Privacy policy

1. Who processes your data

Marek Kramár Kružlov 177 086 04 Kružlov Slovak Republic

Email: info@kovadlina.sk

Kovadlina is the name we run this portfolio under. It is not a registered business — the site is informational, nothing is sold on it and no payments are taken through it. There is no appointed data protection officer; for anything concerning data protection, contact us at the address above.

2. What data we process, and on what basis

There are three kinds of data. Each has its own purpose and its own legal basis.

Contact form

If you write through the form, we process your name, email address and the content of your message in order to reply. The legal basis is steps taken at your request prior to entering into a contract under Art. 6(1)(b) GDPR and, where an enquiry leads to no contract, our legitimate interest in answering a message that was sent to us under Art. 6(1)(f) GDPR. The server also holds your IP address for at most an hour, so the form cannot be abused to send spam.

Server logs

The server records an IP address, browser type, page address and timestamp for every visit. This serves the operation and security of the site — spotting attacks and faults — not working out who you are. The legal basis is our legitimate interest in running the site securely under Art. 6(1)(f) GDPR.

Traffic measurement

We measure traffic with Umami, which we run ourselves on a server at Hetzner. It uses no cookies and stores nothing on your device. It records the page address, the site you came from, your browser, operating system, device type, screen size, language and an approximate location derived from your IP address; the IP address itself is not stored. Visits are grouped under a pseudonymous identifier derived from your IP address and browser, which changes every month. The legal basis is our legitimate interest in knowing how the site is used under Art. 6(1)(f) GDPR. If you consent to it, we also measure traffic with Google Analytics. Without consent the Google tag is never loaded and no analytics cookies are stored. The legal basis for that is consent under Art. 6(1)(a) GDPR, which you may withdraw at any time. The details, and the list of individual cookies, are in the cookie policy.

3. How long we keep the data

Messages from the contact form are kept for as long as it takes to deal with your enquiry, and at most 24 months from our last exchange. Server logs are kept for 90 days and then deleted automatically. The record of your choice in the consent banner lasts 6 months, after which the site asks again. The lifetime of each individual cookie is given in the tables in the cookie policy.

4. Who receives the data

We do not sell your data and do not pass it to third parties for their own purposes. It reaches only the providers who run the site for us and who process it as processors on our instructions:

• Hetzner Online GmbH (Germany) — site hosting, server logs and the server running Umami traffic measurement; the data stays within the European Union.
• Add Rabbit LLC, trading as Purelymail (United States) — the mailbox that messages from the contact form are delivered to. It runs the mailbox on Amazon Web Services infrastructure.
• Google Ireland Limited (Ireland) — traffic measurement, and only if you have consented to it.

Data may also be disclosed to public authorities where the law requires it.

The mailbox that form messages arrive in is with a provider in the United States. The European Commission has issued no adequacy decision covering it, and the provider publishes no standard contractual clauses; the contents of the mailbox are encrypted at their end. Transferring your message is necessary for it to reach us and be answered, so it relies on the derogation in Art. 49(1)(b) GDPR. If you would rather it did not go to the United States, call us instead of writing — the number is on the contact page.

Analytics data may also be processed by Google outside the European Economic Area. For such transfers Google relies on standard contractual clauses, or another mechanism under Chapter V GDPR, which it publishes in its data processing terms. The transfer happens only if you have consented to traffic measurement — without that, nothing is loaded at all.

5. Do you have to provide any of this?

No. You do not have to fill in the form, and you can read the whole site without telling us anything about yourself. Without a name and an email address, though, we cannot reply to you. Consent to traffic measurement is likewise optional, and refusing it does not restrict any of the content you see.

6. Your rights

In relation to your personal data you have the following rights:

• the right of access — to learn whether and what data we process about you, and to receive a copy (Art. 15 GDPR),
• the right to have inaccurate data corrected and incomplete data completed (Art. 16 GDPR),
• the right to erasure, in particular once the data is no longer needed or you have withdrawn consent (Art. 17 GDPR),
• the right to restriction of processing (Art. 18 GDPR),
• the right to portability of the data you provided to us (Art. 20 GDPR),
• the right to object to processing based on legitimate interest (Art. 21 GDPR),
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

Exercising any of them is simple — write to info@kovadlina.sk. We will respond within one month of receiving the request at the latest.

If you believe that our processing of your data breaches the law, you may lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava — dataprotection.gov.sk.

7. Automated decision-making

We do not use your data for automated decision-making or for profiling that would produce legal effects concerning you or similarly significantly affect you.

8. Security

The site is served only over an encrypted HTTPS connection, and access to both the server and the mailbox is protected. Only the controller can access the data — there are no employees it is made available to.

9. Changes to this policy

We may update this policy if what the site does changes. The date of the last change is given at the top. If the purposes we need your consent for change, we will ask for it again.