PRIVACY / GDPR
Privacy policy
A transparent explanation of the information we need for a project enquiry, why we process it and the choices available to you.
- Controller
- PanaComm s. r. o.
- Effective from
- 15 July 2026
- Privacy contact
- oliver@panacomm.sk
01 / CLEAR DATA PRACTICE
At a glance
We use information to assess your brief, prepare a quotation, deliver agreed work and operate the enquiry form securely.
- We primarily process information that you choose to send us.
- Project attachments are used only in connection with your enquiry.
- We do not sell form data or use it to build advertising profiles.
Who controls your data
CNC Formy is a brand operated by PanaComm s. r. o., which determines the purposes and means of processing personal data on this website.
811 06 Bratislava – Staré Mesto
Slovenská republika
- ID
- Company ID 55183638
- TAX
- Tax ID 2121913794
- Register
- Bratislava III City Court, Section Sro, Insert No. 167366/B
- oliver@panacomm.sk
We have not appointed a data protection officer. You can direct any privacy question to us using the contact details below.
Data we process
The scope depends on how you contact us and what you choose to attach to your enquiry.
Enquiry form
Name, email address, selected service and message.
Project attachments
Photos, technical drawings, 3D/CAD data, documents or archives that you choose to upload. Please do not send unnecessary personal data or information that you are not authorised to share.
Communication and project data
Follow-up email or telephone communication, quotation materials and information required to deliver the project.
Technical, security and analytics data
IP address or a shortened cryptographic derivative, request time, security token, basic request metadata and the outcome of abuse-prevention checks. When you visit the website, we may also process the page visited, time, referrer, filtered URL parameters, approximate location and device, operating-system and browser type.
We obtain data directly from you and automatically from the technical communication between your device and our server. Sending an enquiry is voluntary; without a name, email and project description, however, we cannot reliably respond.
Why we need the data
Each purpose has a specific legal basis under the General Data Protection Regulation (GDPR).
Enquiry and quotation
Reviewing your brief, asking technical questions, proposing a solution and preparing a quotation.
Article 6(1)(b) GDPR for an individual or sole trader — steps prior to a contract; for a company representative, Article 6(1)(f) — our legitimate interest in handling a business enquiry and communicating with the organisation represented
Project delivery
Project communication, manufacturing, delivery of results, invoicing and handling related requests.
Article 6(1)(b) GDPR for the customer — performance of a contract; for a legal entity’s contact person, Article 6(1)(f) — our legitimate interest in properly delivering the contractual relationship with their organisation
Website security
Preventing spam, automated attacks, repeated submissions and technical misuse.
Article 6(1)(f) GDPR — legitimate interest in protecting the website and communication
Basic web analytics
Aggregate measurement of traffic, page use and technical performance so that we can improve the website.
Article 6(1)(f) GDPR — legitimate interest in measuring and improving our own website with data minimisation and without individual advertising profiles
Legal obligations
In particular accounting, tax or other obligations that apply once a business relationship is established.
Article 6(1)(c) GDPR — compliance with a legal obligation
Submitting the form is not treated as consent to marketing. We do not currently use optional marketing measurement, advertising cookies or similar technologies. If we activate them, they will run only after your prior consent under Article 6(1)(a) GDPR and the applicable rules on storing or accessing information on a device; refusing consent will not prevent use of the website.
Who may receive the data
We disclose information only to the extent required to operate the site, deliver the message and handle the enquiry. Providers act as processors or independent controllers depending on the nature of their service.
Website hosting, content delivery, technical security, form protection and Web Analytics.
Technical, security and analytics visit and request information; form content passes through the hosting infrastructure.
Temporary storage of project attachments outside the public website and creation of a protected download link.
Attachment content, filename, size, format and technical upload metadata.
Secure delivery of an enquiry notification to our email inbox.
Name, email, service, message, temporary protected attachment links and technical delivery data.
Receipt and storage of the delivered message and subsequent project communication.
Message content, contact details and attachments.
We use Vercel Web Analytics for aggregate measurement of website traffic and performance. It records primarily the time, route visited, referrer, filtered URL parameters, approximate geographic area and device, operating-system and browser type. We do not send names, email addresses, messages, filenames or file contents to analytics. According to Vercel’s published documentation, the service does not use third-party cookies and the derived visit identifier is discarded after 24 hours, so visits cannot be linked across days. We do not use analytics for individual advertising profiles.
Transfers outside the EEA
Vercel and Resend are providers based in the United States and, depending on the service configuration, data may be processed outside the European Economic Area, including in the US. In their published documents, the providers state that they use GDPR transfer mechanisms, notably the European Commission’s Standard Contractual Clauses and supplementary safeguards where appropriate. You may request current information about a specific transfer and its safeguards using our contact email.
How long we retain data
We do not apply one universal deadline. Retention depends on how the enquiry develops, whether a contract is formed and which obligations apply to the record concerned.
Enquiry without a project
No longer than 12 months after the last substantive communication, after which we erase or anonymise the data unless longer storage is necessary to protect a specific legal claim.
Technical data for a delivered project
For the duration of the relationship and then only for as long as reasonably necessary for agreed support, a warranty claim, repeat manufacturing or the protection of rights. We review the need for continued storage at least annually after project completion.
Temporary project attachments
In the form’s private storage for no longer than 30 days after upload; a protected link remains valid for no longer than 7 days. Files needed for an accepted project may be moved into the project documentation and then follow that project’s retention period.
Accounting and tax records
Generally for 10 years after the end of the accounting period to which they relate, unless the law requires a different period.
Security and analytics records
The security token is short-lived, and temporary form-protection records are kept only for the time required to limit abuse or investigate an incident. According to the provider’s documentation, the derived Vercel Web Analytics identifier is discarded after 24 hours; Vercel may retain infrastructure logs under its own retention rules.
Your rights
Subject to the conditions of the GDPR, you may exercise the rights below. We may reasonably verify your identity before responding.
- Access your data and information about its processing
- Correct inaccurate or complete incomplete data
- Erase data when there is no longer a reason to process it
- Restrict processing in the circumstances set out by law
- Receive or transfer data where the portability conditions apply
- Object to processing based on legitimate interests
- Withdraw consent without affecting previous processing where we rely on consent for a specific purpose
Form protection without an intrusive CAPTCHA
The form uses several background layers designed to distinguish a legitimate enquiry from automated misuse.
- A signed, time-limited security token linked to the browser
- Request-origin checks, rate limiting and a hidden trap field
- Server-side bot, file-format, size and basic attachment-structure checks
- Encrypted HTTPS transport and restricted access to delivered communication
The security assessment may reject an automated-looking submission, but it does not constitute a decision with legal or similarly significant effects. If a legitimate form is blocked, email us directly at oliver@panacomm.sk.
Analytics and cookies
We do not currently use advertising cookies or tracking for behavioural advertising. On the basis of legitimate interests, Vercel Web Analytics gives us an aggregate view of traffic and technical website performance; it does not use third-party cookies, create cross-site profiles or receive form or attachment contents. You may object to this processing.
Essential security mechanisms use technical signals only to protect the form. If we later enable Google Analytics, advertising systems, remarketing pixels or another optional analytics or marketing technology, we will request consent before it loads, provide an equally accessible refusal and allow you to change your choice later. We will update this page when specific tools are activated; without consent they will remain blocked.
A question about your data?
Tell us what you need to know or which right you wish to exercise. We will respond clearly and without undue delay.
Contact the controlleroliver@panacomm.skWe will update this notice when the form, a provider, a retention period or a legal requirement changes, and before activating a new optional analytics or marketing technology. The current version and effective date are always published on this page.