This policy explains how Skabro s. r. o. processes personal data collected through skabro.eu, in accordance with Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on personal data protection.
1. Who we are
The controller of your personal data is Skabro s. r. o., with registered office at Zuzany Chalupovej 4029/9, 851 07 Bratislava - mestská časť Petržalka, Slovakia, IČO 56788207, registered in the Commercial Register of Mestský súd Bratislava III, section Sro, insert no. 185366/B.
For any question about this policy or about how we handle your data, write to hello@skabro.eu. We have not appointed a Data Protection Officer, as we are not required to do so.
2. Data we process
Contact form and email. When you contact us we process the name, company name, email address and any information you choose to include in your message. Providing this data is voluntary, but without an email address we cannot reply.
Technical data. Our hosting provider records standard server log data, including IP address, request time, requested resource, browser type and referring page. These logs are used to operate and secure the site.
Where it comes from. We collect personal data directly from you when you write to us or use the form, and automatically from your device through server logs. We do not buy personal data and we do not obtain it from data brokers or public profiles.
Anti-abuse data on the contact page. The enquiry form and the “show phone number” button are both protected by Google reCAPTCHA, which collects information about your browser, device and interaction with the page in order to score how likely the request is to be automated, and sets a cookie in Google’s domain. We store the resulting score with your enquiry. This happens on the contact page only, and only there because that is where both of those things are. If you would prefer not to involve Google, email us at hello@skabro.eu instead - it reaches the same inbox.
Showing you our phone number. The number is not printed on the site; it is held by our form backend and sent to your browser when you ask for it. To stop that being used to harvest it, we count requests per visitor: your IP address is hashed - turned into an irreversible digest, never stored in its readable form - and that digest is kept with the reCAPTCHA score for 24 hours, purely so the hourly limit can be enforced, then deleted automatically. Nothing else about the request is recorded: no browser, no device, no page. We cannot tell from it who asked, and we do not try.
Cookies and device storage. This site sets no cookies of its own, on any page, and on eight of its nine pages stores nothing on your device at all. On the contact page the reCAPTCHA described above accounts for two things and nothing else: a cookie Google sets in its own domain, and one reCAPTCHA entry written into your browser’s local storage under skabro.eu when a check actually runs. Neither is set, read or used by us. Both are itemised in our Cookie Policy.
3. Purposes and legal bases
Where we rely on legitimate interest, the interests we are pursuing are: keeping the site available and free of attack; keeping the contact form usable by preventing automated abuse of it; keeping our telephone number out of the bulk-harvested lists that make a published number unusable; and being able to pick up a conversation you started with us. In each case we considered whether the processing was proportionate to that interest and whether it overrides your own - which is why the follow-up window is finite, the anti-abuse checks run on one page rather than all nine, the hashed record behind the phone number is deleted after 24 hours, and none of it is used for analytics, advertising or measurement. You can object to any of it at any time under section 7.
4. How long we keep it
The periods below are the ones we hold ourselves to, and each is an outer limit rather than a target:
- Enquiries that do not lead to an engagement - up to 24 months from your last message, so we can follow up on the conversation, after which they are deleted.
- Data related to a contract - for the duration of the contract, and afterwards for as long as Slovak accounting and tax legislation requires, which for accounting records is ten years from the end of the accounting period they concern.
- The reCAPTCHA score stored with a submission - deleted with the enquiry it belongs to, under whichever of the two periods above applies. It has no life of its own. What Google keeps at its end is governed by Google’s policy, not ours.
- The hashed record behind a phone-number request - 24 hours, deleted automatically. It exists only to enforce the hourly limit on how often the number can be requested, and it is pruned by the same operation that serves the next request, so there is no scheduled job that could quietly stop running.
- Submissions our anti-abuse checks flag as automated - within the same 24 months, and usually far less. They are stored rather than discarded, and not emailed on, so that a wrongly flagged message can be found and answered instead of vanishing silently. That is the only reason they are kept at all.
- Server logs - held by our hosting provider under its own retention schedule, which is short and set by them rather than by us. We do not copy them into any system of ours, we do not use them for anything but serving and securing the site, and we do not combine them with the enquiry data above. If you need the provider’s exact period in order to make a request, write to hello@skabro.eu and we will get it for you.
5. Who receives your data
We do not sell personal data, we do not share it for advertising, and we do not send marketing or newsletter emails. Data may be processed on our behalf by service providers acting as processors - website hosting, form handling, email delivery, payment processing and, where relevant, accounting services - each bound by a data processing agreement. Data may also be disclosed to public authorities where we are legally required to do so.
Two of those are worth naming, because they are the ones that actually hold what you send us: the site is hosted by Netlify, and enquiries submitted through the form are stored in a Supabase database hosted in Frankfurt. Both act on our instructions under a data processing agreement. If we engage a payment provider for an invoice, it will be a regulated one and it will process card details on its own systems - we never see them.
Google is a separate case, and worth stating plainly. The reCAPTCHA data described in section 2 goes to Google LLC, which uses it for its own purposes as well as ours - improving the service and its general abuse detection. Google is therefore not merely a processor acting on our instructions, and its handling of that data is governed by the Google Privacy Policy rather than by this one. This is the only place on the site where that is true, and it applies only if you use the contact form.
6. Transfers outside the EEA
We prefer providers that process data within the European Economic Area, and choose them that way where there is a reasonable option - the database holding form submissions is hosted in Frankfurt for that reason. Some of the infrastructure this site depends on - website hosting, email delivery and the reCAPTCHA protecting the contact form - is supplied by companies established outside the EEA, principally in the United States, so some processing takes place there.
Where that happens, the transfer is covered by an adequacy decision of the European Commission or by the European Commission’s Standard Contractual Clauses together with the supplementary measures those clauses require. We can tell you which mechanism applies to a particular provider on request - write to hello@skabro.eu.
7. Your rights
Your right to object. Where we process your personal data on the basis of our legitimate interests - the four purposes named in section 3 - you have the right to object to that processing at any time, and to do so simply by telling us. Write to hello@skabro.eu and say you object. We will then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms; if we think we can, we will explain why rather than just continue. You do not need to give a reason and there is no cost.
Your other rights. Under the GDPR you also have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict processing, and to receive your data in a portable format. Where processing is based on consent, you may withdraw it at any time without affecting processing carried out beforehand.
To exercise any of these rights, write to hello@skabro.eu. We may ask you to confirm your identity before acting on a request. We answer within one month, as Article 12(3) of the GDPR requires - extendable by up to two further months where a request is complex or where we have received several from you at once. If that applies we will tell you inside the first month, with the reason.
You also have the right to lodge a complaint with the Slovak supervisory authority, Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, or with the supervisory authority in the EU or EEA country where you live or work.
8. Security and automated decisions
We apply appropriate technical and organisational measures to protect personal data, including encrypted transport, restricted access and regular review of the systems we use. We do not carry out automated decision-making or profiling that produces legal effects. No system can be guaranteed completely secure, and ordinary email is not a secure channel - please do not send credentials or confidential material to us by email before a confidentiality agreement is in place.
9. Children’s data
This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data relating to a child. If you believe a child has sent us personal data, write to hello@skabro.eu and we will delete it.
10. Changes to this policy
If this policy changes, the updated version will be published on this page with a new date, and that version applies from the date it is published. Where a change materially affects how we process your data and the law requires us to tell you directly, we will.