Privacy Policy (GDPR)

Mgr. art. Peter Pavel Vavřík Studio

Last updated: 3. júl 2026

1. Introduction

The protection of personal data is an important part of how we provide our services. When processing personal data, we comply with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 18/2018 Coll. on the Protection of Personal Data, as amended.

This Privacy Policy (hereinafter referred to as “Policy”) explains what personal data we process, for what purposes, on what legal basis, how long we retain it, to whom we may disclose it, and what rights you have as a data subject.

This Policy applies to all individuals who visit the website https://vavrikstudio.com, contact us via email, phone, or other communication channels, use our services, or enter into a business relationship with us.

2. Data Controller

The controller of personal data is:

Mgr. art. Peter Pavel Vavřík Studio

represented by:

Mgr. art. Peter Pavel Vavřík

Company ID: 57608890

Tax ID: 1131120452

Is not a VAT payer.

Registered for VAT pursuant to Section 7a of Act No. 222/2004 Z. z.

Registered in the Trade Register of the Poprad District Office,
, registration number: 740-46804

E-mail:

info@vavrikstudio.com

Phone:

+421 949 711 516

Website:

Vavřík Studio

(hereinafter referred to as “Operator”)

3. Scope of Application

This Policy applies to the processing of personal data:

  • website visitors,
  • people interested in our services,
  • clients,
  • business partners,
  • suppliers,
  • people who communicate with us via email, phone, or social media,
  • persons whose information is listed in accounting or contractual documents.

Our services are primarily intended for businesses (B2B) and adults (B2C). We deliberately do not provide services to individuals under the age of 18.

4. Basic Principles of Personal Data Processing

When processing personal data, we adhere to the following principles in particular:

Legality

We process personal data only if there is a legal basis for doing so under Article 6 of the GDPR or another applicable legal provision.

Fairness and Transparency

We clearly inform data subjects about what data we process, for what purpose, how long we retain it, and what rights they have.

Data Minimization

We process only those personal data that are appropriate, relevant, and necessary to achieve a specific purpose of processing.

Data Accuracy

We take reasonable measures to ensure that personal data is up-to-date and accurate. If we determine that certain data is no longer correct or necessary, we will correct or delete it.

Retention Limits

We retain personal data only for as long as is necessary to fulfill the purpose for which it was collected, or for as long as required by applicable laws.

Integrity and Confidentiality

We use appropriate technical and organizational measures to protect personal data from unauthorized access, loss, destruction, alteration, or misuse.

Responsibility

We are able to demonstrate that our processing of personal data complies with the requirements of the GDPR and other applicable laws.

5. What Personal Data Do We Process?

The scope of the data processed depends on the specific purpose of the processing.

In particular, we may process the following categories of personal data:

Identification Information

  • name,
  • last name,
  • business name,
  • company name,
  • Company ID,
  • Tax ID,
  • VAT identification number pursuant to Section 7a or other tax identification information.

Contact Information

  • email address,
  • phone number,
  • mailing or billing address,
  • registered office or place of business.

Contract and Billing Information

  • the information provided on the orders,
  • the information provided in the price quotes,
  • the information listed on the invoices,
  • data necessary to fulfill contractual obligations,
  • data derived from business communications.

Contact Information

If you contact us via email, phone, or social media, we may process the content of that communication, including the information necessary to handle your request.

Technical Specifications

When you visit the website, depending on the consent you have provided and your device settings, technical data may also be processed, such as:

  • IP address,
  • device type,
  • web browser type and version,
  • operating system,
  • browser language,
  • approximate geographic location derived from the IP address,
  • date and time of the visit,
  • pages visited,
  • source of the visit,
  • anonymized analytical data collected through Google tools.

6. From what sources do we collect personal data?

We collect personal data primarily directly from you, especially when:

  • contact us by email,
  • you call us,
  • you communicate with us via WhatsApp, LinkedIn, Instagram, or other communication channels,
  • you ask us for a quote,
  • you enter into a contract with us,
  • you will provide us with the information needed to issue an invoice,
  • by visiting our website.

In justified cases, we may also process data obtained from publicly available registers or publicly available sources if this is necessary to establish or carry out a business relationship in accordance with applicable laws.

7. Purposes of Personal Data Processing and Legal Bases

We process personal data only to the extent necessary to fulfill specific and lawful purposes. Each processing activity is based on one or more legal grounds under Article 6 of the GDPR.

7.1 Provision of Services and Fulfillment of Contractual Obligations

If you contact us to express interest in our services or enter into a contractual relationship with us, we process your personal data for the following purposes:

  • preparation of a price quote,
  • communications prior to the conclusion of the contract,
  • the conclusion of a contractual relationship,
  • the provision of the services ordered,
  • ongoing communication during the project's implementation,
  • submission of the results of the work,
  • processing changes, complaints, or other requests related to the services provided.

Legal basis:

  • Article 6(1)(b) of the GDPR—performance of a contract or the implementation of measures prior to entering into a contract.

7.2 Issuing Accounting and Tax Documents

Once a business relationship has been established, we are required to process the personal data necessary for:

  • issuing invoices,
  • bookkeeping,
  • compliance with tax obligations,
  • archiving of accounting documents,
  • fulfilling obligations under specific legal regulations.

These may include, in particular:

  • first and last name,
  • business name,
  • address or registered office,
  • Company ID,
  • Tax ID,
  • VAT identification number,
  • the contact information listed on the invoice.

Legal basis:

  • Article 6(1)(c) of the GDPR – compliance with a legal obligation.

7.3 Communication with Prospects and Clients

If you contact us via:

  • email,
  • phone,
  • WhatsApp,
  • LinkedIn,
  • Instagram,
  • SMS,
  • Messenger,
  • Facebook,

We process the data necessary to handle your question or request.

These may include, for example:

  • name,
  • e-mail,
  • phone,
  • the content of the communication,
  • any attachments.

Legal basis:

  • Article 6(1)(b) of the GDPR (pre-contractual negotiations or performance of a contract),

or

  • Article 6(1)(f) of the GDPR—legitimate interest in ensuring effective communication.

7.4 Conducting Business Communications with Other Businesses (B2B)

As part of our business activities, we may contact entrepreneurs or companies to offer our services.

Such communication is intended exclusively for business entities and is conducted in a manner appropriate to the purpose of the business collaboration.

In this process, we can primarily use:

  • publicly available contact information for companies,
  • contact information published on the company's website,
  • contact information from business registries or professional profiles.

We do not use automated distribution of newsletters or marketing emails based on the consent of the individuals concerned.

Legal basis:

  • Article 6(1)(f) of the GDPR—legitimate interest in establishing business relationships.

Any data subject may object to such processing; in that case, we will cease processing their data for this purpose.

7.5 Website Operation

When you visit the website, technical data necessary to ensure its proper functioning, security, and stability may be processed.

This information may include:

  • IP address,
  • device type,
  • operating system,
  • browser type,
  • date and time of the visit,
  • system logs,
  • technical information necessary to protect the website.

Legal basis:

  • Article 6(1)(f) of the GDPR—legitimate interest in ensuring the security and functionality of the website.

7.6 Analytical Data

Once the appropriate consent has been granted, we may process data using analytical tools for the following purposes:

  • analyze website traffic,
  • improve user comfort,
  • optimize content,
  • evaluate the performance of individual pages.

For this purpose, we primarily use:

  • Google Analytics 4,
  • Google Tag Manager,
  • Google Search Console.

These tools can process, in particular:

  • anonymized or pseudonymized identifiers,
  • technical specifications of the device,
  • website visit data,
  • data on user behavior on the website.

Google Tag Manager does not process personal data for analytical purposes or set cookies on its own, but is used to manage tags and scripts.

We use Google Search Console to monitor the technical health of our website, its indexing, and its performance in search results.

Legal basis:

  • Article 6(1)(a) of the GDPR—consent of the data subject.

If you do not give your consent or later revoke it, analytical cookies and the related processing of personal data will not be carried out to the extent that consent is required for them.

7.7 Protection of Rights and Legal Claims

In certain cases, we may also process personal data for the following purposes:

  • dispute resolution,
  • evidence of concluded agreements,
  • the assertion or defense of legal claims,
  • property protection,
  • to prevent fraud or misuse of services.

Legal basis:

  • Article 6(1)(f) of the GDPR—legitimate interest in protecting our rights and legitimate interests.

8. Retention Period for Personal Data

We retain personal data only for as long as is necessary to fulfill the purpose of its processing or for the period specified by applicable laws.

Once this period has expired, we will securely delete, anonymize, or otherwise dispose of the data, unless further retention is required by law or necessary to protect our legal claims.

Provision of Services

For the duration of the contractual relationship and thereafter for the period necessary to protect the rights and legitimate interests arising from the contractual relationship.

Accounting and Tax Documents

For the period required by the laws of the Slovak Republic, in particular the Accounting Act and related tax regulations.

Business Communication

While processing your request and, thereafter, only for a period appropriate to the nature of the communication or until the business relationship ends.

Analytical Data

For the period specified in the settings of the relevant analytical tools or until the consent is revoked, whichever occurs first.

Legal Claims

For the period necessary to assert, establish, or defend legal claims.

9. Deletion of Personal Data

If you ask us to delete your personal data, we will review your request without undue delay.

If there is no legal basis for further processing, we will delete or anonymize your personal data.

However, we cannot delete certain data immediately if we are required by law to retain it or if it is necessary to protect our legitimate interests, particularly to demonstrate compliance with contractual or legal obligations.

10. Recipients of Personal Data

We disclose your personal data only to the extent necessary to fulfill the purpose of its processing and exclusively to persons or entities that are authorized to process the data under applicable law or a contractual relationship with the Controller.

We do not sell personal data to third parties or make it available for commercial use.

Depending on the nature of the services provided, personal data may be disclosed primarily to the following categories of recipients:

  • an IT service provider,
  • web hosting service providers,
  • cloud solution providers,
  • providers of accounting and billing systems,
  • providers of analytical services,
  • to a public authority, if we are required to do so by law,
  • a professional advisor or legal service provider, if necessary to protect our rights or comply with legal obligations.

Each recipient is authorized to process personal data only to the extent necessary to fulfill its legal or contractual obligations.

11. Service Providers Used by the Operator

In providing our services, we use the services of several external providers who, depending on the nature of the service, may process personal data either as data processors or as independent data controllers in accordance with their own terms and conditions for the processing of personal data.

We currently use the following services in particular:

11.1 Google Workspace

To facilitate daily communication and work organization, we use Google Workspace services, which may include, in particular:

  • Gmail,
  • Google Drive,
  • Google Docs,
  • Google Sheets,
  • Google Calendar,
  • Google Appointments.

We use these services primarily for:

  • communication with clients,
  • documentation management,
  • sharing work files,
  • scheduling meetings,
  • project organization.

When using these services, Google may process personal data to the extent necessary to provide the individual services.

11.2 Google Analytics 4

Based on the consent you have provided, we may use Google Analytics 4 to measure website traffic and analyze its usage.

Google Analytics 4 helps us, in particular, to:

  • understand how to use the website,
  • identify technical problems,
  • improve the user experience,
  • Optimize the website's content.

The data processed through this service may include, in particular:

  • IP address (within the scope of processing as defined by the service settings),
  • device identifiers,
  • browser information,
  • operating system information,
  • approximate geographic location,
  • data on visitor behavior on the website.

The specific scope of the data processed depends on the current settings of Google Analytics 4.

11.3 Google Tag Manager

We use Google Tag Manager to manage analytical and technical tags.

Google Tag Manager itself is not used for data analysis and does not store cookies. It is a tool that allows you to manage the scripts used on a website.

Processing of personal data through individual tags depends on the specific services implemented via Google Tag Manager.

11.4 Google Search Console

We use Google Search Console to monitor the technical performance of our website, its indexing status, and its performance in search engine results.

This service is primarily used to:

  • manage website indexing,
  • monitor website performance,
  • identify technical issues,
  • improve content accessibility.

Google Search Console is not intended for marketing profiling of website visitors.

11.5 Websupport

We use the hosting services provided by Websupport to ensure the operation of our website.

The hosting service is primarily used to provide:

  • website hosting,
  • server operation,
  • security measures,
  • system logs,
  • backup services,

The scope of personal data processing depends on the nature of the hosting services provided.

11.6 SuperFaktúra

We use the SuperFaktúra invoicing system to issue invoices.

Prostredníctvom tejto služby môžu byť spracúvané údaje potrebné na:

  • issuing invoices,
  • record business transactions,
  • manage accounting documents,
  • comply with legal obligations arising from accounting and tax regulations.

11.7 KROS Alfa

We use KROS Alfa accounting software for bookkeeping.

As part of this service, personal data necessary for bookkeeping, tax record-keeping, and compliance with the Controller's legal obligations may be processed.

12. International Transfer of Personal Data

Some of the services we use in providing our services may involve the transfer of personal data outside the European Economic Area (EEA).

Such transfers may occur, in particular, when using services provided by Google or other international cloud service providers.

Where personal data is transferred to third countries, we ensure that such transfers are carried out in accordance with the requirements of the GDPR.

Personal data transfers may be based, in particular, on:

  • an adequacy decision issued by the European Commission,
  • Standard Contractual Clauses adopted by the European Commission,
  • or another transfer mechanism recognised under the GDPR.

When using services provided by Google, personal data may be processed in countries outside the EEA. Google states that it applies appropriate safeguards in accordance with applicable laws and the terms governing its services.

13. Security of Personal Data Processing

We pay appropriate attention to the protection of personal data and implement technical and organisational measures appropriate to the nature, scope, and purpose of the processing.

These measures include, in particular:

  • the use of secure communication channels,
  • the protection of access credentials,
  • restricting access to personal data to authorised persons only,
  • regular updates of the software we use,
  • the use of trusted IT service providers,
  • appropriate data backup procedures,
  • the protection of devices against unauthorised access.

Despite the measures we have implemented, it is not possible to guarantee the absolute security of data transmitted over the internet. If a security incident is identified, we will act in accordance with the requirements of the GDPR and take appropriate measures to minimise its impact.

14. Data Subject Rights

If we process your personal data, you have the rights granted to you as a data subject under the GDPR and the applicable laws of the Slovak Republic.

You may exercise your rights at any time by contacting us via email at [info@vavrikstudio.com](mailto:info@vavrikstudio.com) or in writing at the Controller's registered office.

We assess each request individually and respond without undue delay, and in any event within the time limits prescribed by the GDPR.

14.1 Right of Access to Personal Data

You have the right to obtain confirmation as to whether we process your personal data.

If we process your personal data, you have the right to obtain, in particular, information about:

  • the purposes of the processing,
  • the categories of personal data being processed,
  • the recipients or categories of recipients,
  • the envisaged retention period,
  • the source of the data (where it was not obtained directly from you),
  • the existence of automated decision-making,
  • your rights under the GDPR.

Upon request, we will also provide you with a copy of the personal data being processed, provided that doing so does not adversely affect the rights and freedoms of others.

14.2 Right to Rectification

If your personal data is inaccurate, incomplete, or outdated, you have the right to request that it be corrected or completed.

We strive to ensure that all personal data we process is accurate and up to date.

14.3 Right to Erasure ("Right to Be Forgotten")

Under the conditions set out in the GDPR, you have the right to request the erasure of your personal data.

We will comply with your request, in particular, where:

  • the personal data is no longer necessary for the purposes for which it was collected,
  • you withdraw your consent and there is no other legal basis for the processing,
  • you successfully object to the processing,
  • the personal data has been processed unlawfully,
  • their erasure is required by law.

However, this right is not absolute.

We may not be able to erase your personal data where we are required to retain it under applicable law or where it is necessary for the establishment, exercise, or defence of legal claims.

14.4 Right to Restriction of Processing

In the cases provided for by law, you may request the restriction of the processing of your personal data.

During the period of restriction, we may process your personal data only in the exceptional circumstances permitted under the GDPR.

14.5 Right to Data Portability

Where we process your personal data by automated means based on your consent or the performance of a contract, you have the right to receive your personal data in a commonly used, machine-readable format or to request that it be transmitted to another controller, where technically feasible.

14.6 Right to Object to Processing

Where we process your personal data on the basis of our legitimate interests, you have the right to object to such processing at any time.

Upon receiving your objection, we will assess whether there are compelling legitimate grounds for continuing the processing that override your rights and freedoms.

If no such grounds exist, we will cease processing your personal data.

14.7 Right to Withdraw Consent

If the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time.

The withdrawal of your consent does not affect the lawfulness of processing carried out before its withdrawal.

14.8 Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR or applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority.

In the Slovak Republic, the competent supervisory authority is the Office for Personal Data Protection of the Slovak Republic.

You are not required to contact the Controller before lodging a complaint. However, we would appreciate the opportunity to address your concerns first and resolve the matter directly.

15. Automated Decision-Making and Profiling

Pri poskytovaní našich služieb nevykonávame automatizované rozhodovanie ani profilovanie, ktoré by malo právne účinky alebo obdobne významne ovplyvňovalo dotknuté osoby podľa článku 22 GDPR.

Data collected through analytical tools is used solely for statistical, technical, or analytical purposes to improve the quality of our website and the services we provide.

16. Communication via Electronic Communication Channels

If you contact us via:

  • email,
  • phone,
  • SMS,
  • WhatsApp,
  • LinkedIn,
  • Instagram,
  • Messenger,

we process only the personal data necessary to handle your request or to conduct business communications.

We recommend that you do not send us sensitive personal data through these communication channels unless it is strictly necessary.

Communication through social media platforms and messaging services is also governed by the terms and privacy policies of the respective service providers.

17. Links to Third-Party Websites

Our website may contain links to third-party websites or services.

Once you leave our website and access a third-party website, we no longer have control over how your personal data is processed or over the content of that website.

We therefore recommend that you review the privacy policy of the relevant website operator.

18. Cookies

Our website uses cookies and similar technologies to ensure its proper functioning, analyse website traffic, and improve the user experience.

Detailed information about the cookies we use, their purposes, retention periods, and the options available for managing your consent can be found in our separate Cookie Policy.

We use analytics or marketing cookies only where permitted under applicable law and, where required, only after obtaining the user's consent.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, in particular due to:

  • changes in applicable laws,
  • changes to our services,
  • the introduction of new technologies,
  • changes to the service providers we use,
  • changes to our security measures.

The current version of this Privacy Policy will always be published on our website together with the date of its last update.

We recommend that you review this Privacy Policy regularly to stay informed of any updates.

20. Contact Information

If you have any questions regarding the protection of your personal data or wish to exercise your rights under the GDPR, you may contact us:

Mgr. art. Peter Pavel Vavřík Studio

Represented by:

Mgr. art. Peter Pavel Vavřík

📧 info@vavrikstudio.com

📞 +421 949 711 516

🌐 https://vavrikstudio.com

21. Data Minimisation

When processing personal data, we apply the principle of data minimisation in accordance with Article 5(1)(c) of the GDPR. We process only personal data that is adequate, relevant, and limited to what is necessary for the specific purpose of the processing.

Before collecting or processing personal data, we assess whether the scope of the data is proportionate and whether the intended purpose can be achieved by processing a smaller amount of data or data in a less identifiable form.

We do not request or knowingly process special categories of personal data under Article 9 of the GDPR (such as data concerning health, racial or ethnic origin, religious beliefs, or biometric data), unless this is necessary to comply with a legal obligation or such data is voluntarily provided to us by the data subject.

22. Accuracy and Currency of Personal Data

We take appropriate measures to ensure that the personal data we process is accurate, complete, and kept up to date where necessary.

If we determine that any personal data is inaccurate, incomplete, or no longer necessary for the purpose for which it was collected, we will, without undue delay, correct, complete, anonymise, or erase it, unless its continued retention is required by law.

We kindly ask data subjects to inform us without undue delay of any changes to their personal data that may affect the provision of our services or our compliance with legal obligations.

23. Confidentiality and Protection of Personal Data

We process personal data with due regard to its confidentiality, integrity, and availability.

Access to personal data is granted only to individuals who require it to perform their work or contractual duties and who are bound by confidentiality obligations or appropriate contractual obligations to maintain the confidentiality of the personal data they process.

When processing personal data, we implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, alteration, or any other form of unlawful processing.

We regularly review our security measures and, where necessary, adapt them to reflect the current state of technology, the scope of processing, and the potential risks.

24. Protection of Minors' Personal Data

Our services are intended primarily for business customers (B2B) and adult individuals (B2C).

We do not knowingly offer our services to individuals under the age of 18 or intentionally collect personal data from them.

If we become aware that we have collected the personal data of a minor without the knowledge of their legal guardian in violation of applicable law, we will take appropriate steps to promptly erase or anonymise such data, unless its continued processing is required by law.

If you believe that a minor has provided us with their personal data, please contact us using the contact details provided in this Privacy Policy.

25. Validity and Effectiveness of this Privacy Policy

This Privacy Policy becomes valid and effective on 3 July 2026.

The Controller reserves the right to update or amend this Privacy Policy at any time, in particular to reflect changes in applicable laws, the services provided, or the manner in which personal data is processed.

The current version of this Privacy Policy will always be published on the Controller's website.

If any material changes are made that may significantly affect the way personal data is processed or the rights of data subjects, we will provide appropriate notice to the affected individuals to the extent required by applicable law.

26. Revision History

VersionDateDescription of Changes
1.103.07.2026Second edition of the document.