Privacy Policy

Last updated: 15 October 2026

This Privacy Policy explains how we process the personal data of visitors to castledigital.eu, of people interested in our services and of our clients. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, “GDPR”) and the Slovak Act No. 18/2018 Coll. on the Protection of Personal Data.

1. Data controller

We have not appointed a Data Protection Officer. You can contact us with any questions about the protection of your personal data using the details above.

2. What data we process, for what purpose and on what legal basis

2.1 Contact form

• Data: name, email address, company name or website (optional) and the content of your message.
• Purpose: handling your request, answering your question, preparing a quote.
• Legal basis: your consent given by ticking the box in the form (Art. 6(1)(a) GDPR). If your message is an enquiry about our services, we also process the data to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Retention period: for as long as necessary to handle your request, and no longer than 2 years from our last communication unless a contractual relationship arises between us.

You can withdraw your consent at any time by email to contact@castledigital.eu. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

2.2 Communication by email, phone and social media

• Data: contact details and the content of the communication.
• Purpose: answering your questions and enquiries.
• Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in replying to messages we receive (Art. 6(1)(f) GDPR).
• Retention period: no longer than 2 years from our last communication unless a contractual relationship arises.

2.3 Performance of contracts with clients

• Data: identification and contact details of the client and its contact persons, billing details.
• Purpose: concluding and performing the contract, invoicing, accounting.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR), in particular under the Slovak Act No. 431/2002 Coll. on Accounting.
• Retention period: for the duration of the contract and then for the period required by law (accounting documents are kept for 10 years).

2.4 Spam protection (Cloudflare Turnstile)

Our forms are protected by Cloudflare Turnstile, a service of Cloudflare, Inc., which checks whether a form is being filled in by a human or by an automated program. To do so, the service processes technical data about your device and browser, including your IP address. Turnstile is not used for advertising.

Legal basis: our legitimate interest in protecting the website against abuse and spam (Art. 6(1)(f) GDPR).

2.5 Cookies and analytics

We use analytics tools (Google Analytics 4) only with your consent given in the cookie banner (Art. 6(1)(a) GDPR and Section 109(8) of the Slovak Act No. 452/2021 Coll. on Electronic Communications). We currently do not use advertising cookies. You will find more details in our Cookie Policy.

2.6 Map on the Contact page

On the Contact page we can display a map from the Google Maps service (Google Ireland Limited). The map only loads after you allow Functional cookies in the cookie banner or click the “Show map” button. Until then, no data is sent to Google. Once the map loads, Google may process your IP address and technical data about your browser and store its own cookies.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings.

2.7 Our social media profiles

We run profiles on Facebook and Instagram. If you communicate with us on these networks, we process the data you provide to us. For the statistics on visits to our profiles, we are joint controllers with Meta Platforms Ireland Limited. The processing of data by Meta itself is governed by Meta’s own privacy policy.

3. Recipients of personal data

We do not provide personal data to third parties for their own marketing purposes. The following may have access to the data:

• our web hosting and email service provider,
• Google Ireland Limited (Google Analytics, Google Maps),
• Cloudflare, Inc. (Turnstile spam protection),
• the provider of the CookieYes consent management tool,
• our external accountant (for clients),
• public authorities, where required by law.

4. Transfers of data outside the EU

Google and Cloudflare may transfer data to the United States. These companies participate in the EU–U.S. Data Privacy Framework or ensure the transfer by means of standard contractual clauses approved by the European Commission.

5. Automated decision-making and profiling

We do not carry out automated decision-making that would have legal effects on you.

6. Your rights

You have the right to:

• access your personal data (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interest (Art. 21 GDPR),
• withdraw your consent at any time.

You can exercise your rights by email to contact@castledigital.eu. We will reply without undue delay and within one month at the latest.

If you believe that the processing of your data violates the law, you have the right to lodge a complaint with a supervisory authority — in Slovakia, the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk), or the supervisory authority in the EU member state where you live or work.

7. Data security

The website is protected by an encrypted connection (HTTPS). Personal data can only be accessed by authorised persons who need it to perform their tasks.

8. Changes to this policy

We may update this policy, for example when the tools we use or the law change. The current version is always published on this page.