Politique de confidentialité

This Privacy Policy explains how BAZA PRODUCTION s. r. o. processes personal data when you visit our websites, contact us, order our creative or technical services, buy or use our software products and mobile applications, or apply to work with us. It is written in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), Act No. 18/2018 Coll. on Personal Data Protection and Act No. 452/2021 Coll. on Electronic Communications.

1. Controller and contact

The controller of your personal data is BAZA PRODUCTION s. r. o., Gorkého 205/3, 811 01 Bratislava - mestská časť Staré Mesto, Slovak Republic, Company ID (IČO) 57 656 142, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 200079/B ("we", "us", "our").

For anything related to your personal data, write to bazamedia.prod@gmail.com or send a letter to our registered office. We have not appointed a data protection officer, because the law does not require it for our activities; privacy questions are handled directly by our management.

2. Scope

This policy applies to:

• the website bazaproduction.com and its language versions;
• all our divisions: BAZA FILM, BAZA 3D, BAZA SOUND, BAZA DEVELOPERS and BAZA PROMOTION (none of them is a separate company; the controller is always BAZA PRODUCTION s. r. o.);
• the website bazadevelopers.com and the websites of our products, unless a product has its own privacy notice;
• our software products: BAZA Booking Calendar, BAZA Book in the Chat, BAZA Booking Calendar App, BAZA Live Chat, BAZA Academy CRM, Revolut Payment Plugin and BANG;
• communication with us by email, phone and messengers.

3. What we process, why, on what legal basis and for how long

3.1 Visiting this website

bazaproduction.com uses no advertising pixels or tracking technology, and fonts, scripts and media are served from our own domain. See our Cookie Policy.

Analytics (only with your consent). If you accept analytics in the cookie bar, we use Google Analytics 4 (Google Ireland Limited) to understand in aggregate which pages, projects and languages are visited, where visitors come from and which buttons are used (for example opening a video or the project form). Google Analytics 4 does not store IP addresses; data may be transferred to Google LLC in the USA under the EU-U.S. Data Privacy Framework. We have switched off advertising features and Google signals. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 109 of Act No. 452/2021 Coll.), which you can withdraw at any time via Cookie settings in the footer. Retention in Google Analytics: 14 months.

When you open any web page, your browser automatically sends technical data to the server: IP address, date and time of the request, requested address, browser and operating system, and the referring page. Our hosting provider records these data in server logs.

• Purpose: delivering the website, keeping it secure, detecting and investigating attacks and errors.
• Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
• Retention: at most 30 days, unless a specific record is needed longer to investigate a security incident.

bazadevelopers.com uses its own cookie consent tool and, with your consent, Google Analytics; this is described in the cookie notice on that website.

3.2 When you contact us

When you fill in the project form or the brief on our website, or write to us by email, phone or a messenger (for example Telegram, Instagram or LinkedIn), we process your name, contact details, the name of your company, country, the details of your project (direction, budget, timeline, brief answers), the content of your message and any files you send.

The project form does not store anything on our website: when you press Send, it prepares an email with your answers in your own email application, and the data reach us only when you send that email.

To protect the form from spam and abuse, it uses Google reCAPTCHA v3, which is loaded only when you open the form. reCAPTCHA processes technical data (IP address, browser and device information, interaction with the page) and stores the _GRECAPTCHA cookie; the provider is Google Ireland Limited, and data may be transferred to Google LLC in the USA under the EU-U.S. Data Privacy Framework. Legal basis: our legitimate interest in protecting the website and our inbox from automated abuse (Art. 6(1)(f) GDPR). Google's Privacy Policy and Terms of Service apply.

• Purpose: answering your enquiry, preparing an offer, further communication.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for other enquiries, our legitimate interest in answering them (Art. 6(1)(f) GDPR).
• Retention: 24 months after our last communication, unless a contract follows (then point 3.3 applies).

If you contact us through a social network or messenger, the operator of that platform processes your data as an independent controller under its own terms.

3.3 Clients and contracts for our services

For film, 3D, sound, development and marketing projects we process the identification and contact data of our clients and of their contact persons (name, position, email, phone, company, billing details), the project brief, materials you provide, correspondence, invoices and payment records.

• Purpose: concluding and performing the contract, invoicing, protecting our legal claims.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR); contact persons of business clients on the basis of our legitimate interest in communicating with our client (Art. 6(1)(f) GDPR); keeping accounting records as a legal obligation (Art. 6(1)(c) GDPR).
• Retention: for the duration of the contract and then until the limitation periods for claims expire (generally 4 years); accounting documents for 10 years under Act No. 431/2002 Coll. on Accounting.

Persons who appear in our productions (actors, models, speakers, participants): we process their image, voice and related data on the basis of the contract or consent (release) agreed for the production, and only in the scope agreed there.

3.4 Buying and licensing our software products

When you buy a licence or subscription we process your full name, email address, phone number, company and billing details, order and licence data (licence key, plan, number of sites, validity) and the web address where the product is activated.

• Purpose: processing the order, issuing and verifying the licence, providing updates, invoicing, preventing fraud and misuse of licence keys.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR); accounting as a legal obligation (Art. 6(1)(c) GDPR); preventing misuse as our legitimate interest (Art. 6(1)(f) GDPR).
• Retention: for the duration of the licence plus the limitation period; accounting documents for 10 years.

Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe collects your payment card and billing details directly; we never receive or store your full card number. Where the checkout page states that Stripe or another reseller sells the product to you as "merchant of record", that company is an independent controller for the payment transaction.

To verify the licence and provide updates, our WordPress products send technical data to our licence server: the site address, the licence key, the plugin, WordPress and PHP version. They do not send data about your website's visitors or customers.

3.5 Technical support

When you ask for support we process your contact details, the description of the problem and the technical details you give us (site address, WordPress installation, server configuration, screenshots, error logs).

• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Retention: 24 months after the request is closed.

Please never send us passwords to your main administrator account. If we need access to your website, create a temporary account with the lowest necessary permissions and delete it when we are done.

3.6 Our mobile applications

BAZA Booking Calendar App (iOS and Android) is a client for the BAZA Booking Calendar plugin installed on your own website. It has no separate backend and no user accounts on our side.

• The app stores on your device only the website address, WordPress username and WordPress Application Password that you enter. They are kept in the device's encrypted, app-private storage (iOS Keychain / Android EncryptedSharedPreferences) and cannot be read by other apps.
• The app connects directly from your device to the REST API of your own WordPress website over HTTPS. Bookings, clients and calendar data come from your website and stay there. We do not receive, store or have access to these data.
• The app contains no analytics, advertising or tracking libraries and shares no data with third parties.
• While the app is open, it may check your website for new or ending bookings to show an in-app alert, using the same connection.
• Deleting the app, or clearing the saved website and credentials in Settings, deletes everything the app stored on your device.

BANG (a training and weight-loss app) is being prepared. Before it is released we will publish a separate privacy notice describing exactly which data it processes; this section will be updated.

The app stores (Apple App Store, Google Play) process data about downloads and purchases as independent controllers under their own terms.

3.7 When you use our products for your own customers

Several of our products help our clients work with the data of their own customers (for example bookings, chat messages or students). In these cases our client is the controller of those data and is responsible for informing its customers and for having a legal basis.

• BAZA Booking Calendar, BAZA Book in the Chat and Revolut Payment Plugin run on the client's own WordPress website. The data stay on the client's server; we have no access to them unless the client gives us access for support. Payments made through the Revolut Payment Plugin are processed by Revolut under the agreement between the client and Revolut.
• BAZA Live Chat and BAZA Academy CRM: where these services store or transmit data on infrastructure operated by us, we process them only on behalf of and according to the instructions of our client, as a processor under Art. 28 GDPR. The data processing terms form part of the service terms and a signed data processing agreement is available on request.

3.8 Applying to work with us

If you apply for a job or collaboration ("Join BAZA"), we process your CV, portfolio, contact details and the content of our communication.

• Legal basis: steps before entering into a contract at your request (Art. 6(1)(b) GDPR).
• Retention: until the selection is finished and then 6 months; with your consent we keep your application for future opportunities for up to 2 years.

3.9 News and offers

We send commercial emails only if you have agreed to it, or, to our existing clients, about our own similar products and services under Section 116 of Act No. 452/2021 Coll. Every such email contains a simple way to unsubscribe, and you can object at any time by writing to us.

4. Is providing data mandatory?

Providing personal data is voluntary. Without the data needed to conclude and perform a contract, however, we cannot deliver the service or product, issue an invoice or provide support.

5. Recipients

We do not sell, rent or trade personal data. We share them only with parties that help us operate, to the extent they need:

• our hosting and IT infrastructure providers;
• Google Ireland Limited (email service; reCAPTCHA spam protection of the project form; Google Analytics 4, only with your consent);
• Stripe Payments Europe, Ltd. (payments);
• accounting, tax and legal advisors bound by confidentiality;
• our team members and subcontractors working on your project, bound by confidentiality;
• public authorities and courts, where the law requires it.

6. Transfers outside the European Economic Area

Some of our providers (for example Google and Stripe) and some members of our team may process data outside the EEA. We transfer data only where the European Commission has recognised an adequate level of protection (including the EU-U.S. Data Privacy Framework for certified companies) or on the basis of Standard Contractual Clauses approved by the European Commission, together with any additional safeguards needed. You can ask us for a copy of the safeguards used.

7. Your rights

You have the right to:

• access your personal data and receive a copy (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16);
• have data erased ("right to be forgotten") (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object at any time to processing based on our legitimate interest, and always to direct marketing (Art. 21);
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

Send your request to bazamedia.prod@gmail.com. We will answer without undue delay and at the latest within one month; in complex cases this period can be extended by two months, and we will tell you why. We may ask you to confirm your identity.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Slovakia it is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk.

8. Automated decisions

We do not make decisions based solely on automated processing, including profiling, that would have legal or similarly significant effects for you.

9. Children

Our websites and services are intended for adults. We do not knowingly collect data of persons under 16 years of age. Purchases of our products may be made only by persons aged 18 or over. If you learn that a child has given us personal data, let us know and we will delete them.

10. Security

We protect personal data with appropriate technical and organisational measures: encrypted connections (HTTPS), access limited to the people who need it, strong passwords and two-factor authentication for our accounts, and confidentiality obligations for our team and subcontractors.

11. Changes

We may update this policy when our services or the law change. The current version is always published on this page with the date of the last update. We will notify our clients of significant changes by email.