Contents

1. Who is responsible for your data
2. What data we use, why, and on what legal basis
3. Who receives your data
4. Transfers outside the European Economic Area
5. How long we keep your data
6. Cookies
7. Newsletter
8. Your rights
9. Security and automated decisions
10. Children
11. Changes to this policy

---

1. Who is responsible for your data

The controller of your personal data is ISPE, s.r.o., operating under the Fabvitro brand.

• Company ID (IČO): 45304611
• Registered office: Zavarská 9157/10I, 917 01 Trnava, Slovakia
• Registered in the Commercial Register of [District Court, Section Sro, Insert No. number/letter]
• Email: info@fabvitro.com

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on the protection of personal data.

---

2. What data we use, why, and on what legal basis

Situation	Data	Purpose	Legal basis
You send us a message through the contact form on this website	Name, email address, subject (optional), your message, and the technical data needed to deliver it	Replying to you, preparing a technical consultation and quote	Steps taken at your request before a contract (Art. 6(1)(b) GDPR); our legitimate interest in handling business enquiries (Art. 6(1)(f))
You contact us by email or phone	Name, email, phone, institution or company, job role, content of your message and project details	The same as above	The same as above
You place or discuss an order	Contact details, delivery and invoicing details, order and communication history	Coordinating the order between you and the manufacturer, delivery, invoicing, support and complaints	Performance of a contract (Art. 6(1)(b)); legal obligations such as accounting and tax law (Art. 6(1)(c))
We contact you about our solutions (individual business outreach)	Professional contact details such as name, work email, institution, research area	Introducing our services to researchers and R&D teams who may find them relevant	Our legitimate interest in business-to-business communication (Art. 6(1)(f)). You can object at any time.
You subscribe to our newsletter	Email address, name (optional), time of subscription	Sending news, product updates and technical content	Your consent (Art. 6(1)(a)). You can withdraw it at any time.
You visit this website	IP address, date and time, pages requested, browser and device type, recorded in server logs	Delivering the website, security, preventing abuse, fixing errors	Our legitimate interest in running a secure website (Art. 6(1)(f))
You accept analytics cookies on this website	Pages viewed, approximate location, device and browser type, and how you arrived at the site, collected through Google Analytics (see section 6)	Understanding how the website is used so we can improve it	Your consent (Art. 6(1)(a)), given through our cookie banner

Where we contact you for the first time and did not receive your details from you directly, we obtained them from publicly available professional sources, for example university or institute websites, scientific publications, and professional networks such as LinkedIn. We do not buy contact lists.

You are not obliged to give us any personal data. Without your contact details, however, we cannot answer your enquiry or deliver an order.

---

3. Who receives your data

We share personal data only where it is needed for the purposes above:

• ExaBio Innovations (Shenzhen ExaBio Innovations Technology Co. Ltd., China), the manufacturer whose solutions we offer. If your enquiry needs the manufacturer’s input, or you place an order with it, we pass on your name, email, institution and project requirements. For such orders, ExaBio also handles your data for its own purposes under its own terms and privacy notice. See section 4.
• Service providers acting on our behalf (processors): our website hosting provider [hosting provider], the email service that delivers messages sent through the website and our own email [mail provider used in WP Mail SMTP, e.g. Google Workspace / Microsoft 365], our cookie consent provider iubenda S.r.l., and our newsletter provider [newsletter tool, if used]. They may use your data only on our instructions.
• Google (Google Ireland Limited and Google LLC), if you accept analytics cookies. Google provides Google Analytics.
• Accountants, lawyers and other professional advisers bound by confidentiality.
• Public authorities, where the law requires it.

We do not sell your personal data.

---

4. Transfers outside the European Economic Area

China. ExaBio Innovations is located in the People’s Republic of China, a country without an EU adequacy decision, so data protection there may not be equivalent to the EU standard. We send your data to ExaBio only when needed to handle your enquiry or order, and only the details required for that. The transfer relies on the derogation for steps taken at your request before a contract and for performing a contract (Art. 49(1)(b) and (c) GDPR) [and/or: the EU Standard Contractual Clauses concluded with ExaBio – confirm and keep only what is true].

If you prefer that your personal details are not sent to China, tell us in your first message. We will then try to handle the technical discussion without them, although some orders cannot be completed that way.

United States. If you accept analytics cookies, Google may process data in the United States. Google relies on safeguards such as the EU-U.S. Data Privacy Framework and standard contractual clauses. Other providers may also process data outside the EEA, in which case we ensure appropriate safeguards.

---

5. How long we keep your data

• Enquiries and business correspondence (including contact form messages): until the matter is closed and then for up to 3 years after our last contact, so we can handle follow-up questions and defend against possible claims.
• Orders, contracts and invoices: as long as the law requires. Slovak accounting law requires accounting documents to be kept for 10 years.
• Newsletter: until you unsubscribe. We then keep a minimal record of your opt-out so we do not email you again.
• Business outreach contacts: until you object, or for up to 2 years without any reply or interaction, whichever is earlier.
• Server logs: typically up to [30-90] days, depending on our hosting provider.
• Google Analytics data: [2 or 14] months, according to the retention setting in our Google Analytics account.
• Cookie consent records: up to [12] months, so we do not ask you again on every visit.

---

6. Cookies

When you first visit this website, our cookie banner (provided by iubenda) asks for your choice. Strictly necessary cookies are always active. Analytics cookies are set only after you accept them. We do not use advertising cookies. You can change or withdraw your choice at any time through the cookie settings on this website, or by deleting cookies in your browser.

Cookie	Purpose	Type	Lifetime
_iub_cs-*	Stores your cookie choices	Strictly necessary	Up to [12] months
wordpress_test_cookie	Checks whether your browser accepts cookies, on the login page	Strictly necessary	Session
wordpress_logged_in_*, wordpress_sec_*, wp-settings-*	Keep a site administrator signed in and store interface preferences	Strictly necessary, administrators only	Session to 1 year
_ga, _ga_*	Distinguish visitors and measure site usage (Google Analytics)	Analytics, only with your consent	Up to 2 years
trp_language	Remembers the language you chose on the site (TranslatePress)	Functional	[verify]

[Before publishing, compare this table with the cookies you actually see in your browser (F12, Application, Cookies) after accepting all cookies, and remove or add rows to match.]

---

7. Newsletter

We send our newsletter only if you subscribe. We may ask you to confirm your subscription through a link we send to your email address (double opt-in). Every newsletter contains an unsubscribe link, and you can also unsubscribe by writing to info@fabvitro.com. Withdrawing consent does not affect the lawfulness of earlier processing.

---

8. Your rights

You have the right to:

• access the personal data we hold about you and receive a copy,
• have inaccurate data corrected,
• have your data erased where there is no longer a reason for us to keep it,
• restrict processing in certain situations,
• receive data you gave us in a structured, machine-readable format (data portability), where processing is based on consent or a contract,
• object to processing based on our legitimate interest, and to direct marketing at any time, free of charge,
• withdraw consent at any time.

To use any of these rights, email info@fabvitro.com. We usually reply within one month. We may ask you to verify your identity.

You also have the right to lodge a complaint with the supervisory authority. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk. You may also contact the authority in your own EU country.

---

9. Security and automated decisions

We protect your data with appropriate technical and organisational measures, including access limited to people who need it and the use of reputable providers. We do not make decisions about you based solely on automated processing or profiling.

---

10. Children

Our website and services are intended for professionals and organisations. They are not directed at children, and we do not knowingly collect data from them.

---

11. Changes to this policy

We may update this policy, for example when we add new tools or services. The current version is always available on this page, with the date of the last update at the top.