Privacy
notice

2. Details of the controller

Company name: GLOBEFOX s.r.o.

Registered office: Sabinovská 65/9, 821 03 Bratislava, Slovakia

DIČ: 2121882763

IČO: 55100376

Email: antonia@globefox.eu

Telephone: +421 917 705 884

Managing Director: Somogyi Antónia

The controller processes personal data in accordance with the European Union and Slovak data protection rules in force, in particular:

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR),

and Slovak Act No. 18/2018 Coll. on the protection of personal data.

3. Scope of this notice

This notice applies to the processing of personal data concerning the following data subjects:

people making enquiries with GLOBEFOX s.r.o.,

individual contact persons of clients and prospective clients,

jobseekers, applicants and candidates,

people interacting with GLOBEFOX's social media channels,

people using the website, online forms or other online contact channels.

This notice does not cover internal HR processing of GLOBEFOX employees' data, which is governed by a separate internal privacy notice.

4. Principles of processing

The controller processes personal data:

lawfully, fairly and transparently,

for specified purposes,

with data minimisation,

accurately and, where necessary, kept up to date,

subject to storage limitation,

using appropriate technical and organisational security measures.

These principles govern the processing.

The controller only processes personal data that is necessary and proportionate to the particular purpose of processing.

5. Purposes, legal bases, categories of data and retention periods

5.1. Contact, requests for quotations and business communication

Purpose:

handling contact requests, providing quotations, business communication and responding to enquiries.

Legal basis:

Article 6(1)(b) GDPR: taking steps at the data subject's request prior to entering into a contract; or

Article 6(1)(f) GDPR: the controller's legitimate interest in ensuring business communication and maintaining contact.

Categories of data:

name, company name, position, telephone number, email address, content of the enquiry, related correspondence, dates and times, and consultation details.

Retention period:

up to 12 months from initial contact or the last substantive communication, unless a contractual relationship is established or longer retention is necessary for pursuing a legal claim.

5.2. Entering into and performing contracts and related administration

Purpose:

preparing, entering into and performing contracts, maintaining contact, confirming performance and handling claims.

Legal basis:

Article 6(1)(b) GDPR: performance of a contract;

Article 6(1)(c) GDPR: compliance with a legal obligation;

Article 6(1)(f) GDPR: legitimate interest in protecting contractual rights and enforcing claims.

Categories of data:

name, company name, contact details, billing details, delivery details, contractual data, financial performance data, correspondence and consultations.

Retention period:

contractual documentation: 5 years after termination of the contract, unless legislation or an ongoing dispute justifies longer retention;

accounting and invoicing records: for the period required by the applicable accounting and tax obligations, generally 10 years.

5.3. Invoicing, bookkeeping and compliance with tax and accounting obligations

Purpose:

compliance with statutory bookkeeping, invoicing, tax and record-retention obligations.

Legal basis:

Article 6(1)(c) GDPR: compliance with a legal obligation.

Categories of data:

name, address, company name, tax number/identification details, billing details, bank account details, and performance and payment data.

Retention period:

the period required by the applicable accounting and tax rules, typically 10 years.

5.4. Recruitment, selection and handling job applications

Purpose:

receiving and assessing applications, contacting applicants, screening, organising interviews, assessing suitability and presenting candidates to client partners on an appropriate legal basis.

Legal basis:

Article 6(1)(b) GDPR: taking steps at the data subject's request prior to possible employment;

Article 6(1)(f) GDPR: the controller's legitimate interest in documenting the selection process, communicating and handling legal claims.

Categories of data:

name, telephone number, email address, information in CVs and cover letters, professional experience, qualifications, language skills, salary expectations, availability, interview notes and reference information, where provided or made available by the data subject.

Retention period:

for applications for a particular position: until the selection process is concluded and for up to 12 months afterwards;

if the applicant becomes an employee, their data becomes part of the relevant employment documentation;

if the controller wishes to retain the applicant's details for future opportunities, separate consent will be requested.

Important rule:

GLOBEFOX only forwards a candidate's data to a client partner where an appropriate legal basis exists and the data subject has been properly informed about the transfer.

5.5. Candidate database / future job opportunities

Purpose:

notifying the data subject of future job opportunities that may be relevant to them.

Legal basis:

Article 6(1)(a) GDPR: the data subject's consent.

Categories of data:

information contained in application materials, CVs and related communication.

Retention period:

24 months from the date consent is given, or until consent is withdrawn, whichever occurs first.

The data subject may withdraw consent at any time without giving a reason. Withdrawal does not affect the lawfulness of earlier processing.

5.6. B2B contact for direct marketing purposes

Purpose:

presenting GLOBEFOX's services to companies and business partners and contacting potential clients.

Legal basis:

Article 6(1)(f) GDPR: the controller's legitimate interest in establishing business relationships and presenting its relevant services.

Categories of data:

name, company name, position, work email address, work telephone number and information relating to business communication.

Source of data:

publicly available company databases, company websites, professional social networks, business referrals and previous professional contacts.

Retention period:

up to 12 months after the last substantive contact, or until the data subject objects.

The data subject may object at any time to the processing of their personal data for direct marketing; in that case, the controller will stop the related processing.

5.7. Social media pages, messaging platforms and job advertisements

Purpose:

displaying GLOBEFOX's services and job advertisements, maintaining contact, handling messages, brand building and statistical analysis.

Legal basis:

Article 6(1)(f) GDPR: the controller's legitimate interest in maintaining its online presence, communicating and promoting its services.

Categories of data:

profile information provided or visible on social media platforms, messages, reactions, comments, application data and statistical data.

Note:

where the data subject contacts the controller or applies for a job through Facebook, Instagram, Messenger or another social platform, that platform's own data processing also applies. In some cases, platforms may act as independent controllers and, for certain statistical processing activities, under a separate agreement.

Retention period:

until the matter is closed, or up to 12 months, unless processing lawfully continues for another purpose.

5.8. Website security, logging and IT protection

Purpose:

maintaining the security of the website and IT systems, preventing abuse, troubleshooting and system logging.

Legal basis:

Article 6(1)(f) GDPR: the controller's legitimate interest in operating its systems and services securely.

Categories of data:

IP address, date and time, browser and device details, log files and technical error information.

Retention period:

up to 90 days, unless longer retention is necessary due to a security incident or legal dispute.

5.9. Establishment, exercise and defence of legal claims

Purpose:

establishing, exercising and defending legal claims, handling complaints and participating in administrative or court proceedings.

Legal basis:

Article 6(1)(f) GDPR: the controller's legitimate interest in protecting its rights and enforcing its claims.

Categories of data:

all relevant data, documents, correspondence and evidence necessary for the particular matter.

Retention period:

for as long as the purpose of enforcing or defending claims remains, or until the related proceedings are finally concluded.

6. Sources of data

The controller may obtain personal data from the following sources:

directly from the data subject,

from CVs, forms, emails or messages submitted by the data subject,

from publicly accessible professional and business sources,

through social media platforms,

through a partner's referral or introduction,

from job portals or professional databases, provided that an appropriate legal basis for processing exists.

7. Recipients and processors

The controller makes personal data available only to the extent necessary to the following categories of recipients or processors:

accountants and tax advisers,

legal representatives,

IT service providers,

hosting providers,

email and cloud service providers,

providers of CRM / ATS / administration systems,

social media and online advertising platforms,

client partners, where an appropriate legal basis exists for forwarding the candidate's details,

authorities, courts or other bodies where required by law or necessary in response to a lawful request.

Where necessary, the controller enters into appropriate data processing agreements with processors.

8. Transfers to third countries

Where processing involves a service provider that may transfer personal data outside the European Economic Area, the controller carries out such transfers only subject to safeguards complying with the applicable legislation, in particular:

on the basis of an adequacy decision, or

using standard contractual clauses adopted by the European Commission,

with additional supplementary safeguards where necessary.

9. Processing special categories of data

As a general rule, the controller neither requests nor processes data subjects' special categories of personal data.

When applying or making contact, please provide only information necessary for the particular purpose. If the data subject nevertheless submits special categories of personal data, the controller will process it only where an appropriate legal basis exists; otherwise it will be deleted or anonymised.

10. Automated decision-making and profiling

The controller does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning the data subject or similarly significantly affect them.

11. Nature of the provision of data

As a general rule, data subjects provide their data voluntarily. However, certain information may be necessary for:

providing a quotation or responding to an enquiry,

entering into and performing a contract,

invoicing and compliance with statutory obligations,

assessing a job application.

These purposes may require the provision of data.

If the data subject does not provide the necessary information, the controller may be unable to enter into a contract, respond, assess an application or provide the service concerned.

12. Rights of data subjects

Subject to the statutory conditions, data subjects have the right to:

request information about the processing of their personal data,

request access to the data being processed,

request rectification of inaccurate data,

request erasure of their data,

request restriction of processing,

object to processing based on legitimate interests,

object at any time to processing for direct marketing purposes,

withdraw consent at any time where processing is based on consent,

exercise the right to data portability in the cases provided for by law.

The right to data portability does not mean a printed copy; as a general rule, it means a structured, commonly used, machine-readable format, subject to the GDPR's conditions.

The controller responds to data subject requests without undue delay and generally within one month at the latest. In justified cases this may be extended by a further two months, of which the data subject must be informed within one month.

13. Remedies and complaints

If a data subject considers that the processing of their personal data infringes the GDPR or applicable data protection rules, they may lodge a complaint with the supervisory authority or seek a judicial remedy.

The supervisory authority competent for the Slovak controller is:

Úrad na ochranu osobných údajov Slovenskej republiky

Galvaniho Business Centrum II, Galvaniho 7/B

821 04 Bratislava

Slovak Republic

Tel.: +421 2 32 31 32 14

Contact details of the Slovak data protection authority

According to information published by the Slovak authority, a complaint may be submitted to initiate data protection proceedings. The authority publishes detailed procedural rules for complaints; the complaint must be submitted in Slovak.

14. Data security and personal data breaches

The controller applies appropriate technical and organisational measures to protect personal data, in particular against:

unauthorised access,

unauthorised alteration,

unauthorised transfer,

disclosure,

erasure,

destruction,

loss,

damage.

These measures protect against the risks listed above.

In the event of a personal data breach, the controller acts in accordance with applicable legislation. If the breach is likely to pose a risk to data subjects' rights and freedoms, it will notify the competent supervisory authority without undue delay and, where possible, within 72 hours at the latest; data subjects will also be informed where necessary.

15. Cookies and tracking codes

If the GLOBEFOX website uses cookies, tracking technologies, tracking codes or remarketing tools, their detailed rules are set out in a separate Cookie Notice and the associated consent management interface.

16. Amendments to this notice

The controller reserves the right to amend this notice unilaterally, particularly in the event of changes in legislation, processing procedures or an expansion of services. The version currently in force is published on the controller's official platform.

Dated: Bratislava, 9 April 2026