This is a translation provided for convenience. In case of any discrepancy between this English version and the Slovak version, the Slovak version is legally binding.

1. Controller

The controller of personal data is city cake s. r. o., with its registered office at Ovsištské námestie 2631/1, 851 04 Bratislava, mestská časť Petržalka, IČO: 55 336 582, DIČ: 2121958883, IČ DPH: SK2121958883, registered in the Commercial Register of the Mestský súd Bratislava III (Municipal Court Bratislava III), oddiel: Sro, vložka č. 168302/B. Premises and personal pickup location: Ovsištské námestie 1, 851 04 Bratislava.

Contact for data protection matters: info@citycakecompany.sk, +421 907 75 77 66.

2. What data we process

Depending on how you communicate with us, we process:

First name and surname, for identifying the order or inquiry
E-mail address, for communication and order confirmation
Telephone number, for contacting you about the order
Delivery address, for delivering the order
Order details (cake type, size, flavours, date, notes, any dietary requirements)
Photographs you upload to us as a reference for the cake (they may contain personal data, for example a person's likeness)
Technical data about your visit to the website (IP address, device and browser type, behaviour on the site) through cookies and analytics tools, only to the extent of your consent

3. Purpose of processing

Handling the order and performing the contract
Communication with the customer and responding to inquiries
Accounting and tax obligations
Measuring performance and improving our services and website (analytics)
Marketing and remarketing, only based on your consent

4. Legal basis

Performance of a contract (Article 6(1)(b) GDPR), in the case of an order
Compliance with legal obligations (Article 6(1)(c) GDPR), in the case of accounting
Legitimate interest (Article 6(1)(f) GDPR), in the case of the basic operation and security of the website
Consent of the data subject (Article 6(1)(a) GDPR), in the case of analytics and marketing cookies

5. Recipients and processors

We do not sell your data. To keep our operations running, we use trusted providers (processors) who process the data on our behalf:

Supabase, database and storage of orders and uploaded photographs (servers in the EU, eu-central region)
Vercel, website hosting
Resend, sending e-mail notifications about orders
Google (Google Ireland Ltd.), the tools Google Tag Manager, Google Ads, Google Fonts, Google Maps and Google Reviews
Meta (Meta Platforms Ireland Ltd.), Meta Pixel for ad measurement and targeting, only with consent
Microsoft Clarity, behavioural analytics including session recordings (mouse movement, clicks; input fields are masked), only with consent

We may also disclose data to public authorities where the law requires us to do so.

6. Transfers to third countries

Some of the providers listed above are companies established or with infrastructure in the USA. When data is transferred outside the European Economic Area, appropriate safeguards under the GDPR are applied, in particular standard contractual clauses (SCC) or certification under the EU-US Data Privacy Framework.

7. Retention period

We keep data about orders and inquiries for the duration of the contractual relationship and for a further 5 years after its end for the purposes of possible complaints. We keep accounting documents for 10 years in accordance with the Accounting Act. We keep uploaded photographs only for the time needed to handle the order. Marketing consents remain valid until withdrawn.

8. Cookies and tracking technologies

The website uses cookies and similar technologies. We distinguish three categories:

Essential, needed for the website to function, do not require consent
Analytics, help us understand how the site is used (Google Analytics/Tag Manager, Microsoft Clarity including session recordings), only with your consent
Marketing, for ad measurement and targeting (Google Ads, Meta Pixel), only with your consent

Marketing and analytics tools do not run before consent is given. You can change or withdraw your consent at any time via the "Cookie settings" link in the website footer.

9. Your rights

You have the right:

To access your personal data
To rectification of incorrect data
To erasure of data (right to be forgotten)
To restriction of processing
To data portability
To object to processing
To withdraw consent at any time
To lodge a complaint with the supervisory authority

The supervisory authority is the Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, statny.dozor@pdp.gov.sk.

10. Contact

If you have any questions about personal data protection or wish to exercise your rights, contact us at info@citycakecompany.sk or by telephone at +421 907 75 77 66.

Last updated: 7 July 2026

Privacy Policy (GDPR)