Privacy Policy

1. Controller

The controller of your personal data is Sapfir Research & Development s. r. o., registered office at Záhradná 953/19, 900 24 Veľký Biel, Slovak Republic, Company ID (IČO): 56 275 188, Tax ID (DIČ): 2122265519, registered in the Commercial Register of the Bratislava III Municipal Court, section Sro, file no. 178856/B, which operates the noclue brand ("we"). Contact: [email protected], +421 915 565 511.

We have not appointed a Data Protection Officer, as the law does not require us to. Please send any questions or requests to the email above.

2. Purposes, legal bases and retention

• Replying to an enquiry sent through the contact form or by email — name, email, optionally company name, the project type and budget you select, and your message. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and, where you write on behalf of a business, our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR). Kept for 12 months after our last exchange if no engagement follows.
• Protecting the form against spam and abuse (Cloudflare Turnstile) — IP address and technical browser and device signals. Legal basis: our legitimate interest in the security of the website and protection against automated abuse (Art. 6(1)(f) GDPR). Used for verification only.
• Concluding and performing a contract and communicating during a project — identification and contact details of the client and its contact persons, project correspondence and materials. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for a client's contact persons, our legitimate interest in communicating with our contracting party (Art. 6(1)(f) GDPR). Kept for the duration of the engagement and then until limitation periods expire (generally 4 years under the Slovak Commercial Code).
• Accounting and tax — data on invoices and accounting records. Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR together with Slovak Act No. 431/2002 Coll. on accounting). Kept for 10 years following the year they relate to.
• Establishing, exercising or defending legal claims — data needed to resolve a dispute. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Kept for the duration of the dispute and the limitation period.
• Traffic statistics (Google Analytics 4) and ad measurement (Meta Pixel) — device and browser data, pages visited, approximate location derived from the IP address, and identifiers stored in cookies. Legal basis: your consent (Art. 6(1)(a) GDPR and Section 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications). Cookie lifetimes are listed in section 7.

Providing your data is voluntary. Without contact details, however, we cannot reply to you, and without the data needed for a contract and invoicing we cannot conclude or perform it.

We obtain data directly from you. The details of a client's contact persons may also come from the client they represent.

3. Recipients

We do not sell personal data. We share it only as far as necessary with the following recipients, who act as our processors under an agreement pursuant to Art. 28 GDPR, or as independent controllers:

• our website hosting and infrastructure provider,
• Resend, Inc. (USA) — delivering contact form messages to our mailboxes,
• our email mailbox provider,
• Cloudflare, Inc. (USA) — protecting the form with Turnstile,
• Google Ireland Limited — Google Analytics 4, only with your consent,
• Meta Platforms Ireland Limited — Meta Pixel, only with your consent; for the collection of data on our website and its transmission to Meta we are joint controllers with Meta (Art. 26 GDPR), and Meta carries out any further processing as an independent controller,
• accounting, tax and legal advisers bound by confidentiality,
• public authorities where the law requires it.

4. Transfers outside the EU

Some of the providers above may process data in the United States. Such transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR). We will provide information about these safeguards on request.

5. Your rights

• the right of access to your personal data (Art. 15 GDPR),
• the right to rectification (Art. 16 GDPR),
• the right to erasure (Art. 17 GDPR),
• the right to restriction of processing (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR),
• the right to object to processing based on legitimate interest (Art. 21 GDPR),
• the right to withdraw consent at any time, for example through "Cookie settings" in the footer; withdrawal does not affect the lawfulness of processing before it (Art. 7(3) GDPR),
• the right to lodge a complaint with the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk.

We handle requests free of charge and without undue delay, at the latest within one month; where justified we may extend this by two further months and will tell you so.

6. Automated decision-making

We do not make automated individual decisions or carry out profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

7. Cookies and similar technologies

No analytics or marketing tool loads until you consent. You can change your choice or withdraw consent at any time through "Cookie settings" in the footer. The website stores:

• noclue-consent (browser storage, necessary) — remembers your cookie choice; we ask again after 12 months,
• noclue-warp (session storage, necessary for the feature) — carries the name of the destination page for the animated transition between pages; it holds no identifier and is deleted as soon as the next page loads,
• Cloudflare Turnstile (necessary for form security) — checks that the contact form is not sent by a bot,
• Google Analytics 4 (analytics, consent only) — cookies _ga and _ga_*, kept for up to 2 years,
• Meta Pixel (marketing, consent only) — cookies _fbp and fr, kept for up to 90 days.

8. Security

We apply technical and organisational measures appropriate to the data we process, in particular access control, encrypted connections and backups, and secure development practices. We recommend using secure channels when sharing sensitive information.

9. Changes to this policy

We update this policy when our processing or the law changes. The current version is always on this page; the "Effective date" shows the latest revision.

10. Contact

Send questions or requests to [email protected] or to Sapfir Research & Development s. r. o., Záhradná 953/19, 900 24 Veľký Biel, Slovakia.