Skip to content

Privacy Policy

Controller:

RedBlue s. r. o. Pribinova 21/11, 901 01 Malacky, Slovak Republic Company ID (IČO): 57778515 Zapísaná v Obchodnom registri Mestského súdu Bratislava III, oddiel: Sro, vložka č. 202232/B Managing director: Jaroslav Krč Contact: gdpr@123audit.sk · www.123audit.sk

Policy effective from: 05. 11. 2026 Version: 2.2

Article 1 — Introductory provisions

  1. The company RedBlue s. r. o. (hereinafter the "Controller") operates the website https://123audit.sk, through which it provides website audit services (hereinafter the "service" or "audit").
  2. This Privacy Policy (hereinafter the "Policy") informs data subjects about which personal data the Controller processes, for what purposes, on what legal basis, how long it retains them and what rights data subjects have in connection with their processing.
  3. When processing personal data, the Controller proceeds in accordance with:
    • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter the "GDPR");
    • Act No. 18/2018 Coll. on personal data protection and on amendments to certain acts;
    • Other related legal regulations of the Slovak Republic and the European Union. The GDPR applies directly to the Controller as an entity established in the Slovak Republic (Article 3(1) GDPR); the rights of data subjects resident in another Member State, including the right to lodge a complaint with their local supervisory authority (Article 12 of this Policy), are unaffected.
  4. This Policy applies to the processing of personal data of:
    • visitors to the website 123audit.sk,
    • persons interested in the Controller's services,
    • customers who have ordered a service,
    • persons communicating with the Controller (e-mail, form, telephone).

Article 2 — Definitions of basic terms

In accordance with Article 4 of the GDPR, for the purposes of this Policy the following terms mean:

  • Personal data — any information relating to an identified or identifiable natural person;
  • Processing — any operation performed on personal data (collection, recording, organisation, storage, use, disclosure, erasure, …);
  • Controller — the person determining the purposes and means of processing personal data; in this Policy RedBlue s. r. o.;
  • Processor — the person processing personal data on behalf of the Controller;
  • Data subject — the natural person whose personal data is processed;
  • Consent — a freely given, specific, informed and unambiguous indication of the data subject's wishes;
  • Profiling — automated processing of personal data to evaluate personal aspects of a data subject.

Article 3 — What personal data we process

3.1 Website visitors

When you visit the website 123audit.sk, the Controller may process:

  • IP address and technical request data (browser, operating system, requested URL, time) in server and security logs;
  • data stored in cookies and similar technologies (details in the Cookies document).

We measure website traffic and the use of the order forms with the Controller's own tool, PWS Analytics (udaje.redblue.sk). The measurement stores nothing on the visitor's device (no cookies, localStorage or sessionStorage) and respects the “Do Not Track” setting. It records the page visited (without URL parameters), the referring page, time spent on the page, scroll depth, clicks on links to other websites, technical speed metrics and predefined steps of the order form (opening, starting to fill in, submission, type of error, outcome). After an order or an Individual Audit request has been saved successfully, the server records only that it was received and its type (Mini, Complex, modules, Individual). Form field contents, names, contact details, the audited address, prices, order numbers and access tokens are not sent to the measurement. The IP address and browser identifier (user-agent) are used to calculate a pseudonymous fingerprint that differs for each website and changes every day; in addition, only the browser type, operating system and device type (e.g. Chrome, Windows, computer) are derived from the browser identifier. Neither the IP address itself nor the full browser identifier is stored in the measurement database. Measurement does not run on the contract, payment, withdrawal and verification pages. The measurement is not linked to language cookies or customer records. Purpose: traffic statistics and improving the website and the ordering process. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention period: 730 days. We do not use third-party advertising or analytics tools.

3.2 Interested persons and customers (audit service order)

When creating an order or a request for an initial consultation (Individual Audit), the Controller processes in particular:

  • Identification data: first name and surname (for a natural person), business name (for a legal person or self-employed person);
  • Address data: registered office, place of business, address of permanent residence, billing address;
  • Entity identifiers: Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH);
  • Contact data: e-mail address, telephone number;
  • E-mail verification records: the one-time verification code sent when ordering (only its hash is stored), the time of verification and the IP address from which the code was entered — as evidence that the order was placed by the holder of the mailbox;
  • Technical data about the signing of the contract: date, time and IP address at the moment of electronic signature — as evidence of conclusion of the contract;
  • Withdrawal data: identification of the order, reason (optional), the IP address from which the withdrawal was sent, and the bank account number (IBAN) if the consumer asks for the refund to be sent to an account other than the one used for payment;
  • Data about the contact person (for a legal person): first name, surname, e-mail, telephone, position;
  • Order data: type of audit, audited domain, date of order, price, payment identifier;
  • Consent records (consent log): confirmation of consent to the Terms and Conditions, this Policy and the Audit Performance Contract — including the timestamp and version of the documents;
  • Communication: e-mail and other correspondence with the Controller relating to the order, delivery and support.

3.3 Audited websites

During an audit (Mini, Complex or Individual), when checking the publicly available parts of the customer's website, the Controller may incidentally come into contact with personal data of third parties published on the audited website (e.g. e-mails of contact persons, names in the impressum). In this check the Controller itself determines the procedure, tools and methodology of the audit; it therefore processes these publicly available data as an independent controller on the basis of a legitimate interest (Art. 6(1)(f) GDPR) — performance of the ordered audit and identification of shortcomings of the customer's website. This data:

  • is obtained exclusively from the publicly available parts of the audited website and is not combined with other sources;
  • is not stored beyond what is necessary to produce the report;
  • after the audit ends, is not retained longer than is necessary to perform the contract and to fulfil the archiving obligation (Article 5).

Informing each third party concerned individually would involve a disproportionate effort (Art. 14(5)(b) GDPR); the Controller therefore makes the information about this processing publicly available in this Policy. The data subject may object to the processing at any time (Article 9, point 6).

If the customer gives the Controller access to non-public parts of its website or systems (typically with the Individual Audit), the Controller processes the personal data in those systems on behalf of the customer as a processor, and the parties conclude a data processing agreement under Article 28(3) of the GDPR.

3.4 Requests, questions and complaints

If a data subject contacts us (e-mail, contact form), we process the data they provide in the message — in particular name, e-mail, telephone and the content of the message.

Article 4 — Purposes and legal bases of processing

The Controller processes personal data for the following purposes and legal bases in accordance with Article 6 of the GDPR:

Purpose Legal basis Example
Conclusion and performance of the audit performance contract Art. 6(1)(b) GDPR — performance of a contract order processing, invoicing, delivery of the report, support
Compliance with legal obligations Art. 6(1)(c) GDPR — legal obligation accounting and tax obligations (Act No. 431/2002 Coll.), complaint procedure
Legitimate interests of the Controller Art. 6(1)(f) GDPR website security, fraud prevention, debt recovery, evidentiary records of communication and consents
Traffic statistics and improving the website and the ordering process Art. 6(1)(f) GDPR measurement with the Controller's own tool without cookies (Article 3.1)
Marketing to existing customers (own similar services) Art. 6(1)(f) GDPR (legitimate interest); Section 116(15) and (16) of Slovak Act No. 452/2021 Coll. on electronic communications; for recipients in another Member State subject to the national rules implementing Article 13 of Directive 2002/58/EC information about the Provider's further audit services, for no more than 1 year after the end of the contractual relationship; you may object free of charge when ordering and in every message
Marketing based on consent (optional box in the order form) Art. 6(1)(a) GDPR; Section 116(3) of Slovak Act No. 452/2021 Coll. news and offers to persons who have given consent; consent may be withdrawn at any time
Responding to questions and complaints Art. 6(1)(f) GDPR communication with the data subject

The processing of publicly available personal data of third parties on audited websites (Article 3.3 of this Policy) is based on the legitimate interest of the Controller and of the customer in identifying technical, security and legal shortcomings of the audited website (Art. 6(1)(f) GDPR); where the Controller has access to the customer's non-public systems, it takes place on behalf of the customer within the scope of a data processing agreement (Article 28 GDPR).

Provision of data when ordering: identification, address and billing data, the e-mail address and the details of the audited domain are a requirement necessary to conclude and perform the contract and, for billing data, also a statutory requirement (Slovak Act No. 431/2002 Coll. on accounting and Act No. 222/2004 Coll. on value added tax); without them the order cannot be accepted and the contract cannot be concluded. Data marked as optional (telephone number, reason for withdrawal, IBAN, marketing consent) need not be provided and their absence has no consequences (Art. 13(2)(e) GDPR).

Article 5 — Retention period of personal data

The Controller retains personal data only for the period necessary to achieve the purpose of processing:

Category of data Retention period
Signed contract and its annexes 10 years from conclusion of the contract — as supporting document for the accounting transaction and for the defence of legal claims (limitation periods)
Order data (billing, identification) tied to invoice archiving (10 years); where no accounting document corresponds to the order, anonymised after the audit-content archiving period expires (4 years)
Accounting and tax documents 10 years from the end of the accounting period (Act No. 431/2002 Coll.)
Consent records (consent log) 10 years from conclusion of the contract — they form part of the signed contract and are deleted together with it
E-mail verification records (code hash, time, IP address) 12 months from creation of the record — evidence of verification at ordering and abuse protection; deleted automatically afterwards
IP address and time of electronic signature of the contract together with the contract: 10 years — evidence of its conclusion
Bank account number (IBAN) provided on withdrawal from the contract 30 days from settlement of the withdrawal; then erased
Communication (e-mail, contact form) as a rule 3 years from the last communication
Contact form (including the sender's IP address) 3 years from the last communication
Website logs (server, security) as a rule 12 months
Data from measuring website traffic and the order forms (Article 3.1) 730 days from recording; deleted afterwards
Cookies according to the type of cookie (details in the Cookies document)
Publicly available third-party data on audited websites (Article 3.3) and archiving of the audit output (report, certificate, evidence — screenshots and saved copies of pages) for the duration of the audit and archiving, no more than 4 years unless agreed otherwise

After the relevant period expires, the Controller erases or anonymises the personal data.

Article 6 — Recipients and categories of recipients

The Controller does not provide personal data to third parties except where this is necessary to perform a contract, fulfil a legal obligation, or with the express consent of the data subject. Possible recipients:

  • Processors:
    • Hostinger (Hostinger International Ltd., Cyprus) — web hosting, server infrastructure, e-mail server and domain (servers in the EU; for network operation and e-mail delivery Hostinger also uses further processors, including companies based in the USA);
    • Stripe (Stripe Payments Europe, Limited, Ireland) — payment gateway for online card payments. When processing the payment, Stripe acts as the Controller's processor; it receives the customer's e-mail address, order number, package name, amount and payment data. The customer enters the payment card details directly on Stripe's page and the Controller does not receive them. To the extent that Stripe processes data for its own purposes (in particular fraud prevention, anti-money-laundering obligations, regulatory obligations and its own billing), it is an independent controller and processes the data under its own privacy policy (stripe.com/privacy);
    • Anthropic PBC (USA) — provider of the language model used in evaluating the audit (details in Article 7);
    • the provider of accounting or invoicing services;
  • Contractual partners of the Controller who provide specialised services (e.g. legal advice) — only to the extent necessary to perform their task;
  • Public authorities, where required by law or by a final decision (e.g. the Financial Administration of the Slovak Republic, a court, the police);
  • External law firms in the case of debt recovery or disputes.

The Controller will provide the current list of processors with their business name, registered office and purpose of processing on request sent to gdpr@123audit.sk. The Controller will notify the customer in advance of any change or addition of a processor that processes data on the customer's behalf (data processing agreement under Article 3.3); the customer has the right to object to it (Article 28(2) GDPR).

The Controller does not sell personal data to third parties.

Article 7 — Use of artificial intelligence tools

  1. When evaluating the audit, the Controller uses the language model of Anthropic PBC (USA) as an auxiliary tool, both through its programming interface and through the Claude Code tool operated under the Controller's account. The model processes exclusively publicly available content of the audited website (e.g. the published privacy policy, cookie information, legal notice) and the technical findings of the audit (findings, the website address, scores). The customer's identification, contact and billing data from the order are not passed to the model.
  2. Where the published content of the audited website contains personal data of third parties, the Controller processes it as an independent controller (Article 3.3) and Anthropic PBC acts in this respect as a processor of the Controller under Art. 28(3) GDPR on the basis of its contractual terms for business customers, including a data processing addendum. Where the Controller processes data on behalf of the customer (non-public systems), Anthropic PBC is a sub-processor under Art. 28(4) GDPR.
  3. The output of the model is not a decision. Every output is assessed and approved by the Controller's designated senior IT specialist; the Controller does not carry out automated decision-making with legal effect under Art. 22 GDPR.
  4. The transfer to the USA is based on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR) contained in the provider's contractual terms (Article 8).

Article 8 — Transfer of personal data outside the EU / EEA

  1. The Controller prefers processors that process data within the European Union or the European Economic Area.
  2. The Controller uses processors that process or may process personal data also outside the EU/EEA — the language model provider Anthropic PBC (USA), the payment gateway provider Stripe, whose group is headquartered in the USA (both as a processor and as an independent controller under Article 6), and the web hosting and e-mail provider Hostinger, whose sub-processors (e.g. Cloudflare, Inc., Proofpoint, Inc.) are based in the USA. In these cases the transfer is based on the standard contractual clauses adopted by the EU Commission under Art. 46(2)(c) GDPR, or on an adequacy decision (EU–US Data Privacy Framework) where the provider is certified under it.
  3. The data subject has the right to be informed about a specific transfer on the basis of a written request sent to gdpr@123audit.sk.

Article 9 — Rights of the data subject

In accordance with Articles 15 — 22 of the GDPR, the data subject has the following rights:

  1. Right of access (Article 15 GDPR) — to obtain confirmation as to whether personal data concerning them is being processed and, if so, to obtain access to it and information about the processing.
  2. Right to rectification (Article 16 GDPR) — to request the rectification of inaccurate personal data or the completion of incomplete personal data.
  3. Right to erasure ("right to be forgotten", Article 17 GDPR) — to request the erasure of personal data, where there is no other legal ground for its further processing (e.g. a legal obligation to retain accounting documents). If the data subject requests erasure, the Controller erases the audit content (findings, report, certificate, cookie evidence and the outputs of artificial intelligence tools), the e-mail verification records, the bank account and the IP addresses from requests, and stops further processing of contact data. Retained are: (a) the invoice and the data stated on it — 10 years under Act No. 431/2002 Coll.; (b) the signed contract including the consent records — 10 years as evidence of its conclusion; (c) the record of the erasure request itself, without the IP address. If no invoice was issued for the order, the e-mail address in the order is replaced by an anonymous value.
  4. Right to restriction of processing (Article 18 GDPR) — to request a temporary restriction of processing in certain cases.
  5. Right to data portability (Article 20 GDPR) — to receive one's personal data in a structured, commonly used and machine-readable format and to transfer it to another controller.
  6. Right to object (Article 21 GDPR) — to object to the processing of personal data carried out on the basis of the Controller's legitimate interest, including profiling.
  7. Right to object to automated decision-making, including profiling (Article 22 GDPR) — however, in its activities the Controller does not carry out automated decision-making that would produce legal effects or significantly affect the data subject.
  8. Right to withdraw consent at any time, where processing is based on consent. The withdrawal of consent does not affect the lawfulness of processing before its withdrawal.
  9. Right to lodge a complaint with the supervisory authority (Article 12 of this Policy).

The data subject may exercise these rights in writing by e-mail to gdpr@123audit.sk or by post to the address of the Controller's registered office. The Controller will respond to the request without undue delay and in any event within one month of its receipt. Where necessary, taking into account the complexity and number of requests, the period may be extended by two further months; the Controller will inform the data subject of any such extension and the reasons for it within one month of receipt of the request. Where the Controller has reasonable doubts concerning the identity of the requester, it may request additional information necessary to confirm it.

To verify identity, the Controller may ask the data subject for additional information if it has reasonable doubts about their identity.

Article 10 — Security of processing

In accordance with Article 32 of the GDPR, the Controller adopts appropriate technical and organisational measures to ensure the protection of personal data:

  • the transfer of data on the website is protected by HTTPS (TLS) encryption;
  • access to personal data is granted only to authorised persons on a need-to-know basis;
  • regular updating of software and systems;
  • secure passwords, multi-factor authentication where appropriate;
  • records of security incidents and breach procedures;
  • a confidentiality undertaking of employees and processors.

In the event of a security breach that would pose a risk to the rights and freedoms of data subjects, the Controller proceeds in accordance with Articles 33 and 34 of the GDPR (notification to the supervisory authority within 72 hours, and to the data subject where applicable).

Article 11 — Cookies and similar technologies

  1. The website 123audit.sk uses only technical cookies and one technical sessionStorage item, which are necessary to provide a function expressly requested by the visitor (remembering the interface language, operation of the order form). The legal basis is the legitimate interest of the Controller (Art. 6(1)(f) GDPR); under Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications they do not require consent.
  2. The Controller does not use analytics, marketing or profiling cookies. It measures website traffic with its own tool that stores nothing on the visitor's device (Article 3.1); no cookies banner is therefore displayed on the website. Should the Controller introduce tools that store data on the device in the future, it will obtain express consent (Art. 6(1)(a) GDPR) before activating them and update this document and the Cookies document accordingly.
  3. Detailed information about the individual items, their purpose and duration is provided in the Cookies document.

Article 12 — Supervisory authority

The data subject has the right to lodge a complaint with the supervisory authority if they believe that the processing of their personal data infringes the GDPR.

Supervisory authority of the Slovak Republic:

Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky) Hraničná 12, 820 07 Bratislava 27 E-mail: statny.dozor@pdp.gov.sk Web: https://dataprotection.gov.sk

The complaint may also be lodged with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). For Ireland: Data Protection Commission, https://www.dataprotection.ie.

Article 13 — Changes to the Privacy Policy

  1. The Controller is entitled to amend and update this Policy unilaterally. The current version is always published on the website 123audit.sk in the Personal Data Protection section, stating the effective date and version.
  2. In the case of material changes affecting the rights of the data subject, the Controller will give appropriate notice of them (e.g. by e-mail or by a visible notice on the website).

Article 14 — Contact for the Controller

For all questions concerning the processing of personal data, you can contact the Controller:

RedBlue s. r. o. Pribinova 21/11, 901 01 Malacky, Slovak Republic E-mail: gdpr@123audit.sk Web: www.123audit.sk

The Controller currently has not appointed a data protection officer (DPO) under Article 37 of the GDPR, as its activity does not meet the statutory criteria for the mandatory appointment of a DPO. For questions concerning personal data protection, please contact the details stated above directly.