Privacy Policy

This document describes how Spotlight s. r. o. processes personal data in compliance with Regulation (EU) 2016/679 (the „GDPR") and Slovak Act No. 18/2018 on Personal Data Protection.

1. Data controller

Spotlight s. r. o.
Registered office: Bratislava, Slovak Republic
Company ID: 00 000 000
E-mail: hello@spotlight.sk

2. Data we process

We only process data you voluntarily provide via the contact form or e-mail:

• Full name
• E-mail address
• Phone number (if provided)
• Company name (if provided)
• Message content / project description
• Technical data (IP address, browser type) — automatically via analytics

3. Purpose of processing

• Communication — responding to your inquiry, preparing a quote, business correspondence.
• Contract performance — if a contractual relationship is formed, data is needed for performance and legal duties (invoicing, archiving).
• Analytics — anonymized website traffic statistics (Google Analytics 4 with IP anonymization).
• Marketing — only with consent, via newsletter.

4. Legal basis

• Art. 6(1)(a) GDPR — your consent (form, newsletter, marketing cookies).
• Art. 6(1)(b) GDPR — contract performance or pre-contractual measures.
• Art. 6(1)(c) GDPR — legal obligations (accounting).
• Art. 6(1)(f) GDPR — legitimate interest (website security and operation).

5. Retention period

• Inquiries without a follow-up contract: 12 months from last contact.
• Contract data: 10 years (Slovak Accounting Act).
• Marketing data: until consent is withdrawn.
• Cookies: by type, max. 24 months.

6. Recipients

Your data may be shared with the following processors:

• Hosting providers (Cloudflare, Vercel) — website and log storage.
• E-mail services (Google Workspace, Resend) — communication.
• Accountant / tax advisor — invoicing.
• Analytics tools (Google Analytics 4 — anonymized).

Some processors may transfer data to third countries (USA), based on EU-approved Standard Contractual Clauses.

7. Your rights

As a data subject you have the right to:

• Access your data (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16)
• Erasure / „right to be forgotten" (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent (Art. 7(3))
• Lodge a complaint with the Slovak Data Protection Authority

Exercise any of these rights by e-mail to hello@spotlight.sk. We respond within 30 days.

8. Security

We protect data with technical and organizational measures: HTTPS encryption, access controls, regular backups, two-factor authentication on internal systems.

9. Changes

We may update this policy. We will notify you of material changes by e-mail or via a notice on the website.

10. Contact

Questions about data protection: hello@spotlight.sk