Privacy policy

1. Who processes your data

Marek Kramár Kružlov 177 086 04 Kružlov Slovak Republic

Email: info@kovadlina.sk

Kovadlina is the name I run this portfolio under. It is not a registered business — the site is informational, nothing is sold on it and no payments are taken through it. There is no appointed data protection officer; for anything concerning data protection, contact me at the address above.

2. What data I process, and on what basis

There are three kinds of data. Each has its own purpose and its own legal basis.

Contact form

If you write through the form, I process your name, email address and the content of your message in order to reply. The legal basis is steps taken at your request prior to entering into a contract under Art. 6(1)(b) GDPR and, where an enquiry leads to no contract, my legitimate interest in answering a message that was sent to me under Art. 6(1)(f) GDPR. The server also holds your IP address for at most an hour, so the form cannot be abused to send spam.

Server logs

The server records an IP address, browser type, page address and timestamp for every visit. This serves the operation and security of the site — spotting attacks and faults — not working out who you are. The legal basis is my legitimate interest in running the site securely under Art. 6(1)(f) GDPR.

Traffic measurement

If you consent to it, I measure traffic with Google Analytics. Without consent the measurement tag is never loaded and no analytics cookies are stored. The legal basis is consent under Art. 6(1)(a) GDPR, which you may withdraw at any time. The details, and the list of individual cookies, are in the cookie policy.

3. How long I keep the data

Messages from the contact form are kept for as long as it takes to deal with your enquiry, and at most 24 months from our last exchange. Server logs are kept for 90 days and then deleted automatically. The record of your choice in the consent banner lasts 6 months, after which the site asks again. The lifetime of each individual cookie is given in the tables in the cookie policy.

4. Who receives the data

I do not sell your data and do not pass it to third parties for their own purposes. It reaches only the providers who run the site for me and who process it as processors on my instructions:

• Hetzner Online GmbH (Germany) — site hosting and server logs; the data stays within the European Union.
• Add Rabbit LLC, trading as Purelymail (United States) — the mailbox that messages from the contact form are delivered to. It runs the mailbox on Amazon Web Services infrastructure.
• Google Ireland Limited (Ireland) — traffic measurement, and only if you have consented to it.

Data may also be disclosed to public authorities where the law requires it.

The mailbox that form messages arrive in is with a provider in the United States. The European Commission has issued no adequacy decision covering it, and the provider publishes no standard contractual clauses; the contents of the mailbox are encrypted at their end. Transferring your message is necessary for it to reach me and be answered, so it relies on the derogation in Art. 49(1)(b) GDPR. If you would rather it did not go to the United States, call me instead of writing — the number is on the contact page.

Analytics data may also be processed by Google outside the European Economic Area. For such transfers Google relies on standard contractual clauses, or another mechanism under Chapter V GDPR, which it publishes in its data processing terms. The transfer happens only if you have consented to traffic measurement — without that, nothing is loaded at all.

5. Do you have to provide any of this?

No. You do not have to fill in the form, and you can read the whole site without telling me anything about yourself. Without a name and an email address, though, I cannot reply to you. Consent to traffic measurement is likewise optional, and refusing it does not restrict any of the content you see.

6. Your rights

In relation to your personal data you have the following rights:

• the right of access — to learn whether and what data I process about you, and to receive a copy (Art. 15 GDPR),
• the right to have inaccurate data corrected and incomplete data completed (Art. 16 GDPR),
• the right to erasure, in particular once the data is no longer needed or you have withdrawn consent (Art. 17 GDPR),
• the right to restriction of processing (Art. 18 GDPR),
• the right to portability of the data you provided to me (Art. 20 GDPR),
• the right to object to processing based on legitimate interest (Art. 21 GDPR),
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

Exercising any of them is simple — write to info@kovadlina.sk. I will respond within one month of receiving the request at the latest.

If you believe that my processing of your data breaches the law, you may lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava — dataprotection.gov.sk.

7. Automated decision-making

I do not use your data for automated decision-making or for profiling that would produce legal effects concerning you or similarly significantly affect you.

8. Security

The site is served only over an encrypted HTTPS connection, and access to both the server and the mailbox is protected. I am the only person who can reach the data — there are no employees it is made available to.

9. Changes to this policy

I may update this policy if what the site does changes. The date of the last change is given at the top. If the purposes I need your consent for change, I will ask for it again.