1. Operator
The operator of the nearhelp web application (hereinafter referred to as the "application") is:
LightWeb s. r. o.
Registered office: A. Stodolu 5264/37, 036 01 Martin, Slovak Republic
Company ID (ICO): 55 843 581
Tax ID (DIC): 2122105986
Registered: District Court Zilina, section: Sro, file no. 83519/L
E-mail: support@nearhelp.eu
Data protection contact: support@nearhelp.eu
Lead supervisory authority pursuant to Art. 56 GDPR: Office for Personal Data Protection of the Slovak Republic (one-stop-shop mechanism)
Data Protection Officer (DPO): The operator does not currently meet the conditions under Art. 37 GDPR requiring the appointment of a Data Protection Officer (DPO), as it does not provide services that require regular and systematic monitoring of data subjects on a large scale. This obligation is continuously reviewed. For questions regarding data protection, please contact: support@nearhelp.eu.
Data Protection Impact Assessment (DPIA): The operator has conducted a Data Protection Impact Assessment pursuant to Art. 35 GDPR for the processing of geolocation data (GPS coordinates), as this type of data may present a heightened risk to the rights and freedoms of data subjects. The assessment is available upon request via e-mail at support@nearhelp.eu.
2. Data We Process
Within the application, we process the following personal data:
- Registration data: first name, last name (or nickname), e-mail address, password (hashed)
- Profile data: city, skills, description, profile photo, GPS coordinates (optional). GPS coordinates are collected once when setting your profile location and are used to display posts in your area. Your exact location is not shared with other users — only the city/town name is displayed.
- Third-party login data: Google ID, name and e-mail provided by Google (if you choose to sign in with Google)
- User-created content: posts, messages, proposals, reviews, statuses, photos
- Technical data: IP address, browser type, operating system, access time
- Cookies and analytics data: site usage data (with consent only)
- Push notifications: endpoint and keys for push notification delivery (with consent only)
3. Purpose and Legal Basis of Processing
| Purpose | Legal Basis | Retention Period |
|---|---|---|
| Registration and account management | Performance of a contract (Art. 6(1)(b) GDPR) | Duration of the account |
| Displaying posts and facilitating help | Performance of a contract | Duration of the post |
| Communication between users (messages) | Performance of a contract | Duration of the account |
| Push notifications | Consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn |
| Analytics and statistics | Consent (cookies) | Per cookie settings |
| Handling reports and security | Legitimate interest (Art. 6(1)(f) GDPR) | 6 months |
| Technical operation and diagnostics | Legitimate interest (Art. 6(1)(f) GDPR) — ensuring platform security and stability | 90 days |
Where processing is based on legitimate interest, we have conducted a proportionality (balancing) test weighing our legitimate interests against your rights and freedoms. Details of this assessment are available upon request.
4. Recipients of Personal Data
Your personal data may be shared with the following third parties:
- Google LLC – Google Analytics (analytics), Google OAuth (login)
- Hosting providers – servers located within the EU/EEA
Data transfers to the USA (Google, Meta) are safeguarded through the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
We have data processing agreements in place with all processors in accordance with Art. 28 GDPR.
5. Your Rights
Under the GDPR, you have the right to:
- Access – obtain a copy of your personal data
- Rectification – correct inaccurate or incomplete data
- Erasure – request deletion of your data ("right to be forgotten")
- Restriction of processing – restrict how we use your data
- Data portability – obtain your data in a machine-readable format
- Object to processing – you have the right to object to the processing of your personal data based on legitimate interest (Art. 6(1)(f) GDPR). Upon objection, we will cease processing your data for that purpose unless we demonstrate compelling legitimate grounds for the processing
- Withdraw consent – at any time, without affecting the lawfulness of prior processing
- File a complaint – You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic or with the supervisory authority in the EU/EEA Member State of your habitual residence or place of work pursuant to Art. 77 GDPR.
To exercise your rights, please contact us at support@nearhelp.eu. We will respond to your request within 30 days.
In complex cases or when dealing with a high volume of requests, we reserve the right to extend the response period by an additional two months in accordance with Art. 12(3) GDPR. We will inform you of any such extension.
For details about cookies and similar technologies, please refer to our Cookie Policy.
6. Account Deletion
You may delete your account at any time in the profile settings. Upon deletion, all your personal data, posts, messages, and photos will be permanently removed within 30 days. We may retain anonymized statistical data.
In accordance with Directive (EU) 2019/770, upon termination of the service, the operator will cease using your personal data (except where required by law) and will enable you to retrieve your data through the right to data portability under Art. 20 GDPR.
7. Data Security
To protect your data, we use transport encryption (HTTPS/TLS), hashed passwords (bcrypt), CSRF protection, rate limiting, secure session cookies, and regular database backups.
8. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, we will notify the Office for Personal Data Protection of the Slovak Republic within 72 hours of becoming aware of the breach in accordance with Art. 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay in accordance with Art. 34 GDPR, via email or in-app notification.
9. Automated Decision-Making
Your personal data is not subject to automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR. Should this change in the future, we will inform you and ensure your right to human intervention, to express your point of view, and to contest the decision.
10. Children
The application is not intended for persons under 16 years of age. If we discover that we have collected data from a person under 16 years of age without parental consent, we will delete the data without delay.
11. Policy Changes
We may update this policy from time to time. We will notify you of material changes via a notification in the application or by e-mail.