Privacy policy

1. Controller

The controller of personal data is Daflo Systems s. r. o., with its registered office at Doležalova 3424/15C, 821 04 Bratislava, Company ID (IČO): 57855196, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 204011/B (hereinafter the “controller”).

Contact for personal data protection matters: [email protected].

2. What data we process

• Enquiry via the contact form: first name and surname, e-mail, company name and telephone number (if you provide them), the selected topic and the content of the message. After the form is submitted, a function on our hosting at Cloudflare checks the data and sends it to our e-mail inbox through the Resend service. The data is not stored on the website or in any database; the enquiry remains only in our e-mail inbox.
• Enquiry by e-mail: the data you provide in the message. Mail sent to addresses in the daflo.sk domain is forwarded through Cloudflare to our Gmail inbox.
• Contact by telephone: the telephone number and the content of the call to the extent necessary to handle the enquiry.
• Protection of the form against bots: when you start filling in the contact form, the Cloudflare Turnstile service is loaded. On submission it verifies that the enquiry is being sent by a person, not by an automated program. In doing so it processes technical data about the browser and the connection, for example the IP address and the browser type, not the content of the form.
• Visiting the website: the website does not store any cookies or other identifiers in your browser. Technical connection data (IP address, browser type, time of the request) is processed by Cloudflare as the hosting provider to the extent necessary to operate and protect the website, for example against misuse of the form.
• Traffic measurement: for aggregate statistics we use the Cloudflare Web Analytics service. When a page loads, a short measurement script runs and sends Cloudflare data about the page viewed, the page you came from, the country, the device type, the browser and the operating system, and the loading speed. The service does not use cookies or any other storage in your browser and does not recognise individual visitors by IP address or by browser. We see only aggregate counts.

3. Purpose and legal basis

Purpose	Legal basis
Replying to an enquiry, preparing a proposal and arranging a consultation or development	Pre-contractual measures and performance of a contract, Article 6(1)(b) GDPR
Ordinary communication that does not lead to a contract	Legitimate interest, Article 6(1)(f) GDPR
Operation and security of the website, including protection of the form against misuse	Legitimate interest, Article 6(1)(f) GDPR
Aggregate measurement of website traffic and speed	Legitimate interest, Article 6(1)(f) GDPR
Keeping accounts, if a contract is concluded	Compliance with a legal obligation, Article 6(1)(c) GDPR

We do not use personal data for marketing, newsletters or profiling.

4. Retention periods

• Enquiries and communication that do not lead to a contract: 24 months from the last communication; after this period expires we delete them.
• Enquiries and communication that lead to a contract: for the duration of the contract and then until the limitation period for asserting claims expires, as a rule 4 years under the Commercial Code.
• Accounting documents: 10 years under the Act on Accounting.
• Technical connection data: retained by Cloudflare only to the extent necessary for the operation and security of the website.
• Traffic statistics: available in Cloudflare in aggregate form for no more than six months back.

5. Recipients and processors

The following companies process data on behalf of the controller:

• Google (Gmail: the e-mail inbox in which we receive and handle enquiries and communication): the content of enquiries and e-mails.
• Cloudflare (website hosting, traffic measurement with the Web Analytics service, processing of the contact form and its protection against bots with the Turnstile service, forwarding of mail from addresses in the daflo.sk domain to our inbox): technical connection data, traffic measurement data, form data when the form is submitted and the content of incoming e-mails.
• Resend (delivery of the message from the contact form to our inbox): name, company name, e-mail, telephone number, topic and text of the message.

We do not provide data to other third parties. We provide it to public authorities only where the law requires it.

All three providers are companies established in the USA. The transfer of data to the USA relies on the European Commission’s adequacy decision under the EU-US Data Privacy Framework, under which Google, Cloudflare and Resend are certified.

6. Cookies

This website does not store any cookies, whether technical, analytical or marketing. We measure traffic without cookies and without any other storage in your browser; details are in section 2. The website therefore does not display a cookie banner.

7. Your rights

Under the GDPR you have the right:

• of access to your personal data,
• to rectification of inaccurate data,
• to erasure of data if it is no longer needed,
• to restriction of processing,
• to data portability,
• to object to processing based on legitimate interest,
• to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.

Send a request to exercise your rights to [email protected]. We will reply within one month at the latest.

8. Changes to this document

The current version is always published on this page. In the event of a material change we will state a new effective date.