1. Who we are
The controller of personal data within the meaning of Article 4(7) GDPR is Vassweb s. r. o.
Registered office: Školská 981/36, 931 01 Šamorín, Slovakia
Company ID (IČO): 56 921 021 · Tax ID (DIČ): 2122501524 · VAT ID (IČ DPH): SK2122501524
Registration: Commercial Register of the District Court Trnava, Section Sro, Insert No. 59422/T
Managing director: Richard Vass
Email: info@vassweb.com · Phone: +421 918 668 728
This document describes what actually happens to your data on this website — based on how the website is genuinely built. We do not mention tools we do not use.
2. Summary in three sentences
We measure visits only with your consent — both the cookie-free aggregate visit counts (Vercel Web Analytics, section 3 i) and the more detailed Google Analytics 4 statistics start only once you allow them in the cookie bar (Analytics category); without consent they are not loaded. Advertising tags (Google Ads and, if we switch it on, the Meta Pixel) run only with your consent in the Marketing category; without it they are not loaded.
We only receive data from you when you write to us yourself — via the contact form, the e-invoicing connection interest form, the voice recordings order form, the accommodation register interest form, the chatbot or the form in our Facebook or Instagram ad. The exception is the emails we send to businesses ourselves, to a contact they had published on their own website (section 3 g).
Your messages reach us by email and we record a copy in our own internal enquiry register so that no enquiry gets lost. We do not sell them or pass them on to anyone for marketing.
3. What data we process
a) Contact form
We collect your name, email or phone number and the text of your message — exactly what you type into the form. If you fill in the optional Referral code field, it reaches us together with the message so that we know who referred you when preparing an offer. The message reaches us by email. A copy is also stored with Upstash (section 4) — for 7 days at most, so that it is not lost even if the email fails — and from there we transfer it to our internal enquiry register. We add the time of sending and a fingerprint (hash) of the IP address, from which the address cannot be read, so that we recognise repeated submissions. If you leave us your email, we send you an automatic confirmation that your message arrived — a fixed text without the content of your message. We reply to you personally. If you reached the page with the form via a link carrying a campaign tag (for example from a Google ad), we also record these details from the page address in the email with your enquiry: source, medium, campaign, keyword and the Google click ID (utm_source, utm_medium, utm_campaign, utm_term, gclid) — so that we know where the enquiry came from and whether the advertising works; this also applies to the form in point c) and to the accommodation register interest form below, and nothing is stored in your browser for this.
Protection against bots: the form has a hidden field and a timing check that catch automated submissions, and it accepts at most 3 messages per 10 minutes and 5 per day from one IP address. For this, the IP address is kept only in a temporary counter that expires by itself within 48 hours at the latest (Upstash, see section 4). So that the same message does not arrive twice, we keep its fingerprint (hash) for 24 hours — the text of the message cannot be read from it. If you leave us your email, we likewise keep a fingerprint of your address for 24 hours so that we do not send you the confirmation more than once.
Purpose: to answer your enquiry. Nothing else.
Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) in conjunction with point (f) (our legitimate interest in replying).
Registering interest in the accommodation register and guest book. On the Accommodation register page (also in Hungarian) we collect your name, email and what you need (required) and, if you fill them in, also the municipality, the number of flats or houses, the platform you list on, your phone number and a note. You do not enter your guests' data or any login details into the form. The registration reaches us by email in the same way as a message from the contact form — including a copy in our internal enquiry register (point a) — and we send an automatic confirmation to your email (a fixed text without the content of the registration). The purpose, legal basis (Article 6(1)(b) and (f) GDPR) and protection against bots are the same as for the contact form above; the checkbox in the form only confirms that you have read this policy. We will not use your address for a newsletter or bulk mailing.
b) Free website review form — discontinued
Since 23 October 2026 this form is no longer on the website and we do not offer free website reviews. Requests received before then live as email in our mailbox and point 5 applies to them.
c) Registering interest in an e-invoicing connection
On the E-faktúra page (in Slovak only) a business can register its interest in connecting its system to e-invoicing. We collect the company name, email and the type of system you use (required) and, if you fill them in, also your name, phone number, the name of the system, website address, the approximate number of invoices to businesses per month and a note. The registration reaches us by email, just like a message from the contact form, including a copy in our internal enquiry register (point a). We send an automatic confirmation to your email (a fixed text without the content of your registration).
Purpose: to contact you about connecting your system to e-invoicing. We will not use your address for a newsletter or bulk mailing.
Legal basis: Article 6(1)(a) GDPR — your consent, which you give by ticking the checkbox in the form. The registration cannot be sent without consent. You can withdraw your consent at any time by email to info@vassweb.com; withdrawal does not affect the lawfulness of processing before it, and we will then delete your registration.
Protection against bots is the same as for the contact form (point a), and the limits per IP address are counted together with it. Who has access to the registration is set out in section 4, and how long we keep it in section 5.
d) Chatbot on the website
The chatbot answers questions about our services. It works in two modes:
Rule-based mode — answers are assembled from pre-prepared texts directly on our server. Nothing is sent anywhere.
AI mode (if enabled) — the text of your message is sent for processing to Anthropic PBC (USA) and an answer is returned. The transfer to the USA is covered by Standard Contractual Clauses (SCC). According to its public commitments, Anthropic does not store the content permanently and does not use it to train models.
Where the conversation history lives: in your browser (sessionStorage), so that your chat is not lost when you move to another page. It disappears when you close the tab. We do not store it.
If you leave your contact details: your name and email/phone reach us by email together with a transcript of the conversation — the same as from the form, including a copy in our internal enquiry register (point a).
Protection against misuse: the server temporarily remembers your IP address so that it can limit the number of messages (12 per conversation; from one IP address at most 10 per minute and 60 per hour or per day). This record lives only in a temporary counter (Upstash, see section 4) and expires by itself within 48 hours at the latest. The technical log of rejected requests contains only a shortened part of the IP address, not the full address.
Daily AI cap: there is a daily cap on AI-mode answers for the whole website. Once it is reached, the chatbot answers only in rule-based mode — your messages are then not sent to Anthropic.
Legal basis: Article 6(1)(b) GDPR (provision of the service you requested) and point (f) (legitimate interest in protecting the service against misuse).
e) Technical server logs
Our hosting provider (Vercel Inc.) automatically records common technical access data — IP address, browser type and time. These serve the operation and security of the website; we do not build any analytics or profiles from them.
DNS queries (including the IP address) are processed by our DNS provider Cloudflare, Inc.
Cloudflare Turnstile (if enabled) — a check that the form or chat is used by a person, not a bot. During the check, Cloudflare processes the IP address and technical browser data. It is not used for advertising or tracking. Legal basis: Article 6(1)(f) GDPR (legitimate interest in protecting the website against misuse).
Legal basis: Article 6(1)(f) GDPR (legitimate interest in the functioning and security of the site).
f) Visitor statistics (Google Analytics 4) and Google Ads advertising — only with your consent
If you allow the Analytics category in the cookie bar, Google Analytics 4 from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) starts. Without consent its script is not inserted into the page at all and nothing is sent from it to Google (Google Consent Mode v2, “denied” by default).
What is processed: a pseudonymous browser identifier in the _ga and _ga_* cookies, the pages visited and the time of the visit, where you came from (referring page, campaign tag), device and browser type, language and approximate location (country, city) derived from the IP address. When you successfully submit a form or leave your contact in the chat, we record a “generate_lead” event with the form name only — without your name, email, phone or message text.
Purpose: to know how many people visit the website, which pages they read and where they came from, so that we can improve it. Legal basis: your consent — Article 6(1)(a) GDPR and Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications. Retention: the _ga and _ga_* cookies last at most 12 months (we shortened the default 2 years); data in Google Analytics is kept for 14 months and then deleted automatically. Transfers outside the EU: Google may also process data in the USA; the transfer relies on the EU–US Data Privacy Framework, in which Google LLC participates, or on standard contractual clauses.
Withdrawing consent: at any time via the “Cookie settings” button in the footer — Analytics is switched off, the _ga and _ga_* cookies are deleted and the page reloads. Withdrawal does not affect the lawfulness of processing before it.
Google Ads advertising: the Google Ads tag of Google Ireland Limited runs only with your consent in the Marketing category. Without it — even if you allow only the Analytics category — the website discards requests to Google’s advertising services right in your browser and nothing is sent to Google Ads. With Marketing consent, Google Ads records the page view, device and browser type and the IP address, stores the _gcl_au and _gcl_aw cookies (the latter only if you arrived from our ad on Google — it contains the gclid click identifier; when you arrive from our ad on an iPhone or iPad, _gcl_gb or _gcl_ag with the wbraid/gbraid identifier instead) and, when you successfully submit a form or leave your contact in the chat, a “generate_lead” event with the form name only and the campaign tag, and a “Dopyt odoslaný” (enquiry sent) conversion with a random submission number only (so that one enquiry is not counted twice) — without your name, email, phone or message text. Google may read or set its own cookies on its domains (for example doubleclick.net) and may use Google Analytics 4 data for advertising audiences (remarketing).
Purpose: to learn which of our ads on Google brought an enquiry and to show our ads to people who visited the website. Further processing in the advertising system is carried out by Google as an independent controller under its own policy (policies.google.com/privacy). Legal basis: your consent — Article 6(1)(a) GDPR and Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications. Retention: the _gcl_au, _gcl_aw, _gcl_gb and _gcl_ag cookies last at most 12 months. Transfers outside the EU: as for Google Analytics above (EU–US Data Privacy Framework or standard contractual clauses). Withdrawing consent: with the “Cookie settings” button in the footer — Google Ads is switched off, all _gcl_* cookies (_gcl_au, _gcl_aw, _gcl_gb, _gcl_ag) are deleted and the page reloads. You can change ad personalisation in your Google account at adssettings.google.com.
Meta: The Meta Pixel (measuring ads on Facebook and Instagram) runs exclusively with your consent in the Marketing category — see section 3 j).
g) Contacting businesses by email
We write to some businesses and sole traders on our own initiative: one email offering our services. Until 15 October 2026 it also offered a free website review, and we sent at most one short reminder. We contact businesses by email only to offer our services; you can unsubscribe from further messages at any time — simply reply with the word NO. The sender is Vassweb s. r. o., Company ID (IČO) 56 921 021, Školská 981/36, 931 01 Šamorín, Slovakia (contact details in section 1).
Where we get the contact: only from the business's own website — an email address the business itself published there as its contact. We do not buy addresses, guess them or take them from directories.
What data: the email address and, if the business published them next to it on its website, the name and job title of the contact person; also the business name, town, line of business, the website address and the page where we found the contact, and our observation from the publicly available website (e.g. a broken link) that the email mentions.
Purpose: a one-off offer of our services (until 15 October 2026 also of a free website review). We do not add the address to a newsletter and do not share it with anyone for marketing.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in offering our services to businesses (direct marketing, Recital 47 GDPR).
Who has access: we send the emails from our Google Workspace mailbox (Google Ireland Limited), and an AI assistant from Anthropic PBC (USA, SCC) helps us prepare them (reviewing the website, drafting the text). We keep the working records (whom we wrote to and when) in our own internal files.
How long: if you do not respond, we delete the outreach data no later than 12 months after our last email. If you reply, we handle your message like a message from the form (section 5). If you reply NO or object, we keep only your email address on a “do not contact” list, so that we do not write to you again by mistake.
Right to object — at any time and free of charge: simply write to info@vassweb.com, call us on +421 918 668 728 or reply to our email with the word NO (or NIE). We will take your address off our outreach and will not write to you again. You can also exercise the other rights in section 6, including lodging a complaint with the Slovak data protection authority (Úrad na ochranu osobných údajov SR).
h) Ordering voice recordings
On the Hlasové nahrávky page (in Slovak; in Hungarian Hangfelvételek) we collect the company name, email, the language of the recordings and what you need them for (required) and, if you fill them in, also the approximate length of the message, your texts or details, your name and phone number. The order reaches us by email, just like a message from the contact form, including a copy in our internal enquiry register (point a). We send an automatic confirmation to your email (a fixed text without the content of the order). Details from the page address (utm, gclid) are recorded in the same way as in point a).
The message texts you approve are sent to ElevenLabs, Inc. (USA, SCC) to produce the recordings — only the text of the message, not your contact details (see section 4).
Purpose: to process your order — prepare the texts, produce and deliver the recordings and communicate with you about them. We will not use your address for a newsletter or bulk mailing.
Legal basis: Article 6(1)(b) GDPR (performance of a contract and steps taken at your request prior to entering into it). This is not consent — the checkbox in the form only confirms that you have read this policy. We keep the invoice for the recordings for 10 years under the Accounting Act (section 5).
Protection against bots is the same as for the contact form (point a), and the limits per IP address are counted together with it.
i) Visitor measurement without cookies, only with consent (Vercel Web Analytics)
We measure how many people visit the website and which pages they read with Vercel Web Analytics from our hosting provider Vercel Inc. The tool does not use cookies, stores nothing on your device and builds no profile. Its script does, however, send page-view data from your browser, so it starts only after you consent to the Analytics category in the cookie bar; without consent it is not loaded. We only see aggregate counts, not individual people.
What is recorded when a page is viewed: the time, the page address, where you came from (referring page), device type, operating system and browser with version, and approximate location (country, region, city). From the page address we send only campaign tags (utm) and two of our own parameters (zaujem, ref) — anything else, such as the code in an email unsubscribe link, is removed before sending. The tool tells visitors apart only by a temporary fingerprint (hash) of the request, which is discarded after 24 hours; no IP address and no identifier that could be used to find a person or follow them across other websites is stored with the records.
Purpose: to know how many people visit the website, which pages they read and where they came from, so that we can improve it. Legal basis: your consent — Art. 6(1)(a) GDPR and Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications. Retention: the visitor fingerprint 24 hours; we can see the aggregate statistics in the Vercel dashboard for 12 months. Withdrawing consent: at any time with the “Cookie settings” button in the footer — the measurement is switched off and the page reloads; consent you give is valid for at most 12 months. Questions to info@vassweb.com; since the records are not linked to a specific person, we cannot attribute them to you or hand them over (Art. 11 GDPR). Blocking scripts in your browser also stops the measurement.
Enquiries through the form in our Facebook or Instagram ad
When you fill in the form in our Facebook or Instagram ad directly in the app (a Meta instant form), we receive your name, phone number, e-mail address and company name and your answers to the questions in the form (what you need, when you want to start, whether you already have a website). Meta may pre-fill your contact details from your profile — you see them before sending, you can change them and you confirm the submission once more. With the enquiry we also receive the time it was sent and which of our ads and campaigns it came from.
How it reaches us: several times an hour our computer downloads new enquiries through Meta’s interface directly into our internal enquiry register (section 3 a) and sends us an internal notification without your contact details. We do not send them anywhere else.
Purpose: to answer your enquiry and prepare an offer. We will not use your address for a newsletter or bulk mailing. Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) together with point (f) (our legitimate interest in answering the enquiry).
Meta’s role: the form is operated by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). For forms in ads, both Meta and we are controllers — each is responsible for its own processing: we for the data we receive from Meta, Meta for what it processes in its services (for example that you saw the ad and sent the form), under its own policy (facebook.com/privacy/policy). Meta is not our processor. Transfer outside the EU: Meta may also process the data in the USA; the transfer relies on the EU–US Data Privacy Framework, in which Meta Platforms, Inc. participates, or on standard contractual clauses.
Period: in the internal register like other enquiries — for a maximum of 12 months from the last interaction (section 5). In Meta’s system the enquiry is available for us to download for 90 days after it was sent.
Clients — concluding and performing the contract
If you conclude a contract with us (a price quote and its acceptance, an order, a contract for work, website care), we process your name, contact and billing details, details of the company representative, the content of the contract and related communication, complaints (reklamacie@vassweb.com) and withdrawal from the contract (zmluvy@vassweb.com). Purpose: concluding and performing the contract, handling complaints and withdrawals, invoicing. Legal basis: Article 6(1)(b) GDPR (contract), (c) (legal obligations — accounting, VAT) and (f) (legitimate interest in proving, exercising and defending claims under the contract). Retention: contracts and related documents for the duration of the contract and 10 years after it ends, complaint records 4 years after they are handled; invoices 10 years following the year to which they relate.
j) Meta Pixel — measuring ads on Facebook and Instagram, only with your consent
If you allow the Marketing category in the cookie bar, the Meta Pixel of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) starts. Without consent its script is not inserted into the page at all; we do not use the no-JavaScript fallback image (noscript) either — nothing is sent from the website to Meta.
What is processed: a pseudonymous browser identifier in the _fbp cookie (and _fbc if you arrived from an ad on Facebook or Instagram), the page visited and the time (“PageView” event), device and browser type and the IP address; if you are logged in to Facebook or Instagram, Meta can link this data to your account. When you successfully submit a form or leave your contact in the chat, we record a “Lead” event with the form name only — without your name, email, phone or message text; we do not use Advanced Matching.
Purpose: to learn which of our ads on Facebook or Instagram brought an enquiry and to show our ads to people who may be interested. For the collection and transmission of this data we and Meta Platforms Ireland Limited are joint controllers under Article 26 GDPR (the Controller Addendum to Meta’s Business Tools Terms); further processing in Meta’s advertising system is carried out by Meta as an independent controller under its own policy (facebook.com/privacy/policy). Legal basis: your consent — Article 6(1)(a) GDPR and Section 109(8) of Act No. 452/2021 Coll. on electronic communications. Period: the _fbp and _fbc cookies last 3 months; under its terms Meta may retain event data for at most 2 years. Transfer outside the EU: Meta may also process the data in the USA; the transfer relies on the EU–US Data Privacy Framework, in which Meta Platforms, Inc. participates, or on standard contractual clauses.
Withdrawing consent: at any time with the “Cookie settings” button in the footer — the Pixel is switched off, the _fbp and _fbc cookies are deleted and the page reloads. Withdrawal does not affect the lawfulness of processing before it. You can change ad settings in your Meta account at facebook.com/adpreferences.
4. Who receives the data
We do not sell your data and do not provide it to anyone for marketing. Only the following providers are involved (processors under Article 28 GDPR):
Vercel Inc. (USA, SCC) — website hosting, technical logs and visitor measurement with Vercel Web Analytics without cookies, only with consent (section 3 i).
Resend Inc. (USA, SCC) — delivery of your message to us by email and a confirmation of receipt to your email. We do not use it for a newsletter or for bulk mailing.
Anthropic PBC (USA, SCC) — processing of the message text in the chatbot's AI mode (if enabled) and help with preparing the emails we sent to businesses (section 3 g).
Cloudflare, Inc. (USA, SCC) — DNS and bot protection (Turnstile, if enabled).
Upstash, Inc. (USA, SCC) — temporary bot-protection counters (IP address, fingerprints of messages and email addresses) that expire by themselves within 48 hours at the latest, and a temporary copy of enquiries from the forms and the chatbot until we transfer it to our internal register (7 days at most).
ElevenLabs, Inc. (USA, SCC) — production of voice recordings from the texts you order (section 3 h); it receives only the text of the message.
Google Ireland Limited (Ireland; transfers to the USA covered by SCC) — the email mailbox (Google Workspace) where messages from the forms and the chatbot reach us and from which we also send emails to businesses (section 3 g).
Google Ireland Limited (Ireland; transfers to the USA under the EU–US Data Privacy Framework or SCC) — Google Analytics 4 visitor statistics (section 3 f). Only with your consent.
Google Ireland Limited (Ireland; transfers to the USA under the EU–US Data Privacy Framework or SCC) — Google Ads advertising: conversion measurement and remarketing (section 3 f); for advertising Google acts as an independent controller. Only with your consent in the Marketing category.
Meta Platforms Ireland Limited (Ireland; transfer to the USA under the EU–US framework, or SCC) — the form in our Facebook and Instagram ads (section 3, part “Enquiries through the form in our … ad”) and the Meta Pixel, the latter only with your consent to cookies in the Marketing category (section 3 f). Here Meta acts as an independent controller, not as our processor.
5. How long we keep the data
Messages from the forms and the chatbot: they live as email in our mailbox and as a record in our internal enquiry register; the temporary copy at Upstash expires within 7 days at the latest. We keep them for as long as is necessary to handle the enquiry and for any further communication, for a maximum of 12 months from the last interaction. On request we will delete them sooner. If a contract results from the enquiry, the periods in the part “Clients — concluding and performing the contract” in section 3 apply. We will also delete a registration of interest in an e-invoicing connection (section 3 c) if you withdraw your consent.
Enquiries from the form in our Facebook and Instagram ads: in the internal enquiry register for a maximum of 12 months from the last interaction, like messages from the forms; in Meta’s system they are available to us for 90 days after they were sent.
Emails to businesses (section 3 g): if you do not respond, for a maximum of 12 months after our last email. If you decline, we keep only the email address on the “do not contact” list, so that we do not write to you again by mistake.
Temporary bot-protection counters: they expire by themselves within 48 hours at the latest.
Chat history: not stored by us at all — it lives only in your browser and disappears when you close the tab.
Technical server logs: according to the standard retention periods of the hosting provider, typically in the order of days.
Accounting and tax documents: 10 years under Act No. 431/2002 Coll. on Accounting. We also keep invoices under Section 76 of Act No. 222/2004 Coll. on Value Added Tax (legal basis: Article 6(1)(c) GDPR — legal obligation). The documents are also processed by our external accounting firm (processor), and we provide them to public authorities (for example the tax administration) on request.
Cookie bar: your choice is remembered by one essential cookie in your browser for 12 months; after that the bar is shown again. The cookie contains a random consent ID. We keep a record of the choice (consent ID, time, choice per category, bar version, language and page address — without IP address or name) so that we can demonstrate consent; we keep it for at most 4 years.
Google Analytics 4 (only with consent, section 3 f): data 14 months, the _ga and _ga_* cookies at most 12 months.
Google Ads (only with Marketing consent, section 3 f): the _gcl_au, _gcl_aw, _gcl_gb and _gcl_ag cookies at most 12 months; data in the advertising system under Google’s policy.
Vercel Web Analytics (no cookies, with consent, section 3 i): the visitor fingerprint 24 hours, aggregate statistics 12 months.
6. Your rights
Access — you have the right to know what data we process about you.
Rectification — you may request correction of inaccurate data.
Erasure — you may request deletion of your data.
Restriction of processing and portability — under Articles 18 and 20 GDPR.
Object — under Article 21 GDPR, against processing based on legitimate interest.
Withdraw consent — we ask for consent in the form for registering interest in an e-invoicing connection (section 3 c) and in the cookie bar for visitor statistics (sections 3 f and 3 i) and Google Ads advertising or the Meta Pixel, if we switch it on (section 3 f). You can withdraw consent given in the form at any time by email to info@vassweb.com, and cookie consent at any time via the “Cookie settings” button in the footer of this page. Withdrawal does not affect the lawfulness of processing before it.
Complaint — to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR, the Slovak data protection authority, Galvaniho 7/B, 821 04 Bratislava, Slovakia — dataprotection.gov.sk).
Providing data in the forms and in the chat is voluntary and is not a statutory or contractual requirement; without your contact details and message, however, we cannot reply to you or process an order. We do not carry out automated decision-making with legal or similarly significant effects under Article 22 GDPR; advertising audiences (remarketing) at Google and Meta, created only with your consent, have no such effects. For any of these, simply write to info@vassweb.com.
7. Cookies
Details are set out in the separate cookie policy. In short: we always use strictly necessary cookies; visitor statistics (Google Analytics 4) start only with your consent in the cookie bar, and Google Ads advertising only with consent in the Marketing category. The anonymous visitor measurement with Vercel Web Analytics (section 3 i) uses no cookies and stores nothing on your device, but it too starts only with your consent (Analytics category).
8. Our products and services for clients
This policy covers this website. When we build a system for a client (for example a chatbot, an automation or an application), we process data as the client’s processor under Article 28 GDPR — the legal basis for the processing is determined by the client as controller and the terms form part of a separate data processing agreement (DPA) which we sign before launch. Data from the client's systems goes into the client's systems, not to us.
9. Changes
If what the website does changes, we will change this document too — and update the date at the top.
← Back to the home page