Privacy policy.

Who is the controller

The controller is STENVARD s.r.o., Company ID 57 713 880, Solivarská 14E, 080 05 Prešov, Slovakia, represented by Norbert Kovalčín. Send data-subject requests to mail@nkovalcin.com.

What data is collected

Briefs and bookings

When you submit a brief through the contact form or book a call, we store: your name, email, chosen project type and budget, your message or call topic, the submission time, a hash of your IP address, and your browser's user-agent string. The data is held in Kovrin, my system of record hosted in the EU. Legal basis: your consent (GDPR Art. 6(1)(a)) and steps prior to entering a contract (Art. 6(1)(b)).

Newsletter signup

I'm not publishing a newsletter at the moment and don't accept new sign-ups. For earlier sign-ups we keep only the email, an IP hash and the sign-up source. Legal basis: your consent (Art. 6(1)(a)). Unsubscribe through the link in your confirmation email or by writing to mail@nkovalcin.com.

Admin authentication

The admin area uses a single encrypted HTTP-only session cookie (nk_admin_session) for Norbert's login only. No user accounts, no tracking. This cookie is strictly necessary and does not require consent under the ePrivacy Directive.

Analytics

The site uses Conseto, my own consent and analytics tool (hosted in the EU, Frankfurt). Before consent it counts visits without cookies and without storing an identifier. With analytics consent it also turns on Google Analytics 4; with marketing consent, Meta ad measurement. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw any time through Cookie settings in the footer. Details are in the cookie policy.

Processors and sub-processors

• Vercel Inc. (USA; the site and Kovrin run in the EU, Frankfurt region; DPA and SCCs) – hosting for the site and Kovrin.
• Supabase Inc. (database in the EU, AWS Frankfurt) – Kovrin storage for briefs, bookings and subscribers.
• Neon (Frankfurt region) – the site's database for the archive of sent newsletters.
• Conseto (my own product; Frankfurt) – consent management and traffic analytics.
• WEBGLOBE s. r. o. (Websupport) (Slovakia) – sending email from mail@nkovalcin.com, in transit only.
• Google Ireland Limited – Google Analytics 4 (only with consent) and Google Meet for booked calls.
• Meta Platforms Ireland Limited – ad measurement, only with marketing consent.

How long we keep it

• Briefs and bookings: for as long as the business relationship, or talks about one, are active. Deleted within 14 days on request.
• Newsletter subscribers marked active: for as long as you stay subscribed.
• Newsletter subscribers marked unsubscribed: we keep the email flagged as unsubscribed so nothing is ever sent to you again. Fully deleted on request.
• IP hash: stored with the record it belongs to and deleted with it. We never store the IP address itself.

Your rights

Under GDPR (EU 2016/679) you can request access, rectification, erasure, restriction, portability, and objection to processing. Email mail@nkovalcin.com and expect a response within one working day.

You also have the right to lodge a complaint with the Slovak supervisory authority (Úrad na ochranu osobných údajov, dataprotection.gov.sk).

International transfers

The site and Kovrin run in the EU (Vercel and Supabase in Frankfurt); email goes out through Websupport in Slovakia. Vercel, Google and Meta have US parent companies; any transfer is covered by Standard Contractual Clauses and the EU-US Data Privacy Framework. Google and Meta receive data with an identifier only after you consent.

Changes to this policy

Every change gets a fresh Last updated date below. Material changes in purpose or processors will be announced by email to active newsletter subscribers.