Privacy Policy

Last updated: 8 November 2026

In short

The only personal data this website collects is what you type into the request form: your name, your phone number, your company name and your message.
We use it to call you back and prepare a quote. We do not use it for anything else.
This website sets no cookies, runs no analytics and carries no advertising pixels.
We keep an enquiry that does not lead to an order for 12 months, then delete it.
You can ask us at any time what we hold about you, have it corrected, or have it deleted: waycup.sk@gmail.com.

The rest of this page is the detail behind those five points, written so that a data protection authority, a procurement team or your own lawyer can check it line by line.

1. Who is responsible for your data

The controller is the company that runs the WAYCUP brand and this website, based in Bratislava, Slovak Republic. You can reach it here:

Email: waycup.sk@gmail.com · Phone: +421 948 881 881

We have not appointed a Data Protection Officer. We are not required to: our core activity is manufacturing paper cups, not large-scale monitoring of people and not large-scale processing of special categories of data (Article 37 GDPR). Privacy questions go to the email address above.

2. What we process, why, and on what legal basis

Each row is a separate purpose. If a purpose is not in this table, we are not pursuing it.

Purpose	Data	Legal basis	Who receives it	How long we keep it
Answering your request for a price list, samples, custom printing or partnership terms	Name, phone number, company name, the subject you selected, your free-text comment, the address of the page the form was sent from, date and time	Article 6(1)(b) GDPR — steps taken at your request before entering into a contract	Our sales team; our website hosting provider; our email provider	12 months after our last contact with you, then deleted. If an order follows, the contact details move into the customer records below
Running the business relationship once you place an order: production, delivery, support	Contact person’s name, phone, email, delivery details, order and artwork correspondence	Article 6(1)(b) GDPR — performance of the contract with you or your company	Our production and logistics staff; the carrier where one is used	For the duration of the relationship and 4 years after the last order — the general limitation period for commercial claims under § 397 of the Slovak Commercial Code
Issuing invoices and keeping accounting records	Company billing data and the name of the contact person shown on the document	Article 6(1)(c) GDPR — legal obligation under the Slovak Accounting Act (431/2002 Coll.) and the VAT Act (222/2004 Coll.)	Our accountant; the tax authority on request	10 years from the end of the accounting period the document belongs to
Keeping the website available and investigating abuse	IP address, browser identification, requested address, date and time — recorded in the hosting server log	Article 6(1)(f) GDPR — our legitimate interest in the security and availability of our own website	Our hosting provider, including its content delivery network	Rotated automatically by the hosting provider; we do not copy or export the logs
Stopping automated spam through the request form	A one-way hash of the IP address, held as a counter of recent submissions	Article 6(1)(f) GDPR — our legitimate interest in keeping the form usable	Nobody	10 minutes, after which the counter expires automatically

Providing the data is voluntary, but we cannot call you back without a name and a phone number. The other fields are optional.

Where the data comes from

All of it comes from you, either typed into the form or given to us in conversation. We do not buy contact lists, we do not scrape directories and we do not enrich what you give us from outside sources.

3. What we do not do

No analytics or visitor statistics.
No advertising, retargeting or conversion pixels.
No profiling and no automated decision-making within the meaning of Article 22 GDPR.
No newsletter or marketing mailing built from this form.
We never sell, rent or trade personal data.

4. Who else can see the data

Only the following categories of recipient, and only to the extent they need it:

Website hosting — Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Stores the website and the enquiries saved in its database, and runs the content delivery network that every request to this site passes through. Acts as our processor under its Data Processing Addendum, which meets Article 28 GDPR. Hostinger also provides the Reach sign-up form tool: if a page contains a Reach form and you allow External services in the banner, Hostinger receives your IP address and a count of form views.
Email — Google (Gmail). Each submitted enquiry is also sent to our Gmail mailbox, so it passes through Google’s systems. In the European Economic Area these services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Accounting. Our accountant receives invoice data only.
Carriers, where a delivery is not made by our own vehicles. They receive the delivery address and the contact person for the handover.
Public authorities, where the law obliges us to hand something over.

WhatsApp and Instagram

The site shows a WhatsApp button and a QR code. Nothing is sent to WhatsApp while you are simply reading this website — the button is an ordinary link. If you use it, WhatsApp opens and from that moment your use of WhatsApp is governed by the terms and privacy policy of WhatsApp Ireland Limited. We are responsible for the chat history we hold on our own business device, which we keep on the same basis and for the same period as a form enquiry. The same applies to the Instagram link in the footer and to Meta Platforms Ireland Limited.

5. Transfers outside the European Economic Area

We do not deliberately move personal data out of the EEA. Two of our tools can do so in the course of their own operation:

Email. Google may process data on infrastructure in the United States. Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission recognised as ensuring an adequate level of protection in its decision of 10 July 2023 (Article 45 GDPR).
WhatsApp, if you choose to write to us there: WhatsApp Ireland Limited, with transfers to Meta Platforms, Inc. in the United States, which is also certified under the EU–US Data Privacy Framework.

You can ask us for a copy of the safeguards that apply to a specific transfer at the contact address above.

6. Cookies and anything stored on your device

This website sets no cookies of its own and runs no analytics. The only third-party content it can load — Hostinger Reach sign-up forms — loads only on a page that contains such a form and only after you allow it in the banner; no page contains one today. The detail is in our Cookie Policy.

7. Your rights and how to use them

Under Articles 15 to 22 GDPR you have the right to:

Access — a copy of the personal data we hold about you and the information in this notice applied to your case.
Rectification — correction of anything inaccurate, and completion of anything incomplete.
Erasure — deletion, where we no longer need the data or where we are processing it unlawfully. We cannot delete an invoice before the statutory ten years are up.
Restriction — we keep the data but stop using it while a dispute about its accuracy or our legal basis is resolved.
Objection — against anything we do on the basis of legitimate interest, which here means the server logs and the spam counter.
Portability — the data you gave us, in a structured, machine-readable file, where we process it by automated means on the basis of a contract or steps before a contract.

How to ask

Write to waycup.sk@gmail.com with GDPR request in the subject line, or call +421 948 881 881 and ask us to record the request.

How we check it is you. We only ask for information we already hold — normally confirmation from the same phone number or email address you originally used. We will not ask you to send a copy of an identity document, and you should not send one.

How quickly we answer. Within one month of receiving the request. If a request is unusually complex we may extend this by a further two months, and we will tell you within the first month if we do. The answer is free of charge.

What we log. Date received, what was asked, what we did and when we replied. We keep that record for one year as evidence that the request was handled.

8. If you are not satisfied

Tell us first — most things are faster to fix directly. You also have the right to complain to the supervisory authority at any time:

Úrad na ochranu osobných údajov Slovenskej republiky
Hraničná 12, 820 07 Bratislava 27, Slovak Republic
statny.dozor@pdp.gov.sk · +421 2 3231 3214 · dataprotection.gov.sk

If you live or work in another EU member state, you may also complain to the authority there.

9. Security

The site is served over HTTPS. Enquiries are stored in the website database and are visible only to accounts we have created, each with its own password and its own permission level. The request form is rate-limited and carries a hidden anti-spam field. We review who has access when someone joins or leaves.

10. Children

This is a business-to-business website. It is not aimed at children and we do not knowingly collect data from them. If you believe a child has sent us data through the form, write to us and we will delete it.

11. Changes to this notice

This is version 1.0, in force from 8 November 2026.

We review this notice whenever we add a tool that touches personal data, change hosting or email provider, start sending data somewhere new, or when the law changes — and in any case once a year. If a change is material we will say so on the home page for 30 days before it takes effect. Earlier versions are available on request from the contact address above.