Samuel Aurel Kopáč
Document

Privacy Policy

Pursuant to Article 24 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”), the controller issues this Privacy Policy (hereinafter the “Policy”).

Part One

General provisions

Subject matter

  1. This Policy governs the manner in which the controller processes personal data of natural persons (hereinafter the “data subject” or “visitor”) in connection with the operation of the website available at www.samuelaurelkopacdp.sk (hereinafter the “Website”).
  2. This Policy is informative in nature and serves to fulfil the controller’s information obligations under Articles 13 and 14 GDPR.
  3. Using the Website does not in itself constitute consent to the processing of personal data. Where separate consent of the data subject is required by law, it is obtained separately and explicitly.
  4. This Policy has been drawn up in accordance with
    1. the GDPR,
    2. Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts, as amended,
    3. Act No. 452/2021 Coll. on Electronic Communications, as amended,
    4. the guidelines of the European Data Protection Board (EDPB) and of the Office for Personal Data Protection of the Slovak Republic.

Controller

  1. The controller of personal data is
    1. name: Bc. Samuel Aurel Kopáč,
    2. website: www.samuelaurelkopacdp.sk,
    3. contact email: aurelokopac@gmail.com,
    4. phone: +421 907 205 751

    (hereinafter the “controller”).

  2. Within the meaning of Article 4(7) GDPR, the controller alone determines the purposes and means of the processing of personal data.
  3. The controller is not a public authority, and its core activities do not consist of large-scale systematic monitoring of data subjects or large-scale processing of special categories of personal data. Under Article 37 GDPR, the controller is therefore not obliged to designate a data protection officer. All questions relating to data protection are handled directly by the controller using the contact details in paragraph 1.

Definitions

  1. For the purposes of this Policy
    1. personal data means any information relating to an identified or identifiable natural person within the meaning of Article 4(1) GDPR,
    2. processing means any operation or set of operations performed on personal data within the meaning of Article 4(2) GDPR,
    3. data subject means an identified or identifiable natural person to whom the personal data relate,
    4. controller means the entity which, alone or jointly with others, determines the purposes and means of processing within the meaning of Article 4(7) GDPR,
    5. processor means the entity which processes personal data on behalf of the controller within the meaning of Article 4(8) GDPR,
    6. consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes within the meaning of Article 4(11) GDPR,
    7. job means work carried out by the controller for a client, of which the controller keeps a record in the Website administration,
    8. review means a client’s rating and written statement about a job submitted via the Website,
    9. review link means a unique, randomly generated web address that the controller gives to a client to write a review,
    10. cookies means small text files stored in the browser of the visitor’s device when visiting the Website,
    11. local storage means the storage space of the browser of the device used to store data other than cookies,
    12. third country means any country outside the European Economic Area.

Nature of the Website

  1. The Website is the controller’s personal digital portfolio, which provides information about his design and permitting services and publishes client references. Its content is publicly accessible; a special regime applies to the protected parts of the Website under Article V.
  2. The Website
    1. contains a contact form for sending an inquiry to the controller,
    2. contains a review form available to clients via a review link and a public form for writing a review on the References page,
    3. does not allow public registration or the creation of user accounts,
    4. does not sell goods or services and does not process payment data,
    5. does not operate a newsletter or any other form of direct marketing,
    6. does not use analytics, marketing, advertising or profiling tools, or cookies of these types,
    7. does not use profiling or automated decision-making with legal effects for the data subject within the meaning of Article 22 GDPR.
  3. The controller applies the principle of data minimisation under Article 5(1)(c) GDPR and processes only the data necessary to achieve the purposes set out in this Policy.

Protected parts of the Website

  1. The protected parts of the Website are
    1. the Website administration, which is accessible only to the controller after entering a password,
    2. the review pages, which are accessible only via a review link.
  2. A review link contains a random code that cannot be guessed and becomes invalid after the review is submitted until the controller reactivates it. The protected parts of the Website are excluded from indexing by search engines.
  3. The password to the Website administration is not stored in readable form, but only as a cryptographic hash. After repeated unsuccessful login attempts, access is temporarily blocked.
  4. This Policy applies to the protected parts of the Website to the same extent as to its publicly accessible part.
Part Two

Processing of personal data

Categories of personal data processed

  1. When visiting and using the Website, the following categories of personal data may be processed:
    1. technical and operational data recorded in server logs,
    2. data from the contact form,
    3. job data entered by the controller in the Website administration,
    4. review data provided by the client,
    5. data used to protect forms against misuse,
    6. data provided in voluntary email or telephone communication with the controller.
  2. Server logs under paragraph 1(a) may contain
    1. the visitor’s IP address,
    2. the date and time of access,
    3. the requested URL,
    4. the type and version of the web browser,
    5. the server response status code.
  3. The data under paragraph 1(b) are the name, phone number or email address, the municipality of the building, a description of the planned building and the text of the message. These data are not stored on the Website but are delivered to the controller by email.
  4. The data under paragraph 1(c) are the client’s name, the name of the building, the municipality, the year, the scope of work carried out, the service category and, where applicable, a photograph of the completed building. The address of the building and the parcel number are not recorded and are never published. The controller obtains these data directly from the client within the contractual relationship. A photograph of the completed building is published only with the client’s consent and does not show persons or details from which the address could be determined.
  5. The data under paragraph 1(d) are the rating (1 to 5 stars), the text of the review of up to 1,000 characters, the chosen way of displaying the name, the consent to publication and the date of submission.
  6. If a client writes a review via the public form on the References page, they provide, in addition to the data under paragraph 5, their full name, optionally an email address, and details of the building (name of the building, municipality, year, type of service and scope of work). The form does not ask for the address of the building or the parcel number.
  7. The data under paragraph 1(e) are the IP address in irreversibly hashed form and the time the form was submitted.
  8. The controller does not process special categories of personal data within the meaning of Article 9 GDPR via the Website.

Purposes and legal bases of processing

  1. The controller processes personal data for the following purposes:
    1. operation, availability and security of the Website, including keeping server logs,
    2. responding to an inquiry from the contact form and preparing an offer,
    3. keeping records of jobs and creating review links,
    4. publishing reviews in the reference archive on the Website,
    5. protecting forms against spam and misuse,
    6. communicating with persons who contact the controller by email or telephone,
    7. handling requests to exercise the rights of data subjects,
    8. fulfilling the controller’s legal obligations,
    9. reviewing reviews before they are published and removing inappropriate content.
  2. The legal basis for processing is
    1. for the purposes under paragraph 1(a), (c), (e) and (f), the legitimate interest of the controller under Article 6(1)(f) GDPR,
    2. for the purpose under paragraph 1(b), taking steps at the request of the data subject prior to entering into a contract under Article 6(1)(b) GDPR,
    3. for the purpose under paragraph 1(d), the consent of the data subject under Article 6(1)(a) GDPR, given by ticking a separate box in the review form,
    4. for the purpose under paragraph 1(g), compliance with a legal obligation and the legitimate interest in proper record-keeping under Article 6(1)(c) and (f) GDPR,
    5. for the purpose under paragraph 1(h), compliance with a legal obligation under Article 6(1)(c) GDPR,
    6. for the purpose under paragraph 1(i), the legitimate interest of the controller in publishing genuine and non-offensive reviews under Article 6(1)(f) GDPR.
  3. For processing based on legitimate interest, the controller has carried out an assessment of the interests, rights and freedoms of data subjects and concluded that
    1. the scope of the data processed is minimal and corresponds to the nature of a personal portfolio,
    2. the data subject can reasonably expect such processing,
    3. the data subject has the right to object to such processing at any time under Article XIV.

Reviews and references

  1. After a job is completed, the client receives a review link from the controller. The controller does not send the link via the Website, but personally, for example by text message or email.
  2. On the review page, the client sees the details of their job in read-only form. The client fills in only the rating, the text of the review, the way their name is displayed and the consent to publication.
  3. The client chooses how their name is displayed with the review:
    1. full name and municipality,
    2. first name only and municipality,
    3. without a name, in which case the designation “Client” is shown,
    4. do not publish, in which case the review is not published and serves only as feedback for the controller.
  4. A review can also be written via the public form on the References page. A review submitted this way is published after approval by the controller, together with the full name and the location of the building, to which the client explicitly consents. The email address is not published and is used only to verify the review or to contact the client if necessary.
  5. The controller will hide or delete without undue delay any review that contains personal data of third parties, the address of the building or the parcel number, or content that is offensive or manifestly untrue.
  6. Every review is delivered to the controller by email before publication and is published only after his approval. A review that the controller does not approve is deleted within 30 days of its receipt at the latest.
  7. A published review is publicly available on the Website. The controller does not edit the texts of reviews; he may hide or delete a review.
  8. Consent to the publication of a review may be withdrawn at any time by email or by phone using the contact details in Article II. After consent is withdrawn, the controller removes the review from the Website without undue delay, and within 30 days at the latest, and deletes it, including the client’s name. Withdrawal of consent does not affect the lawfulness of publication before the withdrawal.

Retention period

  1. The controller retains personal data only for as long as strictly necessary to achieve the purpose of processing, but no longer than
    1. server logs including the IP address – for the period set by the hosting provider, at most 30 days from recording,
    2. contact form data – at most 12 months from the last communication if no contract is concluded,
    3. job data – for as long as the review is published; if no review is written, at most 2 years from recording the job,
    4. a published review – until consent is withdrawn or until it is deleted by the controller,
    5. the email address from the review form – for as long as the review is kept,
    6. a review that has not been approved – at most 30 days from its receipt,
    7. data used to protect forms – at most 24 hours,
    8. the Website administration login cookie – at most 7 days,
    9. email communication – at most 3 years from the last communication, unless there is a reason for longer retention,
    10. records of the exercise of data subjects’ rights – at most 5 years from handling the request.
  2. After the period under paragraph 1 expires, the data are deleted, anonymised or archived solely to the extent required by law.
  3. In the event of ongoing litigation, an inspection or other proceedings, the relevant data are retained for the duration of such proceedings and for the statutory limitation or preclusive periods.

Recipients of personal data

  1. Personal data are processed primarily by the controller. To the extent necessary, they may be made available to
    1. processors providing hosting, database and email delivery services, to the extent arising from the operation of the Website,
    2. the public, to the extent of a published review (the name as chosen by the client, the location and details of the building, the rating and the text of the review),
    3. public authorities, where required by law or on the basis of a final decision of the competent authority.
  2. The controller does not sell, rent or provide personal data to third parties for marketing purposes.
  3. Processing by processors under paragraph 1(a) is governed by a contract or other legally binding act within the meaning of Article 28 GDPR that provides appropriate data protection safeguards.
  4. At the request of the data subject, the controller will specify the current range of processors.

Transfers to third countries

  1. When using the services of processors under Article X, data may be transferred to the United States of America.
  2. A transfer under paragraph 1 takes place only if one of the conditions under Chapter V GDPR is met, in particular
    1. on the basis of an adequacy decision of the European Commission under Article 45 GDPR (EU–US Data Privacy Framework),
    2. on the basis of standard contractual clauses under Article 46(2)(c) GDPR.

Security of processing

  1. Taking into account the nature, scope, context and purposes of processing, the controller has adopted and continuously updates appropriate technical and organisational measures under Article 32 GDPR, in particular
    1. encryption of data in transit using HTTPS/TLS,
    2. access to the database only from the server, not from the visitor’s browser,
    3. storing the Website administration password only as a cryptographic hash and temporarily blocking login after repeated unsuccessful attempts,
    4. single-use, randomly generated review links,
    5. storing and displaying review texts only as plain text,
    6. limiting the number of form submissions from a single address,
    7. regular data backups,
    8. up-to-date software and libraries used to operate the Website.
  2. No method of transmitting data over the internet or of electronic storage can be described as completely secure. Data security is ensured with reasonable effort in line with current technical standards.
  3. In the event of a personal data breach likely to result in a high risk to the rights and freedoms of data subjects, the controller will inform them without undue delay in accordance with Article 34 GDPR.
Part Three

Cookies and similar technologies

Cookies

  1. Cookies are small text files stored in the browser of the visitor’s device when visiting the Website.
  2. The Website uses only strictly necessary technical means:
    1. one cookie used to keep the controller logged in to the Website administration; it does not concern ordinary visitors,
    2. an entry in the browser’s local storage that keeps the light or dark display mode chosen by the visitor; it contains no personal data and is not sent to the server.
  3. The Website does not use analytics, advertising, marketing or profiling cookies, or similar third-party technologies. For this reason, it does not display a cookie consent banner.
  4. The means under paragraph 2 are exempt from the requirement of prior consent under Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications, as they are strictly necessary to provide a service explicitly requested by the user. The legal basis for their processing is the legitimate interest of the controller under Article 6(1)(f) GDPR.
  5. Visitors can manage cookies at any time in their web browser settings, in particular delete stored cookies or block them.
Part Four

Rights of data subjects

Overview of rights

  1. In connection with the processing of their personal data, the data subject has in particular
    1. the right of access under Article 15 GDPR, i.e. to obtain confirmation as to whether their personal data are being processed and a copy of them, including information on the purposes, categories of data, recipients and retention periods,
    2. the right to rectification under Article 16 GDPR, i.e. to request the correction of inaccurate or the completion of incomplete data,
    3. the right to erasure under Article 17 GDPR, where the conditions under Article 17(1) GDPR are met and none of the exceptions under Article 17(3) GDPR applies,
    4. the right to restriction of processing under Article 18 GDPR in the cases set out in Article 18(1) GDPR,
    5. the right to data portability under Article 20 GDPR, where processing is based on consent or a contract and is carried out by automated means,
    6. the right to object under Article 21 GDPR, on grounds relating to their particular situation, to processing based on legitimate interest,
    7. the right to withdraw consent under Article 7(3) GDPR where processing is based on consent; withdrawal does not affect the lawfulness of prior processing,
    8. the right to lodge a complaint with the supervisory authority under Article XVI.

Exercising rights

  1. The data subject exercises their rights by email at aurelokopac@gmail.com or by phone at +421 907 205 751. The request should contain in particular
    1. identification of the data subject to the extent necessary to verify their identity,
    2. a specification of the right being exercised and a brief justification of the request,
    3. contact details for delivering the response.
  2. Where there are reasonable doubts about the identity of the person exercising a right, the controller may, under Article 12(6) GDPR, request additional information necessary to confirm the identity of the data subject. This measure serves to protect personal data against unauthorised access.
  3. The controller will handle the request without undue delay and in any event within one month of receipt. Taking into account the complexity and number of requests, this period may be extended by a further two months. The data subject will be informed of any extension and the reasons for it within one month of receipt of the request in accordance with Article 12(3) GDPR.
  4. Under Article 12(5) GDPR, the controller may
    1. charge a reasonable fee taking into account the administrative costs where a request is manifestly unfounded or excessive, in particular because of its repetitive character,
    2. refuse to act on such a request.
  5. The first copy of the personal data processed is provided free of charge. For any further copies, the controller may charge a reasonable fee based on administrative costs under Article 15(3) GDPR.

Supervisory authority

  1. The supervisory authority for personal data protection is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovakia, www.dataprotection.gov.sk.
  2. Supervision of the storage of information in terminal equipment and of gaining access to it, including cookies, under Section 109 of Act No. 452/2021 Coll. is carried out by the Regulatory Authority for Electronic Communications and Postal Services, Továrenská 7, 828 55 Bratislava, Slovakia.
  3. The data subject has the right to file a petition to initiate personal data protection proceedings under Section 100 of Act No. 18/2018 Coll. if they believe that their rights have been infringed by the processing of their personal data.
  4. Filing a petition under paragraph 3 is not conditional on first exercising the right with the controller. However, the controller recommends contacting him directly first in order to resolve the matter without unnecessary formalities.
Part Five

Special provisions

Voluntary provision of data

  1. The controller does not require data subjects to provide identification data merely to visit the Website.
  2. The processing of technical data in server logs and of data used to protect forms is technically necessary for the operation and security of the Website.
  3. Filling in the contact form is voluntary. Without a name and contact details, however, the controller cannot respond to the inquiry.
  4. Writing a review and consenting to its publication are voluntary, and not doing so has no adverse consequences for the data subject.

Automated decision-making and profiling

  1. The controller does not carry out automated decision-making, including profiling, that would produce legal effects concerning the data subject or similarly significantly affect them within the meaning of Article 22 GDPR.

Protection of minors’ data

  1. The Website is not intended for persons under the age of 16, and the controller does not knowingly process their personal data.
  2. If the controller finds that it has obtained personal data of a person under paragraph 1 without the consent of their legal guardian, it will delete them without undue delay.

External links

  1. The Website may contain links to websites or services of third parties.
  2. These are links only. The Website does not contain embedded third-party elements that would send data about the visitor without them actively clicking.
  3. The controller is not responsible for how such third parties process personal data. By clicking an external link, the data subject leaves the controller’s Website and the policy of the respective third party applies.
Part Six

Common and final provisions

Changes to the Policy

  1. The controller may unilaterally update this Policy, in particular in the event of
    1. changes in data protection legislation,
    2. changes in the scope or manner of processing personal data,
    3. a change of the technical infrastructure provider or other processors.
  2. The current version of the Policy is always published on the Website together with its effective date.

Effective date

  1. This Policy takes effect on 19 October 2026.
  2. This English version is provided for information purposes. In the event of any discrepancy, the Slovak version prevails.