Legal
Privacy policy
How Digitaliko s.r.o. handles your data.
We process personal data under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on personal data protection. Here you will find what data we process, why, for how long and what rights you have.
1. Who we are
Digitaliko s.r.o., Šípková 377/17, 958 03 Malé Uherce, Slovakia, Company ID (IČO): 55 164 650, registered in the Commercial Register of the District Court Trenčín, Section Sro, Insert No. 44685/R, email: info@digitaliko.com (“we”).
2. What data, for what and for how long
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Replying to your inquiry (form, email, meeting booking) | name, email, company, phone, message text, attachments you send, meeting time, your answer to “How did you hear about us?” if you pick one, and the page you came to the website from (for example a link from LinkedIn), so we know where inquiries come from | steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) | as long as we need it to reply and for further communication about the inquiry, then we delete it |
| Ideas for your website at your request ("we look at your website") | email, website address, the public content of your company website and our notes on it | steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) | 12 months from the last message if no cooperation follows, then we delete it |
| Contract and cooperation | contact and billing details, project communication | performance of a contract (Art. 6(1)(b) GDPR) | for the term of the contract and afterwards as long as the law requires it or limitation periods for claims run |
| Accounting | data on invoices and payments | legal obligation under the Slovak Accounting Act (Art. 6(1)(c) GDPR) | 10 years (Accounting Act) |
| Strictly necessary cookies (language, your choice in the consent banner, protecting the form from bots) | technical browser data | legitimate interest in a working and secure website (Art. 6(1)(f) GDPR) | as in the cookie table in section 5 |
| AI assistant on the website (chat) | the questions you type into the chat and the assistant’s answers; if you send us the conversation, also your name, email, company and the chat transcript; if you enter your website address in the chat, we read the public text of its home page and at most three more pages and send it to the language model, we do not store the text | answering your questions: our legitimate interest (Art. 6(1)(f) GDPR); a conversation you send us: steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) | the chat text for at most 12 months in PostHog (see the text below the table); the transcript of a conversation you send us is part of the inquiry email and kept like the inquiry |
| Analytics and marketing (PostHog, Google Analytics 4, Leadfeeder, Meta pixel, LinkedIn Insight Tag) | pages viewed, clicks, IP address, visit source | your consent in the cookie banner (Art. 6(1)(a) GDPR) | as in the cookie table in section 5, at most 2 years |
AI assistant: we store the text you write to the assistant and its answers (without email addresses and phone numbers) in PostHog (data in the EU) for at most 12 months, to improve the assistant and to answer questions it left unresolved. The legal basis is our legitimate interest.
When we develop software for a client and work with its customers' data, we are a processor. In that case we work with the data only on the client's instructions and under our contract with the client.
3. Who we share data with
We pass data on only when the law requires it or when it is needed to perform a contract. We have a data processing agreement or terms with every processor.
The VAT number you enter in the VAT check tool is verified with the European Commission's VIES service.
- Vercel Inc. (USA): website hosting and technical access logs (IP address, time, browser); Vercel AI Gateway, which passes AI assistant messages to the language model and, under Vercel’s terms, does not store their content
- Anthropic PBC (USA): the language model that writes the AI assistant’s answers; it receives only the conversation text, not the form details (name, email, company)
- PostHog Inc. (USA, data stored in the EU): cookieless traffic measurement, visitor analytics and session recordings after your consent
- Google Ireland Limited (Ireland): Google Analytics 4 after your consent, and the info@digitaliko.com mailbox (Google Workspace)
- Dealfront Holdings Oy (Finland), Leadfeeder: recognizes from the IP address which company a visit came from and which pages it viewed, after your consent to marketing cookies. It does not identify individual people.
- Nikolai Tschacher (Germany), ipapi.is: after your consent to marketing cookies, we look up from the IP address the name of the company or organization a visit came from. We do not store the IP address, only the company name, its domain and country (not for home or mobile connections). Legal basis: consent.
- Meta Platforms Ireland Ltd. (Ireland), Meta pixel: after your consent to marketing cookies, it measures visits and conversions (a sent form, a booked call) from ads on Facebook and Instagram and builds remarketing audiences. For collecting the data on our website and transmitting it to Meta, we and Meta are joint controllers (Court of Justice of the EU, C-40/17 Fashion ID); Meta alone is responsible for any further processing. Data may be transferred to the USA under the EU-U.S. Data Privacy Framework.
- LinkedIn Ireland Unlimited Company (Ireland), LinkedIn Insight Tag: after your consent to marketing cookies, it shows us aggregate data about visitors (for example industry or job title) that does not reveal individual people, builds remarketing audiences and measures conversions from ads on LinkedIn. LinkedIn removes direct identifiers within 7 days and deletes the pseudonymized data within 180 days. Data may be transferred to the USA under the EU-U.S. Data Privacy Framework.
- CookieYes Limited (United Kingdom): the consent banner and storing your choice
- Cloudflare Inc. (USA): Turnstile, protecting the contact form and the AI assistant form from bots
- ActiveCampaign LLC, Postmark (USA): sending messages from the contact form or the AI assistant and the confirmation email
- Cal.com Inc. (USA): booking the 15-minute meeting, loaded only when you open the booking
- Accounting firm (Slovakia): bookkeeping
4. Transfers outside the EU
Some processors are based in the USA. Transfers rely on a European Commission decision (EU-U.S. Data Privacy Framework) or standard contractual clauses (Art. 46 GDPR).
5. Cookies
The website uses cookies and browser local storage (localStorage). On your first visit, a CookieYes consent banner appears. There you accept, reject or set your consent by category (analytics and marketing cookies).
Without your consent, the website uses only strictly necessary cookies it cannot work without: remembering your chosen language, storing your choice in the consent banner and protecting the contact form from bots (Cloudflare Turnstile). The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR) together with Section 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications.
Analytics and marketing tools (PostHog including session recording, Google Analytics 4, Leadfeeder, Meta pixel and LinkedIn Insight Tag) store data in your browser only after you give consent in the consent banner. The legal basis is your consent (Art. 6(1)(a) GDPR).
Without your consent, we measure traffic without cookies via PostHog (data stored in the EU): the number of page views, the source of the visit, the device type and which parts of the website you use (for example clicking a button, opening a form or the assistant, sending a form), but never what you type into them. We store nothing in your browser and do not link the visit to you as a person. We do this based on our legitimate interest (Art. 6(1)(f) GDPR), so we know which pages and features help people.
What the website stores in your browser:
- Strictly necessary (no consent): cookieyes-consent (CookieYes): your choice in the consent banner, valid for 1 year
- Strictly necessary (no consent): PARAGLIDE_LOCALE: your chosen website language, valid for 400 days
- Strictly necessary (no consent): Cloudflare Turnstile on the contact form: technical data to verify that the form is not sent by a bot
- Strictly necessary (no consent): dk_nudge_dismissed (localStorage): that you closed the "we look at your website" offer, so it is not shown again for 30 days
- After consent to analytics cookies: ph_… (PostHog, cookie and localStorage): a random visitor identifier for analytics and session recording, valid for 1 year
- After consent to analytics cookies: _ga and _ga_… (Google Analytics 4): valid for 400 days
- After consent to marketing cookies: _lfa (Leadfeeder, cookie and localStorage): a visit identifier used to recognize the company, valid for 2 years
- After consent to marketing cookies: _fbp (Meta pixel) and fr (Meta, facebook.com domain): a browser identifier for ad measurement and remarketing, valid for 90 days
- After consent to marketing cookies: li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory (LinkedIn Insight Tag, linkedin.com domain): a browser identifier for ad measurement, remarketing and aggregate visitor data, valid from 1 day to 1 year
- After consent to marketing cookies: dk_first_touch (localStorage): where you first came from (UTM parameters, landing and referring page); attached to your form message so we know where the inquiry came from
- After consent to marketing cookies: dk_session_touch (sessionStorage): where you came from on this visit; attached to your form message and gone when you close the tab
- After consent to marketing cookies: dk_converted (localStorage): that you already sent the form or booked a meeting, so the offer to look at your website is not shown again
- Only when you open the booking: __cf_bm (Cloudflare, via Cal.com): technical bot protection for the booking calendar, valid for 30 minutes
You can change or withdraw your consent at any time via the cookie icon in the bottom left corner of the page. After you withdraw consent, analytics and marketing tools no longer store data in your browser. Withdrawal does not affect processing before it.
6. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing and portability, and the right to object. If we process data based on consent, you can withdraw it at any time. Send your request to info@digitaliko.com; we will reply within one month at the latest.
If you believe we process data unlawfully, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.
We do not carry out automated decision-making or profiling with legal effects.
7. Validity
This policy applies from 4 November 2026. When we change how we process data, we update the policy and change the date.