Draft version. The operator's identification details (company ID, address) will be added before launch on stafeta.sk; the text is being reviewed by a lawyer.
Controller
- Controller: Daniel Cok, Slovak Republic
- Website: Štafeta, predaj firiem, stafeta.sk
- Contact: daniel@stafeta.sk or the contact form. Please mention in your message that it concerns personal data protection.
We have not appointed a data protection officer (DPO), as the law does not require one for the scope of our processing.
What data we process
We only process data you send us yourself through a form on the website, plus necessary technical data.
Seller form (home page, Sell a business page and Contact page):
- full name, e-mail, phone (optional),
- type of business or industry, approximate annual revenue,
- message (Contact page only, optional).
Founding member form (Buy a business and Businesses for sale pages):
- full name, e-mail, phone (optional),
- what you are looking for, budget and region (optional).
Interest in a specific business (on a business in the catalogue):
- full name, e-mail, phone (optional), message (optional),
- identification of the business you are interested in.
Technical data: your IP address when you submit a form. We use it only to protect against abuse (at most 3 submissions from one address per 10 minutes), and it is kept only in the server's memory for at most 10 minutes. Server logs at the hosting provider may contain your name and e-mail from the submitted form.
Analytics and marketing data (cookie identifiers, visit data) are processed only with your consent. Details are in the Cookie Policy.
We do not require registration, we have no user accounts, and we do not process payment data on the website.
Please do not send sensitive data or detailed financial data about your business through the form. We will exchange those only in a personal conversation or after signing a contract.
What we use the data for and the legal basis
- Replying to a seller's inquiry and preparing the mediation of a sale. I will get back to you, we will arrange a conversation and, if appropriate, prepare a mediation agreement. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
- Replying to interest in a specific business. I will send you a non-disclosure agreement (NDA) and, after it is signed and your identity is verified, full information about the business. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
- Founding member. We add you to the founding members and send you businesses for sale that match what you are looking for. Legal basis: your consent, given by submitting the form (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the contact form.
- Confirmation e-mail. After you submit a form, we automatically send you a confirmation that we received your message. This is part of handling your inquiry.
- Replying to general questions, protecting the website against abuse and defending legal claims. Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR).
- Analytics and marketing (only if the tools are enabled). Legal basis: your consent (Art. 6(1)(a) GDPR and Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications).
Providing data is voluntary. Without a name and e-mail, however, we cannot reply to your inquiry.
We do not carry out automated decision-making or profiling with legal effects on you.
Who we share data with
We do not sell data. Only the following entities process it as processors, to the extent necessary for their service:
- MailerSend (MailerLite group, based in the EU): delivering form data to the controller's mailbox and sending you the confirmation e-mail.
- Vercel Inc. (USA): website hosting and server-side processing of the submitted form.
- Sentry (Functional Software, Inc., USA): capturing technical errors, only if the service is enabled. Error reports are configured not to contain the user's e-mail or IP address, and we do not record session replays.
- Google Ireland Limited (Google Tag Manager, Google Analytics 4) and Meta Platforms Ireland Limited (Meta Pixel): analytics and ad measurement, only if the tools are enabled and only with your consent.
Form data arrives in the controller's mailbox, where it is further processed by Daniel Cok.
We will pass your data to another person, for example to a seller when introducing an interested buyer, only with your consent or where required by law.
Transfers outside the European Economic Area: Some providers (Vercel, Sentry, Google, Meta) or their subcontractors may process data in the USA. Such transfers rely on safeguards under Art. 44 to 49 GDPR, in particular the European Commission's adequacy decision for the EU-US Data Privacy Framework or the standard contractual clauses that the providers include in their data processing agreements.
How long we keep the data
- Seller inquiries, interest in a business and general questions: at most 2 years from the last contact. If we conclude a contract, we keep the data for its duration and then for the period required by specific regulations (for example accounting and tax rules).
- Founding members: until you unsubscribe or withdraw your consent.
- IP address for abuse protection: at most 10 minutes in the server's memory.
- Records at processors (sent e-mails in MailerSend, logs at Vercel): for the period set by the terms and settings of the respective provider.
- Analytics data: according to the retention settings of the respective tool, only if you gave consent.
On request, we will delete your data earlier unless we are legally required to keep it.
Your rights
Under the GDPR (Art. 15 to 22) and Act No. 18/2018 Coll. (Sections 21 to 28), you have the right:
- of access to the data we process about you and to a copy of it,
- to rectification of inaccurate or incomplete data,
- to erasure of data that is no longer needed or where you have withdrawn consent,
- to restriction of processing in the cases set out in Art. 18 GDPR,
- to data portability for data you provided on the basis of consent or a contract,
- to object to processing based on legitimate interest,
- to withdraw consent at any time, for example by unsubscribing from the founding members via the contact form or by changing your cookie settings. Withdrawal does not affect the lawfulness of processing before the withdrawal.
You can exercise your rights via the contact form. We will reply without undue delay and at the latest within one month. In complex cases we may extend this period by two further months and will let you know. Before handling a request, we may verify that it really comes from you.
Complaint to the supervisory authority
If you believe we process your data unlawfully, you can file a petition to initiate proceedings (Section 100 of Act No. 18/2018 Coll.) or a complaint with:
Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky) Hraničná 12, 820 07 Bratislava 27 dataprotection.gov.sk
We would appreciate it if you contacted us first so we can try to resolve the matter.
Cookies and local storage
We store necessary items without consent, and analytics and marketing items only with consent. The list of all items with their names and duration is in the Cookie Policy.
Minors
The website is intended for adults who are selling or buying a business. We do not knowingly process data of persons under 16.
Changes to this policy
We may update this policy, for example when we change tools or after review by a lawyer. The date of the last change is shown at the top of the page.