1. Who we are
The controller of personal data within the meaning of Article 4(7) GDPR is Vassweb s. r. o.
Registered office: Školská 981/36, 931 01 Šamorín, Slovakia
Company ID (IČO): 56 921 021 · Tax ID (DIČ): 2122501524 · VAT ID (IČ DPH): SK2122501524
Registration: Commercial Register of the District Court Trnava, Section Sro, Insert No. 59422/T
Managing director: Richard Vass
Email: vass@vassweb.com · Phone: +421 918 668 728
This document describes what actually happens to your data on this website — based on how the website is genuinely built. We do not mention tools we do not use.
2. Summary in three sentences
We measure visits only with your consent — Google Analytics 4 statistics start only once you allow them in the cookie bar (Analytics category); without consent they are not loaded. No advertising pixel runs on this website.
We only receive data from you when you write to us yourself — via the contact form, the free website review form, the e-invoicing connection interest form, the voice recordings order form, the accommodation register interest form or the chatbot. The exception is the emails we sent to businesses ourselves until 15 October 2026, to a contact they had published on their own website (section 3 g).
We do not store your messages in any database. They reach us by email and are handled there like ordinary mail.
3. What data we process
a) Contact form
We collect your name, email or phone number and the text of your message — exactly what you type into the form. The message reaches us by email. We do not store it in a database or in a CRM system. If you leave us your email, we send you an automatic confirmation that your message arrived — a fixed text without the content of your message. We reply to you personally. If you reached the page with the form via a link carrying a campaign tag (for example from a Google ad), we also record these details from the page address in the email with your enquiry: source, medium, campaign, keyword and the Google click ID (utm_source, utm_medium, utm_campaign, utm_term, gclid) — so that we know where the enquiry came from and whether the advertising works; this also applies to the forms in points b) and c) and to the accommodation register interest form below, and nothing is stored in your browser for this.
Protection against bots: the form has a hidden field and a timing check that catch automated submissions, and it accepts at most 3 messages per 10 minutes and 5 per day from one IP address. For this, the IP address is kept only in a temporary counter that expires by itself within 48 hours at the latest (Upstash, see section 4). So that the same message does not arrive twice, we keep its fingerprint (hash) for 24 hours — the text of the message cannot be read from it. If you leave us your email, we likewise keep a fingerprint of your address for 24 hours so that we do not send you the confirmation more than once.
Purpose: to answer your enquiry. Nothing else.
Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) in conjunction with point (f) (our legitimate interest in replying).
Registering interest in the accommodation register and guest book. On the Accommodation register page (also in Hungarian) we collect your name, email and what you need (required) and, if you fill them in, also the municipality, the number of flats or houses, the platform you list on, your phone number and a note. You do not enter your guests' data or any login details into the form. The registration reaches us by email in the same way as a message from the contact form — we do not store it in any database or CRM system — and we send an automatic confirmation to your email (a fixed text without the content of the registration). The purpose, legal basis (Article 6(1)(b) and (f) GDPR) and protection against bots are the same as for the contact form above; the checkbox in the form only confirms that you have read this policy. We will not use your address for a newsletter or bulk mailing.
b) Free website review form
On the Free website review page we collect the website address and your email (required) and, if you fill them in, also your name, company name and a note. The request reaches us by email, just like a message from the contact form — we do not store it in any database or CRM system. We send an automatic confirmation to your email (a fixed text without the content of your request) and then the written review itself.
For the review we look at the publicly available website at the address you entered, the way an ordinary visitor sees it. We do not log in to it and we do not change anything on it.
Purpose: to prepare and send you the review you asked for and to communicate with you about it. We will not use your address for a newsletter or bulk mailing.
Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). This is not consent — the checkbox in the form only confirms that you have read this policy. Without the website address and email we cannot prepare or send the review.
Protection against bots is the same as for the contact form (point a), and the limits per IP address are counted together with it.
c) Registering interest in an e-invoicing connection
On the E-faktúra page (in Slovak only) a business can register its interest in connecting its system to e-invoicing. We collect the company name, email and the type of system you use (required) and, if you fill them in, also your name, phone number, the name of the system, website address, the approximate number of invoices to businesses per month and a note. The registration reaches us by email, just like a message from the contact form — we do not store it in any database or CRM system. We send an automatic confirmation to your email (a fixed text without the content of your registration).
Purpose: to contact you about connecting your system to e-invoicing. We will not use your address for a newsletter or bulk mailing.
Legal basis: Article 6(1)(a) GDPR — your consent, which you give by ticking the checkbox in the form. The registration cannot be sent without consent. You can withdraw your consent at any time by email to vass@vassweb.com; withdrawal does not affect the lawfulness of processing before it, and we will then delete your registration.
Protection against bots is the same as for the contact form (point a), and the limits per IP address are counted together with it. Who has access to the registration is set out in section 4, and how long we keep it in section 5.
d) Chatbot on the website
The chatbot answers questions about our services. It works in two modes:
Rule-based mode — answers are assembled from pre-prepared texts directly on our server. Nothing is sent anywhere.
AI mode (if enabled) — the text of your message is sent for processing to Anthropic PBC (USA) and an answer is returned. The transfer to the USA is covered by Standard Contractual Clauses (SCC). According to its public commitments, Anthropic does not store the content permanently and does not use it to train models.
Where the conversation history lives: in your browser (sessionStorage), so that your chat is not lost when you move to another page. It disappears when you close the tab. We do not store it.
If you leave your contact details: your name and email/phone reach us by email together with a transcript of the conversation — the same as from the form. They do not go into any database.
Protection against misuse: the server temporarily remembers your IP address so that it can limit the number of messages (12 per conversation; from one IP address at most 10 per minute and 60 per hour or per day). This record lives only in a temporary counter (Upstash, see section 4) and expires by itself within 48 hours at the latest. The technical log of rejected requests contains only a shortened part of the IP address, not the full address.
Daily AI cap: there is a daily cap on AI-mode answers for the whole website. Once it is reached, the chatbot answers only in rule-based mode — your messages are then not sent to Anthropic.
Legal basis: Article 6(1)(b) GDPR (provision of the service you requested) and point (f) (legitimate interest in protecting the service against misuse).
e) Technical server logs
Our hosting provider (Vercel Inc.) automatically records common technical access data — IP address, browser type and time. These serve the operation and security of the website; we do not build any analytics or profiles from them.
DNS queries (including the IP address) are processed by our DNS provider Cloudflare, Inc.
Cloudflare Turnstile (if enabled) — a check that the form or chat is used by a person, not a bot. During the check, Cloudflare processes the IP address and technical browser data. It is not used for advertising or tracking. Legal basis: Article 6(1)(f) GDPR (legitimate interest in protecting the website against misuse).
Legal basis: Article 6(1)(f) GDPR (legitimate interest in the functioning and security of the site).
f) Visitor statistics (Google Analytics 4) — only with your consent
If you allow the Analytics category in the cookie bar, Google Analytics 4 from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) starts. Without consent its script is not inserted into the page at all and nothing is sent from it to Google (Google Consent Mode v2, “denied” by default).
What is processed: a pseudonymous browser identifier in the _ga and _ga_* cookies, the pages visited and the time of the visit, where you came from (referring page, campaign tag), device and browser type, language and approximate location (country, city) derived from the IP address. When you successfully submit a form or leave your contact in the chat, we record a “generate_lead” event with the form name only — without your name, email, phone or message text.
Purpose: to know how many people visit the website, which pages they read and where they came from, so that we can improve it. Legal basis: your consent — Article 6(1)(a) GDPR and Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications. Retention: the _ga and _ga_* cookies last at most 12 months (we shortened the default 2 years); data in Google Analytics is kept for 14 months and then deleted automatically. Transfers outside the EU: Google may also process data in the USA; the transfer relies on the EU–US Data Privacy Framework, in which Google LLC participates, or on standard contractual clauses.
Withdrawing consent: at any time via the “Cookie settings” button in the footer — Analytics is switched off, the _ga and _ga_* cookies are deleted and the page reloads. Withdrawal does not affect the lawfulness of processing before it.
Advertising: neither Google Ads nor the Meta Pixel (remarketing on Facebook and Instagram) runs on the website today. If we deploy them, it will be exclusively with your consent in the Marketing category, and we will add them to this policy beforehand.
g) Contacting businesses by email (until 15 October 2026)
Until 15 October 2026, we wrote to some businesses and sole traders on our own initiative: one email offering a free website review and our services, and at most one short reminder. We no longer contact businesses by email. The sender was Vassweb s. r. o., Company ID (IČO) 56 921 021, Školská 981/36, 931 01 Šamorín, Slovakia (contact details in section 1).
Where we got the contact: only from the business's own website — an email address the business itself published there as its contact. We did not buy addresses, guess them or take them from directories.
What data: the email address and, if the business published them next to it on its website, the name and job title of the contact person; also the business name, town, line of business, the website address and the page where we found the contact, and our observation from the publicly available website (e.g. a broken link) that the email mentioned.
Purpose: a one-off offer of a free website review and our services. We do not add the address to a newsletter and do not share it with anyone for marketing.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in offering our services to businesses (direct marketing, Recital 47 GDPR).
Who has access: we sent the emails from our Google Workspace mailbox (Google Ireland Limited), and an AI assistant from Anthropic PBC (USA, SCC) helped us prepare them (reviewing the website, drafting the text). We keep the working records (whom we wrote to and when) in our own internal files.
How long: if you do not respond, we delete the outreach data no later than 12 months after our last email. If you reply, we handle your message like a message from the form (section 5). If you reply NO or object, we keep only your email address on a “do not contact” list, so that we do not write to you again by mistake.
Right to object — at any time and free of charge: simply write to vass@vassweb.com, call us on +421 918 668 728 or reply to our email with the word NO (or NIE). We will take your address off our outreach and will not write to you again. You can also exercise the other rights in section 6, including lodging a complaint with the Slovak data protection authority (Úrad na ochranu osobných údajov SR).
h) Ordering voice recordings
On the Hlasové nahrávky page (in Slovak; in Hungarian Hangfelvételek) we collect the company name, email, the language of the recordings and what you need them for (required) and, if you fill them in, also the approximate length of the message, your texts or details, your name and phone number. The order reaches us by email, just like a message from the contact form — we do not store it in any database or CRM system. We send an automatic confirmation to your email (a fixed text without the content of the order). Details from the page address (utm, gclid) are recorded in the same way as in point a).
The message texts you approve are sent to ElevenLabs, Inc. (USA) to produce the recordings — only the text of the message, not your contact details (see section 4).
Purpose: to process your order — prepare the texts, produce and deliver the recordings and communicate with you about them. We will not use your address for a newsletter or bulk mailing.
Legal basis: Article 6(1)(b) GDPR (performance of a contract and steps taken at your request prior to entering into it). This is not consent — the checkbox in the form only confirms that you have read this policy. We keep the invoice for the recordings for 10 years under the Accounting Act (section 5).
Protection against bots is the same as for the contact form (point a), and the limits per IP address are counted together with it.
4. Who receives the data
We do not sell your data and do not provide it to anyone for marketing. Only the following providers are involved (processors under Article 28 GDPR):
Vercel Inc. (USA, SCC) — website hosting and technical logs.
Resend Inc. (USA, SCC) — delivery of your message to us by email and a confirmation of receipt to your email. We do not use it for a newsletter or for bulk mailing.
Anthropic PBC (USA, SCC) — processing of the message text in the chatbot's AI mode (if enabled) and help with preparing the emails we sent to businesses (section 3 g).
Cloudflare, Inc. (USA, SCC) — DNS and bot protection (Turnstile, if enabled).
Upstash, Inc. (USA) — temporary bot-protection counters (IP address, fingerprints of messages and email addresses) that expire by themselves within 48 hours at the latest.
ElevenLabs, Inc. (USA) — production of voice recordings from the texts you order (section 3 h); it receives only the text of the message.
Google Ireland Limited (Ireland; transfers to the USA covered by SCC) — the email mailbox (Google Workspace) where messages from the forms and the chatbot reach us and from which we also sent emails to businesses until 15 October 2026 (section 3 g).
Google Ireland Limited (Ireland; transfers to the USA under the EU–US Data Privacy Framework or SCC) — Google Analytics 4 visitor statistics (section 3 f). Only with your consent.
Meta Platforms Ireland Ltd. — remarketing on Facebook and Instagram. Only after deployment and only with your consent.
5. How long we keep the data
Messages from the forms and the chatbot (including website review requests and the reviews we send you): they live as email in our mailbox. We keep them for as long as is necessary to handle the enquiry and for any further communication, for a maximum of 12 months from the last interaction. On request we will delete them sooner. We will also delete a registration of interest in an e-invoicing connection (section 3 c) if you withdraw your consent.
Emails to businesses (section 3 g): if you do not respond, for a maximum of 12 months after our last email. If you decline, we keep only the email address on the “do not contact” list, so that we do not write to you again by mistake.
Temporary bot-protection counters: they expire by themselves within 48 hours at the latest.
Chat history: not stored by us at all — it lives only in your browser and disappears when you close the tab.
Technical server logs: according to the standard retention periods of the hosting provider, typically in the order of days.
Accounting and tax documents: 10 years under Act No. 431/2002 Coll. on Accounting.
Cookie bar: your choice is remembered by one essential cookie in your browser for 12 months; after that the bar is shown again. The cookie contains a random consent ID. We keep a record of the choice (consent ID, time, choice per category, bar version, language and page address — without IP address or name) so that we can demonstrate consent; we keep it for at most 4 years.
Google Analytics 4 (only with consent, section 3 f): data 14 months, the _ga and _ga_* cookies at most 12 months.
6. Your rights
Access — you have the right to know what data we process about you.
Rectification — you may request correction of inaccurate data.
Erasure — you may request deletion of your data.
Restriction of processing and portability — under Articles 18 and 20 GDPR.
Object — under Article 21 GDPR, against processing based on legitimate interest.
Withdraw consent — we ask for consent in the form for registering interest in an e-invoicing connection (section 3 c) and in the cookie bar for visitor statistics (section 3 f). You can withdraw consent given in the form at any time by email to vass@vassweb.com, and cookie consent at any time via the “Cookie settings” button in the footer of this page. Withdrawal does not affect the lawfulness of processing before it.
Complaint — to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR, the Slovak data protection authority, Galvaniho 7/B, 821 04 Bratislava, Slovakia — dataprotection.gov.sk).
For any of these, simply write to vass@vassweb.com.
7. Cookies
Details are set out in the separate cookie policy. In short: we always use strictly necessary cookies; visitor statistics (Google Analytics 4) start only with your consent in the cookie bar.
8. Our products and services for clients
This policy covers this website. When we build a system for a client (for example a chatbot, an automation or an application), we process data on the basis of a contract with the client (Article 6(1)(b) GDPR) and the terms form part of a separate data processing agreement (DPA) which we sign before launch. Data from the client's systems goes into the client's systems, not to us.
9. Changes
If what the website does changes, we will change this document too — and update the date at the top.
← Back to the home page