Privacy notice
On this page
This notice explains what personal data we collect through this website, why we process it, the legal basis for doing so, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Act No. 18/2018 Coll. on the Protection of Personal Data (Slovak Republic).
Controller: Netcraft, s.r.o., IČO 48106330, Karpatské námestie 7770/10A, 831 06 Bratislava – Rača, Slovak Republic. For any privacy question or request, write to hello@netcraft.sk or use the contact form.
What we collect, and why
Enquiries
When you write to us through the contact form or by email we process what you send: your name, your email address, your message, and anything else you choose to include. We use it to answer you and, if we go on to work together, to prepare and perform that work.
Legal basis: steps taken at your request prior to entering into a contract, and performance of a contract once there is one (Art. 6(1)(b) GDPR).
Invoices and accounting
If you become a client we process the details needed to invoice you and keep the records Slovak accounting and tax law requires.
Legal basis: compliance with our legal obligations (Art. 6(1)(c) GDPR).
Technical logs
Our host records limited technical data — including your IP address and the pages requested — to serve the site securely and to deal with abuse. We do not use it to identify you or to build any profile.
Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
Analytics and cookies
This site sets no analytics or advertising cookies. There is no Google Analytics, no Meta Pixel, no session recording and no advertising tag. That is why you were not asked to accept anything when you arrived.
Only cookies strictly necessary for the site to work are used, and those do not require consent. If we ever add analytics we will ask for your consent before anything loads, and this notice will say what the tool is before it is switched on.
Who else processes your data
We keep the list short on purpose, and there is no third-party form service in it.
| Processor | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts and serves this site; processes technical data such as your IP address | EU edge, company in the US |
| Resend, Inc. | Delivers messages sent through the contact form to our mailbox | US |
Both operate under their own data processing terms and the safeguards required for transfers outside the EU.
Client work — where we are a processor, not the controller
This part matters if you work with us rather than only read the site.
To do the work we usually need access to systems that hold personal data you are responsible for: hosting, a CMS database, analytics, sometimes a customer list inside a site we are migrating. For that data you are the controller and we act as your processor. In practice:
- Access is scoped and temporary. We ask for the least access that does the job, and we ask you to revoke it when the work ends.
- Copies are deleted. Migration work means taking an export. We keep it while the project runs, delete it after handover, and confirm in writing when we have.
- We sign a data processing agreement where we process personal data on your behalf, as Art. 28 GDPR requires. Ask and we will send ours.
- Sub-processors are named per engagement, in the contract, before the work starts — including any AI model provider, the tier used and what its terms say about training on customer data. If that is not acceptable for your data, we build the work self-hosted so nothing leaves your infrastructure.
We do not disclose that you are a client without your permission. It is the same policy that keeps client names and logos off this site.
How long we keep things
| Data | Retained |
|---|---|
| Enquiries and email | While the conversation is useful, then deleted |
| Invoices and accounting records | Up to 10 years, as Slovak law requires |
| Technical logs | A short period, as part of running a server |
| Client exports and credentials | Deleted at handover |
Your rights
The following rights apply to everyone whose personal data we process, under the GDPR and Act No. 18/2018 Coll.
Right of access. You can obtain a copy of the personal data we hold about you and information about why we process it. We will normally answer in writing, or electronically if you asked electronically.
Right to rectification. If anything we hold is inaccurate, incomplete or out of date, tell us and we will correct or complete it.
Right to erasure. You can ask us to delete your personal data — for example where it is no longer needed for the purpose it was collected for. We assess each request against any legal obligation we still have, such as the accounting retention above.
Right to restriction of processing. You can ask us to stop using your data in certain circumstances, for instance while an accuracy dispute is resolved.
Right to data portability. For data processed on the basis of consent or a contract, you can ask us to transfer what you provided to another party.
Right to object. Where we rely on legitimate interest, you can object, and we will stop unless we can show compelling grounds that override your interests.
Right to withdraw consent. Where we rely on consent you can withdraw it at any time. Withdrawal does not affect processing already carried out lawfully beforehand.
Right to complain. If you believe your data is being processed unlawfully you can complain to the supervisory authority:
Úrad na ochranu osobných údajov Slovenskej republiky Námestie 1. mája 18, 811 06 Bratislava +421 2 32 31 32 14
We would rather you told us first — it is faster, and if we have got something wrong we want to fix it.
Changes to this notice
If we change it we will change the date below. Adding any analytics or new processor will be reflected here before it goes live.
Last updated: 19 August 2026.