Privacy Policy
1. Data Controller
The data controller within the meaning of Article 4(7) GDPR is:
Super Lead s. r. o.
Petržalská 1639/8, 060 01 Kežmarok
Reg. no.: 52527743
E-mail: info@supermart.sk
We have not appointed a Data Protection Officer (DPO) because under Article 37 GDPR we are not obliged to do so (we are not a public authority, we do not perform large-scale systematic monitoring nor process special categories of data as a core activity).
2. Data We Process
| Category | Specific data | Purpose | Legal basis |
|---|---|---|---|
| Identification | Email, name (optional), password (hash) | Account creation and operation | Contract performance (Art. 6(1)(b) GDPR) |
| Billing | Name, address, business ID, tax ID, VAT ID (companies) | Issuing invoices | Contract performance + legal obligation (accounting law) |
| Payment | IBAN (for affiliate payouts), variable symbol, amount | Processing payments and commissions | Contract performance |
| Operational | IP address (hash), user agent, login time, in-app action timestamps | Security, abuse prevention, statistics | Legitimate interest (Art. 6(1)(f)) |
| Content | Feed URL, product data, generated posts, connected Meta accounts (page ID, access token) | Service delivery | Contract performance |
| Communication | Support emails, content of notification emails | Communication, support | Contract performance / legitimate interest |
3. Retention Period
- Active accounts: for the duration of the contract + 12 months after termination
- Invoices and accounting records: 10 years (accounting law)
- Login logs and IP: 6 months
- Cookies — affiliate tracking: 30 days (kept even if no registration)
- Content data (products, posts): together with the account; deleted within 90 days after account cancellation (except aggregated anonymized statistics)
4. Who We Share Data With
We disclose data to third parties only to the extent necessary to provide the service:
- WebSupport, s.r.o. (Slovakia) — web hosting, mailbox, database
- Anthropic, PBC (USA) — Claude AI API for text generation. Data (product name, description) is sent anonymously without billing details. Privacy policy
- Google LLC (USA / Ireland) — Gemini API for AI lifestyle graphics. Privacy policy
- Meta Platforms, Inc. (USA / Ireland) — when publishing to Facebook / Instagram via the Graph API
- Google reCAPTCHA (USA / Ireland) — bot protection on registration and the contact form. Google collects IP address, mouse movement data, and page interaction. Privacy policy
For transfers to third countries (USA) we rely on standard contractual clauses pursuant to a European Commission decision or organizations certified under the Data Privacy Framework (DPF).
5. Your Rights
Under GDPR you have the following rights, which you can exercise by emailing info@supermart.sk:
- Access to data (Art. 15) — we will send you a free copy of all data we hold about you
- Rectification (Art. 16) — we will correct inaccurate data
- Erasure / "right to be forgotten" (Art. 17) — except data we are required to retain (invoices for 10 years)
- Restriction of processing (Art. 18)
- Data portability (Art. 20) — export of your products, posts and history in structured format (JSON / CSV)
- Object to processing based on legitimate interest (Art. 21)
- Lodge a complaint with the Slovak Data Protection Authority (dataprotection.gov.sk)
We process requests within 30 days of receipt.
6. Cookies
The website https://supermart.sk uses the following cookies:
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
smart_sess | Account login (session) | until browser closes | Essential |
aff_ref | Affiliate tracking (who invited you) | 30 days | Functional |
smart_consent | Record of your cookie consent | 1 year | Essential |
_ga, _ga_* | Google Analytics — anonymized traffic measurement | 2 years | Analytics |
_GRECAPTCHA | Google reCAPTCHA — bot protection | 6 months | Essential |
We do <strong>not</strong> use third-party marketing cookies (Facebook Pixel, Google Ads, etc.). Analytics cookies (Google Analytics) are active only after your consent via cookie banner. reCAPTCHA and session cookies are necessary for site operation and security.
7. Security
We protect your data through:
- Passwords in the database are stored as secure hashes (bcrypt),
- All traffic is transmitted via HTTPS (TLS),
- Database access is restricted by the hosting IP firewall,
- We regularly update software and apply security patches.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and notify the supervisory authority within 72 hours.
8. Changes
We may occasionally update this policy. You can always find the current version at https://supermart.sk/gdpr.php. We will notify you of material changes by email.