HERMSTAV

Privacy Policy

Protecting your personal data matters to us. This document explains what personal data we process, why, how long we retain it, and what rights you have under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection.

1. Data Controller

HERMSTAV s.r.o., Závodská cesta 3911/24, 010 01 Žilina, Slovenská republika, IČO: 54 386 926, DIČ: 2121652621, IČ DPH: SK2121652621
Email: info@hermstavsro.sk
Phone: +421 948 763 639

2. What Data We Process and Why

Contact form

When you send an inquiry via the contact form, we process your name, email address, phone number (if provided), and the content of your message. The purpose is handling your inquiry and communicating with you. The legal basis is the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in communicating with prospective clients (Art. 6(1)(f) GDPR).

Subcontractor registration

When you register as a subcontractor, we process the identification and contact details of the company and its contact person (company name, company ID, address, name, email, phone) and any further details you provide (services, certifications, references, pricing and payment terms). The purpose is keeping a register of potential subcontractors and establishing business cooperation. The legal basis is pre-contractual measures (Art. 6(1)(b) GDPR).

Cookies

Non-essential cookies (analytics, marketing) are used solely based on your consent (Art. 6(1)(a) GDPR). See our Cookie Policy for details.

Operational and security logs

When you visit the website, server logs may briefly process your IP address and browser data. The purpose is operating the site and protecting it against attacks and spam. The legal basis is our legitimate interest in website security (Art. 6(1)(f) GDPR).

3. Retention Periods

We retain personal data for the duration of pre-contractual negotiations, for the term of the contract concluded between us, and for the period during which claims arising from the contract exist, until they become time-barred.

Accounting and contractual records and the data contained in them are retained for the periods required by law, but for at least 10 years from their creation and the limitation of the claims arising from them.

Cookies — according to the validity periods listed in the Cookie Policy.

4. Data Recipients

To operate the website and email communication, we use vetted processors (web hosting and email service providers) who process data solely on our instructions. Data may be disclosed to public authorities where required by law.

We provide your personal data in particular to the following recipients / categories of recipients:

  • natural and legal persons involved, within a supply relationship with us or with any of our suppliers, in the performance of the contract concluded with you or in negotiations on concluding such a contract (regardless of the number of tiers at which they are involved in the supply chain),
  • natural and legal persons providing accounting services, tax advisory services, legal services and other advisory services.

However, regardless of the purpose and scope of the processing of personal data, we are entitled to carry out any processing operations with personal data also through any other entity (i.e. a processor within the meaning of Article 4(8) GDPR); this sentence constitutes a general authorisation for the use of processors. Each processor engaged in this way is entitled, for the purpose of fulfilling its respective obligations or exercising its rights, to engage further processors in the processing of personal data. Each further processor may proceed in the same manner, regardless of the number of tiers at which the respective further processor is engaged in the processing of personal data under the relevant contract.

5. Transfers to Third Countries

Your personal data is processed within the European Union and is not transferred to any third country.

6. Your Rights

In connection with the processing of your personal data, you have the following rights:

  1. the right of access – i.e. the right to obtain confirmation as to whether your personal data is being processed and, if so, the right to access that data and information on (i) the purposes of the processing, (ii) the persons or categories of persons to whom the personal data is disclosed, (iii) the envisaged retention period or, where that is not possible, the criteria used to determine it, (iv) your rights (see point b) and below),
  2. the right to rectification – i.e. the right to have inaccurate personal data corrected without undue delay; taking into account the purposes of the processing, you have the right to have incomplete personal data completed,
  3. the right to erasure (“right to be forgotten”) – i.e. the right to obtain from us without undue delay the erasure of personal data concerning you where (i) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the consent on which the processing is based has been withdrawn and there is no other legal basis for the processing, (iii) you exercise the right to object (see point f) below) and no overriding legitimate grounds for the processing exist, (iv) you object to the processing of personal data for direct marketing purposes, (v) the personal data has been unlawfully processed, (vi) the personal data has to be erased for compliance with a legal obligation under EU and/or Slovak law, (vii) the personal data was collected in relation to the offer of information society services addressed directly to a child pursuant to Article 8(1) GDPR,
  4. the right to restriction of processing – i.e. the right to have us restrict the processing of personal data where (i) you contest the accuracy of the personal data, for a period enabling us to verify its accuracy, (ii) the processing is unlawful and you object to the erasure of the personal data and request the restriction of its use instead, (iii) we no longer need the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims, (iv) you have exercised the right to object (see point f) below), pending verification of whether our legitimate grounds override yours,
  5. the right to data portability – i.e. the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format and the right to transmit that data to another controller of your choice without hindrance from us; this right applies where (i) the processing is based on your consent and, at the same time, (ii) it is carried out by automated means,
  6. the right to object – i.e. the right to object at any time to the processing of your personal data, whereby (i) where the processing is based on the performance of our legitimate interests or the performance of our tasks carried out in the public interest, we may no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims, and (ii) where personal data is processed for direct marketing purposes, we must cease such processing,
  7. the right related to automated decision-making – i.e. the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you; this does not apply if the decision (i) is necessary for entering into, or the performance of, a contract between you and us, (ii) is authorised by EU or Slovak law which also lays down suitable measures to safeguard your rights, freedoms and legitimate interests, or (iii) is based on your consent.

You can exercise your rights by emailing info@hermstavsro.sk.

Where the processing of personal data is based on your consent, you have the right to withdraw it at any time; withdrawal does not affect the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with the supervisory authority — Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.

You have the right to request explanations from us regarding the purpose, manner, conditions and scope of the processing of personal data as well as regarding any of your rights. We will provide the necessary explanations and information free of charge and in a form that is understandable to you. Upon request, we will inform you against whom and in what manner you may exercise your rights.

We will respond to your request and provide the relevant information without undue delay; in the case of a more complex or detailed response, we may set a reasonable period for providing the relevant information.

However, we reserve the right to refuse to provide explanations and information as set out here where requests are manifestly unfounded or excessive, in particular because of their repetitive character.

7. Data Security

We have implemented appropriate technical and organisational measures — encrypted data transfer (HTTPS), a secured server, anti-abuse protection of forms, and access to data restricted to authorised persons only.

8. Final Provisions

We may update this policy from time to time; the current version is always published on this page. Effective from: 30 July 2026.