Privacy Policy

1. Data Controller

When managing our clients' advertising accounts and data, we generally act as a processor under Art. 28 GDPR — the client is the controller of that data. Processing is governed by a data processing agreement.

2. Data We Process

a) Website (moveminds.sk)

• Strictly necessary cookies: mm_consent — stores your consent choice (valid 180 days)
• Statistics cookies (only with your consent): Google Analytics 4 — _ga, _ga_* (traffic measurement, valid up to 2 years)
• Preference and marketing cookies are used only with your consent; we currently deploy none
• Contact details you voluntarily provide (e-mail, phone, message content)

You can change or withdraw your cookie consent anytime via "Cookie settings" in the page footer. Upon withdrawal, analytics cookies are deleted. Measurement runs only after consent is granted (Google Consent Mode v2).

b) Marketing & AI Services including the MoveMinds Connect service

• Identification, contact, and billing data of clients and their contact persons
• Access to the client's systems and accounts (Google Ads, Meta Ads, GA4, CRM, e-shop) and data from them — solely under the client's authorization and in the processor role; access is set up via standard authorization interfaces (OAuth 2.0)
• Content of interactions with the service (e.g. queries entered via chat) needed to provide a response
• Business communication and operational logs (timestamps, diagnostics)

We process client data only to the extent needed to provide the service. We operate our infrastructure on servers in the EU (Microsoft Azure, West/North Europe region). Access is encrypted and separated per client; the client can revoke our access at any time.

3. Purposes & Legal Bases

• Website analytics — consent, Art. 6(1)(a) GDPR (withdrawable at any time)
• Providing services & performing contracts — contract and pre-contractual steps, Art. 6(1)(b) GDPR
• Responding to inquiries & B2B communication — legitimate interest, Art. 6(1)(f) GDPR
• Security & abuse prevention — legitimate interest, Art. 6(1)(f) GDPR
• Accounting & tax obligations — legal obligation, Art. 6(1)(c) GDPR

4. Recipients & Processors

We do not sell personal data. To the extent necessary, we share it with these categories of recipients:

• Google (Google Ireland Ltd.) — Google Analytics, Google Ads, Firebase / Google Cloud hosting
• Meta Platforms Ireland Ltd. — Facebook / Instagram advertising integrations
• Microsoft (Azure) — cloud infrastructure for selected services
• Accounting and legal service providers — to the extent of statutory obligations

5. International Data Transfers

Some recipients (Google, Meta, Microsoft) may transfer data to the USA. Transfers rely on the adequacy decision for the EU–U.S. Data Privacy Framework or on the EU Standard Contractual Clauses (SCC) with supplementary safeguards.

6. Data Retention

• Cookies: mm_consent 180 days; _ga and _ga_* up to 2 years (only with consent)
• Inquiries and business communication: 2 years from the last contact
• Contractual and billing records: 10 years (Slovak Accounting Act)
• Access to client systems within the Connect service: for the term of the contract; upon termination we revoke access and keep operational logs for max. 90 days

7. Your Rights

Under the GDPR, you have the right to:

• access your personal data (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure — the "right to be forgotten" (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• withdraw consent at any time — without affecting prior lawful processing

Exercise your rights by e-mail using the contact below; we respond within 30 days. Data deletion process: Data Deletion Instructions

You also have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.

8. Security

• Encrypted communication (TLS/HTTPS) and encryption of tokens and credentials (AES-256)
• Least-privilege access and per-client access separation
• Regular security audits of code and infrastructure

9. Automated Decision-Making & Children

We do not carry out automated decision-making or profiling with legal effects on you. Our services and website are intended for businesses and persons over 16 years of age.

10. Google & Meta Integrations

• Authorization uses the standard OAuth 2.0 protocol; you can revoke access anytime in your Google account settings (myaccount.google.com/permissions) or on Facebook (Settings → Business Integrations)
• Use of data from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements
• Data from Meta platforms is processed under the Meta Platform Terms and this policy

11. Changes to This Policy

We may update this policy. The current version is always published on this page with its last-updated date; we will announce material changes on the website.

12. Contact

For privacy questions or to exercise your rights, contact us at michal.cehula@moveminds.sk.