# Privacy Policy

for website https://marianstancik.dev · Version 2.0 · Effective from 5 October 2026

## 1. Who is the Data Controller?
The Data Controller pursuant to Article 4(7) of Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on Personal Data Protection is:

- **Controller:** Marian Stancik — Sole Proprietor (fyzická osoba – podnikateľ)
- **Place of Business:** Černákova 2046/8, 977 01 Brezno, Slovak Republic
- **Business ID (IČO):** 57068917 | **Tax ID (DIČ):** 1082585075 | **VAT Status:** Non-VAT payer
- **Trade Register:** District Office Brezno, Trade Register No. 630-22847
- **GDPR Contact:** marianstancik@agentmail.to
- **Web:** https://marianstancik.dev

## 2. Categories of Data, Purposes, and Lawful Bases

| Processing Purpose | Categories of Data | Lawful Basis (GDPR) | Retention Period |
| :--- | :--- | :--- | :--- |
| **Performance of Contract** (conducting audits, autonomous agent engineering) | Name, surname, email, billing address, target URL | Art. 6(1)(b) GDPR (contract performance) | Duration of contractual relationship + statutory limitation periods |
| **Statutory Obligations** (accounting and tax record-keeping) | Billing and payment records | Art. 6(1)(c) GDPR (Act No. 431/2002 Coll. on Accounting) | 10 years following the relevant fiscal year |
| **Communication & Inquiries** | Name, email, inquiry content | Art. 6(1)(f) GDPR (legitimate interest to respond) | 1 year from last communication |
| **Newsletter / Engineering Briefs** | Email address | Art. 6(1)(a) GDPR (consent) | Until consent withdrawal (1-click unsubscribe) |
| **Server Security & Infrastructure** | IP address, timestamp, user agent, HTTP status code | Art. 6(1)(f) GDPR (legitimate interest in cybersecurity) | Up to 90 days in rotating server logs |
| **Client Data Processing in Custom Agent Engagements** | Client data flows per specifications | Art. 28 GDPR (Processor role) | Governed by bilateral Data Processing Agreement (DPA) |

## 3. Recipients and Sub-Processors
1. **Vercel Inc. (USA / EU):** Edge cloud hosting (EU-US Data Privacy Framework + SCC).
2. **Hetzner Online GmbH (Germany / EU):** Dedicated European cloud infrastructure.
3. **Stripe Payments Europe Ltd. (Ireland / EU):** Licensed payment institution.
4. **AgentMail:** Transactional notifications and deliverables.
5. **Umami Analytics:** Self-hosted cookieless analytics on dedicated EU server infrastructure.

## 4. Automated Decision-Making, Profiling, and AI Act
- The Controller does not engage in automated individual decision-making or profiling with legal or similarly significant effects under Article 22 GDPR.
- Outputs generated with the assistance of autonomous systems (Hermes Agent) remain subject to human editorial review (human-in-the-loop), fulfilling transparency obligations under Article 50 of Regulation (EU) 2024/1689 (AI Act).

## 5. Rights of Data Subjects under GDPR
Under Articles 15 to 22 GDPR, you have the following rights:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent
- Right to lodge a complaint with a supervisory authority: **Office for Personal Data Protection of the Slovak Republic** (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, Slovak Republic, https://dataprotection.gov.sk

## 6. Security of Processing
Pursuant to Article 32 GDPR, appropriate technical and organizational measures are enforced: TLS 1.3 encrypted transmission, strict security headers (HSTS), isolated European infrastructure, and least-privilege access control.