Privacy Policy
codium s.r.o. places great emphasis on the security, transparency and lawfulness of processing your personal data.
This document provides comprehensive information on how we collect, process, store and protect your personal data when you use our website www.codium.sk, when you communicate with us, in recruitment processes and in the course of our business relationships.
This policy has been prepared in accordance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR),
- Slovak Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts, as amended,
- Slovak Act No. 452/2021 Coll. on Electronic Communications, as amended.
Note on our products and services: The processing of personal data within the BLUE platform or other software products and services we provide to clients is governed by separate contractual arrangements with the respective client (usually a data processing agreement under Art. 28 GDPR, in which we act as the processor). These activities are not covered by this document.
1. Controller identification
The controller of your personal data is:
Company name: codium, s.r.o.
Registered office: Kálov 356, 010 01 Žilina, Slovak Republic
Company ID (IČO): 47 255 757
Tax ID (DIČ) / VAT ID (IČ DPH): 2024177738, VAT ID: SK2024177738
Registration: Registered in the Commercial Register of the District Court of Žilina, Section: Sro, Insert No. 66485/L
Contact e-mail for data protection matters: hello@codium.sk
(hereinafter the “controller” or “we”)
The controller has not appointed a data protection officer (DPO) under Art. 37 GDPR. You can address any questions and requests concerning the protection of personal data to the contact e-mail above or to the controller’s registered office address.
2. Purposes, legal bases and retention periods
We process your personal data only for clearly defined, legitimate purposes and on the basis of valid legal grounds:
| Purpose of processing | Categories of personal data | Legal basis for processing | Retention period |
|---|---|---|---|
| 1. Handling enquiries and communication via the contact form / e-mail | First name, surname, e-mail address, phone number, company name (if provided), content of the message / enquiry. | Art. 6(1)(f) GDPR (the controller’s legitimate interest in effective communication and in answering general enquiries). | For as long as necessary to handle the enquiry and any follow-up communication, no longer than 6 months after the communication ends, unless a contract is concluded. |
| 2. Concluding and performing contracts with clients and suppliers (natural persons – sole traders) | First name, surname, place of business, company ID, tax ID/VAT ID, bank and payment details, contact details, details of the subject of the contract. | Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures). | For the duration of the contractual relationship and then until the general limitation periods expire (4 years after the contract ends). |
| 3. Communication and cooperation with representatives and employees of B2B partners (legal entities) | First name, surname, job title / position, work e-mail, work phone, employer identification details. | Art. 6(1)(f) GDPR (legitimate interest in the proper performance of the contract with the business partner and in operational communication) in conjunction with Section 78(3) of Act No. 18/2018 Coll. | For the duration of the contractual relationship with the respective partner and then until the limitation periods for the protection of legal claims expire (4 years). |
| 4. Accounting and compliance with tax obligations | Billing details, name and surname of the sole trader, address, company ID, tax ID, payment details, details of goods and services supplied. | Art. 6(1)(c) GDPR (compliance with legal obligations under Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on VAT). | 10 years following the year to which the accounting documents relate. |
| 5. E-mail direct marketing to existing customers (soft opt-in) | First name, surname, e-mail address, purchase / order history. | Art. 6(1)(f) GDPR (legitimate interest in promoting our own similar products and services) in conjunction with Section 116(15) of Act No. 452/2021 Coll. | For the duration of the contractual relationship and no longer than 1 year after it ends (Section 116(16) of Act No. 452/2021 Coll.), or until you object (unsubscribe). |
| 6. General direct marketing (newsletter, offers – non-clients) | First name, surname, e-mail address, phone number. | Art. 6(1)(a) GDPR (consent of the data subject) in conjunction with Section 116(3) of Act No. 452/2021 Coll. | Until consent is withdrawn (no longer than 3 years after it was given). We keep records of consent being given and withdrawn for at least 4 years after withdrawal (Section 116(5) of Act No. 452/2021 Coll.). |
| 7. Recruitment for open job positions | First name, surname, academic title, contact details, address, CV details (education, experience), cover letter. | Art. 6(1)(b) GDPR (measures taken at the applicant’s request prior to entering into an employment contract). | Until the recruitment process for the given position ends. Once the selection is over, the data of unsuccessful applicants is deleted without undue delay. |
| 8. Maintaining a database of job applicants (talent pool) | Applicant’s identification and contact details, CV, overview of qualifications and experience. | Art. 6(1)(a) GDPR (the applicant’s explicit and voluntary consent given for this purpose). | For the period stated in the consent, usually 1 to 2 years, or until consent is withdrawn. |
| 9. Establishing, proving and defending legal claims (disputes) | Data from contracts, invoices and mutual communication, records of disputes and receivables. | Art. 6(1)(f) GDPR (legitimate interest in protecting the controller’s property and legal defence). | Until the relevant limitation periods expire (4 years); in the event of a dispute, for the entire duration of the proceedings and until the decision is enforced. |
| 10. Records management and archiving | Registry records and files according to their subject matter. | Art. 6(1)(c) GDPR (compliance with a legal obligation under Act No. 395/2002 Coll. on Archives and Registries). | According to the retention periods set out in the controller’s records retention schedule. |
Information on the processing of personal data through online identifiers and analytics/marketing tools can be found in the separate Cookie Policy.
3. Source of personal data
- Directly from you: We obtain most personal data directly from you (by filling in the contact form, through direct e-mail communication, by submitting a job application or by concluding a contract).
- From a third party (B2B partners): If you are an employee or representative of our contractual partner (a client or supplier), we obtained your basic identification and contact details from your employer in connection with our mutual business relationship.
- From public registers: Where justified, we may verify basic identification details in publicly available registers (the Commercial Register of the Slovak Republic, the Trade Register of the Slovak Republic, the register of VAT payers).
4. Recipients of personal data
We disclose your personal data only to the extent necessary and only to vetted parties:
- Processors (service providers): Parties that provide external services to us under a written data processing agreement pursuant to Art. 28 GDPR:
- web hosting and cloud infrastructure providers,
- accounting, tax and payroll service providers,
- providers of IT administration, system maintenance and software tools,
- providers of e-mail distribution tools.
- Independent controllers: Attorneys and legal advisers (bound by statutory confidentiality), auditors, banks, postal and courier services.
- Public authorities: Courts, law enforcement authorities, tax offices, the Slovak Trade Inspection or the Office for Personal Data Protection of the Slovak Republic, where we are required by law to disclose the data.
5. Transfers of personal data to third countries
We primarily process and store your personal data within the European Union (EU) and the European Economic Area (EEA).
Data is transferred to third countries (mainly the USA) only when we use global cloud and analytics services (Google Ireland Ltd., Meta Platforms Ireland Ltd., Microsoft Ireland Operations Ltd. / LinkedIn). These transfers are legally safeguarded by:
- The European Commission’s adequacy decision (EU-U.S. Data Privacy Framework – DPF): Google LLC, Meta Platforms, Inc. and Microsoft Corporation are certified participants in the DPF, which guarantees an adequate level of protection comparable to that in the EU.
- Standard contractual clauses (SCC): Where DPF certification does not apply, transfers are safeguarded by standard contractual clauses adopted by the European Commission under Art. 46 GDPR, supplemented by additional security and encryption safeguards.
6. Automated individual decision-making and profiling
The controller does not carry out automated individual decision-making or profiling within the meaning of Art. 22 GDPR that would produce legal effects concerning data subjects or similarly significantly affect them.
7. Obligation to provide personal data and consequences of not providing it
- Performance of a contract: Providing personal data for the purpose of concluding and performing a contract is a contractual requirement. Without it, the contract cannot be concluded or properly performed.
- Legal obligation: Providing data for tax and accounting purposes is a statutory requirement. Without it, we cannot issue tax documents in accordance with the law.
- Handling an enquiry: Providing data in the contact form is voluntary; however, without contact details we are unable to respond to your enquiry.
- Consent (marketing, applicant database): Providing data is entirely voluntary. Not giving consent has no negative legal consequences for the use of our main services.
8. Rights of the data subject
As a data subject, you have the following rights under the GDPR and the Act on the Protection of Personal Data:
- Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether we process personal data about you and, if so, to access it and receive a copy of the data being processed.
- Right to rectification (Art. 16 GDPR): You have the right to have inaccurate data concerning you corrected, or incomplete data completed, without undue delay.
- Right to erasure (“right to be forgotten”) (Art. 17 GDPR): You have the right to have your personal data erased if it is no longer necessary for the purposes for which it was collected, if you withdraw your consent and there is no other legal basis, or if it has been processed unlawfully.
- Right to restriction of processing (Art. 18 GDPR): You have the right to request that the processing of your data be suspended (e.g. while its accuracy is being verified or while an objection is being examined).
- Right to data portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller.
- RIGHT TO OBJECT (Art. 21 GDPR):
- Legitimate interest: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data based on legitimate interest (Art. 6(1)(f) GDPR). In that case, we will no longer process the data unless we demonstrate compelling legitimate grounds that override your interests or rights.
- DIRECT MARKETING: If you object to the processing of personal data for direct marketing purposes, your personal data will IMMEDIATELY CEASE TO BE PROCESSED for this purpose without any further assessment.
- Right to withdraw consent at any time: Where processing is based on consent (Art. 6(1)(a) GDPR), you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
- Right to lodge a complaint with the supervisory authority: If you believe that your rights are being infringed in the processing of personal data, you have the right to file a petition to initiate personal data protection proceedings with the supervisory authority:
- Office for Personal Data Protection of the Slovak Republic
- Address: Galvaniho 7/B, 820 07 Bratislava 27
- Web: dataprotection.gov.sk
- E-mail: statny.dozor@pdp.gov.sk
9. How to exercise your rights and deadlines
- How to exercise your rights: You can exercise your rights in writing at the controller’s registered office address or electronically at the e-mail address hello@codium.sk.
- Response time: In accordance with Art. 12(3) GDPR, we will provide you with information on the action taken without undue delay and in any event within one month of receiving your request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receiving the request, together with the reasons for the delay.
- Free of charge: We handle requests free of charge. However, where requests are manifestly unfounded or excessive (in particular because of their repetitive character), we may charge a reasonable fee taking into account the administrative costs, or refuse to act on the request.
10. Security of personal data
The controller has adopted appropriate technical and organisational measures to ensure a level of security appropriate to the risk in accordance with Art. 32 GDPR. These measures include in particular:
- encrypted communication on the website via the HTTPS protocol (SSL/TLS certificate),
- strict management of access rights to internal systems and databases on a “need-to-know” basis,
- regular backups and antivirus protection of servers and workstations,
- payment processing exclusively through licensed and certified payment gateways with bank-level security (PCI DSS compliant partners).
11. Final provisions
The controller reserves the right to update this policy due to legislative changes or changes to its processing procedures. The current version is always published on this page.
Last updated: 28.9.2026