Privacy Policy

Data Controller

• This website is operated by ALLMAT s. r. o., Preseľany 542, 956 12 Preseľany, Slovakia.
• For privacy questions or data requests, contact us at info@allmat.sk or through the public contact page.

Public website usage

• When you browse the public website, technical request data is processed to deliver pages, keep the service secure, remember permitted choices and show the correct language version.
• Public pages may load technical assets needed for the proper operation, security and display of the website.

Contact and quote inquiries

• When you submit the contact form, we process your name, email, phone, optional service interest, message, form language, source path, privacy acknowledgement and any uploaded images you choose to send.
• The data is used to understand the inquiry, assess the practical project context, respond to you and manage follow-up communication.
• The required checkbox confirms that you have read this Privacy Policy and understand that the submitted data is needed to handle the inquiry.
• The contact form is a lightweight quote/contact flow. It does not create an account, CRM record, database record or stored upload record on this website.

Uploaded images and browser-side compression

• Uploaded images are used only to understand and process your inquiry.
• The form accepts JPG and PNG images, up to 5 images, with server-side limits on each file and on total upload size.
• Before sending, the browser may compress and resize selected images to JPEG format so the inquiry can be delivered reliably.
• Uploaded images are sent to Allmat internally as email attachments through Resend. The customer confirmation email does not attach the images; it only confirms that the inquiry and uploaded images were received.
• Uploaded images are not stored in an application database or separate file storage by this website.

Transactional emails

• We use Resend to send internal inquiry notifications to Allmat and customer confirmation emails.
• Internal notification emails may include the inquiry text, contact details and uploaded image attachments. Customer confirmation emails include the inquiry content and, where relevant, a note that images were received, but do not attach the uploaded images.
• Email delivery may involve recipient address, sender address, message content needed for the email, delivery metadata and provider message identifiers.

Hotjar analytics

• Hotjar loads only after analytics consent, only in production, and only on eligible public pages.
• We use Hotjar to understand how visitors use the public website so we can improve usability.
• We do not intentionally use Hotjar Identify, custom user IDs, user attributes or form metadata.
• The contact page is excluded from Hotjar loading in the current implementation.

Google Ads conversion tracking

• Google Ads / Google tag loads only after marketing consent.
• Marketing measurement is used to evaluate advertising conversions, including contact clicks and successful contact-form submissions.
• Google Ads may process technical browser data, page context, consent state and conversion-event data according to Google configuration and applicable service terms.

Cookies and browser storage

• Necessary cookies store your analytics and marketing consent choices. Optional analytics and marketing cookies/storage are used only after the relevant consent.
• The Cookie Policy explains the current categories, service names, known storage names and how to change or withdraw your choices.

Processors and recipients

• We use the processors and recipients listed below to operate the website, deliver email, protect and route inquiries, provide analytics after consent, measure advertising after consent and maintain technical logs.
• Access is limited to authorized persons and providers that need the data for the described purposes.

International transfers

• Some providers may process data outside the European Economic Area. Where this happens, we rely on appropriate contractual and technical safeguards such as data processing agreements and standard contractual clauses where required.
• The exact transfer path can depend on provider configuration, routing, support and infrastructure availability.

Security

• We protect the service with measures such as consent controls, same-origin checks, rate limiting, honeypot checks, upload type and size limits, image validation, no-store contact responses and security headers.
• No online service is risk-free, but appropriate technical and organisational measures are implemented according to the sensitivity of the processed data.

Children

• This website is intended for business, customer and professional use and is not directed at children.
• If we learn that children's personal data was provided without an appropriate reason or authority, we will restrict or delete it where required.

Automated decision-making and AI

• The service does not make decisions with legal or similarly significant effects solely by automated means.
• Contact form text and uploaded images are not processed by AI in the current implementation.

Your rights and complaint authority

• Depending on the situation, you may request access, correction, deletion, restriction, portability, objection or withdrawal of consent where consent is the legal basis.
• You may also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic if you believe your data is processed unlawfully.
• We may need to verify your identity before acting on a request.

Processors and recipients

This table lists the services and recipient categories used by the current Allmat implementation.

Retention overview

Retention depends on the data type, business context, security need and legal obligations.