Privacy notice.
1. Controller
Composite Group s.r.o., Panenská 5, 811 03 Bratislava, Slovakia, is the controller for the personal data processed on this website. Contact: privacy@composite-group.com.
2. Data we process
We process three categories of personal data. (i) Data you submit via the contact or cooperation forms — name, email, role, project description. (ii) Technical access data automatically captured by our hosting provider — IP address, user agent, referrer, timestamp, requested resource. (iii) Cookies and similar technologies as described in section 6.
3. Purpose and legal basis
Form submissions are processed to reply to your enquiry on the legal basis of pre-contractual measures or, where applicable, our legitimate interest in conducting business correspondence (Article 6 (1)(b) or (f) GDPR). Technical access data is processed on the legal basis of our legitimate interest in operating and securing the website (Article 6 (1)(f) GDPR).
4. Retention
Contact-form data is retained for 24 months after the last correspondence, or longer where statutory retention obligations apply. Technical access logs are retained for 14 days unless a security incident requires longer retention.
5. Recipients
Personal data is processed only by Composite Group s.r.o. and by data processors acting under written instructions on our behalf. Current processors include our hosting provider (within the EU/EEA), our transactional-email provider, and where applicable our analytics provider. We do not transfer personal data to recipients outside the EU/EEA without appropriate safeguards.
6. Cookies and similar technologies
This website uses only strictly necessary cookies required for the site to function (language preference, session state). We do not use marketing or cross-site tracking cookies. Where we use anonymised analytics, this is on the basis of our legitimate interest and the IP address is anonymised before storage.
7. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.
You may exercise these rights by writing to privacy@composite-group.com. You also have the right to lodge a complaint with the supervisory authority in the EU member state where you reside, work, or where the alleged infringement occurred. The competent authority for Composite Group is the Office for Personal Data Protection of the Slovak Republic.
8. Security
We protect personal data using technical and organisational measures appropriate to the risk: encrypted transport (TLS), access controls, the principle of least privilege, and regular audits of our processors. No system is perfectly secure; if you have reason to believe a security incident has affected your data, please contact us immediately.
9. Changes
We may update this notice from time to time. Material changes are indicated through the "Last updated" date at the top of the page and, where required, through direct notice to affected individuals.