We obtain data directly from you when you contact us by email, by phone, through the contact form or in the course of a business relationship. When you use the website, essential technical logs may be generated. We do not request special categories of personal data; please do not send such data unless it is necessary and has been agreed with us in advance.
2. Purposes, data, legal bases and retention periods
Enquiries and pre-contractual communication
Categories of data
Name, company, email address, phone number, subject and content of the message, and any data included in attached technical documentation.
Purpose
Responding to an enquiry, technical consultation, preparing a quotation and taking steps prior to entering into a contract.
Legal basis
Article 6(1)(b) GDPR; when communicating with a representative of a legal entity, our legitimate interest under Article 6(1)(f) GDPR in handling business communication.
Retention
For the duration of the enquiry and for no more than 12 months after the last communication, unless a contractual relationship is established or the data must be retained for the establishment, exercise or defence of legal claims.
Contracts, orders and delivery of products or services
Categories of data
Identification and contact details of the customer or its representative, and information about the order, contract, delivery, payments and related communication.
Purpose
Entering into and performing a contract, order administration, invoicing, delivery and handling complaints.
Legal basis
Article 6(1)(b) GDPR and compliance with legal obligations under Article 6(1)(c) GDPR.
Retention
For the duration of the contractual relationship; accounting and tax records are generally retained for 10 years under applicable legislation. Other data is retained for the statutory periods applicable to the establishment, exercise or defence of legal claims.
Website security and technical operation
Categories of data
IP address, request time, visited URL, browser and device information, and technical security logs where recorded by the hosting infrastructure.
Purpose
Secure website operation, error detection, prevention of misuse and protection of information systems.
Legal basis
Our legitimate interest under Article 6(1)(f) GDPR in the security and proper operation of the website.
Retention
Generally for no more than 30 days; in the event of a security incident, until the incident has been investigated and any related claims have been resolved.
3. Cookies and Google Maps
The website uses essential local storage solely to remember your cookie choice. We currently do not use analytics or marketing cookies. Google Maps is loaded only with your consent under Article 6(1)(a) GDPR. Once the map is loaded, Google Ireland Limited may process your IP address, device information and interactions with the map, and data may be transferred outside the European Economic Area in accordance with Google’s policies.
You may refuse consent or change your choice later using the “Cookie settings” button in the footer. The website remains functional without consent and the map will not be loaded.
Personal data is accessible only to authorised persons and contractual partners to the extent necessary. These may include providers of hosting and IT support, email services, accounting or legal advice, carriers and public authorities where required by law. Data submitted through the contact form is processed by Formspree, Inc. as a processor. When Google Maps is activated, Google Ireland Limited is a recipient of data.
We do not sell personal data or disclose it for incompatible marketing purposes.
5. Transfers to third countries
A transfer outside the EEA may occur when the contact form is submitted through Formspree, whose infrastructure is located in the United States according to the provider, or when Google Maps is enabled. Formspree states that it uses Standard Contractual Clauses for cross-border processing. Any other transfer will take place only where a legal mechanism under Chapter V GDPR and appropriate supplementary safeguards are available.
6. Your rights
the right to access your personal data and obtain a copy,
the right to rectification of inaccurate data or completion of incomplete data,
the right to erasure where the legal conditions are met,
the right to restriction of processing,
the right to data portability where processing is based on consent or a contract and is carried out by automated means,
the right to object to processing based on legitimate interests,
the right to withdraw consent at any time without affecting the lawfulness of processing before its withdrawal,
the right to lodge a complaint with the supervisory authority.
You can submit a request to office@nm-steel.eu. To protect your data, we may take reasonable steps to verify your identity. We will respond without undue delay, generally within one month; in complex cases, this period may be extended under the conditions laid down in the GDPR.
7. Supervisory authority
If you believe that we process your personal data in breach of applicable law, you have the right to contact:
Úrad na ochranu osobných údajov Slovenskej republikyGalvaniho Business Centrum IIGalvaniho 7/B, 821 04 BratislavaSlovak Republicdataprotection.gov.sk
8. Security, automated decision-making and changes
We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access or disclosure. We do not carry out automated individual decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
We may update this information when our processing activities, providers or applicable laws change. The current version is always published on this page.
