Privacy Policy

of the company iMach Slovakia s. r. o., which provides manufacturing services and operates an online shop under the trade name SolidLabs through the website www.solidlabs.sk

English translation for information only. The legally binding version of this Privacy Policy is the Slovak version. In the event of any discrepancy between the two versions, the Slovak version prevails.

Article I — Controller of Personal Data

  1. The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”), and within the meaning of Act No. 18/2018 Coll. on the Protection of Personal Data (hereinafter the “Data Protection Act”) is:

    iMach Slovakia s. r. o. Okružná ulica 1309/18, 900 44 Tomášov, Slovak Republic Company ID (IČO): 56 249 021 registered in the Commercial Register of the Bratislava III Municipal Court, section Sro, insert No. 178298/B (hereinafter the “Controller”)

  2. The Controller’s contact details for personal data protection matters:

    • E-mail: matej@imach.sk
    • Telephone: +421 911 090 844
    • Correspondence address: iMach Slovakia s. r. o., Okružná ulica 1309/18, 900 44 Tomášov

  3. The Controller has not appointed a Data Protection Officer under Article 37 of the GDPR, as it does not meet the legal criteria requiring such an appointment. In all matters relating to the protection of personal data, you can contact the Controller directly using the contact details in paragraph 2.

Article II — Definitions

For the purposes of this Policy, the following terms have the following meanings:

a) Personal data — any information relating to an identified or identifiable natural person (data subject) under Article 4(1) of the GDPR.

b) Data subject — a natural person whose personal data the Controller processes; typically a visitor to the Website, a person interested in a quote, a Buyer (a Consumer or a self-employed natural person) or a contact person of a Buyer that is a legal entity.

c) Processing — any operation performed on personal data (collection, recording, organisation, storage, alteration, retrieval, transfer, disclosure, erasure, etc.) under Article 4(2) of the GDPR.

d) Processor — a natural or legal person that processes personal data on behalf of the Controller on the basis of a written contract under Article 28 of the GDPR.

e) Website — the website www.solidlabs.sk.

Article III — Scope of the Personal Data Processed

Depending on the nature of the interaction with the data subject, the Controller may process the following categories of personal data:

A. Identification and contact data

  • first name and surname
  • the trade name of a self-employed natural person (if the Buyer is self-employed)
  • e-mail address
  • telephone number
  • address (billing and delivery)
  • for legal entities: the first name, surname and job title of the contact person

B. Data about a legal entity / self-employed person (B2B)

  • Company ID, Tax ID, VAT ID (under Act No. 222/2004 Coll. on VAT, these data are also personal data in the case of a self-employed natural person)
  • details of registration in the Commercial Register or Trade Register

C. Transaction and billing data

  • order number, invoice number, payment reference
  • subject of the order, price, payment method, date of payment
  • bank account number (for payment by transfer or for a refund following a complaint/withdrawal)
  • history of orders and complaints

D. Content of communication

  • the content of e-mail and telephone communication with the Controller
  • the content of the conversation with the AI assistant (chatbot) on the Website — your name and, if you enter them, your e-mail and telephone number, the text of the messages, the time of the messages and a technical conversation identifier (replies are generated by the Google Gemini model — see Article IV(5) and Article V)
  • the content of quote requests and comments on quotes

E. Content of materials and designs

  • graphic files and 3D models sent by the Buyer for production (SVG, DXF, STL, STEP, PDF, PNG, JPG)
  • photographs, sketches and other materials
  • approved graphic/3D designs prepared by the Controller
  • Note: Materials may contain personal data of third parties (e.g. a logo with a name, portrait photographs, names on name tags). The Buyer is responsible for being entitled to use such materials (see GTC Article V(5)).

F. Technical data (cookies, log files)

  • IP address
  • browser type and version, operating system, screen resolution
  • referrer (the page from which the visitor came)
  • date, time and duration of the visit, URLs visited
  • identifiers in cookies and in browser storage (functional and — after consent — analytics)
  • technical records of application errors (if the Sentry tool is active — see Article IV(10))
  • These data are processed to the extent necessary for the operation, security and improvement of the Website — see Article VIII.

G. Data needed to protect against misuse

  • data from security tools (Cloudflare Turnstile — against spam and bots), IP addresses suspected of misuse, logs of security incidents

The Controller does not process special categories of personal data under Article 9 of the GDPR (data concerning health, racial origin, political opinions, sex life, etc.), except where such data form part of materials sent by the Buyer (e.g. a photograph for engraving) — in that case the Controller processes them solely for the purpose of completing the order and does not draw any further conclusions from them.

Article IV — Purposes of Processing and Legal Bases

The Controller processes personal data only for specified purposes and only on the basis of one of the legal bases under Article 6(1) of the GDPR:

1. Conclusion and performance of the purchase contract, processing of orders

  • Purpose: receiving and evaluating a quote request, preparing a quote, concluding the purchase contract, manufacturing the Goods, delivering the Goods, handling complaints and the Buyer’s questions.
  • Categories of data: A, B, C, D, E.
  • Legal basis: Article 6(1)(b) of the GDPR — processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Retention period: for the duration of the contractual relationship and, after it ends, for the limitation periods for making any claims (usually 4 years under the Commercial Code / 3 years under the Civil Code, from the end of the warranty period).

2. Compliance with legal obligations — accounting and taxes

  • Purpose: issuing invoices and other tax documents, keeping accounts, archiving tax documents, fulfilling obligations towards tax and other public authorities.
  • Categories of data: A, B, C.
  • Legal basis: Article 6(1)(c) of the GDPR — processing is necessary for compliance with a legal obligation of the Controller, in particular under:
    • Act No. 431/2002 Coll. on Accounting (archiving accounting documents for 10 years);
    • Act No. 222/2004 Coll. on Value Added Tax (invoice requirements, archiving for 10 years);
    • Act No. 595/2003 Coll. on Income Tax.
  • Retention period: 10 years from the end of the accounting year in which the document was issued.

3. Compliance with legal obligations — complaints and consumer rights

  • Purpose: keeping records of complaints, issuing documents confirming that a complaint has been made and how it was handled.
  • Categories of data: A, C, D, E.
  • Legal basis: Article 6(1)(c) of the GDPR — under Act No. 108/2024 Coll. on Consumer Protection and the Civil Code.
  • Retention period: 4 years from the handling of the complaint.

4. Delivery of the Goods by a carrier

  • Purpose: passing the data needed to deliver the Goods to the chosen carrier (name, address, telephone, e-mail for notifications).
  • Categories of data: A, C.
  • Legal basis: Article 6(1)(b) of the GDPR — performance of the contract; the data are passed to processors acting as carriers (see Article V).
  • Retention period: until the Goods are handed over and the consignment document is archived as required by law (normally 2 years).

5. Customer communication (AI assistant on the Website, e-mail, telephone)

  • Purpose: answering questions, providing information about products and services, preliminary pricing, preparing and handling enquiries, supporting orders.
  • Categories of data: A, D, E.
  • Legal basis:
    • Article 6(1)(b) of the GDPR — where the communication leads to the conclusion or performance of a contract (e.g. sending an enquiry from the chat);
    • Article 6(1)(f) of the GDPR — the Controller’s legitimate interest in communicating effectively with prospective and existing customers, where the communication does not lead to a contract. The legitimate interest has been assessed by a balancing test; the rights and freedoms of the data subject are not disproportionately affected.
  • AI assistant SolidLabsHelpo (chatbot):
    • When you open the chat, we inform you that you are communicating with an artificial intelligence system, not a person. Replies are generated by the Google Gemini model (Google’s Gemini API service). To generate a reply, your name and the content of the messages in the conversation are passed to Google; your e-mail and telephone number are not passed to Google.
    • We store the conversation transcript (your name, e-mail and telephone number if you entered them, the messages and their time) in non-public storage of the Sanity service (see Article V) so that we can follow up on the conversation and handle your enquiry. Only the Controller has access to the transcript.
    • If you send an enquiry from the chat, it is saved together with any attachments and a summary of the conversation in the enquiry database, and the Controller handles it as an enquiry under point 1.
    • Please do not enter sensitive data (e.g. about your health) or data of other persons in the chat unless this is necessary.
  • Retention period:
    • communication leading to a contract — as under point 1;
    • communication not leading to a contract (an enquiry that was not carried out) — max. 24 months from the last interaction;
    • a transcript of a conversation with the AI assistant from which no enquiry was sent — max. 12 months from the last message.

6. Protection against misuse — Cloudflare Turnstile, anti-spam

  • Purpose: protecting the Website and forms against automated misuse (bots, spam, DoS attacks).
  • Categories of data: F, G.
  • Legal basis: Article 6(1)(f) of the GDPR — the Controller’s legitimate interest in protecting its system and keeping the Website operational.
  • Retention period: security logs usually up to 90 days.

7. Traffic analysis and improvement of the Website (Google Analytics 4)

  • Purpose: measuring traffic, analysing visitor behaviour, optimising the content and structure of the Website.
  • Categories of data: F (pseudonymised identifiers in cookies, information about the device and the pages visited, events such as sending an enquiry or clicking on a contact). Google Analytics 4 does not store IP addresses.
  • Legal basis: Article 6(1)(a) of the GDPR — the consent of the data subject given through the cookie banner. Consent is voluntary and can be withdrawn at any time (see Articles VIII and IX).
  • Method: before consent is given, the Google Analytics tool is not loaded at all and no analytics cookies are stored (Google Consent Mode v2 with denial as the default). Advertising features (Google signals, ad personalisation) are switched off.
  • Retention period: user-level and event-level data are kept in Google Analytics 4 for 14 months; after this period only aggregated statistics without identifiers are available.

8. Marketing communication (newsletter, if activated in the future)

  • Purpose: sending commercial information, news and special offers.
  • Categories of data: A.
  • Legal basis: Article 6(1)(a) of the GDPR — the consent of the data subject, or Article 6(1)(f) of the GDPR in combination with Section 62(3) of Act No. 452/2021 Coll. on Electronic Communications (so-called soft opt-in for existing customers, with the option to unsubscribe at any time).
  • Retention period: until consent is withdrawn or the person unsubscribes from the newsletter.

9. Defence against legal claims

  • Purpose: establishing and defending the Controller’s legal claims, demonstrating compliance with contractual and legal obligations.
  • Categories of data: all relevant categories.
  • Legal basis: Article 6(1)(f) of the GDPR — the Controller’s legitimate interest.
  • Retention period: for the limitation periods and, where applicable, for the duration of any dispute.

10. Recording of Website errors (Sentry) — if active

  • Purpose: detecting and fixing technical errors on the Website.
  • Categories of data: F — technical data about the error (description of the error, page address, type of browser and device, time). When an error occurs, the course of the session may also be recorded (a so-called replay), in which all text is masked and images and media are blocked — neither the content of forms nor any displayed personal data are recorded.
  • Legal basis: Article 6(1)(f) of the GDPR — the Controller’s legitimate interest in a secure and functional Website.
  • Retention period: according to the settings of the Sentry service, at most 90 days.
  • The tool is loaded only if the Controller switches it on; if it is not active, no data are passed to it.

11. Sending e-mails and backups

  • Purpose: delivering a confirmation of receipt of an enquiry to the customer and a notification to the Controller (the Resend e-mail service); regular database backups (including enquiry data) for recovery in the event of an outage or data loss.
  • Categories of data: A, C, D (in the backup also E — a list of attachments, not their content).
  • Legal basis: Article 6(1)(b) of the GDPR for the enquiry confirmation; Article 6(1)(f) of the GDPR for backups (legitimate interest in the availability and recoverability of data, Article 32 of the GDPR).
  • Retention period: e-mails as under point 1 or 5; backups at most 12 months, after which they are deleted.

Article V — Recipients of Personal Data (Processors)

The Controller may disclose personal data to the following recipients acting as processors (Article 28 of the GDPR), solely to the extent necessary to achieve the purpose for which the data were obtained and on the basis of a written data processing agreement (unless replaced by law or another legally binding act):

A. Carriers

For the purpose of delivering the Goods:

  • Packeta Slovakia s. r. o. — operator of the Packeta pick-up point network;
  • General Logistics Systems Slovakia s. r. o. (GLS);
  • Slovenská pošta, a. s. (Slovak Post);
  • DHL Parcel Slovensko spol. s r. o.

Carriers receive the minimum data necessary for delivery: name, delivery address, telephone, e-mail for notifications and the parcel number.

B. Providers of IT infrastructure and cloud services

  • Supabase, Inc. (USA) — the database of enquiries and customers and non-public storage of attachments to enquiries. Attachments are not publicly accessible; the Controller opens them only through temporary links with limited validity. The transfer to the USA is safeguarded by Standard Contractual Clauses (SCC) under European Commission Decision 2021/914.
  • Vercel, Inc. (USA) — Website hosting, content delivery, server functions (processing of forms and the chat) and their technical logs. The transfer to the USA is safeguarded by SCC.
  • Sanity.io / Sanity Labs, Inc. (USA / EU) — content management (CMS) for the online shop at solidlabs.sk/studio and non-public storage of transcripts of conversations with the AI assistant (see Article IV(5)). The transfer outside the EEA is safeguarded by SCC.
  • Cloudflare, Inc. (USA) — protection of forms and the chat against bots (Cloudflare Turnstile), security services. Cloudflare is certified under the EU-U.S. Data Privacy Framework (DPF).
  • Functional Software, Inc. (Sentry) (USA) — recording of technical errors on the Website, only if the tool is active (see Article IV(10)). The transfer to the USA is safeguarded by SCC or by DPF certification.

C. AI, analytics and e-mail services

  • Google LLC (USA) — provider of the Gemini API service (the model that generates the AI assistant’s replies) and Google Analytics 4 (only after consent). Google is certified under the EU-U.S. Data Privacy Framework (DPF).
  • Resend, Inc. (USA) — sending e-mails from the Website (confirmation of receipt of an enquiry, notifications to the Controller, database backups). The transfer to the USA is safeguarded by SCC or by DPF certification.

The AI assistant passes to Google only your name and the content of the messages in the conversation, not your e-mail or telephone number. However, the content of the messages may also include data that you enter yourself. Google processes these data under the terms of the Gemini API service, and processing may also take place outside the EEA.

D. Accounting

  • Doklado, s. r. o. (Slovak Republic) — provider of the accounting platform used to keep the Controller’s accounts (app.doklado.sk). It is a processor established in the Slovak Republic.

E. Public authorities

In cases laid down by law, personal data may be disclosed to public authorities (the tax office, the Slovak Trade Inspection, courts, law enforcement authorities, the Office for Personal Data Protection), solely on the basis of a legal authorisation and to the extent necessary.

F. Professional advisers

Where necessary — a legal representative (lawyer) or tax adviser — all bound by a statutory duty of confidentiality.

Article VI — Transfer of Personal Data to Third Countries

  1. Some of the processors listed in Article V are established or process data in third countries outside the European Economic Area (EEA), in particular in the United States of America (Supabase, Vercel, Cloudflare, Google, Resend, Sentry if active, and partly Sanity).

  2. Transfers to the USA are carried out in accordance with Chapter V of the GDPR, primarily on the basis of: a) European Commission Decision No. 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework (EU-U.S. Data Privacy Framework, DPF) — for transfers to companies certified under the DPF; b) Standard Contractual Clauses (SCC) under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 — for transfers to companies not certified under the DPF.

  3. The data subject may request more detailed information about the safeguards for a specific transfer by contacting the Controller (matej@imach.sk).

Article VII — Automated Decision-Making and Profiling

  1. The Controller does not carry out automated individual decision-making within the meaning of Article 22(1) of the GDPR that would produce legal effects concerning the data subject or similarly significantly affect them.

  2. The AI assistant SolidLabsHelpo (chatbot) on the Website is an artificial intelligence system, of which we inform you when you open the chat (Article 50 of Regulation (EU) 2024/1689 on artificial intelligence). It provides information and sales-support communication — it does not assess creditworthiness, decide on prices or carry out profiling of the data subject. Its replies (including indicative prices) are non-binding; a binding quote and the approval of an order are always confirmed manually by the Controller.

  3. Google Analytics 4 processes data in pseudonymised form, without identifying a specific natural person and without drawing individual consequences.

Article VIII — Cookies and Similar Technologies

  1. The Website uses cookies and similar technologies. Cookies are small text files stored in your browser that are used mainly to ensure the functioning of the Website and — once consent has been obtained — to measure traffic.

  2. Categories of cookies:

    a) Essential (functional) cookies and browser storage — ensure the basic operation of the Website (the contents of the basket, a conversation with the AI assistant in progress during the visit, remembering your cookie choice, protection of forms against bots using Cloudflare Turnstile). They are processed on the legal basis of Article 6(1)(f) of the GDPR — the Controller’s legitimate interest in operating the Website — and, under Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications, do not require consent.

    b) Analytics cookies — Google Analytics 4 (in particular _ga and _ga_<ID>, valid for up to 2 years). They are used to measure traffic, analyse behaviour and improve the Website. They are stored only after the data subject has given active consent in the cookie banner.

    c) Marketing cookies — the Controller currently does not use marketing cookies on the Website. If it starts to use them in the future, it will store them only after obtaining prior consent.

  3. Consent management. The cookie banner offers equivalent “Accept” and “Reject” buttons and detailed “Settings”. Consent to analytics (and, where applicable, marketing) cookies can be at any time:

    • changed or withdrawn via the “Cookie settings” link in the footer of the Website — on withdrawal, the Google Analytics cookies are deleted from your browser;
    • withdrawn by deleting cookies in your browser settings;
    • refused on your first visit to the Website in the cookie banner.

    We remember your choice for 12 months, after which we ask you again. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.

  4. Browser settings. The data subject can manage cookies in their browser settings (block, delete, set exceptions). Blocking essential cookies may cause some parts of the Website not to work.

Article IX — Rights of the Data Subject

In connection with the processing of personal data, the data subject has the following rights, which they can exercise by contacting the Controller (by e-mail at matej@imach.sk or by post to the address of the registered office):

  1. Right of access to personal data (Article 15 of the GDPR) — the right to obtain from the Controller confirmation as to whether personal data concerning them are being processed and, if so, access to those personal data and to the information under Article 15 of the GDPR, including a copy of the data processed.

  2. Right to rectification (Article 16 of the GDPR) — the right to have inaccurate personal data corrected and incomplete personal data completed.

  3. Right to erasure (“right to be forgotten”) (Article 17 of the GDPR) — the right to have personal data erased without undue delay where one of the grounds under Article 17(1) of the GDPR applies (e.g. the data are no longer necessary for the purpose for which they were collected; the data subject has withdrawn consent; the data have been processed unlawfully). The right does not apply where processing is necessary, for example, for compliance with a legal obligation (accounting) or for the establishment or defence of legal claims.

  4. Right to restriction of processing (Article 18 of the GDPR) — the right to have the Controller restrict processing in the cases under Article 18(1) of the GDPR (e.g. the accuracy of the data is contested, the processing is unlawful, the data are needed to establish legal claims).

  5. Right to data portability (Article 20 of the GDPR) — the right to receive the personal data concerning the data subject that they have provided to the Controller in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller — where the processing is based on consent or a contract and is carried out by automated means.

  6. Right to object (Article 21 of the GDPR) — the right to object at any time to the processing of personal data concerning them that is based on Article 6(1)(f) of the GDPR (legitimate interest), including profiling. After assessing the objection, the Controller will stop the processing unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims.

  7. Right not to be subject to automated individual decision-making (Article 22 of the GDPR) — the Controller does not carry out such decision-making (see Article VII).

  8. Right to withdraw consent (Article 7(3) of the GDPR) — where processing is based on consent, the data subject has the right to withdraw it at any time, without affecting the lawfulness of processing before its withdrawal.

  9. Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR) — if the data subject believes that the processing of their personal data infringes the GDPR or the Data Protection Act, they have the right to lodge a complaint with the supervisory authority, which is:

    Office for Personal Data Protection of the Slovak Republic Hraničná 12, 820 07 Bratislava 27 tel.: +421 2 3231 3214 e-mail: statny.dozor@pdp.gov.sk web: www.dataprotection.gov.sk

Article X — How to Exercise Your Rights and Time Limits

  1. The data subject can exercise their rights:

    • by e-mail at matej@imach.sk;
    • in writing to the address of the Controller’s registered office (Okružná ulica 1309/18, 900 44 Tomášov).

  2. Where there is doubt about the identity of the applicant, the Controller reserves the right to request additional information necessary to confirm the identity of the data subject (Article 12(6) of the GDPR), in order to prevent the misuse of rights by third parties.

  3. The time limit for handling a request is 1 month from the day it is received. This period may be extended by a further 2 months taking into account the complexity or number of requests; the Controller will inform the data subject of the extension, together with the reasons for it, within 1 month of receiving the request.

  4. Free of charge. Handling a request is generally free of charge. If a request is manifestly unfounded or excessive (in particular because of its repetitive character), the Controller may, in accordance with Article 12(5) of the GDPR, either charge a reasonable fee taking into account the administrative costs or refuse to act on the request.

Article XI — Security of Personal Data

  1. The Controller has taken appropriate technical and organisational measures under Article 32 of the GDPR to protect personal data against unauthorised access, alteration, destruction or loss, in particular:

    • encrypted communication between the browser and the Website (HTTPS / TLS);
    • protection of access to internal systems by passwords and two-factor authentication where possible;
    • regular software updates and third-party security audits (Cloudflare, Vercel, Supabase);
    • training and binding confidentiality of persons with access to personal data;
    • restriction of access to data on a “need-to-know” basis (attachments to enquiries and conversation transcripts are stored non-publicly and only the Controller has access to them);
    • contractual safeguards with processors, including SCC for transfers to third countries.

  2. In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the Controller will proceed in accordance with Articles 33 and 34 of the GDPR — it will notify the breach to the Office for Personal Data Protection of the Slovak Republic within 72 hours and, where necessary, will also inform the data subjects.

Article XII — Specific Information on Materials Containing Data of Third Parties

  1. Buyers often send the Controller materials (graphics, photographs, texts, 3D models) that may contain personal data of third parties — for example names on engraved name tags, portraits for laser engraving on wood, photographs of people used in a product.

  2. The Buyer, as an independent controller in relation to the third parties, is responsible for having a proper legal basis for processing these data (usually the consent of the data subject or a legitimate interest). The Controller processes these data solely as the Buyer’s processor — and only to the extent necessary to complete the specific order.

  3. When sending the materials, the Buyer declares that they have the appropriate authorisation to use the personal data of third parties in the product and undertakes to indemnify the Controller in full in the event of any claims by third parties against the Controller in connection with such data.

  4. After the Goods have been delivered, the Controller archives the materials only to the extent and for the period necessary for any complaint, re-production or defence of legal claims (normally until the end of the warranty period + 1 year); after this period they are permanently deleted.

Article XIII — Final Provisions

  1. This Privacy Policy enters into force and takes effect on 13.10.2026. It replaces the version effective from 23.04.2026.

  2. The Controller reserves the right to change this Policy as necessary (in particular in the event of changes in legislation, a change of processors or an extension of services). The current version will always be published on the Website with its effective date. The Controller will inform the data subject in an appropriate manner of significant changes affecting processing based on consent and, where necessary, will ask for new consent.

  3. Matters not governed by this Policy are governed directly by the GDPR, Act No. 18/2018 Coll. on the Protection of Personal Data and other applicable legislation of the Slovak Republic and the EU.

  4. This Policy is available on the Website in Slovak. Where there are several language versions, the Slovak version prevails.

Tomášov, 13.10.2026

iMach Slovakia s. r. o. Mgr. Šimon Matej, executive director Jozef Petluš, executive director

SolidLabs · +421 911 090 844 · matej@imach.sk · Okružná ulica 1309/18, 900 44 Tomášov, Slovakia