Privacy Policy

Information on the processing of personal data under Art. 13 of Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on the Protection of Personal Data.

Last updated: 29.09.2026

This English version is a translation provided for convenience. If it conflicts with the Slovak version in any way, the Slovak version governs, since the controller is registered in Slovakia and the site falls under Slovak and EU law.

1. Who is the controller

The controller under Art. 4(7) GDPR, the person who determines the purposes and means of processing Your personal data on this website (renekyz.eu), is René Kyžňanský, a self-employed sole trader registered in Slovakia (Registration No. / IČO: 57569410, Tax ID / DIČ: 1125051158). You can reach me by e-mail at kontakt@renekyz.eu. The processing described below is small in scale and low-risk, so Art. 37 GDPR doesn't require me to appoint a Data Protection Officer, and I haven't appointed one.

2. What data I process, for what purpose, and on what legal basis

a) Contact form data. When You use the contact form, I process the name, e-mail address, selected service and message You enter, solely to respond to Your enquiry and discuss a possible collaboration. Legal basis: Your consent, given by ticking the consent checkbox before submitting the form (Art. 6(1)(a) GDPR), together with my legitimate interest in being able to reply to enquiries sent to me (Art. 6(1)(f) GDPR).

b) Invoicing and contract data. If an enquiry develops into a paid collaboration, I also process billing details, such as Your name, address, and, for business clients, company registration numbers, along with details of the service ordered, needed to conclude and perform the contract and to issue accounting documents. Legal basis: performance of a contract or steps taken at Your request before entering into one (Art. 6(1)(b) GDPR), and my legal obligations under Act No. 431/2002 Coll. on Accounting (Art. 6(1)(c) GDPR). This data is processed and retained separately from contact-form enquiries, under the rules in Section 3.

c) Technical data collected automatically. My hosting provider's web server logs technical data for every visit: Your IP address, browser type, referring page, and timestamp. It keeps this for a limited period, to secure the site, prevent abuse, and diagnose technical faults. Legal basis: my legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR). I don't use this log data to identify individual visitors, for analytics, or for marketing.

To stop spam and password guessing, the site itself keeps a one-way hash of Your IP address (never the address itself) for up to 1 hour after You submit the contact form. Legal basis: my legitimate interest in protecting the site and my inbox (Art. 6(1)(f) GDPR).

I don't use cookie-based analytics, advertising trackers, or marketing pixels anywhere on this site.

3. How long I keep it

Contact-form enquiries that don't turn into a collaboration are kept for up to 12 months from Your last contact with me, then deleted, unless a longer period is needed to establish, exercise or defend a legal claim, or You ask me to delete them sooner.

Invoices and accounting records are kept under Act No. 431/2002 Coll. on Accounting, generally for 10 years from the end of the accounting period they relate to. This period follows from statute, and I cannot shorten it at Your request.

Automatically collected server logs are retained only for a short period, set by my hosting provider's standard security practices, and I don't use them for long-term analysis.

4. Who else processes Your data (recipients)

I keep the number of parties who see Your data to a minimum, and I don't sell or rent it to anyone. The following process data on my behalf, or as a consequence of how the site is built:

Websupport, s.r.o. (Slovakia, EU): hosts the site, the database, and the outgoing e-mail (SMTP) system this site runs on. Your contact-form message reaches my mailbox through their mail servers, and stays on their database infrastructure for as long as I retain it. All of this happens within the EU/EEA.
Google LLC / YouTube: video on the Projects page is embedded from YouTube in "privacy-enhanced mode" (youtube-nocookie.com), which limits what reaches Google until You choose to play a video. Loading the player or a video thumbnail still requests Google's servers and can expose Your IP address to them. Google LLC self-certifies under the EU-U.S. Data Privacy Framework, which the European Commission recognises as adequate protection for data transferred to the United States. I don't control what Google does with this data beyond that point; see Google's own Privacy Policy for details.

If an enquiry develops into a paid collaboration, I may also share billing data with my accountant or tax adviser, solely for bookkeeping and to meet my tax obligations.

I don't use any other third-party analytics, advertising, or tracking services.

5. Cookies and similar technologies

This site sets one functional, first-party session cookie (PHPSESSID), needed for the language switcher (Slovak/English) to work. It carries no tracking identifier and expires when You close Your browser. Your light/dark theme preference is stored in Your browser's local storage, not a cookie, and never leaves Your device. Neither is used for tracking, profiling, or advertising, so no cookie-consent banner is required for them under applicable ePrivacy rules. If You play an embedded YouTube video, YouTube may set its own cookies under its own privacy policy, outside my control.

6. International data transfers

My hosting, database and e-mail infrastructure (Websupport) sits within the EU/EEA. The only transfer outside the EU/EEA that can happen is to Google/YouTube (United States) when a video embed or thumbnail loads, as described in Section 4, under the EU-U.S. Data Privacy Framework adequacy mechanism.

7. Your rights

Under the GDPR, You have the right to:

Access: request a copy of the personal data I hold about You
Rectification: request correction of inaccurate or incomplete data
Erasure: request deletion of Your data ("right to be forgotten")
Restriction: request that I limit how I use Your data
Object: object to processing based on my legitimate interest
Withdraw consent: at any time, without affecting anything I did with Your data before the withdrawal
Data portability: get the data You gave me in a structured, machine-readable format
Lodge a complaint: with the Slovak data protection authority (contact details below), or the authority in Your own EU member state

The right to erasure does not apply to invoices and accounting records during their statutory retention period (Section 3); that retention follows from Act No. 431/2002 Coll. and cannot be waived by request.

To exercise any of these rights, contact me at kontakt@renekyz.eu. I'll respond within one month, as required by Art. 12(3) GDPR.

Supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, Slovak Republic. Website: dataprotection.gov.sk.

8. Automated decision-making

I don't carry out automated decision-making or profiling that has legal or similarly significant effects on You.

9. Changes to this policy

I may update this policy if the way the site processes data changes, for example if I add a new tool or integration. The date at the top of this page shows the current version. I'd suggest checking back occasionally.