Privacy Policy
Introduction
Protecting your personal data is important to codium, s.r.o. This document explains what personal data we process, for what purposes, on what legal basis, to whom we disclose it, how long we keep it, and what rights you have as a data subject. This notice is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Slovak Act No. 18/2018 Coll. on the Protection of Personal Data, as amended.
This document covers personal data we process in connection with operating the codium.sk website – that is, when handling enquiries, through cookies and web analytics (Google Analytics), in marketing communications, and in recruitment for open positions. The processing of personal data within the BLUE Platform or other products and services that codium provides to its clients is handled individually under the contract with the respective client (for example, a data processing agreement under Art. 28 GDPR) and is not covered by this document.
Controller
Company name: codium, s.r.o.
Registered office: Kálov 356, 010 01 Žilina, Slovak Republic
Company ID (IČO): 47 255 757
Tax ID (DIČ): 2024177738, VAT ID: SK2024177738
Registered in the Commercial Register of the District Court of Žilina, Section: Sro, Insert No. 66485/L
E-mail: hello@codium.sk
(hereinafter “codium” or “we”)
Scope and purposes of processing
We process personal data for the following purposes and to the following extent:
| Purpose of processing | Categories of personal data | Legal basis |
|---|---|---|
| Handling enquiries submitted via the contact form | First name, surname, e-mail, phone number, message content | Pre-contractual measures (Art. 6(1)(b) GDPR), legitimate interest (point (f)) |
| Performance of a contract with a client or supplier | First name, surname, job title, contact and billing details | Performance of a contract (point (b)), compliance with legal obligations (point (c)) |
| E-mail and SMS marketing | E-mail, phone number | Consent (point (a) GDPR, Section 116 of Act No. 452/2021 Coll.); for existing clients, legitimate interest (point (f)) – the so-called soft opt-in |
| Telephone marketing | Phone number | Legitimate interest (point (f)), taking into account the Robinson list under Section 116 of Act No. 452/2021 Coll. |
| Recruitment for job positions | First name, surname, contact details, content of CV and cover letter | Pre-contractual measures (point (b)); where data is kept for future openings, additionally consent (point (a)) |
| Accounting and tax compliance | Billing details, company ID, tax ID | Compliance with legal obligations (point (c)) – Accounting Act, VAT Act |
| Cookies, web analytics and ad measurement (Google Analytics 4, Meta Pixel, LinkedIn Insight Tag, Google Ads – managed via Google Tag Manager) | IP address, device/browser identifier, on-site behaviour data | Consent (point (a)); Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications |
| Dispute resolution, exercise of legal claims, archiving | Data from the purposes listed above | Legitimate interest (point (f)); Act No. 395/2002 Coll. on Archives and Registries |
Categories of personal data
- Identification data: first name, surname, academic title
- Contact details: e-mail, phone number, address
- Company data for B2B contacts: company name, registered office/place of business, company ID
- Billing and payment details
- Data generated when visiting the website: IP address, cookies, device data and on-site behaviour
- For job applicants: content of the CV, cover letter and any references
codium does not process special categories of personal data (such as health or biometric data).
Recipients of personal data
We disclose personal data only to the extent necessary to fulfil the purposes above, in particular to: our accounting adviser, legal counsel, and providers of software and cloud services with whom we have a written data processing agreement under Art. 28 GDPR; IT support providers; and, where justified, law enforcement authorities, courts, the National Bank of Slovakia or other public authorities where required by law.
Cross-border transfers of personal data
As a rule, we do not transfer personal data outside the European Economic Area (EEA). We use secure cloud services from trusted providers with servers in the EU. The exception is the web analytics and ad measurement tools we use on the website once consent is given – Google Analytics 4 and Google Ads (Google LLC), Meta Pixel (Meta Platforms, Inc.) and LinkedIn Insight Tag (LinkedIn Corporation, part of Microsoft) – through which website usage data may be transferred to the USA. Since 10 July 2023, these transfers have been covered by the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework; Google, Meta and Microsoft/LinkedIn are certified under it at the time of writing. The current list of certified companies is available at dataprivacyframework.gov.
Retention period
- Enquiries via the contact form with no subsequent contractual relationship: for as long as necessary to handle the enquiry, generally no more than 2 years from the last communication
- Contractual relationships: for the duration of the contract and 5 years after it ends
- Accounting and tax documents: for the period required by specific legislation (Accounting Act, VAT Act – generally 10 years)
- CVs of unsuccessful applicants: no more than 1 year after the recruitment process ends, or until consent is withdrawn
- Consents to marketing communications: until consent is withdrawn; records of consent/objection to telephone marketing are kept for at least 4 years after withdrawal
- Cookies: according to the lifetime of each cookie as stated in the cookie banner settings on the website
Your rights as a data subject
With regard to your personal data, you have the following rights:
- the right of access to your personal data,
- the right to rectification of inaccurate or incomplete data,
- the right to erasure (“right to be forgotten”),
- the right to restriction of processing,
- the right to data portability,
- the right to object to processing, in particular for direct marketing and processing based on legitimate interest,
- the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before its withdrawal,
- the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Galvaniho 7/B, 820 07 Bratislava 27, dataprotection.gov.sk.
You can exercise your rights by e-mail at hello@codium.sk or in writing at our registered office address. We will respond to your request within 30 days of receiving it at the latest.
Cookies and web analytics
Our website uses cookies and similar technologies. On your first visit, a cookie banner informs you about this and lets you accept or reject cookies or set more detailed preferences. You give consent to non-essential cookies (for example, statistical ones) voluntarily in accordance with Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications and Art. 6(1)(a) GDPR; you can withdraw your consent at any time by changing the settings in the cookie banner.
We use the following categories of cookies on the website:
- Essential cookies – required for the basic functioning of the website; no consent needed.
- Statistical/analytics cookies (Google Analytics 4) – help us understand how visitors use the website; managed via Google Tag Manager and deployed only after consent is given – without consent, GA4 remains disabled.
- Marketing cookies (Meta Pixel, LinkedIn Insight Tag, Google Ads) – used to measure the effectiveness of advertising campaigns and to target ads; deployed only after consent is given in the relevant cookie banner category.
Processing of job applicants' data
If you send us your CV or cover letter in response to a job posting, we process this data for the purposes of the recruitment process, on the basis of pre-contractual measures or, where applicable, your consent. We keep the data of applicants who were not hired for no more than 1 year after the recruitment process ends, unless you have given us consent to keep it longer for future openings.
Automated decision-making
We do not carry out automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.
Security of personal data
We have adopted appropriate technical and organisational measures to protect your personal data, including encrypted data transfer, secure access and the use of trusted cloud providers based in the EU. When processing payment data, we follow the PCI DSS (Payment Card Industry Data Security Standard).
Changes to this document
We may update this privacy notice from time to time, in particular following changes in legislation or in the way we process personal data. The current version is always available on this page together with the date of the last update.
Contact
If you have any questions about the protection of personal data, contact us at hello@codium.sk or in writing at: codium, s.r.o., Kálov 356, 010 01 Žilina, Slovakia.
This version is effective from 1.1.2026.