Privacy & cookie policy

Who we are

The data controller is SIW s.r.o., Športovcov 1179/12, 026 01 Dolný Kubín, Slovakia, company ID (IČO) 54371171 (“Spot”, “we”). We are a product design and engineering studio.

Privacy questions and requests: dave@spot.design.

What we collect and why

Your email address, when you unlock the guide. The cancellation-laws guide asks for an email address to unlock the full requirements. We use it to send you the guide and to follow up about our services. The form is delivered through Web3Forms, a form-delivery service that forwards the submission to our mailbox. We do not attach your email to any analytics data.

Analytics (on unless you disable it). We use Mixpanel to understand how the site is used: which pages are viewed, roughly where visits come from, and when the guide is unlocked. Mixpanel assigns a random identifier to your browser; it never receives your email address. We also use Mixpanel Session Replay, which rebuilds how a page was used — scrolling, clicks and mouse movement — so we can see where the guide is confusing. It is not a video of your screen: the replay is reconstructed from the page, so the site’s own wording is visible in it. Anything you type is masked: we can see that you used a field, never what you entered. Our Mixpanel project, replays included, is hosted on Mixpanel’s EU servers.

Marketing (on unless you disable it). We use the Meta Pixel (Meta Platforms Ireland Ltd) to measure our ads on Meta’s platforms and to reach people similar to our visitors. When active, it tells Meta which of our pages your browser loaded. Meta’s own use of that data is described in Meta’s privacy policy. In the same way we use the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) to measure our ads on LinkedIn and to show them again to people who visited this site. When active, it tells LinkedIn which of our pages your browser loaded; if you are logged in to LinkedIn, LinkedIn can link that to your LinkedIn account. We only ever see aggregated reports (for example the industries or job functions of visitors), never who you are. LinkedIn’s own use of that data is described in LinkedIn’s privacy policy.

Server logs. Our hosting provider, Hetzner Online GmbH, records the IP address, browser type, requested page and time of each request in standard server logs, which we use to keep the site secure and working.

Third-party content. Pages load company logos from Google’s favicon service, flag images from Wikimedia Commons and flag icons from the jsDelivr CDN. Loading those files sends your IP address and browser details to the provider concerned, in the same way as loading any web resource. We do not receive any data back from them.

Cookies and browser storage

Analytics and marketing cookies are set from your first page view unless you disable them in the banner, or your browser sends a Global Privacy Control signal. Disabling them does not limit the site in any way. This is everything the site stores in your browser:

• spot-consent — set by this site, in browser storage. Remembers your cookie choice so we don’t ask again. Kept for 12 months. Necessary for the choice to work.
• spot-consent:gpc-override — set by this site, in browser storage, only if you choose Continue while your browser sends a Global Privacy Control signal. Remembers that your choice came after the signal, so we honour it. Kept until you change your choice.
• spot-gate:cancellation-laws — set by this site, in browser storage, when you unlock the guide. Keeps it unlocked on your later visits. Kept until you clear your site data.
• mp_…_mixpanel — set by Mixpanel, in browser storage, unless you disable analytics. Holds the random analytics identifier for your browser. Persists until you clear your site data or use the button below.
• _fbp (and _fbc if you arrived from a Meta ad) — set by the Meta Pixel, as cookies, unless you disable marketing. Identify your browser to Meta for ad measurement. Kept for 90 days.
• li_fat_id — set by the LinkedIn Insight Tag, as a cookie, unless you disable marketing. Identifies your browser to LinkedIn for ad measurement and retargeting. Kept for 30 days.
• ln_or — set by the LinkedIn Insight Tag, as a cookie, unless you disable marketing. Tells LinkedIn whether its analytics may run on this site. Kept for 1 day.
• The LinkedIn Insight Tag also sets cookies on LinkedIn’s own domain (bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_sugr) — these belong to LinkedIn, are described in LinkedIn’s cookie policy, and the button below cannot remove them; manage them in your LinkedIn settings or by clearing your browser’s cookies.
• snitcher_… — left behind by Snitcher, a company-identification service we stopped using on 19 September 2026. Nothing on this site sets or reads these any more; if your browser still holds them, they expire within 12 months, and the button below removes them right away.

To disable analytics and marketing cookies, use the first button below: it turns them off, clears their identifiers (including LinkedIn’s on this site) and reloads the page. The second button clears your stored choice and shows the banner again; until you choose, the default applies and the cookies are on.

Disable analytics and marketing cookies Turns them off, clears their identifiers and reloads the page.

Show the cookie banner again Clears your stored choice and shows the banner again. Until you choose, the default applies (cookies on).

Legal bases

• Consent (GDPR Art. 6(1)(a)) for sending you the guide and follow-ups after you unlock it. You can withdraw consent at any time; that does not affect processing that happened before.
• Legitimate interest (GDPR Art. 6(1)(f)) for analytics and marketing cookies — understanding how the guide is used and measuring our advertising — which are on by default and can be disabled at any time in the banner or with the button above; for identifying the companies that visit us, so we can offer them our services (business-to-business marketing); and for server logs and third-party content needed to display the pages — keeping the site secure and working.

Who we share it with

We do not sell your data. Web3Forms (form delivery), Mixpanel (analytics) and Hetzner Online GmbH (hosting) process it on our behalf, as do the content providers listed under third-party content. Meta and LinkedIn are different: what the Meta Pixel and the LinkedIn Insight Tag send is also used by Meta and LinkedIn for their own advertising purposes — which is why California law calls it “sharing” (see your rights below). We may also disclose data where the law requires it.

International transfers

Mixpanel data stays in the EU. Meta, LinkedIn, Web3Forms and the content providers may process data in the United States or other countries outside the EEA. Where that happens, transfers rely on safeguards such as the EU–US Data Privacy Framework and/or the European Commission’s standard contractual clauses, as set out in each provider’s own terms.

How long we keep it

• Emails from the guide form: 12 months from your last interaction with us, or until you ask us to delete them.
• Analytics data in Mixpanel: 12 months, then deleted or anonymised. Session replays: 30 days.
• Server logs: 30 days.
• Cookie and storage lifetimes are listed in the cookies section above.

Your rights

Under the GDPR you can ask us to:

• tell you what data we hold about you and give you a copy (access);
• correct it (rectification);
• delete it (erasure);
• restrict or object to how we use it;
• give it to you in a portable format;
• and you can change your mind at any time — for cookies, disable them with the first button above; for emails, withdraw consent via the unsubscribe link or by writing to us.

Write to dave@spot.design. We answer within one month. You can also complain to a data-protection supervisory authority — the one in your country, or ours, the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).

If you are in California or another US state with a privacy law. We do not sell personal information for money. Using the Meta Pixel and the LinkedIn Insight Tag counts as “sharing” personal information for cross-context behavioural advertising under California law. You can opt out of that at any time: choose Disable in the cookie banner, or use the Disable analytics and marketing cookies button above. We also honour the Global Privacy Control browser signal as an opt-out request. You have the same rights of access, deletion and correction listed above; write to us at the address above and we will not treat you differently for exercising them.

Changes to this policy

If we change what we collect or who we work with, we will update this page and the date at the top. Material changes to how we use your data will be flagged again in the cookie banner.