Legal information

Privacy policy.

What data we process about you, why, for how long, and what you can do about it.

Effective from 22 October 2026

This document describes how H&O Group I s.r.o. processes the personal data of visitors to hogroup.eu under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll.

It is written to match what the website actually does. If that changes, this document changes with it.

1. Who processes your data

Controller: H&O Group I s.r.o.
Registered office: Šúrska 716/5, 900 01 Modra, Slovak Republic
Company ID: 53 153 774
Email: info@hogroup.eu
Phone: +421 908 097 012

We have not appointed a data protection officer, as we are not required to. For any data protection matter, write to info@hogroup.eu.

2. Business enquiry form

The form on the Contact page is for enquiries about working together.

Data: full name, company, email, phone, type of enquiry, message text, form language and the date of submission
Purpose: handling the enquiry, replying to it and further communication about possible cooperation
Legal basis: Art. 6(1)(b) GDPR, steps taken at your request prior to entering into a contract, and Art. 6(1)(f) GDPR, our legitimate interest in business communication
Retention: 3 years from the last communication about that enquiry

Filling in the form is voluntary. Without a name, an email address and a message we cannot reply to you.

3. Job applications

The form on the Careers page is for sending us your CV.

Data: full name, email, field or position, and the content of the attached CV
Purpose: assessing your application and contacting you about it
Legal basis: Art. 6(1)(b) GDPR, steps taken at your request prior to entering into an employment contract
Retention: 1 year from receipt. If you ask us to keep your CV longer for future openings, we keep it on the basis of your consent.

The CV is delivered by email to info@hogroup.eu through the Resend service. It is not stored in this website's database.

4. Anonymous employee feedback

The form on the Your Voice page is built so that it does not collect personal data.

Only the category, severity, message text, handling status, management's internal note and the date received are stored. We do not store a name, email, phone number, IP address, device type, browser, form language or session identifier. The server function does not even read them.

The time received is stored rounded down to the hour. An exact timestamp could be matched against an entry in the operational logs and used to identify the sender. That is why the administration shows it as a whole hour.

What we do not guarantee: the hosting provider sees the request IP address in its own operational logs for their retention period. That is outside our database and outside the reach of H&O Group I management, but it is not technical untraceability across the internet as a whole.

If you write details into the message that make you identifiable, those become personal data. We then process them under Art. 6(1)(f) GDPR, our legitimate interest in handling employee feedback, and keep them for 3 years. This is why the form itself asks you not to include such details.

5. Website operation

Data: IP address, request time, page address, browser and operating system type
Purpose: serving the page, security and abuse protection, error diagnosis
Legal basis: Art. 6(1)(f) GDPR, legitimate interest in operating the website securely and reliably
Retention: as set by the hosting provider, typically days to weeks

The website uses no Google Analytics or any other traffic measurement tool and builds no visitor profiles.

6. Cookies and similar technologies

The website itself stores no tracking cookies in your browser.

ho_consent: Holds your decision about the Google map. Stored in your browser's local storage, not on a server. Necessary for the choice to work, kept for 12 months.
hoLangScroll: Remembers where you were on the page when you switch language, so the site can take you back to the same spot. It is kept in the browser only while you move to the other language version, is never sent anywhere and is deleted straight away. Necessary for this feature, no consent required.
ho_admin: Administration login session. Created only when an administrator signs in, valid for 12 hours, set as HttpOnly and Secure. It does not affect ordinary visitors.
Google cookies: Created only after you allow the map in the consent bar. Their content and lifetime are set by Google.

The office map in the footer is loaded from Google only after you consent. Until then, no request reaches Google from that map. You can change your decision at any time using the button in the footer.

The Archivo and IBM Plex Mono typefaces are served directly from this website. Displaying them sends no request from your browser to Google or any other third party.

7. Who we share data with

We do not sell your data and do not pass it on for third party marketing. We share it only with the processors that run the service for us:

Vercel Inc. (USA): hosting of the website and the server functions
Supabase (database in the Frankfurt region, EU): storage of enquiries and feedback
Resend (USA): delivery of the CV email
Google Ireland Limited: The office map, and only once you consent

We may also disclose data to public authorities where the law requires it.

8. Transfers outside the European Union

Vercel and Resend are companies based in the United States. Transfers are covered by the European Commission's standard contractual clauses, or by certification under the EU-U.S. Data Privacy Framework. The database holding enquiries and feedback is located in the European Union, in the Frankfurt region.

9. Your rights

In relation to your personal data you have the right:

of access to the data and to a copy of it (Art. 15 GDPR),
to rectification of inaccurate data (Art. 16 GDPR),
to erasure (Art. 17 GDPR),
to restriction of processing (Art. 18 GDPR),
to data portability (Art. 20 GDPR),
to object to processing based on legitimate interest (Art. 21 GDPR),
to withdraw consent at any time where processing is based on it, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, email info@hogroup.eu. We reply within one month of receiving the request.

If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, statny.dozor@pdp.gov.sk.

10. Automated decision making

We do not use your data for automated decision making or profiling.

11. Changes to this document

We update this document whenever the way we process data changes. The effective date of the current version is shown at the top of the page.