Personal Data Protection

Who processes your data

The data controller is:

AkuDesign s.r.o.
Gagarinova 5/B, 821 01 Bratislava, Slovakia
Company ID (IČO): 46824057 · Tax ID (DIČ): 2023599853 · VAT ID: SK2023599853
E-mail: firma@akudesign.sk · Phone: +421 948 635 581

We have not appointed a data protection officer (DPO) — given the scale and nature of our processing, the law does not require one.

All the data we process comes directly from you. We collect no visitor data from other sources.

What we process, why, and on what legal basis

Contact form

When you write to us through the contact form, we store your name, e-mail address, phone number (if you provide one), the text of your message and the language of the page you wrote on. Alongside these we store your IP address and browser information — these serve solely to protect the form against abuse. The data stays in our own database.

Two e-mails go out on submission: a notification to our inbox (with your address as the reply-to address) and a confirmation to you (with our address as the reply-to address), in the language you wrote in.

The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract, where your enquiry concerns our services) and Art. 6(1)(f) GDPR — our legitimate interest in answering the enquiries we receive. The IP address and browser information are processed under Art. 6(1)(f) GDPR, our legitimate interest in protecting the form against abuse.

Providing the data is neither a statutory nor a contractual requirement — it is voluntary. Without a name, an e-mail address and a message, however, we cannot answer you.

We keep messages until your enquiry has been handled and any related follow-up communication has ended; then we delete them.

Spam protection runs entirely on our own server — a hidden check field, a timing check and rate limiting. We use no reCAPTCHA and no other third-party service.

Consent record

Whenever you give, change or withdraw cookie consent, we write a record of it: a pseudonymous identifier (the same one held in the cookie in your browser, kept across a change of mind — so we can demonstrate the full chain of a grant and a withdrawal), the action taken, the chosen categories, a truncated IP address, browser information, the page language and the time.

The IP address is truncated before it is stored: for IPv4 the last octet is zeroed (/24), for IPv6 only the first 48 bits are kept. The truncation is irreversible — the full address cannot be reconstructed from it and is stored nowhere.

The legal basis is Art. 6(1)(c) GDPR: under Art. 7(1) GDPR we must be able to demonstrate that you gave consent. We keep the records for 24 months; after that an automated task, which runs daily, deletes them.

Google Analytics 4

We use Google Analytics 4 (measurement id G-S1JZ94M1F0) to measure traffic — but only if you grant consent to analytics cookies. Without consent the page contains no reference to any Google domain and sends no request to one; the measurement code does not load at all.

The processor is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to the USA — see the section on transfers to third countries. IP anonymisation is built into Google Analytics 4.

The legal basis is Art. 6(1)(a) GDPR — your consent, which you can withdraw at any time in the cookie settings. We read aggregate statistics from Google Analytics through a server-to-server connection from our own admin; that sets and runs nothing in your browser.

Google Maps on the Contact page

The map showing our office location loads only if you grant consent to marketing cookies — on this site, that is the only thing this category is used for. Without consent you see a labelled placeholder with an explanation and a link to the cookie settings instead of the map. If the map does load, Google receives your IP address and data about your device and browser, and may set its own cookies on Google's domains. The processor and the transfer position are the same as for Google Analytics. The legal basis is Art. 6(1)(a) GDPR — your consent.

Strictly necessary cookies

We use our own cookies to run the site — the session, form protection and remembering your cookie choice. These require no consent (§ 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications). Their full list, with lifetimes, is on the Cookies page.

Administrator accounts

For our own staff and collaborators who manage the site's content, we keep accounts holding a name, an e-mail address, a password hash and roles, plus a log of changes made in the admin, kept for 730 days. This does not concern visitor data.

What we do not do

This site uses no Google Ads, no Facebook pixel or chat, no reCAPTCHA, no fonts from third-party servers (fonts are served from our own server), no newsletter, no e-shop and no payments. We carry out no profiling and no automated individual decision-making within the meaning of Art. 22 GDPR. We do not sell your data and share it with nobody beyond the processors listed below. We obtain no data about you from third-party sources.

Who receives the data

These processors under Art. 28 GDPR work with the data:

• WebSupport s. r. o., Karadžičova 12, 821 08 Bratislava, Slovakia, Company ID: 36421928 — operates the shared hosting on which the site, its database and the server access logs run. Our e-mail also leaves through the same provider's mail server; we use no other delivery service.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Google Analytics 4 and Google Maps, both only after your consent.

Nobody else receives your data.

Transfers to third countries

With Google's services, data may be transferred to the USA. Google LLC is certified under the EU–US Data Privacy Framework, and standard contractual clauses apply in addition. Outside the Google services, which run only with your consent, we make no transfers to third countries.

How long we keep the data

Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy of it (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• have processing restricted (Art. 18),
• data portability — for data you provided to us and we process on the basis of consent or a contract (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent at any time — without affecting the lawfulness of processing before the withdrawal,
• lodge a complaint with a supervisory authority.

Send your request to firma@akudesign.sk or to our registered address. We will answer within one month of receiving the request at the latest (Art. 12(3) GDPR).

The supervisory authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.

Cookies

Details of all cookies the site uses — names, purposes and lifetimes — are on the separate Cookies page. There you can change or withdraw your choice at any time; the same link is in the footer of every page. Withdrawing consent is as easy as giving it.

Legal framework

We process personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Slovak Act No. 18/2018 Coll. on the protection of personal data. The use of cookies is governed by § 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications.

Changes to this policy

We may update this policy from time to time, for example when the services we use change. The date of the last revision is shown at the foot of this page.

Contacting us

For any personal data matter, write to firma@akudesign.sk, call +421 948 635 581, or contact us at AkuDesign s.r.o., Gagarinova 5/B, 821 01 Bratislava, Slovakia.