Privacy policy
This Privacy Policy explains how Santox s. r. o., Záhradnícka 15921/46A, 821 08 Bratislava, Slovakia (“Santox”, “we”, “us”) handles personal data when you visit santox.co (the “Website”), contact us, or when we communicate with you as a prospective client or business partner.
It applies to Website visitors, people who send us an enquiry, and representatives of companies we talk to about a project. It does not cover personal data we process on behalf of our clients while building or operating software for them; that processing is governed by our contract and data processing agreement with each client.
1. Controller and contact
The controller of your personal data is Santox s. r. o., Záhradnícka 15921/46A, 821 08 Bratislava, Slovakia.
For any question about this Policy or your data, email [email protected] or write to the address above, marked “Privacy”.
2. Data we collect
Depending on how you interact with us, we may collect:
- Enquiry data: the name, work email, company, estimated budget and message you submit through the contact form, and the time it was sent.
- Correspondence: emails, call notes, meeting details and any documents you share with us while we discuss a project.
- Business contact data: name, job title, company and business contact details of company representatives, where you give them to us, someone at your company introduces you, or they are published for business purposes.
- Technical data: IP address, browser and device type, requested pages, referring page, timestamps and error information recorded by our server and network provider when the Website is loaded.
- Security data: signals used to block spam and abuse of the contact form, such as the number of submissions from an IP address and whether a hidden anti-bot field was filled in.
- Preference data: your cookie choice, stored in your browser, and any objection or opt-out you send us.
Please do not send us special categories of personal data (for example health data) or confidential information about other people through the contact form. If your message contains another person’s personal data, make sure you are allowed to share it with us.
3. Sources
We obtain personal data directly from you and your device, from colleagues at your company who introduce you or forward your details, from our hosting, network and email providers, and from publicly available business sources such as company websites and business registers. We do not buy personal data or use data brokers.
4. Purposes and legal bases
| Purpose | Typical data | Legal basis (GDPR) |
|---|---|---|
| Reply to your enquiry and prepare an offer | enquiry data, correspondence | steps taken at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in answering business enquiries where you act for a company (Art. 6(1)(f)) |
| Communicate with company representatives about a potential or ongoing project | business contact data, correspondence | legitimate interests (Art. 6(1)(f)) |
| Deliver the Website and keep it secure | technical and security data | legitimate interests (Art. 6(1)(f)) |
| Remember your cookie choice | preference data | legal obligation to obtain and respect consent (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Measure how the Website is used, if analytics is enabled | technical data, analytics identifiers | consent (Art. 6(1)(a)), given through “Accept all” |
| Keep business and accounting records once you become a client | business contact data, contract and invoicing details | legal obligation (Art. 6(1)(c)); performance of a contract (Art. 6(1)(b)) |
| Establish, exercise or defend legal claims and respond to authorities | relevant records | legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
Our legitimate interests are answering and developing business relationships, running a reliable and secure Website, preventing spam and abuse, and protecting our legal rights. When we rely on them, we weigh them against your interests and reasonable expectations, and you can object at any time (see section 10).
Where we rely on consent, you can withdraw it at any time without affecting processing that took place before. Withdrawing consent never limits your ability to contact us.
Providing your data is voluntary. Without your name, email and a description of your project we cannot reply to an enquiry.
5. Cookies and local storage
The Website uses only storage that is needed for it to work, such as remembering your cookie choice. We do not use advertising or cross-site tracking cookies. Optional analytics is used only if you choose “Accept all”. Details are in the Cookie policy.
6. Marketing
We do not add you to a newsletter or marketing list because you sent an enquiry. If we later send you relevant information about our services as a business contact, we do so only as permitted by law, and every such message tells you how to opt out. Replies to your enquiry and messages about an ongoing project are not marketing.
7. Who receives your data
We do not sell personal data. We share it only where needed, with:
- service providers that process data for us under data processing agreements, listed in the table below;
- professional advisers, such as lawyers, accountants and auditors, bound by confidentiality;
- authorities, courts or other parties where the law requires it or where it is necessary to protect our rights or the safety of others;
- a buyer, investor or successor in a merger, acquisition or similar transaction, subject to appropriate safeguards; and
- other parties at your request or with your consent.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Network delivery, DNS and protection against attacks | technical and security data | Global network, United States |
| Google Ireland Limited (Google Workspace) | Email, calendar and documents used to receive and answer enquiries | enquiry data, correspondence | European Union, United States |
| Resend, Inc. | Delivering contact-form messages to our inbox | enquiry data | United States |
| Google LLC (Google Fonts) | Delivering the fonts used on the Website | IP address, browser data | United States |
| jsDelivr | Delivering the 3D graphics library used on the Website | IP address, browser data | Global network |
8. International transfers
Some providers process data outside the European Economic Area, including in the United States. Where this happens, we rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified providers) or on the Standard Contractual Clauses, together with additional safeguards where appropriate. You can ask us for information about these safeguards at [email protected].
9. How long we keep data
We keep personal data only as long as needed for the purpose it was collected for, then delete or anonymise it.
| Record | Default period |
|---|---|
| Enquiries and correspondence that do not lead to a contract | 24 months after our last contact |
| Business contact data of client representatives | For the duration of the business relationship and up to 3 years after it ends |
| Contracts, invoices and accounting records | 10 years, as required by Slovak accounting law |
| Server and security logs | Up to 30 days, longer only while investigating a specific incident |
| Your cookie choice | In your browser until you change it or clear your browser data |
| Records of objections and opt-outs | As long as needed to respect them |
We may keep a limited record longer where the law requires it or to establish, exercise or defend legal claims.
10. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive data you gave us in a portable format (Art. 20);
- object at any time to processing based on our legitimate interests, and to direct marketing (Art. 21); and
- withdraw consent at any time.
To use a right, email [email protected]. We may ask you to confirm your identity. We reply within one month, which can be extended by two further months for complex requests; if so, we tell you why.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk. We would appreciate the chance to address your concern first, but this is not required.
11. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. Automated checks are used only to filter spam and abuse of the contact form.
12. Security
We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls, limits on contact-form submissions and restricted access to enquiry data. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority and, where required, you.
13. Children
The Website is intended for businesses and is not directed at children under 16. We do not knowingly collect their personal data. If you believe a child has sent us data, contact us and we will delete it.
14. Changes
We may update this Policy when our practices, providers or the law change. The version and effective date at the top show when it last changed. For material changes we will add a clear notice on the Website.
15. Contact
Santox s. r. o.
Záhradnícka 15921/46A
821 08 Bratislava, Slovakia
[email protected]