1. Who we are
The controller of personal data within the meaning of Article 4(7) GDPR is Vassweb s. r. o.
Registered office: Školská 981/36, 931 01 Šamorín, Slovakia
Company ID (IČO): 56 921 021 · Tax ID (DIČ): 2122501524 · VAT ID (IČ DPH): SK2122501524
Registration: Commercial Register of the District Court Trnava, Section Sro, Insert No. 59422/T
Managing director: Richard Vass
E-mail: vass@vassweb.com · Phone: +421 918 668 728
This document describes what actually happens to your data on this website — based on how the website is genuinely built. We do not mention tools we do not use.
2. Summary in three sentences
Without your consent, nobody tracks you — no analytics and no advertising pixel run on this website.
We only receive data from you when you write to us yourself — via the contact form or via the chatbot.
We do not store your messages in any database. They reach us by e-mail and are handled there like ordinary mail.
3. What data we process
a) Contact form
We collect your name, e-mail or phone number and the text of your message — exactly what you type into the form. The message reaches us by e-mail. We do not store it in a database or in a CRM system.
Purpose: to answer your enquiry. Nothing else.
Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) in conjunction with point (f) (our legitimate interest in replying).
b) Chatbot on the website
The chatbot answers questions about our services. It works in two modes:
Rule-based mode — answers are assembled from pre-prepared texts directly on our server. Nothing is sent anywhere.
AI mode (if enabled) — the text of your message is sent for processing to Anthropic PBC (USA) and an answer is returned. The transfer to the USA is covered by Standard Contractual Clauses (SCC). According to its public commitments, Anthropic does not store the content permanently and does not use it to train models.
Where the conversation history lives: in your browser (sessionStorage), so that your chat is not lost when you move to another page. It disappears when you close the tab. We do not store it.
If you leave your contact details: your name and e-mail/phone reach us by e-mail together with a transcript of the conversation — the same as from the form. They do not go into any database.
Protection against misuse: the server temporarily remembers your IP address so that it can limit the number of messages (12 per conversation, 20 per IP per 10 minutes, 60 per day). This record lives only in the server's memory, is not stored anywhere and expires by itself after a while.
Legal basis: Article 6(1)(b) GDPR (provision of the service you requested) and point (f) (legitimate interest in protecting the service against misuse).
c) Technical server logs
Our hosting provider (Vercel Inc.) automatically records common technical access data — IP address, browser type and time. These serve the operation and security of the website; we do not build any analytics or profiles from them.
DNS queries (including the IP address) are processed by our DNS provider Cloudflare, Inc.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in the functioning and security of the site).
d) Analytics and advertising — only with your consent
Today no analytics and no advertising pixel run on this website. We plan to deploy Google Analytics 4 (analytics) and, to measure advertising effectiveness, Google Ads and the Meta Pixel — remarketing on Facebook and Instagram (marketing).
We deploy these tools exclusively with your consent. If you do not give consent, they are not loaded — their scripts are not inserted into the page at all. They are switched off by default.
Legal basis: Article 6(1)(a) GDPR (your consent), which you can withdraw at any time.
4. Who receives the data
We do not sell your data and do not provide it to anyone for marketing. Only the following providers are involved (processors under Article 28 GDPR):
Vercel Inc. (USA, SCC) — website hosting and technical logs.
Resend Inc. (USA, SCC) — delivery of your message to us by e-mail. We do not use it for a newsletter or for bulk mailing.
Anthropic PBC (USA, SCC) — processing of the message text in the chatbot's AI mode (if enabled).
Cloudflare, Inc. (USA, SCC) — DNS.
Google Ireland Limited — analytics and advertising measurement. Only after deployment and only with your consent.
Meta Platforms Ireland Ltd. — remarketing on Facebook and Instagram. Only after deployment and only with your consent.
5. How long we keep the data
Messages from the form and the chatbot: they live as e-mail in our mailbox. We keep them for as long as is necessary to handle the enquiry and for any further communication, for a maximum of 12 months from the last interaction. On request we will delete them sooner.
Chat history: not stored by us at all — it lives only in your browser and disappears when you close the tab.
Technical server logs: according to the standard retention periods of the hosting provider, typically in the order of days.
Accounting and tax documents: 10 years under Act No. 431/2002 Coll. on Accounting.
Your cookie consent: your choice is stored in your browser for 6 months, after which we ask again.
6. Your rights
Access — you have the right to know what data we process about you.
Rectification — you may request correction of inaccurate data.
Erasure — you may request deletion of your data.
Restriction of processing and portability — under Articles 18 and 20 GDPR.
Object — under Article 21 GDPR, against processing based on legitimate interest.
Withdraw consent — you can withdraw consent to analytics or marketing tools at any time via the "Cookie settings" button in the footer of this page.
Complaint — to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR, the Slovak data protection authority — dataprotection.gov.sk).
For any of these, simply write to vass@vassweb.com.
7. Cookies
Details are set out in the separate cookie policy. In short: without consent we use only what is strictly necessary for the website to work.
8. Our products and services for clients
This policy covers this website. When we build a system for a client (for example a chatbot, an automation or an application), we process data on the basis of a contract with the client (Article 6(1)(b) GDPR) and the terms form part of a separate data processing agreement (DPA) which we sign before launch. Data from the client's systems goes into the client's systems, not to us.
9. Changes
If what the website does changes, we will change this document too — and update the date at the top.
← Back to the home page