Privacy Policy

alpsbyte.com has no newsletter, no analytics, and no tracking. We do not know who visits, and we do not profile anyone. There is no cookie banner because there is nothing to consent to — the one cookie we set remembers whether you chose English or Slovenian.

If you fill in the contact form or email us, we have what you wrote. That is the whole picture. The rest explains the details, because a policy that only says "we respect your privacy" says nothing.

The controller of the personal data described here is:

No Data Protection Officer is appointed; the criteria in Article 37 GDPR do not apply. Write to privacy@alpsbyte.com for anything on this page.

This policy is written under the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the Slovenian Personal Data Protection Act (ZVOP-2).

Visiting this site. IP address, browser type and version, operating system, referring page, pages viewed, date and time — written to server logs by our hosting provider. Purpose: deliver the site, keep it available, detect and investigate abuse. Legal basis: legitimate interest, Art. 6(1)(f). Retention: 30 days, then deleted automatically.

Contact form. Name, email address, company, the content of your message, and anything else you type. Purpose: answer you and, where relevant, discuss working together. Legal basis: steps prior to a contract at your request, Art. 6(1)(b); otherwise legitimate interest, Art. 6(1)(f). Retention: 24 months after our last contact. A submitted form reaches us as an email; it is not stored anywhere else.

Emailing us. Your address, your message, anything you attach, and our reply. Purpose, basis and retention are the same as for the form.

That is the complete list. We do not use form data to send you offers you did not ask for, and we do not add you to any list.

On legitimate interest. Our interest is running a secure, available website and replying to people who write to us. We have weighed that against your interests and rights: the data is minimal, ordinary, and never used to profile you. You can object at any time — see section 6.

One cookie, strictly necessary, no banner required. It is set under Article 6(1)(f) GDPR and the exemption in Article 157 of the Slovenian Electronic Communications Act (ZEKom-2), which does not require consent for cookies needed to provide a service the user explicitly asked for.

alpsbyte_lang — first-party, expires after one year. Remembers whether you chose English or Slovenian, so the site does not reset every page. It holds one of two values: en or sl. Nothing else. Clear it in your browser settings and the site works fine — it will just ask again.

The contact form sets no cookies and carries no tracking scripts. If we ever add analytics, this section changes first, and non-essential cookies will not load until you agree.

Separately from this website: during consulting, IT, business development and M&A engagements we encounter personal data inside our clients' systems, documents and data rooms. In those cases the client is the controller and AlpsByte is the processor. We act only on the client's documented instructions, under a written Data Processing Agreement concluded pursuant to Article 28 GDPR covering confidentiality, security, sub-processors, assistance with data subject rights, and deletion or return of data when the engagement ends.

If your data reached us through one of our clients, this policy does not govern that processing — the client's own policy does. Send your request to them. If you send it to us, we will forward it to the relevant controller without undue delay and tell you we have done so.

Under the GDPR you can ask us to confirm whether we hold data about you and give you access to a copy; correct what is wrong; erase what we have; restrict processing while a dispute is resolved; port data you gave us to another controller; and object to processing based on legitimate interest.

Write to privacy@alpsbyte.com. We answer within one month — extendable by two months for complex requests, in which case we tell you why inside the first month. It costs nothing unless a request is manifestly unfounded or excessive.

Given how little we hold, most requests are simple: if you have never written to us, we almost certainly have nothing of yours beyond a log line that has already expired.

Complaints. Tell us first — we would rather fix it. You can also complain to the supervisory authority at any time: Informacijski pooblaščenec RS, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.

We do not sell personal data and do not share it for anyone else's marketing. The only parties involved are Vercel (hosting and server logs, US/EU) and Infomaniak (email, Switzerland — covered by the European Commission's adequacy decision).

Each is bound by a written Article 28 agreement and processes only on our instructions. We may also disclose data to public authorities where legally required. Data stays in the EEA or a country with an adequacy decision; if that ever changes we will rely on the European Commission's Standard Contractual Clauses and say so here.

Traffic to this site, including form submission, is encrypted with TLS. Accounts that touch personal data use multi-factor authentication and least-privilege access. No transmission over the internet is perfectly secure, and we will not pretend otherwise — if a breach is likely to pose a high risk to your rights we will notify you, and the Information Commissioner within 72 hours as required by Article 33 GDPR.

None. We do not make decisions about you by automated means, and we do not profile you. There is no mechanism here that could.

We update this policy when what we do changes, or when the law does. The version and date at the top always reflect the current text. If we start collecting more than we do today, we will say so before we start — and where consent is required, we will ask for it rather than assume.