Privacy Policy (GDPR)

This information explains how Twinly s.r.o. processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter "GDPR") and Slovak Act No. 18/2018 Coll. on the protection of personal data.

1. Personal data controller

The personal data controller is:

Twinly s.r.o. processes personal data in accordance with applicable legislation and takes care of its security and protection.

2. What personal data we process

We only process personal data that is necessary for the purposes of our business. In particular:

• first name and last name
• email address
• phone number
• company name
• billing details (needed to issue payment documents)
• technical data (e.g. IP address, data obtained through cookies)

3. Purpose and legal basis of processing

We process personal data only for clearly defined purposes and on the relevant legal grounds under the GDPR:

4. Who we share personal data with

Your personal data is processed by us and by authorized persons or processors who provide us with technical or administrative services. These are third parties with whom we have data processing agreements:

• Supabase – provides database services and user authentication; processes personal data as a processor
• Stripe – provides card payment services; processes payment data as a processor
• Vercel – provides website hosting; processes technical data as a processor
• Google – provides analytics and SEO tools; processes technical data and cookies as a processor

The processors above are contractually bound to maintain the security and confidentiality of personal data.

5. Personal data retention period

We retain personal data only for the necessary period, which depends on the purpose of processing:

• contact data and contract-related data: for the duration of the contractual relationship and subsequently for the period set by applicable legislation (at least 5 years in connection with accounting and tax regulations)
• billing data: for 10 years in accordance with the Accounting Act
• data obtained on the basis of consent: until consent is withdrawn, at most for the period stated in the consent itself
• technical data and cookies: according to your browser settings, generally until the session ends or until the specific cookie expires

After these periods, personal data is deleted or anonymized.

6. Cookies

Cookies are small text files that are stored in your browser when you visit a website. They allow the website to recognize your device and remember certain information.

What we use cookies for:

• ensuring the functionality of the website
• remembering your preferences and settings
• measuring traffic and analyzing visitor behavior through analytics tools (Google Analytics)

How to reject cookies:

You can control the use of cookies in your web browser settings. Most browsers allow you to block, limit or delete cookies. Please note that rejecting certain cookies may result in limited website functionality.

7. Rights of the data subject

As a data subject, you have the following rights under the GDPR:

• Right of access – you have the right to obtain from us confirmation of whether your personal data is being processed, and if so, the right of access to that data
• Right to rectification – you have the right to have inaccurate personal data rectified without undue delay, and to have incomplete data completed
• Right to erasure ("right to be forgotten") – under certain conditions you have the right to have your personal data erased
• Right to restriction of processing – under certain conditions you have the right to request that we restrict the processing of your personal data
• Right to data portability – you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and the right to transfer that data to another controller
• Right to object – you have the right to object at any time to the processing of your personal data based on legitimate interest; if you object, we will no longer process your data unless there are compelling legitimate grounds or grounds for the establishment, exercise or defense of legal claims
• Right to withdraw consent – where processing is based on your consent, you have the right to withdraw it at any time, in whole or in part, without affecting the lawfulness of processing carried out before the withdrawal
• Right to lodge a complaint – if you believe that the processing of your personal data violates the GDPR or applicable legislation, you have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk

8. Contact for exercising rights

If you wish to exercise any of the rights listed above, have questions about personal data protection or any comments, contact us by email:

office@twinly.eu

We will respond to your request without undue delay, no later than one month from its receipt. In cases of complexity or a high volume of requests, this period may be extended by a further two months; in that case we will inform you of the extension and the reasons.