1. Operator

The controller of personal data is:

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Act No. 18/2018 Coll. on the Protection of Personal Data and other legal regulations that apply to specific processing.

2. Who is affected by the processing?

We may process personal data in particular about:

• website visitors,
• persons who contact us or request a consultation,
• registered users of the Library,
• paid access users L2 and L3,
• professional services clients,
• contact and billing persons of clients,
• persons who exercise a complaint, withdrawal from the contract or other right.

3. What personal data may we process?

The scope of data depends on which part of the portal or service you use.

Identification and contact details

This may include in particular:

• first and last name,
• business name,
• email and phone,
• mailing or billing address.

Company and billing information

This may include in particular:

• Company ID, VAT ID and VAT ID, if applicable,
• billing information,
• invoice, payment and payment status data.

Account and membership details

This may include in particular:

• user account identification,
• account email,
• access level L1, L2 or L3,
• monthly or annual paid access option,
• start and end of the period and expiration date,
• records needed for secure access management.

Communication data

This may include in particular:

• content of messages and forms,
• email communication,
• data necessary to process a request, complaint or withdrawal from a contract.

Technical and safety data

Depending on the function used, this may include, for example, IP address, browser and device type, connection data, security and server logs, cookies and other technical identifiers.

To protect selected forms from automated abuse, we use Cloudflare Turnstile. For security verification, Cloudflare may process in particular the IP address, browser and connection data, technical security signals, User-Agent, TLS fingerprint, Sitekey and the associated request origin. Turnstile is used to distinguish a regular visitor from automated traffic and to protect forms from bots. Cloudflare states that Turnstile does not access message content, form data or other page content when providing this security feature.

Analytical data

If you consent to statistics, we use Google Analytics 4 to measure website traffic and usage. Depending on the specific visit, this may include:

• online and cookie identifiers used to distinguish visits and sessions,
• information about viewed pages and events on the website,
• time and technical data about the visit,
• browser and device type data,
• approximate geographical data derived from the technical connection data.

According to Google, Google Analytics 4 does not record or store individual IP addresses for visits from users in the European Union, Switzerland, and the United Kingdom. The IP address may be used to derive an approximate geographic location upon collection and is then discarded before storing the analytics data.

A detailed list of cookies, their purpose, provider, validity period and category is maintained in the document
Cookie Policy (EU).

4. For what purposes and on what legal basis do we process data?

If processing is necessary for the performance of a contract or legal obligation, we do not use consent as a substitute for this legal basis.

5. What data is needed?

We need some data to conclude or perform a contract, create and maintain an account, activate paid access or issue an invoice. If you do not provide this data, it may not be possible to provide the relevant service or feature.

We do not request data from you that is not necessary for a specific purpose without reasonable cause.

6. How long do we keep data?

We retain personal data only for the period necessary for the purpose for which it was collected or for the period required by law.

The retention settings in Google Analytics 4 do not apply in the same way to all aggregated reports of the service. The validity periods of specific analytical cookies are specified in the current
Cookie Policy (EU).

If a legal dispute, inspection or other proceeding is ongoing, we may retain relevant data for longer to the extent necessary to resolve it.

7. To whom personal data may be disclosed

To the extent necessary, personal data may be processed or received in particular by:

• hosting and email infrastructure provider,
• SuperInvoice for invoicing and recording payments,
• accounting and tax service providers,
• banks and payment infrastructure for bank transfers,
• technical support or security providers, if their access is necessary,
• Cloudflare, Inc. when using Cloudflare Turnstile to protect forms from bots and automated abuse,
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, when providing Google Analytics 4 after consenting to statistics,
• public authorities, if required by law,
• legal or professional advisors, if necessary to protect rights.

In providing Turnstile to protect our website, Cloudflare processes security signals on our behalf. Cloudflare also states that it acts as a separate controller when processing signals to improve Turnstile's ability to detect bots.

When providing Google Analytics 4, Google processes analytics data in accordance with the Google Analytics Terms of Service and the applicable data processing terms.

8. Transfers of personal data outside the EEA

Some technology service providers operate globally. If a particular service or technology involves the transfer of personal data outside the European Economic Area, the appropriate legal mechanisms and safeguards under the GDPR are in place.

When using Cloudflare Turnstile Data processing may occur outside the EEA, including the United States of America. Mechanisms and safeguards are used for international transfers in accordance with applicable law.

When using Google Analytics 4 After collection, analytics data may be further processed within Google's global infrastructure. Google applies legal mechanisms for international transfers that comply with applicable legal requirements.

According to Google, when users from the European Union visit, Google Analytics only uses the IP address to derive approximate geographic data and then discards it before storing the analytics data.

9. Automated decision-making

We do not carry out automated individual decision-making or profiling that would produce legal effects on you or similarly significantly affect you within the meaning of Article 22 of the GDPR.

Technical adjustment or termination of the Library's access level based on payment status and expiration date constitutes implementation of the agreed access conditions, not marketing profiling.

We use Google Analytics 4 for statistical measurement of website traffic and usage, not for automated individual decision-making towards visitors. In our current setup, we do not use advertising profiles or advertising personalization features of Google Analytics.

10. Your rights

Under the terms of the GDPR, you have the right in particular to:

• obtain information about whether we are processing your personal data,
• to access personal data,
• to correct incorrect or incomplete data,
• to delete data if legal conditions are met,
• to restrict processing,
• object to processing based on legitimate interest,
• to data portability, if the legal conditions are met,
• withdraw consent at any time, if the processing is based on consent; the withdrawal does not have a retroactive effect on the lawfulness of the previous processing,
• file a motion to initiate proceedings or a complaint with the supervisory authority.

You can exercise your rights at
info@pepax.sk.
If necessary to protect your data, we may reasonably verify the identity of the applicant before processing the request.

11. Supervisory authority

The supervisory authority is:

Current contact details are available on the website of the Personal Data Protection Office of the Slovak Republic.

12. Cookies and similar technologies

A detailed list of cookies used, their purpose, provider, validity period and category is maintained in the document
Cookie Policy (EU),
which is updated according to the actual website settings.

We use strictly necessary cookies only to the extent necessary for the website or service requested by the user to function.

In our current setup, we do not use Google marketing tags, Google Analytics advertising personalization features, Google Signals, or the collection of data provided by users.

We use Cloudflare Turnstile as a security technology to detect automated form abuse, not for advertising or marketing profiling. The current Turnstile configuration does not use Pre-clearance mode.

You can refuse consent or change it later through cookie settings.

13. Security of personal data

We use appropriate technical and organizational measures according to the nature of the processing. These include in particular:

• authorization management,
• user account protection,
• HTTPS,
• backup,
• restriction of access to internal records and billing data,
• protection of selected forms using Cloudflare Turnstile,
• Managing consent to statistical cookies before launching Google Analytics 4.

If a security incident occurs, we proceed according to its severity and legal reporting obligations.

14. Changes to this information

We may update this information if the purposes of processing, services used, technical settings or legal requirements change.

If the change affects how we use analytics or other optional technologies, we will also align the relevant consent settings and cookie documentation.

The current version is always published on this page.