for what purposes, on what legal basis, to whom it may be provided, how long we retain it, and what rights the data subject has.

A. Controller identification

Controller
Elektrorepas, s. r. o.
Registered address
Turčiansky Peter 84, 038 41 Turčiansky Peter, Slovakia
Company ID
57115893
Tax ID
2122575455
VAT ID
SK2122575455
Registration
Commercial Register of the District Court Žilina, Section: Sro, Insert No. 88361/L
Email
info@elektrorepas.sk
Website
www.electrorepas.com

Hereinafter referred to as the “Controller”.

When this document is used on the TikTok agency website, the following contact email may also be used: info@tiktokagentura.sk.

B. Purposes of personal data processing

The Controller processes personal data primarily for the following purposes:

1. Handling contact forms and messages

We process personal data of individuals who contact us via a web form, email, phone or social media in order to respond to enquiries, handle requests and prepare proposals.

2. Receiving and evaluating applications to the TikTok LIVE agency

When a person fills in an application to the TikTok LIVE agency, we process data necessary to assess the applicant’s suitability, verify basic conditions and potentially initiate collaboration.

3. Communication with creators, managers and partners

We process personal data for routine communication, organising collaboration, answering questions, providing support and coordinating next steps.

4. Record-keeping of applicants and collaborating persons

We process data of persons who have expressed interest in or been accepted for collaboration.

5. E-shop, goods sales and order processing

Where the Controller sells goods or services online, it processes customer personal data to accept, process and deliver orders and communicate with customers.

6. Accounting and tax obligations

We process personal data necessary to fulfil legal obligations, particularly in relation to invoicing and document archiving.

7. Handling complaints, grievances and legal matters

We process personal data necessary to handle complaints, grievances and disputes.

8. Marketing communications

Where the data subject consents or where permitted by law, we may process personal data to send marketing information. Consent may be withdrawn at any time.

9. Publication of photographs and videos

Photographs and videos of individuals may only be processed and published where a legal basis exists, in particular the consent of the data subject.

10. Competitions, campaigns and reviews

Where a data subject participates in a competition or campaign, we process personal data to organise it and contact participants.

11. Website operation, security and cookies

When visiting the website, technical data, cookies and IP addresses may be processed for purposes of security, analytics and service improvement.

12. Communication via WhatsApp

For the TikTok agency Hybrid Agency, the Controller uses the WhatsApp number +421 902 662 192 (WhatsApp Business Platform, provided by Meta Platforms Ireland Limited). Via WhatsApp, we process personal data for the following purposes:

  • Applying via WhatsApp – instead of using the web form, applicants can apply via WhatsApp. An automated chat assistant (bot) asks the same questions as the web form, in the data subject’s language (Slovak, Czech, Hungarian, Romanian, Bosnian/Croatian/Serbian or English), and creates the application from the answers. Before collecting application data, it asks for consent with a link to this document.
  • Answering questions – we handle questions and requests from people who write to us.
  • Support for streamers collaborating with the agency – identity verification with a one-time code sent to the streamer by their manager via TikTok LIVE Backstage messages and with a 6-digit PIN chosen by the streamer; answers to questions about monthly goals and statistics based on agency data (TikTok LIVE Backstage exports); contact with their manager and reporting problems.
  • Voice messages, photos, videos and documents – files sent to us by the data subject are stored encrypted and may be transcribed into text in order to handle the request they belong to.
  • Managing the TikTok account via the TikTok API – only with the streamer’s separate consent, the agency helps manage their TikTok account and its marketing via the official TikTok API (profile and video statistics, preparing and publishing content). This processing only starts once TikTok approves the agency’s app, and the streamer also confirms the connection directly in TikTok.

We only send messages as replies to people who wrote to us first, within 24 hours of their last message. We do not send marketing or bulk messages via WhatsApp. By typing STOP, the data subject stops all messages; by typing START, they resume them. The streamer may withdraw consent to the management of their TikTok account at any time by typing REVOKE.

C. Categories of personal data processed

The Controller may process in particular: full name, age, email address, phone number, address, country, TikTok username, TikTok profile link, social media links, follower count, LIVE streaming information, communication content, billing details, photographs, videos, IP addresses and cookies. Only data that is adequate, relevant and necessary for the specific purpose is processed.

For communication via WhatsApp (section B.12), we also process: WhatsApp phone number, WhatsApp profile name, message content (text, voice messages, photos, videos, documents and their transcripts), language of communication, application answers (to the same extent as in the web form) and records of consent. For collaborating streamers, also the link to their TikTok account in the agency’s records, verification status and the PIN, which is stored only as an irreversible hash – we never know or see the PIN itself.

D. Legal basis for processing

1. Consent of the data subject

Article 6(1)(a) GDPR – marketing communications, voluntary form submissions.

For communication via WhatsApp (section B.12) – processing of application data (the chat assistant asks for consent with a link to this document before collecting it) and the streamer’s separate consent to the management of their TikTok account via the TikTok API, which may be withdrawn at any time by typing REVOKE.

2. Performance of a contract or pre-contractual steps

Article 6(1)(b) GDPR – order processing, application assessment, preparation of collaboration.

For communication via WhatsApp (section B.12) – applying via WhatsApp (steps taken at the applicant’s request prior to entering into a contract) and support for collaborating streamers (performance of the collaboration contract).

3. Compliance with a legal obligation

Article 6(1)(c) GDPR – accounting and tax obligations.

4. Legitimate interests of the Controller

Article 6(1)(f) GDPR – protection of rights, website security, internal record-keeping.

For communication via WhatsApp (section B.12) – security of streamer verification (PIN, temporary lockout of verification after 3 incorrect attempts) and answering questions from people who write to us.

E. Retention periods

1. Contact forms and routine communications

Generally for as long as necessary to handle the request, at least 2 years.

2. Applications to the TikTok LIVE agency

Generally up to 2 years from submission of the application or last communication.

3. Contractual collaboration

For the duration of collaboration and generally 5 years after its termination.

4. Accounting and tax documents

Generally 10 years in accordance with applicable law.

5. Complaints and legal matters

For the duration of handling the matter and for as long as necessary to protect legal claims.

6. Marketing communications

Until consent is withdrawn, or up to 5 years.

7. Cookies

Depends on the type of cookie and the settings of the specific tool.

8. Communication via WhatsApp

  • Conversations without an application – 30 days after the last message.
  • Conversations linked to an application – as long as the application (up to 24 months if no collaboration is established).
  • Conversations of verified streamers – for the duration of the collaboration and of the link to their TikTok account in the agency’s records, then according to the rules above.
  • Voice messages, photos, videos and documents are deleted together with the conversation.
  • The data subject may request erasure at any time; the Controller deletes the conversation in the administration panel.

F. Recipients of personal data

Personal data may be disclosed to website hosting providers, email service providers, accountants, legal representatives, IT administrators, courier services, payment gateways, analytics tools, public authorities and platforms where a legal basis exists.

For communication via WhatsApp (section B.12), the recipient is Meta Platforms Ireland Limited as the provider of the WhatsApp Business platform (Cloud API), which acts as the Controller’s processor when transmitting messages.

G. Transfer of personal data to third countries

Personal data may in some cases be processed through services whose providers are located outside the EU or EEA. Such transfers only take place where GDPR conditions are met (e.g. standard contractual clauses). This may include tools such as Google, Meta, TikTok or cloud services.

For communication via WhatsApp (section B.12), Meta may also process data outside the EU or EEA, for example in the USA. Such transfers only take place where GDPR conditions are met, in particular on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework or standard contractual clauses.

H. Automated decision-making and profiling

The Controller does not carry out automated individual decision-making with legal effects on the data subject. Basic website traffic analysis may occur where cookie settings permit.

The WhatsApp chat assistant (section B.12) automatically asks questions, records answers and creates the application, but it does not decide on acceptance into the agency – such decisions are made by people (the agency’s managers). An automated security measure is the temporary lockout of PIN verification after 3 incorrect attempts.

I. Cookies

The website may use cookies — small text files stored on the visitor’s device. They are used for website functionality, traffic measurement and marketing. Analytical and marketing cookies are only used with the visitor’s consent.

J. Security of personal data

The Controller takes appropriate technical and organisational measures to protect personal data. Access is restricted to persons bound by confidentiality obligations.

Phone numbers, messages and files from communication via WhatsApp are stored encrypted on the Controller’s server (web hosting in Slovakia). The streamer’s PIN is stored only as an irreversible hash. Access to conversations is limited to the agency owner and the assigned manager.

K. Rights of the data subject

The data subject has the right to access their personal data, request rectification, erasure, restriction of processing, data portability, object to processing and withdraw consent. They also have the right to lodge a complaint with a supervisory authority.

Supervisory authority: Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava 27, Slovakia
www.dataprotection.gov.sk

L. How to exercise rights

By contacting the Controller:

  • Email: info@elektrorepas.sk
  • WhatsApp: +421 902 662 192
  • Address: Elektrorepas, s. r. o., Turčiansky Peter 84, 038 41 Turčiansky Peter, Slovakia

For queries related to the TikTok agency website: info@tiktokagentura.sk

M. Obligation to provide personal data

Provision of data may be a legal or contractual obligation, necessary for handling a request, or voluntary. If the data subject does not provide the necessary data, the Controller may be unable to provide the service or process the application.

N. Controller’s declaration

The Controller declares that personal data is processed lawfully, fairly and transparently, only for specified purposes, to the extent necessary and for the minimum period required.

O. Final provisions

Effective date: 11 June 2026

Last updated: 23 October 2026 (communication via WhatsApp added)

The Controller reserves the right to update this document. The current version will be published on the website.