Privacy policy

This policy explains how we process personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Slovak Act No. 18/2018 Coll. on the protection of personal data.

The controller of your personal data on https://niio.sk is its niio s.r.o., identified in full at the end of this page. For anything concerning your data, write to hello@niio.sk.

We process personal data only as far as necessary to answer enquiries, provide our services and meet our contractual and legal obligations.

Contact form and email: your name, email address, organization if you give one, the type of project, your budget and timeline, the text of your message and anything else you send us in it or by email. We use it to handle your enquiry, prepare an offer and talk about the project.

Contracts and accounting: if an enquiry becomes a project, your name, address, email, phone and billing details, and a company ID and tax ID where they apply. We use them to perform the contract, issue invoices, keep a record of our work and handle complaints.

We do not use your data for marketing and we do not make automated decisions about you.

We process an enquiry and an offer as steps taken at your request before entering into a contract, under Article 6(1)(b) of the GDPR. Where an enquiry is not about a contract, we rely on our legitimate interest in answering business correspondence, under Article 6(1)(f) of the GDPR.

We process project data to perform the contract, under Article 6(1)(b) of the GDPR, and to meet legal obligations, chiefly under the accounting act, under Article 6(1)(c) of the GDPR.

We do not sell your personal data or give it to third parties for marketing. Only contracted partners (processors) who help us run the business have access to it, and they are bound by confidentiality and by the duty to protect it under the GDPR:

Hetzner Online GmbH, whose servers in Germany or Finland run this site and our internal systems.

Google, which runs our mailbox hello@niio.sk. Google may process data outside the European Economic Area; such transfers are protected by the European Commission’s standard contractual clauses.

External accountants and tax advisers, where the data belongs to our accounts.

We keep enquiries and offers as long as needed to handle the enquiry, and at most one year after our last exchange if no contract follows.

We keep the data in contracts and invoices for the duration of the contract and for as long as the law requires.

Under the GDPR you have these rights over your personal data:

Right of access: you may ask whether we process your personal data and get access to it.

Right to rectification: you may have incorrect data corrected and incomplete data completed.

Right to erasure (“to be forgotten”): you may ask us to erase data that is no longer needed for the purpose we collected it for, or after you withdraw your consent.

Right to restriction of processing, in the cases the law sets out.

Right to data portability: you may receive your data in a structured, commonly used format and take it to another controller.

Right to object to processing we carry out on the basis of our legitimate interest.

Right to withdraw consent at any time where processing rests on it; withdrawing does not affect the lawfulness of processing before it.

To exercise your rights, write to hello@niio.sk; we answer within one month.

Right to lodge a complaint: if you believe we process your data unlawfully, you may complain to Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.

We count page views with our own installation of Umami, hosted on our servers. It sets no cookie, stores nothing in your browser, collects no personal data and cannot recognise you on a later visit. A browser “Do Not Track” setting switches it off, and so does “Reject all”, or its own switch, in the cookie bar.

Only if you allow it, the same installation records a replay of your visit: pointer movement, clicks, scrolling and the page as you see it. Text you type into fields is masked, and a replay is not linked to your name or to an enquiry you send. We use replays to find where the site confuses people.

The legal basis is your consent, under Article 6(1)(a) of the GDPR. You can withdraw it at any time with “cookie settings” at the bottom of every page, and recording stops at once. Replays stay on our own servers and are deleted within twelve months.

What the site stores on your device, and why, is on the cookies page. You can change your choice at any time with “cookie settings” at the bottom of every page.