Privacy Policy

The controller responsible for data processing on this website is: NDVDL s.r.o. Rázusovo nábrežie - HUMA 6 811 02 Bratislava Slovak Republic IČO: 52603750 DIČ: 2121130814 IČ DPH: SK2121130814 Managing Director: Christian Starzengruber Phone: +43 800 007075 Email: office@ndvdl.io

When visiting our website, our web server automatically collects the following data (server log files): • IP address of the requesting computer • Date and time of access • Name and URL of the retrieved file • Amount of data transferred • Browser type and version • Operating system used • Referrer URL (previously visited page) This data is used exclusively to ensure trouble-free operation of the website and to improve our services. It is automatically deleted after 30 days. We cannot link this data to a specific person. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical provision of the website).

When you contact us via the contact form, the following data is collected: • Name • Email address • Message content This data is used exclusively to process your inquiry and is deleted after complete processing and expiry of any legal retention periods, unless a contractual relationship is established. Processing is carried out via the email service provider Resend (Resend, Inc., San Francisco, USA). Their privacy policy applies. Data transfer to the USA is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

We distinguish between two kinds of cookies and comparable storage technologies. **Strictly necessary cookies** — the site does not work without them. They are set without consent: • Language preference (next-intl): stores your chosen language • Consent record (ndvdl_consent, localStorage): stores exactly the choice you made in the cookie banner, with a timestamp — the only way your choice can be respected on your next visit and evidenced afterwards • Campaign parameters (ndvdl_campaign, sessionStorage): see the section on campaign parameters Legal basis: Art. 6(1)(f) GDPR in conjunction with § 109 of Slovak Act No. 452/2021 Coll. and § 165(3) of the Austrian Telecommunications Act 2021. No consent is required for strictly necessary storage. **Services requiring consent** — statistics and advertising measurement. These are loaded only after you have agreed in the cookie banner. Without your consent no such script is executed and no connection to the providers concerned is established. Your consent applies for twelve months and can be changed or fully withdrawn at any time via the "Settings" link in the footer. Withdrawal takes effect for the future; the lawfulness of processing carried out until then is unaffected (Art. 7(3) GDPR). Legal basis for these services: Art. 6(1)(a) GDPR (consent).

If you have consented to the "Statistics" category, we use PostHog for audience measurement. The provider for European customers is PostHog BV, Keizersgracht 62, 1015 CS Amsterdam, Netherlands. Data is processed exclusively in PostHog's EU cloud (data centre in Frankfurt am Main, Germany) — there is no transfer to the United States. The following is recorded: • pages visited, time spent and the order of the visit • clicks on buttons and links • whether and at which point an enquiry form was abandoned • browser type, operating system, screen size, approximate region of origin • a randomly generated identifier that makes your visit recognisable — with no link to your name PostHog additionally records the course of your visit (session recording) so we can see where visitors get stuck. **All input fields are masked**: whatever you type into a form — name, company, phone number, message — is not recorded and is not visible in the recording. Collection runs technically via our own domain (ndvdl.io/ingest) and is forwarded from there to PostHog. We use this data solely to understand which content gets read and where our site is hard to follow. There is no disclosure to third parties and no combination with other data sources. Purpose: audience measurement and improvement of the website. Legal basis: Art. 6(1)(a) GDPR (consent). Retention: session recordings for a maximum of 30 days, aggregated usage statistics for a maximum of 12 months. Further information: https://posthog.com/privacy

If you have consented to the "Advertising measurement" category, we load the Google tag (gtag.js) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Its sole purpose is measuring the success of our ads: we want to know which ad an enquiry came from. To that end a conversion signal is sent to Google when the contact form is submitted. Google sets cookies in this context and may also transfer data to the United States; the basis for this is the EU standard contractual clauses (Art. 46(2)(c) GDPR) and Google LLC's certification under the EU-US Data Privacy Framework. Without your consent the Google tag is not loaded — no script appears in the page source and no request is sent to Google. Purpose: measuring the success of advertising. Legal basis: Art. 6(1)(a) GDPR (consent). Further information: https://policies.google.com/privacy

If you reach our site through an advertising link, the address bar contains parameters such as "utm_source", "utm_campaign" or "gclid". We store these parameters in your browser tab's temporary storage (sessionStorage) and pass them along when you submit an enquiry form. The enquiry email then contains a line such as "Campaign: utm_source=google · utm_campaign=it-infrastruktur". These parameters contain no information about you personally; they describe the ad you arrived through. They are processed solely together with your enquiry, are not evaluated beyond that, and are discarded when the browser tab is closed. Purpose: handling your enquiry with knowledge of what it refers to. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in handling enquiries appropriately).

On the page /werkzeuge/e-mail-check you can enter a domain. It is transmitted to our server and used there exclusively to retrieve publicly readable DNS records and the TLS certificate of the associated website. No access to your systems takes place and no port scan is performed. The domain you enter is not stored and not passed on to third parties; the result is produced during the request and returned to you only. To limit abusive bulk queries, your IP address is held in the server’s memory for a maximum of ten minutes and then discarded. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the availability and protection of the service). The IT self-assessment on the page /werkzeuge/it-check runs entirely in your browser. Your answers are transmitted to us only if you explicitly submit the contact form at the end — they then form part of your enquiry and are processed as described under point 3. If you submit nothing, the answers never leave your device and are lost when you close the page.

This website is hosted by Vercel Inc. (440 N Baxter St, Covina, CA 91723, USA). When you visit our website, information (server log files) is automatically transmitted to Vercel's server. Vercel processes data in accordance with its privacy policy. Data transfer to the USA is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable presentation of the website).

Under the GDPR, you have the following rights: • Right of access (Art. 15 GDPR): You may request information about your personal data processed by us. • Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data. • Right to erasure (Art. 17 GDPR): You may request the deletion of your data, provided no legal retention obligation exists. • Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing of your data. • Right to data portability (Art. 20 GDPR): You may request that we provide your data in a machine-readable format. • Right to object (Art. 21 GDPR): You may object to the processing of your data at any time. To exercise your rights, please contact: office@ndvdl.io

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) Hraničná 12 820 07 Bratislava 27 Slovak Republic Phone: +421 2 3231 3214 Email: statny.dozor@pdp.gov.sk Website: www.dataprotection.gov.sk

We employ technical and organizational security measures to protect your personal data against manipulation, loss, destruction, or access by unauthorized persons. Our security measures are continuously improved in line with technological developments. Data transmission between your browser and our server is encrypted via TLS/SSL (HTTPS).

We reserve the right to adapt this privacy policy as needed to ensure it always complies with current legal requirements or to implement changes to our services. The new privacy policy will apply to your subsequent visits.