Privacy Policy
This policy explains what personal data we process, why we process it, how long we keep it and what rights you have as a data subject under Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and Slovak Act No. 18/2018 Coll. on the protection of personal data.
This English version is provided for your convenience. In the event of any discrepancy, the Slovak version prevails.
1. Data controller
The controller of your personal data within the meaning of Art. 4(7) GDPR is:
- Company name: GDESIGN, s.r.o.
- Registered office: Hlavná ulica 309/19, 919 24 Križovany nad Dudváhom, Slovakia
- Company ID (IČO): 45 401 764
- Tax ID (DIČ): 2023004027
- VAT ID: SK2023004027
- Registration: Commercial Register of the Trnava District Court, Section Sro, Entry No. 25346/T
- Email:
- Phone:
We have not appointed a Data Protection Officer (DPO), as we are not required to under Art. 37 GDPR. For any data protection matters, please contact us at the email address above or in writing at our registered office.
2. What data we process
When you contact us through the form or work with us, we process:
- Identification data: your name (or company name);
- Contact details: email address and phone number (if you provide it);
- Content of communication: the text of your message and any further correspondence;
- Billing details (once a contract is concluded): company name, registered address, company and tax ID;
- Technical data when you visit the website: IP address and browser type — processed by our hosting provider as part of security and operational logs.
3. Purpose and legal basis of processing
| Purpose | Legal basis | Retention period |
|---|---|---|
| Handling your enquiry from the contact form | Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract | Up to 3 years from our last communication if no contract is concluded. |
| Concluding and performing a contract (building a website / providing a service) | Art. 6(1)(b) GDPR — performance of a contract | For the duration of the contract plus 4 years (statutory limitation period). |
| Issuing and archiving invoices | Art. 6(1)(c) GDPR — legal obligation (Slovak Accounting Act and VAT Act) | 10 years. |
| Security and operational logs | Art. 6(1)(f) GDPR — legitimate interest (website security) | Up to 30 days. |
Providing your details in the form is voluntary, but without them we cannot contact you or prepare a quote.
4. Recipients and processors
We may share your personal data with the following categories of recipients:
- Website hosting and operation: Vercel Inc. — website hosting and operational logs (servers in a data centre within the EU);
- Email delivery: Resend (Plus Five Five, Inc.) — delivering messages from the contact form to our inbox;
- Accountant / tax adviser: to the extent necessary for bookkeeping;
- Public authorities (tax office, courts, police) where required by law.
We have concluded data processing agreements with our processors under Art. 28 GDPR, in some cases in the form of the processor's standard data processing terms.
5. Transfers to third countries
Some of our infrastructure providers (Vercel, Resend) are based in the USA. Any such transfer of personal data is safeguarded by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 and by the EU-U.S. Data Privacy Framework.
6. Your rights as a data subject
Under Articles 15–22 GDPR, you have the right to:
- access your data and information about how it is processed;
- have inaccurate or incomplete data rectified;
- have your data erased (the “right to be forgotten”) where it is no longer needed for the purpose it was collected for;
- restrict processing;
- receive your data in a portable, machine-readable format;
- object to processing based on legitimate interest;
- lodge a complaint with the supervisory authority — the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, Slovakia, or with the supervisory authority in your EU country of residence.
You can exercise your rights in writing at our registered office or by email. We will respond within one month, which may be extended by a further two months in complex cases.
7. Automated decision-making and profiling
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR when processing your personal data.
8. Cookies
For details on cookies and similar technologies, please see our separate Cookie Policy.
9. Changes to this policy
We may update this policy from time to time. The current version, with its effective date, is always available on this page.
Effective from: 31 May 2026