Privacy policy

This website is operated by Qualitex, a company that designs, manufactures and installs custom furniture, with a showroom at the LIGHTPARK furniture centre, Račianska 90, 831 02 Bratislava, 2nd floor.

Contact for data protection matters: phone +421 952 030 818 or the form on the Contact page.

We follow Regulation (EU) 2016/679 (GDPR), Slovak Act No. 18/2018 Coll. on the protection of personal data and Act No. 452/2021 Coll. on electronic communications.

What we process:

• what you fill in: your name, e-mail or phone number and your message;
• photos and videos of the space, if you attach them (optional, up to 10 files): they are uploaded to our server while you fill in the form and reach us with the enquiry by e-mail (larger files as a download link to our server); the server removes metadata including location (GPS) from photos, while videos are stored as you uploaded them and may contain the location where they were recorded;
• what is added automatically: the page language, the name of the project, category or page you send the enquiry from, and the time it was received; if you came through one of our ads in the hour before, also its labels (source, channel, campaign).

Why: to reply to you, arrange a site survey and prepare an offer.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). If the enquiry does not concern an order, our legitimate interest in replying to messages (Art. 6(1)(f) GDPR).

Providing your details is voluntary, but we cannot reply without a name and a contact. Please do not include information in your message that we do not need to handle the enquiry.

Enquiry priority. When an enquiry arrives, the system automatically gives it an indicative priority based on the length of the message and the page it was sent from. This helps us decide the order in which we handle enquiries. A person always decides what happens next; this is not automated decision-making within the meaning of Art. 22 GDPR. Legal basis: our legitimate interest in handling enquiries efficiently (Art. 6(1)(f) GDPR).

The enquiry is stored on our server and sent to us by e-mail. If the form protection flags an enquiry as possible spam (for example, it was sent without the check in the browser or contains more than two links), it is only stored on the server and not sent by e-mail.

To keep bots from abusing the form, we check that it was sent from our website and how quickly it was filled in. We also limit the number of submissions from one IP address (no more than 5 per hour). For this purpose we store the IP address only in pseudonymised form (as a hash); a shortened part of this hash is stored with the enquiry. When you upload photos and videos, we limit their number and size per IP address over 24 hours; for this we keep a hash of the IP address for 24 hours. So that the same enquiry is not stored twice, we keep a hash of the contact details and message for 24 hours. Legal basis: our legitimate interest in the security of the website (Art. 6(1)(f) GDPR).

Without your consent we do not use cookies, advertising tools or third-party analytics. We count visits ourselves, on our own server (section 5). Advertising cookies from Meta are switched on only if you agree (section 4a). Fonts, images and videos are loaded from our own server, not from third parties.

We store the following in your browser’s storage:

• qx-vstup (sessionStorage, home page only) — a flag that the opening animation has already played, so it does not repeat while you browse. It is deleted when you close the tab and is not sent anywhere.
• qx-fon (sessionStorage) — the order of the background drawings, so that the background does not flicker when you move between pages. It is deleted when you close the tab and is not sent anywhere.
• qx-suhlas (localStorage) — your choice on advertising cookies (accepted or declined) and its date, so that we do not ask on every page. We ask again after 12 months. It is not sent anywhere.
• Meta’s entries (_fbp and _fbc cookies; multiFbc, lastExternalReferrer and others in localStorage) — only if you consent to advertising cookies (section 4a); deleted when you withdraw consent.

Your browser also checks, directly on your device, whether reduced motion or data saving is switched on, so that it does not download video unnecessarily. This information is not sent anywhere.

If you click “Accept” in the bar at the bottom of the page, your browser loads the Meta pixel code from connect.facebook.net and sends Meta Platforms Ireland Ltd. (Ireland) data about the visit: the address of the page viewed, information about your browser and device, your IP address and identifiers in the _fbp and _fbc cookies, which the pixel stores on our domain (_fbc only if you arrived by clicking a Meta ad — it holds the ID of that click); the pixel also keeps the click ID and the site you came from in your browser’s localStorage (multiFbc, lastExternalReferrer, lastExternalReferrerTime). If you are logged in to Facebook or Instagram, Meta may link the visit to your account. We send only page views and the fact that you sent an enquiry — without the content of the form (no name, contact details or message). Automatic collection of clicks and form fields is switched off.

Purpose: to know which ads on Facebook and Instagram bring enquiries, and to be able to show ads to people who have visited our website.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 109(8) of Act No. 452/2021 Coll.). Without consent the pixel is not loaded. You can withdraw consent at any time with the “Cookie settings” button at the bottom of the page; the _fbp and _fbc cookies and the Meta entries the pixel stored on our domain are then deleted.

Who is responsible: we are jointly responsible with Meta Platforms Ireland Ltd. for collecting the data on our website and sending it to Meta (Art. 26 GDPR). Essence of the arrangement (https://www.facebook.com/legal/controller_addendum): we are responsible for informing you and obtaining consent on our website; Meta is responsible for handling your rights over the data it keeps after receiving it; you may exercise your rights against either of us (Art. 26(3) GDPR). Meta governs any further processing under its own policy: https://www.facebook.com/privacy/policy. Data may also go to Meta Platforms, Inc. in the USA, which is certified under the EU–US Data Privacy Framework.

On every visit, the hosting provider’s server records technical details of the request (for example the time, the page address and browser details) and the IP address. They are needed to run and secure the website (Art. 6(1)(f) GDPR).

Visit statistics. We count ourselves which pages people view and where they come from — on our own server, without cookies and without third-party services. When you view a page, your browser sends our server which page it is, its language, whether it is the first page of your visit, and the name of the website you came from (only the name, for example google.com, not the page address). If you move to a page from another page of our website, your browser also sends that page’s address; the server stores only which page it was — so that we can see how people move around the website (from which page to which). From the IP address, the server determines the country and city and stores only the day, page, language, whether it was the first page of the visit, country, city, source and any campaign labels in the link; it does not store the IP address with this data. To keep the statistics from being inflated artificially, we limit the number of page views from one IP address per hour; for this we keep the IP address for one hour, and only as a hash. If the link you arrived through carries campaign labels (utm_source, utm_medium and utm_campaign — for example in our ads: utm_source=instagram, utm_campaign=kitchens), your browser also sends them, and the server stores them with the day of the visit. If you arrived through one of our ads, we also keep these labels together with a hash of your IP address (for IPv6, of its /64 network part) for one hour, so that we know which campaign brought an enquiry; if you send us an enquiry from the same internet connection within that time, we attach these labels to it. After an hour this record is no longer used and is deleted at the next visit to the website. If your browser sends a Global Privacy Control or Do Not Track signal, the page view is not counted. Country and city are determined using the IP Geolocation by DB-IP database stored on our server; the IP address is not sent anywhere. Legal basis: our legitimate interest in knowing which pages of our website interest people, in which countries and cities, and which of our ad campaigns bring visits and enquiries (Art. 6(1)(f) GDPR).

• Hetzner Online GmbH (Germany) — hosting: the website server in Finland (running the website, storing enquiries and attached photos and videos, server logs and visit statistics) and the mailbox on a server in Germany (delivering enquiries by e-mail).
• our website and server administration contractor — technical administration of the website, server and e-mail.

Hetzner and this contractor are processors: they process data only on our instructions and under a contract (Art. 28 GDPR). We disclose data to public authorities only where the law requires us to. We do not sell the content of the form or use it for advertising. If you consent to advertising cookies, Meta also receives data about your visit (section 4a). Data is not transferred outside the EU/EEA, except possibly by Meta if you consent to advertising cookies (section 4a).

• Enquiries (on the server and in the mailbox): at most 12 months after the last correspondence if no contract is concluded. If a contract is concluded, for its duration and then as required by accounting and tax rules.
• Photos and videos attached to enquiries: on the server for 12 months after the enquiry is sent, in the mailbox like the enquiry; files uploaded to a form that was not sent: 24 hours.
• Records of form submissions, file uploads and page views per IP address (hash): 1 hour, for files 24 hours; after that they are deleted at the next visit to the website.
• Hash of the contact details and message (against double submission): 24 hours.
• Campaign labels with a hash of the IP address: 1 hour; after that they are deleted at the next visit to the website.
• Visit statistics (day, page, language, country, city, source, campaign labels): 24 months.
• Server logs: as long as needed to run and secure the server, according to its settings.
• Data in your browser: qx-vstup and qx-fon until you close the tab.
• _fbp and _fbc cookies (Meta, only with consent): 90 days from the last visit; Meta’s localStorage entries until you withdraw consent; data sent to Meta is kept by Meta under its own policy.
• qx-suhlas (your cookie choice): 12 months.

You have the right:

• to access your data and receive a copy (Art. 15 GDPR);
• to have inaccurate data corrected (Art. 16);
• to erasure (Art. 17) and to restriction of processing (Art. 18);
• to portability of the data you provided to us (Art. 20);
• to withdraw consent at any time where processing is based on consent; processing before withdrawal remains lawful (Art. 7(3)); you can withdraw consent to advertising cookies with the “Cookie settings” button at the bottom of the page.

Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (replies to enquiries not concerning an order, enquiry priority, form protection, server logs, visit statistics) (Art. 21 GDPR).

Send us your request through the form on the Contact page or call +421 952 030 818. We will reply without undue delay and within one month at the latest.

If you believe we process your data unlawfully, you can file a petition to open proceedings on personal data protection (Section 100 of Act No. 18/2018 Coll.) with the Office for Personal Data Protection of the Slovak Republic (www.dataprotection.gov.sk), or contact the supervisory authority in the EU country where you live.

The Instagram and Facebook links are plain links — nothing from these networks is loaded on our website, except the Meta pixel if you consent to it (section 4a). Once you follow them, the privacy rules of that network apply.

We update this policy whenever our processing changes. Effective from 28 October 2026.