Privacy Policy

Effective date: 20 September 2026

This Privacy Policy explains how personal data is processed when you visit the website ub.consulting ("UB Consulting") or contact us. It applies to this website only. Further company details are set out in our Imprint. Details of the individual cookies used are set out in our Cookie Policy.

1. Controller

Alpen Agency s. r. o.
Saleziánov 4
071 01 Michalovce
Slovak Republic

Company Registration Number (IČO): 50378414
VAT Identification Number (IČ DPH): SK2120316979
Managing Director: Franz Pisec
Email: office@ub.consulting
Phone: +43 664 506 98 70

"UB Consulting" is a brand operated by Alpen Agency s. r. o.

2. Data Protection Contact

For all privacy-related requests, please contact: office@ub.consulting

We have not appointed a Data Protection Officer, as we are not required to do so under Art. 37 GDPR. Should this change, the contact details will be published here.

3. Personal Data We Process

3.1 Website access data (server logs)

When you access our website, our hosting provider's systems automatically process:

  • IP address
  • Date and time of access
  • Requested page/URL
  • HTTP status code and volume of data transferred
  • Browser and device information (user agent)
  • Referrer URL (where transmitted by your browser)

This data is required in order to deliver the website and to ensure its stability and security.

3.2 Communications (contact form, email and telephone)

Our contact page (ub.consulting/contact/) provides a contact form. If you use it, we process the details you enter there:

  • Name (required)
  • Email address (required)
  • Message (required)
  • Company name (optional)
  • Phone number (optional)

Submissions are not stored in this website's database. They are delivered by email to office@ub.consulting only; the message is sent through our hosting provider's mail infrastructure (see section 7). Your email address is set as the reply address (Reply-To) so that we can respond to you directly. Your IP address is not included in the notification; for server log files see section 3.1.

To protect the form against automated abuse, it contains an additional field that is invisible to humans (a “honeypot”) and a timing check that detects unusually fast submissions. Both run exclusively on our own server. No cookies are set for this purpose, no third-party services are embedded and no data is passed on to third parties; in particular, Google reCAPTCHA is not used.

If you contact us by email or telephone instead, we process the data you provide to us in doing so — usually the same details.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries and in preventing spam). The required fields are necessary for us to be able to handle your enquiry; the remaining details are optional. For retention periods see section 15.

3.3 Newsletter subscription

If you subscribe to our newsletter, we process your email address together with the confirmation and log data required to document your consent (see section 12).

4. Purposes of Processing

  • Operating, delivering and securing the website
  • Responding to inquiries and managing business communications
  • Preparing offers and performing contracts
  • Preventing abuse, spam and attacks
  • Measuring website usage on an aggregated basis (only with your consent)
  • Sending our newsletter (only if you have subscribed)

5. Legal Bases (Art. 6 GDPR)

  • Art. 6(1)(a) GDPR – consent (analytics and other non-essential cookies, newsletter)
  • Art. 6(1)(b) GDPR – contract performance and pre-contractual measures (inquiries, proposals)
  • Art. 6(1)(c) GDPR – compliance with a legal obligation (where applicable)
  • Art. 6(1)(f) GDPR – legitimate interests (website delivery, IT security, abuse prevention, efficient business communication)

Where cookies or comparable technologies are stored on or read from your device, this is additionally based on § 109 of the Slovak Act No. 452/2021 Coll. on Electronic Communications, which implements Art. 5(3) of the ePrivacy Directive. Storage or access that is not strictly necessary takes place only with your consent.

6. Legitimate Interests

Where processing is based on Art. 6(1)(f) GDPR, our legitimate interests are: ensuring the availability, stability and IT security of the website, preventing misuse such as spam and brute-force attacks, and maintaining efficient business communication and administration.

7. Hosting and Email Infrastructure

This website and the associated email infrastructure are operated on servers provided by our hosting provider, ТОВ «Хостінг Україна» (Hosting Ukraine LLC), vul. Mashynobudivna 35-A, Kyiv, Ukraine, company registration number (EDRPOU) 37593550 ("Hosting Ukraine" / ukraine.com.ua / adm.tools), which acts as our processor within the meaning of Art. 28 GDPR.

The servers used for this website are physically located in Germany, in the data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, at its Falkenstein location. Website content and server logs are therefore stored within the European Union.

Our hosting provider is established in Ukraine. Administrative access to the systems from Ukraine cannot be excluded, so that a transfer of personal data to a third country within the meaning of Chapter V GDPR may occur. Ukraine is not covered by an adequacy decision of the European Commission. Such transfers are therefore made on the basis of appropriate safeguards pursuant to Art. 46 GDPR (EU Standard Contractual Clauses), supplemented by technical and organisational measures, in particular transport encryption and access controls.

8. Cookies and Consent Management

We use the consent management platform Complianz to obtain, store and document your consent. Complianz runs locally on our own server; no data is transmitted to the plugin vendor for this purpose. Complianz stores your consent decision in cookies with the prefix cmplz_. These cookies are strictly necessary for complying with our legal documentation obligations and are set without consent on the basis of Art. 6(1)(c) and (f) GDPR.

Cookies and comparable technologies that are not strictly necessary — in particular analytics cookies (see section 9) — are only set after you have given your consent.

You can withdraw or change your consent at any time with effect for the future in the consent settings on our Cookie Policy page, which is linked in the footer of every page. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

A full list of the cookies used, including their names, purposes, providers and storage periods, is set out in our Cookie Policy.

8.1 Language cookie

This website is available in several languages. To remember your language selection, the cookie pll_language is set by the Polylang plugin, which runs locally on our server. The cookie has a storage period of one year and contains only the language code (e.g. "en"). It is used solely to display the site in the language you selected and does not permit any identification of you as a person.

9. Website Analytics (Google Analytics 4)

Only with your consent, we use Google Analytics 4 with the measurement ID G-5G9X2XXF26 in order to understand, on an aggregated basis, how our website is used. The provider for users in the EU/EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies (_ga, _ga_5G9X2XXF26) to distinguish returning visits and to record events such as page views, session duration, approximate location (country/region level), device type and referrer.

We have implemented the following settings:

  • Google Consent Mode v2 with all consent signals set to denied by default; Google tags are only loaded and executed after you have consented to statistics.
  • IP addresses are shortened by Google before any further processing.
  • Google Signals is not enabled; no cross-device tracking and no advertising features are used.
  • Data retention for user- and event-level data is set to 14 months.
  • No Google Tag Manager and no advertising or social media pixels are used on this website.

Legal basis: Art. 6(1)(a) GDPR (consent). Google Ireland Limited acts as our processor. Personal data may be transferred to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023; in addition, Standard Contractual Clauses have been concluded.

You can withdraw your consent at any time in the consent settings on our Cookie Policy page. Further information on data processing by Google is available at https://policies.google.com/privacy.

10. Website Security (Wordfence)

To protect this website against attacks, we use the security plugin Wordfence Security, provided by Defiant, Inc., 1700 Westlake Ave N, Suite 200, Seattle, WA 98109, USA.

Wordfence operates a web application firewall and login protection. For this purpose it processes IP addresses, request data and login attempts, and stores them in a log on our own server in order to detect and block attack patterns. Wordfence sets cookies only for logged-in administrators (wfwaf-authcookie-*, wf_loginalerted_*); no cookies are set for ordinary website visitors.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the security and availability of our website. The "Wordfence Security Network" is enabled on this website. Wordfence therefore transmits data on blocked and suspicious requests — in particular IP addresses, the attack pattern that was recognised and the requested URL — to Defiant, Inc. in the United States, where they are used to maintain the threat database and to update the firewall rules. Such transfers are made on the basis of appropriate safeguards pursuant to Art. 46 GDPR (EU Standard Contractual Clauses). Further information: https://www.wordfence.com/privacy-policy/.

11. Fonts and External Content

All fonts used on this website are hosted locally on our own server. No connection to Google Fonts or any other external font provider is established, and no data is transmitted to such providers when you visit this website.

This website does not embed any maps, videos or social media content. Our office addresses are linked to Google Maps as ordinary external hyperlinks. Such a link only transmits data to Google when you actively click on it; the processing is then governed by Google's privacy policy. We have no influence on it.

12. Newsletter

If — and only if — you subscribe to our newsletter, we process your email address in order to send you information about our services. Dispatch is carried out using Mailchimp, a service provided by Intuit Inc., 2700 Coast Avenue, Mountain View, CA 94043, USA, acting as our processor.

Subscription uses the double opt-in procedure: after you register, you receive an email asking you to confirm your subscription. We store the registration and confirmation, including the time and the IP address used, in order to document your consent.

Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, either via the unsubscribe link contained in every newsletter or by sending an email to office@ub.consulting. Following withdrawal, your email address will be deleted from the distribution list.

Intuit Inc. is established in the United States and is certified under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses have been concluded. Further information: https://www.intuit.com/privacy/statement/.

13. Recipients and Processors

We do not sell personal data. Data is disclosed only where this is necessary and permitted by law. The following categories of recipients may receive personal data:

  • Hosting and email infrastructure: ТОВ «Хостінг Україна» (Hosting Ukraine LLC), Kyiv, Ukraine (Ukraine), servers in Germany (see section 7)
  • Website analytics: Google Ireland Limited, Ireland (only with your consent, see section 9)
  • Website security: Defiant, Inc., USA (see section 10)
  • Newsletter dispatch: Intuit Inc. (Mailchimp), USA (only if you have subscribed, see section 12)
  • Image optimisation: Voormedia B.V., Netherlands (TinyPNG) — compresses image files that we upload to the website ourselves; no visitor data is transmitted
  • Website maintenance and IT support: carried out by Alpen Agency s. r. o. itself; no external service provider is engaged for this purpose
  • CRM and project management tools: no such tools are connected to this website
  • Tax advisors, auditors and public authorities, where we are subject to a legal obligation

Where we engage processors, they are bound by data processing agreements pursuant to Art. 28 GDPR.

14. International Transfers

Personal data may be transferred to third countries outside the EU/EEA in the cases described above, namely:

  • Ukraine – administrative access by our hosting provider (section 7). There is no adequacy decision for Ukraine; transfers are made on the basis of appropriate safeguards pursuant to Art. 46 GDPR (EU Standard Contractual Clauses).
  • United States – Google LLC (section 9), Defiant, Inc. (section 10) and Intuit Inc. (section 12). Google LLC and Intuit Inc. are certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023); in addition, Standard Contractual Clauses have been concluded. For Defiant, Inc., transfers are made on the basis of Standard Contractual Clauses.

You may request a copy of the safeguards in place by writing to office@ub.consulting.

15. Retention

  • Server logs: retained for up to 30 days, unless a longer period is required in order to investigate a specific security incident.
  • Inquiry and communication data: retained for up to 24 months after the last contact, unless a contract follows or statutory retention obligations apply.
  • Contract-related data: retained in accordance with statutory retention obligations under Slovak commercial and tax law (as a rule 10 years).
  • Consent records (cookie consent): retained for the duration of the consent and for a further 3 years in order to provide evidence of consent.
  • Analytics data: deleted by Google after 14 months at the latest.
  • Newsletter data: retained until you unsubscribe or withdraw your consent.

16. Your Rights

You have the right to:

  • obtain access to your personal data (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • object to processing based on legitimate interests (Art. 21 GDPR)
  • withdraw your consent at any time with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please contact office@ub.consulting.

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is:

Úrad na ochranu osobných údajov Slovenskej republiky
(Office for Personal Data Protection of the Slovak Republic)
Hraničná 12
820 07 Bratislava 27
Slovak Republic
Website: https://dataprotection.gov.sk/en/

18. Requirement to Provide Data

Providing personal data is neither required by law nor by contract. However, if you do not provide certain data — such as an email address — we may not be able to respond to your inquiry or provide the services you have requested.

19. Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

20. Changes to This Privacy Policy

We may update this Privacy Policy in order to reflect changes to our website or to legal requirements. The current version is always published on this page.

Last updated: 20 September 2026