Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

LeMi Digital Lab s.r.o.
Trieda KVP 1C, 040 23 Košice, Slovak Republic
IČO: 57 569 762
Email: ···

All requests regarding your personal data (access, deletion, correction) may be sent to the email address above.

2. Scope and legal basis

This policy applies to data processed at lemidigitallab.eu and any sub-pages. We process personal data only to the extent permitted by law and only for the purposes described below.

Legal bases we rely on (GDPR Art. 6):

• Art. 6(1)(a): your consent (e.g. analytics cookies)
• Art. 6(1)(b): performance of or steps prior to a contract (e.g. responding to enquiries)
• Art. 6(1)(f): our legitimate interests (e.g. server security logs)

3. Data we process

3.1 Contact form

When you submit the contact form we collect: name, email address, company name (optional) and your message. We use this data solely to reply to your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual communication).

Messages are forwarded to our inbox via Resend (Resend Inc., 185 Clara St, San Francisco, CA 94107, USA). Resend acts as a data processor under a Data Processing Agreement. Data is deleted within 24 months of the last contact unless a business relationship arises.

3.2 Server and access logs

This website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare automatically logs access data including IP address, browser type, referring URL and timestamp for security and operational purposes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in site security). Cloudflare acts as a processor and is bound by Standard Contractual Clauses (SCCs) for transfers to the USA. Logs are retained for up to 30 days.

3.3 Google Analytics 4

We use Google Analytics 4 (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to understand how visitors use the site. Analytics is disabled by default. It is activated only after you grant consent. Legal basis: Art. 6(1)(a) GDPR.

When activated, Google Analytics sets cookies and sends usage data (pages visited, session duration, device type) to Google servers. We have enabled IP anonymisation and disabled advertising features. Data is processed in the USA under Google's SCCs. You may opt out at any time by adjusting your browser settings or using the Google Analytics Opt-out Browser Add-on. Retention period in Google Analytics: 14 months.

4. Cookies

This site does not set first-party cookies beyond those required for analytics (only with your consent, see section 3.3). We do not use tracking pixels, retargeting cookies or social media widgets that load third-party scripts without consent.

Cloudflare may set a security cookie (__cf_bm) to detect automated bot traffic. This is strictly necessary and set without consent under Art. 6(1)(f) GDPR.

5. Your rights under GDPR

As a data subject you have the following rights:

• Right of access (Art. 15): obtain a copy of the data we hold about you.
• Right to rectification (Art. 16): correct inaccurate data.
• Right to erasure (Art. 17): request deletion of your data.
• Right to restriction (Art. 18): limit how we use your data.
• Right to data portability (Art. 20): receive your data in machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): withdraw analytics consent at any time without affecting past processing.

To exercise any of these rights, contact us at ···. We will respond within 30 days. You also have the right to lodge a complaint with the Slovak supervisory authority:

Úrad na ochranu osobných údajov SR
Hraničná 12, 820 07 Bratislava
dataprotection.gov.sk

6. International data transfers

Some processors listed above (Google, Cloudflare, Resend) are based in the United States. Transfers are safeguarded by Standard Contractual Clauses (SCCs) adopted by the European Commission, ensuring an adequate level of data protection.

7. Note for visitors from Switzerland (nDSG)

In addition to the GDPR, Swiss residents are protected by the revised Swiss Federal Act on Data Protection (nDSG), which came into force on 1 September 2023 and is substantively equivalent to the GDPR. The rights described in section 5 apply equally under nDSG Art. 25 ff. The competent Swiss supervisory authority is:

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Feldeggweg 1, CH-3003 Bern
edoeb.admin.ch

Note: this policy is written in English. In the event of a dispute, the English version is the authoritative version under both GDPR and nDSG.

8. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available at lemidigitallab.eu/privacy. Material changes will be communicated by updating the "Last updated" date at the top.