Privacy Policy

for website https://marianstancik.dev · Version 2.0 · Effective from 5 October 2026

1. Who is the Data Controller?

The Data Controller pursuant to Article 4(7) of Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on Personal Data Protection is:

Controller: Marian Stancik — Sole Proprietor (fyzická osoba – podnikateľ)

Place of Business: Černákova 2046/8, 977 01 Brezno, Slovak Republic

Business ID (IČO): 57068917 | Tax ID (DIČ): 1082585075 | VAT Status: Non-VAT payer

Trade Register: District Office Brezno, Trade Register No. 630-22847

GDPR Contact: [email protected]

Web: https://marianstancik.dev

This policy applies to the processing of personal data of visitors to marianstancik.dev and clients ordering digital services.

2. Categories of Data, Purposes, and Lawful Bases

Processing Purpose	Categories of Data	Lawful Basis (GDPR)	Retention Period
Performance of Contract (conducting audits, autonomous agent engineering)	Name, surname, email, billing address, target URL	Art. 6(1)(b) GDPR (contract performance)	Duration of contractual relationship + statutory limitation periods
Statutory Obligations (accounting and tax record-keeping)	Billing and payment records	Art. 6(1)(c) GDPR (Act No. 431/2002 Coll. on Accounting)	10 years following the relevant fiscal year
Communication & Inquiries	Name, email, inquiry content	Art. 6(1)(f) GDPR (legitimate interest to respond)	1 year from last communication
Newsletter / Engineering Briefs	Email address	Art. 6(1)(a) GDPR (consent)	Until consent withdrawal (1-click unsubscribe)
Server Security & Infrastructure	IP address, timestamp, user agent, HTTP status code	Art. 6(1)(f) GDPR (legitimate interest in cybersecurity)	Up to 90 days in rotating server logs
Client Data Processing in Custom Agent Engagements	Client data flows per specifications	Art. 28 GDPR (Processor role)	Governed by bilateral Data Processing Agreement (DPA)

3. Recipients and Sub-Processors

Personal data is shared only with vetted service providers who provide sufficient security guarantees and are bound by Data Processing Agreements (DPA) pursuant to Article 28 GDPR:

Vercel Inc. (USA / EU): Edge cloud hosting. Transfers to the USA are safeguarded under Chapter V GDPR via the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC).
Hetzner Online GmbH (Germany / EU): Dedicated European cloud infrastructure for autonomous agent backend operations.
Stripe Payments Europe Ltd. (Ireland / EU): Licensed payment institution for secure online payments.
AgentMail: Transactional order confirmations and delivery emails.
Umami Analytics: Self-hosted cookieless analytics on dedicated EU server infrastructure without tracking or profiling.

4. Automated Decision-Making, Profiling, and AI Act

The Controller does not engage in automated individual decision-making or profiling with legal or similarly significant effects under Article 22 GDPR.
Outputs generated with the assistance of autonomous systems (Hermes Agent) remain subject to human editorial review (human-in-the-loop), fulfilling transparency obligations under Article 50 of Regulation (EU) 2024/1689 (AI Act).

5. Rights of Data Subjects under GDPR

Under Articles 15 to 22 GDPR, you have the following rights:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure / "right to be forgotten" (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right to withdraw consent at any time
Right to lodge a complaint with a supervisory authority:

Office for Personal Data Protection of the Slovak Republic

(Úrad na ochranu osobných údajov Slovenskej republiky)
Hraničná 12, 820 07 Bratislava 27, Slovak Republic
Web: https://dataprotection.gov.sk
Email: [email protected]

To exercise your rights, contact: [email protected]. Requests are handled free of charge within 30 days.

6. Security of Processing

Pursuant to Article 32 GDPR, appropriate technical and organizational measures are enforced: TLS 1.3 encrypted transmission, strict security headers (HSTS), isolated European infrastructure, and least-privilege access control.