Privacy policy

The Data Controller is BossMedia s.r.o., with headquarters in Liptovská Kokava 301, 032 44 Liptovská Kokava, Slovak Republic, IČO: 52 978 974, which on the website stands under the brand GRIZZONI (hereinafter “the Data Controller”, “we” or “our company”).

The website: https://grizzoni.sk/

Contact for the protection of personal data and the exercise of rights: info@grizzoni.skThe phone +421 903 218 367Contact Person Pavel Multáň. Written requests may be sent to the registered office, marked ‘Personal data protection’.

The principles explain the processing of data of visitors to the site, interested in houses, buildings, wooden structures, parts and related services, customers, persons acting on behalf of customers, suppliers and business partners. The relevant provisions also apply to users of the account, chat, order tracking and partner program, if they take advantage of these features.

We provide information under Articles 12 to 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (‘GDPR’). Act No. 18/2018 Z. z. on Personal Data Protection and on Amendments to Certain Acts also applies to the relevant extent. Specific rules for cookies and electronic marketing are governed by Act No. 452/2021 Z. z. on Electronic Communications. [1–3]

Personal data may also be an online identifier or technical data, if it allows to directly or indirectly identify a natural person. Data about a business company may contain personal data of its operators, employees or contact persons.

We use the data for specific purposes, to the extent necessary and only for as long as necessary. We take care of their accuracy, restriction of access and adequate protection. Before further use for another purpose, we will evaluate its permission and meet the relevant information obligation.

Each activity has its own legal basis. The consent to advertising or analytics is not a condition for the handling of the usual demand or the conclusion of a contract. The reading of the policies or the use of the website itself does not represent consent to all the described processing.

Identification and contact details: name, surname, e-mail, telephone, delivery and invoicing address; with the entrepreneur also the business name, business location and identification data to the extent necessary.

Demand and project data: selected house or construction, location and building address, necessary land data, required preparation, budget, date, notes, project documents, photos and annexes.

Contract, order and accounting data: offers, orders, contracts, transfer protocols, invoicing, payments and their identificators, bank connection when paying or returning money, delivery data, complaints and claims.

Communication data: content of emails, messages and chat, contact requests, dates of meetings and business communication records. This description does not mean that telephone calls are recorded soundly; any recording requires a special assessment and notification before the recording is started.

Account and partnership data: login ID, data required to verify access, order history, partnership code, documents for calculation and provision payment, if you use the relevant service.

Technical and security data: IP address, access time, desired page, browser type and device, error and security records, session ID to the extent necessary for the relevant function.

Optional measurement data: online identificators, site visits, source of visit, interactions, approximate geographical area derived, for example, from the IP address and campaign events, if you have given the appropriate consent.

Newsletter activity data: message openings and link clicks recorded for a specific recipient through Brevo. The conditions for individual measurement are described in section 8.3.

Data on choices and rights: granting and withdrawal of consent, categories of cookies, time and version of information, objections and requests for the exercise of rights and the way to resolve them.

We do not request data on health, religion, sexual life or other specific categories under Article 9 of the GDPR, unless there is a specific legal reason for a special situation. Do not send birth numbers, copies of documents, card details or unnecessary data of other persons to the free fields and attachments. In case of random delivery of excess data, we consider the removal or restriction of access.

We collect data primarily from you when you visit the website, communicate, create an account or order. In the necessary extent also from your representative, business partner, designer, maker or payment and delivery provider. We may use the relevant public registers to verify the business data or the data required for the project.

If we do not obtain the data directly from you, we will notify you of the specific source, data categories and other information under Article 14 of the GDPR, as a rule, not later than one month; in case of earlier communication not later than at the first contact or at the first delivery to another recipient. The exception will only be applied under the terms of Article 14(5) of the GDPR. Public availability itself does not mean free use for any purpose.

6.1 Requests, consultations and offers

Data and documents are processed for the purpose of addressing the application, agreing the meeting, assessing the solution and preparing the offer. For the steps towards your own contract, the basis is Article 6(1)(b) of the GDPR. For a general question or communication with an employee of another company, we use Article 6(1)(f) of the GDPR; the interest is to facilitate communication and ensure business cooperation.

After completion of the request, we may retain the necessary communication for negotiation and the protection of claims based on legitimate interests. The deadline is in point 12; the request is not automatically included in the advertising database.

6.2 Order, contract and implementation

We use the data to conclude the contract, confirm the order, manufacture, transport, assembly, delivery, informing about the course and payment of the price. Article 6(1)(b) of the GDPR. For the contact persons of legal entities, it is generally referred to in point (f), since these persons may not be a Contracting Party themselves.

We send order confirmations, payment requests and changes of dates in connection with the contract. Separate marketing content is governed by section 8.

6.3 Accounting and legal obligations

We process document data, payments and supporting records under Article 6(1)(c) GDPR. In particular, Act No. 431/2002 Z. z. on Accounting and, where applicable, Act No. 563/2009 Z. z. on Tax Administration apply. We apply other tax and record-keeping rules according to the specific transaction and our status. [4]

6.4 Claims, withdrawals and consumer incentives

Customer data, delivery and defect we use to accept and resolve complaints. In the case of legal obligations, the basis is Article 6(1)(c) of the GDPR, in particular in connection with the Civil Code and Law No. 108/2024 Z. z. on Consumer Protection. The contract guarantee is, to the appropriate extent, referred to in point (b). The subsequent preservation of the necessary evidence for the defence of claims is based on point f). [5, 7]

In the notice of withdrawal, we process the name, e-mail, order or contract indication, extent of withdrawal, the possible additional message and time of receipt. We use the data for receiving and confirming notification, arranging withdrawal and any return of money. Legal obligations are fulfilled in accordance with Article 6(1)(c) of the GDPR, contractual arrangement in accordance with paragraph (b) and the necessary evidence for the protection of claims in accordance with paragraph (f). The confirmation will be sent to the e-mail; the notification and confirmation will be recorded separately from the order status.

6.5 Protection of rights and security

We use the necessary data to demonstrate performance, resolve disputes, recover debts, prevent fraud, unauthorized approaches and attacks. Article 6(1)(f) of the GDPR. The interest is the protection of rights, property, data and availability of services. We assess the necessity and reasonability of the intervention in your rights.

6.6 Account, order tracking and chat

When creating an account, we use the data for the requested user service in accordance with Article 6(1)(b) of the GDPR. The protection of the account and the investigation of unauthorized access shall be based on the legitimate interest under point f). We provide information about the order for the purpose of its arrangement and informing the customer.

We process messages in the chat according to the nature of the question similar to requests or contractual communication. The technical conversation ID allows you to assign messages and continue to communicate; to this extent, it can be saved in the browser. On the shared device, after completion, use the option to terminate the conversation. Closing a window is not a request for deletion of contractual or law-reserved data.

The web chat is connected to WhatsApp, through which the server receives messages and can respond back to the web conversation. When transmitted, the text of the message, the visitor's name, the conversation code and the address of the interview-related page are transmitted. The customer writes directly on the web and does not need a WhatsApp account. The recipients and transfers are described in points 10 and 11. The consent to marketing is not a condition for sending a question.

We also communicate with the customer through the messenger. During this communication, we process the information you make available to us in the Service, to answer a question or address a specific requirement according to the legal grounds listed above. We use Messenger as a separate communication channel.

6.7 Partnership Program

We use partner data for registration, performance of the partnership agreement, recording referrals, and calculating and paying commissions under Article 6(1)(b) GDPR; for partners’ representatives, under point (f). We fulfil accounting obligations under point (c). We provide the partner only with data necessary to check commission, such as the referral identifier, relevant value and claim status.

Advertising or affiliate ID in the visitor’s device is not automatically necessary only because according to it we pay the providence. We store the grizzoni_ref partner cookie and assign new visits or orders to the partner only after the explicit marketing permission in the common cookies settings. After refusal or withdrawal of marketing, the cookie will be deleted and the further assignment will be stopped. The change of the choice does not change the already made orders or the registration of claims for provision.

6.8 Consent and exercise of rights

For the proof of consent, the registration of its appeal and the settlement of rights, we process the necessary data according to Article 6(1)(c) of the GDPR in conjunction with Article 7(1) and Article 12 to 22 of the GDPR; in electronic marketing also according to Article 116 of Law No. 452/2021 Z. z. Evidence for a specific dispute may have a separate basis under point (f).

The obligatory fields are marked. To answer, we need the applicable contact and content of the request; additional data according to the scope of the service. The provision of data on request is your choice, but without the necessary data we don’t know how to answer, prepare an offer or fulfill the contract. Data on the law-prescribed documents is a legal requirement.

provide third-party data only to the extent necessary and with permission to provide them. For contact persons or property owners, we assess our own legal basis; the general statement of the sender does not replace our obligations under the GDPR.

We do not automatically use photographs and plans for preparing or carrying out an order as public references. We publish identifiable reference photographs, customer names or statements on the basis of separate consent under Article 6(1)(a) GDPR, unless another specifically assessed basis applies. For portraits and expressions of a personal nature, we also respect Sections 11 to 13 of the Civil Code. [5]

8.1 Reporting on the basis of consent

We send news and offers by e-mail or other explicitly selected channels for special consent in accordance with Article 6(1)(a) of the GDPR and Article 116(3) of Law No. 452/2021 Z.z., unless a legal exception is applicable. The consent is not specified in advance or associated with the mandatory confirmation of the order. The usual request is not the consent of the newsletter.

You can terminate the receipt at any time free of charge through the voting link or through our contact. The appeal does not change the legality of the previous processing. We will terminate the corresponding submission; the evidence of consent and appeals may be kept on a special legal basis.

8.2 Customer exception

If we use a legal customer exception, it may only be our own similar goods and services and the contact that the same company has acquired when selling. You must be able to simply and free of charge refuse to use in contact with each message and you must not refuse it before. The basis is Article 6(1)(f) of the GDPR; the interest is to inform customers about their own similar offer.

The conditions of the exception are set out in Section 116(15), and the time limit in subsection 16, of Act No. 452/2021 Z. z.: a contact obtained during a sale may be used in this way for no more than one year after the contractual relationship ends. A price enquiry alone or an incomplete purchase is not a sale that automatically establishes this exception. [3]

You can object to direct marketing processing at any time. If we object, we will cease to use the data for this purpose, including related profiling. The reason you don’t need to indicate and we won’t examine whether our marketing interests prevail.

8.3 Measurement of opening and clicks in newsletters

For newsletters sent through Brevo, we evaluate the opening of messages and clicks on links also in the link to a specific recipient. The data is used to evaluate the success of the campaigns. The letter for this measurement uses tracking pixels and individualized links; the technology details indicate in Documentation of opening and click measurement.

The consent to the individual measurement is obtained separately from the consent to sending the newsletter. The legal basis for the processing of individual events for this purpose is Article 6(1)(a) of the GDPR. If the measurement involves storing or accessing information in the terminal, the requirement of prior proofable consent shall apply as follows: Article 109(8) of Law No. 452/2021 Z. z.Technical scope for pixels and tracking links explain Guidelines EDPB 2/2023, points 47 to 51.

You can withdraw your consent to the individual measurement with a separate link in each newsletter and remain logged in to the collection. The withdrawal of the consent to the measurement and the withdrawal from the newsletter are separate options.

The choice of analytical and marketing cookies on the web does not replace your decision on individual measurement in newsletters. You can also notify the change or withdrawal of this option at the address. info@grizzoni.sk. Please state the email address receiving the newsletter and whether you wish to withdraw only measurement consent or also the subscription itself.

We use optional traffic, behavior and advertising campaign measurements according to our consent. The basis for the processing of personal data is Article 6(1)(a) of the GDPR; for information in the facility, Article 109(8) of Law No. 452/2021 Z. z. is also applied. The list of technologies and their deadlines are in the Cookies Policy.

Custom statistical measurement and comparison of menu versions (A/B test), if used on a specific page, are subject to the same analysis choice verified by the server. Without it, optional measurement events are not recorded. Consent to marketing, including partner recommendations, is set separately; it does not allow analytics itself. Authorization of the category itself does not mean that every prepared external service is active.

Custom GRIZZONI Traffic Review, if it is enabled and you enable analytics, processes random visit and view IDs, the path of the selected public page without URL parameters, the type of device, the general category of visit source, clicks on the predefined buttons and the start of the form, the range of shift and the estimate of active time. It records the unlogged view of the home page, products, categories and spring offer. Events are stored on your own server; they do not contain IP addresses, entire browser chains, the content of the forms or chat or customer identificators or orders. This review does not play the mouse movement or the image of the page. The details of the session and storage are in Policy of Cookies.

Measurement can work with pseudonym identifier. Pseudonymization or a summary review itself do not mean that personal data are not processed during the collection. Agreement with advertising technologies may allow the creation of interest groups, the assignment of conversions or remarketing.

In Microsoft Clarity, interactions may include clicking, shifting and reconstructing the course of the visit; it is not an image from the visitor’s camera. Forms, chats and spaces containing identification, payment or project documents must be excluded from such registration or effectively masked. We activate the service within the scope of informed consent. [10]

The website uses Websupport hosting. System emails are sent through the Resend service; online payments are set through Stripe and Google and Facebook are offered to log in. We use the Brevo service to send newsletters.

E-mailovú schránku info@grizzoni.sk prevádzkujeme u Websupportu. Pri práci so schránkou používa kontaktná osoba aj osobný účet ChatGPT Pro od OpenAI, pripojený prostredníctvom vlastného doplnku. Prístup zahŕňa celý obsah e-mailov aj ich prílohy, nielen vybrané úryvky. Sprístupnené údaje preto môžu zahŕňať kontaktné a objednávkové informácie aj osobné údaje v priložených dokumentoch. Vlastný doplnok používame aj na odosielanie odpovedí zákazníkom a odstraňovanie správ zo schránky. Odpovede pripravené pri manuálnej práci cez tento doplnok pred odoslaním skontroluje a schváli kontaktná osoba. Samostatná automatická asistentka využívajúca Anthropic API je opísaná nižšie. Na mazanie správ sa doplnok používa iba na jej výslovný pokyn. Odstránenie správy zo schránky samo osebe neodstráni jej prípadné kópie v AI účte, samostatne uložených súboroch ani zálohách; ich uchovávanie a výmaz sú opísané v bode 12.

Configuration of a personal ChatGPT Pro account. The ‘Improve the model for everyone’ option is disabled in the account used (as of 21. 10. 2026). This option concerns the use of new conversations to improve models. This setting does not determine data retention periods or processing locations and is not a general guarantee for every service or separately submitted feedback. Details: Control of Conversations for Training a Data from connected applications.

The purpose of supporting AI. ChatGPT helps with orientation in customer communication and preparing subjects and suggestions of answers. The legal basis for this support work is Article 6(1)(f) of the GDPR; the legitimate interest is the effective handling of communication. The legal basis of the demand itself or of the contractual fulfilment is listed in point 6. The use of AI must be necessary and proportionate to a specific task; the availability of the tool itself does not replace this assumption.

OpenAI – personal ChatGPT Pro. For users in the EEA, the consumer policy is listed as the operator of OpenAI Ireland Limited. The consumer service ChatGPT Pro is used; its conditions differ from corporate services and API. The provider describes the provision and security of the service, legal obligations and other purposes and recipients in its European Privacy Policy. Training settings are described above, retention periods in section 12 and transfers in section 11.

If your request for access or deletion relates to e-mail communications, you can also specify related processing through your own add-on and AI account. The original report, the work conversation and the separate file may be separate records; deadlines and exemptions are specified in point 12.

Websupport s.r.o. – hosting and email box. It provides web hosting and the box info@grizzoni.sk Information of the provider: Privacy Protection Websupport.

Resend / Plus Five Five, Inc. – system emails. To send the message, the recipient’s email address, the message content and any attachments, such as the order document, are made available to the service. For the data that we provide for sending it, it acts as a mediator. Details : Data Processing Agreement Resend a Information about GDPR.

Stripe – online platby. When choosing this payment, we send the provider an e-mail, order identification, item and payment amount. You enter the payment card data in the Stripe payment interface; our website does not store the payment card number. In compliance with our instructions, Stripe acts as a mediator and for its own purposes, such as security and legal obligations, as an operator. The documentation for the EEA lists Stripe Payments Europe, Limited as a contractual entity, Stripe Technology Europe, Limited for regulated payment services and Stripe Technology Company, Limited for other activities; involvement depends on the service used. Details : Privacy Center Stripe a Conditions of Data Processing Stripe.

WhatsApp – link to the web chat. Web chat messages are transmitted via WhatsApp Business Platform / Cloud API to the service to communications equipment. According to the terms of the platform, WhatsApp Ireland Limited is a contractual entity for a company in the EEA. The provider describes its own processing of registration, operating and support data in podmienkach platformy WhatsApp. Conditions of data processing apply only to the extent to which the relevant terms of service determine the status of the mediator; it is not a uniform status for all data and activities.

Messenger – Customer communication. Messenger zo skupiny Meta používame na prijímanie a vybavovanie správ zákazníkov. Na stránkach Grizzoni.sk a Pavel Multáň môžeme pri zapnutom automatickom odpovedaní používať AI asistentku na otázky k ponuke GRIZZONI. Spracúva obsah otázky, nevyhnutnú časť príslušného rozhovoru a technické identifikátory potrebné na priradenie odpovede. Pri verejných otázkach ide aj o obsah príslušného príspevku a komentára. Súkromné správy z Messengera sa nepoužívajú ako podklad verejných odpovedí v komentároch. Pri používaní služby sa uplatňujú aj Privacy Policy Meta. The scope of data available to the provider and its use are also governed by that service’s terms; these policies apply to our copy of the communication and the handling of your request.

Automatická AI asistentka – Anthropic API. Na prípravu automatických odpovedí na bežné zákaznícke otázky na webe, e-mailom a v podporovaných kanáloch Facebooku používame samostatné komerčné API služby Claude od spoločnosti Anthropic. Poskytujeme mu text otázky, potrebnú časť daného rozhovoru a verejné podklady k našej ponuke. Automatická odpoveď môže byť odoslaná bez predchádzajúcej kontroly človekom a je označená ako odpoveď AI asistentky. O vybavenie človekom môžete požiadať priamo v rozhovore alebo na info@grizzoni.sk. Asistentka môže urobiť chybu; nerozhoduje o objednávke, platbe, reklamácii ani vašich právach a nevyhodnocuje prílohy.

Spracúvanie odoslaného obsahu v Anthropic API upravujú podmienky komerčnej služby a príslušná dohoda o spracúvaní údajov. Informácie poskytovateľa o uchovávaní vstupov a výstupov API vrátane výnimiek sa vzťahujú na jeho evidencie. Žiadosť o údaje spracúvané pri našej zákazníckej komunikácii adresujte na kontakt v bode 1; podľa potreby ju riešime aj s poskytovateľom. Ide o samostatnú službu od manuálnej práce v osobnom účte ChatGPT Pro opísanej vyššie.

Brevo – newslettery. We use the letter to manage the contacts intended to send newsletters, send campaigns, and to evaluate the opening and clicks according to point 8.3. When processing our contacts for this purpose, he acts according to the provider's documentation as a mediator; in his own processing he may have the status of operator. Details : Brevo's tasks in the processing of data. The provider states that The data processing agreement is part of the terms of service.

In the company, only persons who need the data have access to work tasks. We provide them to external recipients to the necessary extent:

hosting, storage, backup, e-mail, web administration and security providers;

Providers of accounting and administrative services;

to banks and payment service providers when paying or returning money;

transporters, designers, assembly partners and suppliers involved in the required implementation;

a lawyer and other professional advocates in the field of protection of rights;

the providers of activated analytical, advertising, communication and media services according to the specific choice;

the court, tax, supervisory and other authorized authorities, if required by law or a properly applied legal claim.

If the supplier acts as our mediator, the processing must be regulated by the contract in accordance with Article 28 GDPR. Banks, lawyers and some platforms may act as separate operators for their own purposes. When jointly determining the purposes and means, we assess Article 26 of the GDPR and make available the essence of the relevant agreement.

If Microsoft Clarity is used, Microsoft acts as an operator according to the documentation of the service. For customers in the EU, the documentation indicates Microsoft Ireland Operations Limited and the subsequent processing by Microsoft Corporation in the USA. This description does not mean that the service is active on each page. Details : Microsoft Clarity. [10]

The specific scope of the available data depends on the service used: for example, when paying, sending a newsletter or communicating through chat. You can ask for information about the recipients of your specific data at contact in point 1. The introduction of a prepared analytical or advertising service does not mean that it is active on the web.

Technological services may be processed or remote accessed from countries outside the European Union and the European Economic Area. The location of the invoicing company or server in the EU does not exclude any further transfer.

Resend – United States of America. The provider keeps in the USA the content of the messages, the record of delivery and other operating data. The selection of the European shipping region does not change the location of the data stored. The processing agreement applicable to Resend accounts includes standard contractual clauses for international transfers. The warranty text is available in dohode Resend; Location of the data explains the provider.

OpenAI – processing outside the EEA. The European OpenAI policy indicates processing in the United States and other countries in which its affiliates and suppliers operate. In transmissions, it shall indicate the decisions on adequacy where applicable, or the standard contractual clauses. The details and method of obtaining a copy of the warranty indicate in European Privacy Policy; kontakt je privacy@openai.com. Neither a personal Pro plan nor disabling training means that processing takes place exclusively in the EU.

WhatsApp – prenosy aj do USA. The terms of the platform indicate the processing also in the US and other providers' country. For data processed in the status of the mediator, the data is WhatsApp Transfer Supplement Transfer from WhatsApp Ireland Limited to WhatsApp LLC and Meta Platforms, Inc. in the US. The supplement describes the use of the EU-US Data Privacy Framework and alternative mechanisms, including standard contractual clauses. The text of the guarantees and the scope of their use are available in the linked terms; you can also ask for further information at contact in point 1.

Anthropic API. Pri príprave automatických odpovedí môže dochádzať k spracúvaniu údajov aj mimo EÚ a EHP. Prenosové záruky pre komerčné služby vrátane štandardných zmluvných doložiek opisuje poskytovateľ v dohode o spracúvaní údajov. Tým nie je dotknutá všeobecná požiadavka na prípustnosť prenosu uvedená v tomto bode.

Database Hosting. The provider lists databases storage sites in the EU, namely OVH hosting in France and Germany and Google Cloud in Belgium. The location of the databases itself does not confirm that no access is made from another country for any support or further activity. The Source: Information Letter on the location of data.

Transfer can only be made in accordance with Chapter V of the GDPR: to a decision on adequacy pursuant to Article 45 or appropriate guarantees pursuant to Article 46, in particular standard contractual clauses, an assessment of the conditions of transfer and the necessary additional measures. In the EU-US Data Privacy Framework, the specific US recipient must be actively certified and the relevant data and service must fall within the certification scope. The framework does not apply automatically to every company in the United States. [9]

We do not consider exceptions under Article 49 a common solution for regular use of analytics. the consent to cookies does not replace the assessment of international transmission.

Information about the recipient, the country and the guarantees used, their copy or the way of obtaining will be provided to the contact in point 1; the protected information may be adequately modified.

Stripe. International processing may be involved by companies and suppliers in the United States and other countries. Transmission Conditions Stripe describe the EU-US Data Privacy Framework and replacement mechanisms, including standard contractual clauses, for transfers to the United States.

Brevo a Messenger. Providers may use group companies, support teams and other suppliers outside the EEA. Conditions including data processing agreement Contractual transfers guarantees including standard contractual clauses. by Messengeri, information on international processing is available in Principles of Meta. Locating the database in the EU does not by itself mean that all activities and access take place exclusively in the EEA. You may request information about recipients of your specific data and the relevant safeguards using the contact details in section 1.

We determine the deadlines according to the purpose, legal obligations and necessity. After their termination, we will delete or irreversibly anonymize the data. The deletion from one register does not mean the deletion of the lawfully stored accounting document.

Legal basis: Sections 35 and 36 of the Accounting Act, Section 101 et seq. of the Civil Code, Section 387 et seq., particularly Section 397, of the Commercial Code, and Section 116 of the Electronic Communications Act. A limitation period does not itself require all data to be retained; justification and a proportionate scope are necessary. [3–6]

Delete by the provider of ChatGPT. Regular and archived conversations remain stored until they are deleted. After deletion, the provider shall report the deletion from its systems within 30 days, with the exception especially for security or legal obligations and the data already sent. Separately stored files should be deleted separately. Our above-mentioned period of 24 months is the period to ensure the deletion from our account, not the claim of the immediate extinction of each copy from the provider. Details : Keeping conversations and files in ChatGPT.

Deposits are not intended for normal use. Removal takes into account the cycle of secure restoration; after restoration, valid removal and objection must be reapplicated. Longer storage for a dispute or legal obligation concerns only the necessary data with limited access.

The rights are applied under the terms of the GDPR; not all apply to every legal basis.

Access under Article 15: confirmation of processing, information about purposes, recipients, deadlines and other legal circumstances; also copy of data taking into account the rights of other persons.

Correction in accordance with Article 16: Correction of incorrect data and supplementation of incomplete data.

Deletion pursuant to Article 17: for example, when the purpose, illegality or withdrawal of consent is terminated without any other basis. It does not apply to the extent of mandatory retention or the need to determine, apply or defend legal claims.

Limitation under Article 18: for example during the verification of correctness or objection; also in the case of illegal processing, if you request a limitation instead of deletion.

Portability under Article 20: subject to the statutory conditions, you may obtain the data you provided, which we process automatically on the basis of consent or a contract, in a structured, commonly used and machine-readable format; you may also request direct transmission where technically feasible.

Opposition under Article 21: You may object to the legitimate interest on the grounds of your situation. We can only process further if we prove serious legitimate reasons prevailing over your rights or the need for legal claims. In direct marketing, the objection is unconditional.

The withdrawal of the consent under Article 7(3) is at any time and as simple as it has been granted, without affecting the legality of the processing before the withdrawal.

Protection pursuant to Article 22: the right not to be subject to exclusively automated decision with legal or similarly serious effects unless the legal exemption with the relevant guarantees is applied.

Appeal and judicial protection under Articles 77 to 79; in the event of compliance with the conditions, the compensation of the damage under Article 82.

In the cases of Article 19, we will notify the recipient of the correction, deletion or limitation, if this is not impossible or does not require improper effort. We inform you of the recipients on request.

Write to contact from point 1. Enter the request and the data required to search for the record, such as the e-mail or order number used. You don’t need to use a specific form or quote paragraphs.

We will solve the request without unnecessary delay, not later than one month after delivery. In case of complexity or number of applications, the deadline may be extended by another two months; within the first month we will notify the extension and the reasons. If we do not dismiss, we will explain the reason and possibilities of the complaint and legal protection within a legal period. [1, 8]

In case of justified identity doubts, we may request additional reasonable information; we do not automatically require a copy of the identity card. Equipment is usually free. In the event of an apparently unfounded or unfair request, under the conditions of Article 12(5) may be required a reasonable fee or refused to act; we must prove that the conditions are met.

Withdrawal of electronic marketing consent or an objection to a marketing call also requires a verifiable confirmation within 30 days at the latest under Section 116(6) of Act No. 452/2021 Z. z. This period does not permit marketing to continue after withdrawal or objection. [3]

You may file a complaint to the competent supervisory authority, in particular in the Member State of habitual residence, workplace or place of alleged infringement. In Slovakia it is:

Office for the Protection of Personal Data of the Republic of Slovakia

Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovakia

Web: https://dataprotection.gov.sk/

Information and Model of Proposal: https://dataprotection.gov.sk/sk/ine/vzory-formulare-stiahnutie/navrh-zacatie-konania-ochrane-osobnych-udajov/

In the case of a proposal for the opening of the proceedings, it is applied in particular § 100 of Law No. 18/2018 Z. z. Contacting us is not a general condition of the right to submit a complaint; the appropriate details of the specific submission are in the instructions of the Office. [2, 8]

The final decisions of the operator about orders, their cancellation and the return of money are approved by a person. ChatGPT serves as a support tool in these decisions; it does not decide separately about the rights of the customer. This statement concerns the decision-making of the operator, not the separate procedures of payment and other external providers.

The automatic confirmation of the order, the usual price or provision calculation, or the display of the state of production itself, do not mean such a decision. Advertising evaluation may include profiling on the basis of consent if used. Before making a decision with a significant effect, we will provide information about logic, significance, consequences and guarantees.

In accordance with Article 32 of the GDPR, we take measures appropriate to the risks and nature of the processing. These include, as necessary, authorization management, logging protection, updates, secure transfer, backup, silence and supplier control. Their description does not replace the actual implementation.

In the event of a personal data breach, we act under Articles 33 and 34 GDPR, including notifying the authority and informing affected individuals where the statutory conditions are met. Suspected incidents may be reported using the contact details in section 1.

The website and the business offer are not targeted to children. We do not require a flat date of birth. If the online consent service offered directly to children would be introduced, the conditions and verification of the permission shall be assessed specifically in accordance with Article 8 of the GDPR.

We update the principles with a substantial change in processing. The new version will be marked by the update date and the significant change will be notified in an appropriate way. If new consent is needed, the update itself does not replace it.

Related document: Policy of Cookies. ‘Cookie settings’ on public pages, including the separate cookie page, allow separate choices for analytics and marketing, including partner referrals. The setting is shared across the website; it does not confirm that every planned external service has been activated.

Details about each cookie, its purposes and life can be found in the Cookies Policy. The change of consent on the website works in the future; the withdrawal of consent to the individual measurement of newsletters is processed separately in accordance with point 8.3.