1. Controller and contact
The controller is Štefan Müller – steveprojects, a sole trader in Slovakia. Please use the email addresses below for privacy questions or to exercise your rights. No separate data protection officer is listed.
Privacy Notice
How this website handles your information
This notice covers visits to steveprojects.com and enquiries through the website. Processing of client project data is dealt with separately where needed.
2. Contact form
We process the email address and message you provide, together with submission time, IP address, browser user agent and host, to respond, consider a potential contract and investigate abuse. The legal basis is Article 6(1)(b) GDPR for pre-contract steps requested by you; other enquiries and abuse prevention rely on our legitimate interest under Article 6(1)(f).
Providing an email address and message is voluntary, but we cannot respond without them. Do not send passwords, health information or other special-category data through the public form. We do not use a form submission to add you to a newsletter or automated marketing list.
3. Technical operation and local storage
A PHP session cookie is necessary for the form's CSRF protection; it is not an advertising cookie. Browser local storage remembers a language you select (HU/SK/EN). The cookie is session-based; the language choice remains until you remove it in the browser.
A SHA-256 digest of your IP address and submission timestamps are held in temporary server storage to enforce a 60-second interval and a limit of four submissions per hour. Entries older than an hour are pruned on later requests; physical removal of the temporary file also depends on hosting operations. The legal basis is our security-related legitimate interest under Article 6(1)(f) GDPR.
4. Fonts and service providers
This website loads fonts through Google Fonts. Your browser may therefore connect directly to Google servers and send technical data, especially your IP address and browser information. Contact messages pass through the hosting provider's mail system and arrive in a domain mailbox and a Google Gmail mailbox.
Hosting, email and infrastructure providers may receive data needed for their roles. Google services may involve processing outside the EEA; you can ask the controller for information about applicable safeguards. The website currently has no advertising or visitor analytics tracking script.
5. Retention
We keep enquiries while responding and considering a potential contract, and afterwards for as long as reasonably needed to establish or defend legal claims. Contract and invoice data, where relevant, follow statutory retention duties. The controller reviews whether mailbox messages are still needed once their purpose ends.
Hosting and email providers may apply their own technical-log retention rules. We can provide further details on actual periods for particular data categories on request.
6. Your rights
You may request access, correction, erasure and restriction, and portability where its conditions apply. You may object to processing based on legitimate interests. If processing were based on consent, you could withdraw it, but the contact form does not rely on consent.
Send requests to either listed email address; we respond within the GDPR time limits. You may complain to the Slovak Data Protection Authority or another competent supervisory authority under the GDPR.
7. Security and automated decisions
HTTPS, access controls, form validation, CSRF protection and submission limits help protect data. No internet service can promise zero risk. Technical filtering of submissions is not automated decision-making with legal or similarly significant effects under Article 22 GDPR.
8. Changes and legal framework
We update this notice when actual processing changes. Regulation (EU) 2016/679 and Slovakia's Act No. 18/2018 Coll. apply in particular. A new version does not retrospectively change the lawfulness of earlier processing.