Privacy Policy

This policy explains what personal information VERLYON collects through verlyon.com, when you contact us and when we work together: what we use it for, the legal basis, who we share it with, how long we keep it, and the choices and rights you have. It applies to visitors from the United States, the United Kingdom, the European Union and everywhere else.

Who we are

VERLYON s. r. o. is the company responsible for your personal information (the “controller”). We’re a limited liability company registered in Slovakia, EU: Company ID 57 618 844, Commercial Register of the District Court Banská Bystrica, section Sro, entry no. 55935/S. Full company details are on our Company Details page. Because we’re based in the EU, the EU General Data Protection Regulation (GDPR) applies to everything we do with personal information, wherever you live.

For anything about your data, email info@verlyon.com. We haven’t appointed a data protection officer because the law doesn’t require one for a business of our size and type.

What we collect and why

When you contact us

Your name, work email, company, website, and anything you write to us by form, email or on a call. We use it to reply, prepare a website preview or a quote, and keep a record of the conversation. Legal basis: steps you asked us to take before a contract (GDPR Art. 6(1)(b)) and our legitimate interest in answering business inquiries (Art. 6(1)(f)).

When you become a client

Contact and billing details of your company and the people we work with, project communication and the materials you send us. We use them to deliver the project, invoice it and keep our books. Legal basis: the contract (Art. 6(1)(b)) and our obligations under Slovak accounting and tax law (Art. 6(1)(c)).

When we reach out to a business

If we contacted you about our services, we found your business contact details (name, role, work email or phone, company information) in public sources such as company registers, business directories or your company’s website. We use them only to offer services relevant to your business. Legal basis: our legitimate interest in business-to-business marketing (Art. 6(1)(f)). Reply “no thanks” or “unsubscribe” at any time and we’ll stop. We’ll delete your details and keep only a note not to contact you again.

Analytics and advertising cookies

Information about how you use the site (pages viewed, device and browser, approximate location based on IP address, how you found us) and cookie identifiers. We use Google Analytics 4, managed through Google Site Kit and Google Tag Manager, to understand traffic. When we run ad campaigns, we use Google Ads and the Meta Pixel to measure them. Legal basis: your consent (Art. 6(1)(a)). None of these tools load until you allow them in the cookie banner, and you can change your choice anytime under Cookie settings. Details are in our Cookie Policy.

Server logs and security

Our hosting provider keeps technical logs (IP address, time, requested page, browser) to keep the site secure and running. Legal basis: legitimate interest (Art. 6(1)(f)).

Protecting our rights

If ever needed, we use information to establish, exercise or defend legal claims. Legal basis: legitimate interest (Art. 6(1)(f)).

When we work on your project

If we process personal data on your behalf while building or running your website, campaigns or other work (for example messages your own visitors send through a form we built), you’re the controller and we act as your processor. The details are in our Data Processing Agreement under Article 28 GDPR, which is an annex to every contract and part of our Terms & Conditions.

Where the information comes from

Directly from you, except for business outreach, where it comes from the public sources described above. Giving us your details is voluntary, but without contact details we can’t reply, and without billing details we can’t sign a contract.

Who we share it with

These companies process personal information for us as service providers (processors), only on our instructions and under a written agreement:

• Websupport s. r. o., Slovakia: website hosting and email. Data stays in the EU.
• Cloudflare, Inc.: the internal system where we keep inquiries and projects. EU and United States.
• CookieYes Limited, United Kingdom: the cookie banner and a record of your choice.
• Google Ireland Limited and Google LLC: Google Analytics 4, Google Tag Manager and Google Ads, only with your consent. EU and United States.
• Meta Platforms Ireland Limited and Meta Platforms, Inc.: the Meta Pixel, only with your consent and only when we run ads. EU and United States.
• Our external accountant, Slovakia: bookkeeping.

We may also disclose information to public authorities when the law requires it. We don’t sell personal information, and we don’t share it in exchange for money.

Transfers outside the EU and the UK

Google, Meta and Cloudflare may process data in the United States. All three are certified under the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework, which the European Commission recognized as adequate on July 10, 2023. Standard contractual clauses approved by the European Commission apply as an additional safeguard. CookieYes is in the United Kingdom, which the European Commission recognizes as providing adequate protection.

How long we keep it

• Inquiries that don’t lead to a project: 3 years after our last contact.
• Business outreach contacts: until you object, and no longer than 2 years after our last contact.
• Contracts and project communication: for the length of the contract and 4 years after it ends (the limitation period under the Slovak Commercial Code).
• Accounting records: 10 years from the end of the year they relate to (Slovak Accounting Act).
• Google Analytics 4 data: 14 months.
• Cookies: as listed in the Cookie Policy.
• Server logs: no longer than 12 months.

When the period ends, we delete or anonymize the information.

How we protect it

Encrypted connections (HTTPS), individual accounts with the least access needed, two-factor sign-in where available, regular updates, and weekly backups kept for 30 days.

Your rights in the EU, the UK and Switzerland

You can ask for access to your data and a copy of it, correction, deletion, restriction of processing and a portable copy of data you gave us under a contract or consent. You can object at any time to processing based on our legitimate interest, including direct marketing, and withdraw any consent without affecting what we did before. Email info@verlyon.com and we’ll reply within one month. We may ask for details to confirm it’s really you.

You can also complain to the Office for Personal Data Protection of the Slovak Republic (Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk), which is our lead supervisory authority, or to the data protection authority where you live or work, such as the UK Information Commissioner’s Office (ico.org.uk).

Your rights in the United States

Depending on your state (for example California, Colorado, Connecticut, Virginia or Texas), you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of targeted advertising. We give these rights to every US visitor, whether or not your state’s law covers a business of our size.

• Selling and sharing. We don’t sell personal information. If you accept advertising cookies, Google and Meta may use information from this site to show you ads elsewhere, which some state laws call “sharing” or “targeted advertising.” Advertising cookies stay off until you opt in, and you can turn them off anytime under Cookie settings.
• Global Privacy Control. We treat a Global Privacy Control signal from your browser as a request to opt out of advertising cookies.
• Do Not Track. There’s no common standard for how websites should respond to browser “Do Not Track” signals, so we don’t respond to them. Our cookie banner keeps every non-essential cookie off until you choose otherwise.
• Other parties. With your consent, Google and Meta may collect information about your online activity over time and across different websites when you visit ours.
• How to make a request. Email info@verlyon.com. We’ll confirm we received it within 10 business days and answer within 45 days. An authorized agent can act for you with your written permission. We won’t treat you differently for using your rights. If we decline a request, reply to our answer with “Appeal” and we’ll review it within 45 days.
• Children. Our services are for businesses. The site isn’t directed to children, and we don’t knowingly collect information from anyone under 16.

Canada

You can ask to see and correct the personal information we hold about you and withdraw consent, as provided by PIPEDA. Use the same email address. You can also contact the Office of the Privacy Commissioner of Canada.

Automated decisions

We don’t make decisions about you based solely on automated processing, and we don’t profile you in ways that have legal or similarly significant effects. With your consent, Google and Meta may tailor the ads you see.

Changes to this policy

If we change this policy, we’ll update this page and the effective date at the top. If a change is significant, we’ll also email our clients.

This policy is effective as of October 20, 2026.