Privacy Policy

1. Consent

By using our website or providing your data, you consent to this Privacy Policy and agree to the collection and use of information in accordance with it.

2. Information We Collect

We collect only information necessary for legitimate business purposes and in compliance with Article 6 GDPR. This may include:

• Identification data – name, company, address, email address, telephone number;
• Communication content – messages or attachments you send via forms or email;
• Technical data – IP address, browser type, operating system, access times, and referring URLs collected automatically via server logs or analytics;
• Account data – information provided during registration, subscription, or service ordering.

3. How We Use Your Information

• To provide, operate, and maintain our website and digital services;
• To improve and personalize content and user experience;
• To understand usage patterns and optimize performance;
• To communicate regarding projects, support, invoices, or legal obligations;
• To send technical or marketing updates where lawful consent has been granted;
• To detect, prevent, and investigate fraud or security incidents.

4. Log Files and Cookies

Our hosting provider automatically logs visitors' IP addresses, browser types, Internet Service Provider, timestamps, referring/exit pages, and click counts. These data are processed on the basis of legitimate interest (Art. 6 para. 1 (f) GDPR) for system security and analytics, and are not linked to personally identifiable information.

This website may use strictly necessary and analytical cookies. You may disable cookies in your browser settings at any time. More information on cookie control is available on your browser's help page or at youronlinechoices.eu.

5. Third-Party Services and Advertising

KAPO GROUP s.r.o. may integrate third-party analytics or marketing tools (e.g., Google Analytics, Meta Pixel) that use cookies or similar technologies to measure performance and audience reach. These providers process data under their own privacy policies and are contractually bound by EU Standard Contractual Clauses where applicable. We do not sell, lease, or otherwise disclose your data to advertisers.

6. Data Retention

Personal data are retained only as long as necessary for the purposes described or as required by accounting, tax, or legal obligations. Order, invoice and payment records are kept for the statutory accounting retention period under Slovak law; account data are kept while your account exists and are deleted or anonymised afterwards, unless a longer retention period is required by law.

7. Security of Data, Encryption and Card Payments

We implement appropriate technical and organizational measures under Article 32 GDPR to protect personal data against unauthorized access, alteration, disclosure or loss:

• Encryption in transit – the entire website, including the account area and checkout, is served exclusively over HTTPS using SSL/TLS encryption (TLS 1.2 or higher). Data submitted through forms, logins and payment steps are never transmitted over an unencrypted connection, and HTTP requests are redirected to HTTPS;
• Card data – card payments are processed on the secure payment page of our licensed payment service provider. Card details are encrypted and transmitted directly to that provider, which processes them under the security requirements of the Payment Card Industry Data Security Standard (PCI DSS) applicable to it. KAPO GROUP does not receive, process or store your full card number, expiry date or security code (CVV/CVC) on its own systems, and no such data are present in our database;
• Payment records we do hold – amount, currency, payment method, status, timestamps and the provider's transaction identifiers, which are needed to match a payment to an order, issue the invoice and process refunds;
• Encryption at rest and access control – account passwords are stored only as salted one-way hashes (bcrypt) and are never recoverable in plain text; databases and file storage run on access-controlled infrastructure with encrypted connections, and access is limited to authorised staff on a need-to-know basis;
• Authentication – access to the client portal and the administration area is protected by individual credentials and short-lived access tokens;
• Organizational measures – confidentiality obligations for staff, logging of administrative access, and review of security measures on an ongoing basis.

No method of transmission or storage is absolutely secure; however, in the event of a personal data breach likely to result in a risk to your rights, we notify the Office for Personal Data Protection of the Slovak Republic and, where required, affected individuals, in accordance with Articles 33 and 34 GDPR.

Further information on payment security, accepted methods and refunds is available in our Payment Policy.

8. GDPR Data Protection Rights

Under Articles 12–23 GDPR, you have the following rights regarding your personal data:

• Access right – to obtain confirmation and a copy of data we hold about you;
• Rectification right – to request correction of inaccurate or incomplete data;
• Erasure right – to request deletion where no lawful basis for processing exists;
• Restriction right – to limit processing under certain conditions;
• Objection right – to object to processing based on legitimate interests or direct marketing;
• Portability right – to receive your data in a structured, machine-readable format and transmit it to another controller.

To exercise any of these rights, email [email protected]. We will respond within one month, as required by Article 12 GDPR.

9. Children's Privacy

Our website and services are intended for individuals aged 16 and over. We do not knowingly collect personal data from children under 16 years, in compliance with Article 8 GDPR. If you believe that a minor has provided us with personal data, please contact us immediately so we can delete the information.

10. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in legislation, technology, or our practices. The revised version will be posted on this page with the updated "Effective date."

11. Contact Information

Effective date: 12 October 2026 (version 2.0) | Compliant with Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC (ePrivacy), and Slovak Act No. 18/2018 Coll. on Personal Data Protection.