Privacy Policy
Last updated: August 18, 2026 · Version 2
1. Who processes your data
The controller is CIMBAĽÁK s.r.o., company no. 36473219, registered office Duklianska 17A/3579 085 01 Bardejov Slovensko, entered in Obchodnom registri Okresného súdu Prešov, vložka číslo: 12835/P ("we").
Contact for data protection matters: objednavky@cimbalak.sk.
2. What this service is
We run a web chat in which an assistant built on a large language model answers your questions about what we sell. The same assistant can prepare a quote and place an order for you.
The chat starts out anonymous. There is no registration, no account, and until you give us an e-mail address we do not know who you are.
3. What we process
3.1 The conversation
We store the whole text of your conversation with the assistant — your messages and its answers. We do this so the assistant remembers what you discussed, so you come back to the conversation after a reload, and so we can deal with complaints and faults.
Please do not type anything into the chat that does not need to be there — in particular no health information, national identifiers, card numbers or passwords. The assistant does not need them, and they become part of the stored transcript.
3.2 Contact and identification data
If you want to order, the assistant asks for your name, e-mail address and telephone number. We verify the e-mail address with a six-digit code sent to it.
3.3 Order data
For an order we store its contents, prices, the language of the conversation, the time, and a copy of your contact details as they stood at the moment of ordering. We never rewrite that copy afterwards, not even when you change your contact details — an order has to remain a record of what was actually agreed.
We also store a record of your consent: when you gave it, and to which version of which document.
3.4 Technical data
We store the language of the site, the language the assistant answers in, and token counts (to protect the service from abuse).
We deliberately do not record IP addresses in the public chat. Ordinary web server logs may contain them; they serve operations and security only.
4. Legal bases and purposes
| Purpose | Legal basis (GDPR) | How long |
|---|---|---|
| Answering questions in the chat | consent, Art. 6(1)(a) | until withdrawn, at most 24 months from the last message |
| Verifying the e-mail address | contract / pre-contractual steps, Art. 6(1)(b) | the code lasts minutes; the address stays with the order |
| Fulfilling an order | contract, Art. 6(1)(b) | for the duration of performance |
| Accounting and tax obligations | legal obligation, Art. 6(1)(c) | 10 years |
| Protecting the service from abuse | legitimate interest, Art. 6(1)(f) | 12 months |
| Demonstrating that consent was given | legitimate interest, Art. 6(1)(f) | for the limitation periods |
5. Who we share it with
5.1 The language model provider
So the assistant can answer, we send the conversation to a language model provider through OpenRouter (OpenRouter, Inc., USA), which routes the request onward to the model provider.
This is a transfer to a third country. It relies on the standard contractual clauses adopted by the European Commission under Art. 46(2)(c) GDPR.
If you do not agree to that transfer, please do not use the chat — without sending the text to the model the assistant cannot answer. Write to us at objednavky@cimbalak.sk instead.
5.2 Other recipients
- our hosting and server infrastructure provider
- our e-mail gateway provider
- our own staff, who handle orders
We will name any of these recipients on request at objednavky@cimbalak.sk.
We do not sell your data and do not use it for profiling or advertising.
6. Internal records of assistant runs
To monitor quality and cost we keep technical records of every call to the language model. Those records include the text of your messages, the assistant's answers and the instructions we send to the model. Only authorised staff can read them. We keep them for 90 days.
We say so explicitly because this is a second place the conversation is held, and nothing about using the service makes it visible.
7. Automated decision-making
Answers are produced by a language model, so the processing is automated. There is, however, no automated decision-making producing legal effects within the meaning of Art. 22 GDPR: every order is checked and handled by a person, and the assistant cannot conclude an order without you confirming it.
The assistant can be wrong. What binds us is always the detail we confirm to you by e-mail.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, the right to object to processing based on legitimate interest, and the right to withdraw consent at any time (withdrawal does not affect the lawfulness of processing before it).
Exercise them at objednavky@cimbalak.sk. We answer within one month.
You may also complain to a supervisory authority — in Slovakia the Office for
Personal Data Protection, Galvaniho 7/B, 821 04 Bratislava,
dataprotection.gov.sk, or the authority where you live or work.
9. Children
The service is not intended for anyone under 16, and we do not knowingly process their data.
10. Changes
We may update this policy. Every change of substance gets a new version, and we will ask for your consent again on your next visit.