Privacy Policy
Information under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) · effective from 11 November 2026
This policy explains how we process personal data when you visit mumi.dev, write to us, send a project brief, book a call, leave a review or work with us as a client. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and Slovak Act No. 18/2018 Coll. on the Protection of Personal Data, and only to the extent needed for each purpose.
1. Controller
| Controller | mumi.dev – Muhammad Turdiev and Saad Hidbani |
|---|---|
| Registered office | |
| Company ID (IČO) | |
| Tax ID (DIČ) | |
| VAT ID (IČ DPH) | |
| [email protected] | |
| Website | mumi.dev |
2. Data protection officer
We have not appointed a data protection officer under Article 37 GDPR, as our core activities do not involve large-scale, regular and systematic monitoring of individuals or processing of special categories of data. For any question about your personal data, contact us at [email protected].
3. Purposes, legal bases and retention periods
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Replying to your message or project brief | name, e-mail, phone number (if you give it), your message, the services, timing and price estimate you selected | Art. 6(1)(b) GDPR – steps taken at your request before entering into a contract; for general questions Art. 6(1)(f) – our legitimate interest in replying | up to 24 months after our last contact, unless a contract follows |
| Booking and holding a free consultation call | name, e-mail, phone number (required only for a phone call), chosen date and time, call format, topic | Art. 6(1)(b) GDPR – steps before entering into a contract | up to 24 months after the call, unless a contract follows |
| Delivering a project – communication, design previews and feedback | contact and billing details of the client and its contact persons, project communication, feedback sent through a preview link (name, e-mail, message) | Art. 6(1)(b) GDPR – performance of a contract; for contact persons of a business client Art. 6(1)(f) – legitimate interest in communicating with the client | for the duration of the contract and then until the limitation periods for legal claims expire (as a rule 4 years) |
| Invoicing and accounting | name or business name, address, IČO / DIČ / IČ DPH, invoiced services and amounts | Art. 6(1)(c) GDPR – Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on VAT | 10 years from the end of the year to which they relate |
| Publishing client reviews | name, role or company (optional), rating, review text | Art. 6(1)(a) GDPR – consent; a review is published only after our approval | until you withdraw consent or we remove the review |
| Website security and spam prevention | IP address stored with a form submission, session cookie, server access logs (IP address, time, requested address, browser information) | Art. 6(1)(f) GDPR – legitimate interest in securing the website and preventing abuse | IP address: as long as the form record; server logs: a limited period set by the hosting provider, then deleted automatically |
| Delivering the website through a content delivery and protection network | IP address and technical data of the request | Art. 6(1)(f) GDPR – legitimate interest in a fast, available and protected website | processed transiently; security logs for a short period |
| Establishing, exercising or defending legal claims | data relevant to the claim | Art. 6(1)(f) GDPR – legitimate interest in protecting our rights | until the claim is finally resolved |
Giving your name and e-mail is necessary for us to reply or to book a call; without them we cannot do so. A phone number is voluntary unless you ask us to call you. Where processing is based on consent, you may withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal.
4. Categories and sources of personal data
- We process only ordinary personal data: identification and contact details, the content of your messages, booking details, billing details and technical data. We do not ask for special categories of personal data (for example health data); please do not send them to us.
- We obtain personal data directly from you. Data of contact persons of our business clients may come from the client (your employer or principal).
5. Cookies and storage in your device
The website uses only cookies and browser storage that are strictly necessary for it to work or that remember a setting you chose (language, light or dark theme). We do not use analytics, advertising or social-media tracking tools. Details are in our Cookie Policy.
6. Recipients and processors
| Recipient | Role and purpose |
|---|---|
| members of the mumi.dev team | handling enquiries, bookings and projects, only to the extent necessary |
| WebSupport s.r.o., Karadžičova 12, 821 08 Bratislava, Slovakia | processor – hosting of the website and the database |
| Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA | processor – content delivery network, protection against attacks and abuse |
| our e-mail service provider | processor – delivery of e-mails, including notifications about your message or booking |
| Telegram (messaging service) | internal notifications to our team about a new message or booking; the notification contains the details you entered in the form |
| WhatsApp Ireland Limited, Ireland | independent controller – only if you contact us via WhatsApp (WhatsApp privacy policy) |
| accountants, tax advisers and lawyers | where needed for accounting, tax or legal matters; bound by confidentiality |
| public authorities | only where required by law (e.g. tax authorities, courts, law enforcement) |
We do not sell personal data and do not share it with third parties for their marketing.
7. Transfers outside the European Economic Area
We store personal data on servers in the Slovak Republic. Cloudflare, Inc. may process some technical data in the United States; such transfers are based on the European Commission adequacy decision for the EU–U.S. Data Privacy Framework, under which Cloudflare is certified, or on standard contractual clauses under Article 46(2)(c) GDPR. The Telegram messaging service may process notification content outside the EEA; we keep notifications limited to what our team needs to respond to you.
8. Your rights
As a data subject you have the right to:
- access your personal data and receive a copy (Art. 15 GDPR),
- have inaccurate or incomplete data rectified (Art. 16 GDPR),
- have your data erased where there is no longer a reason to process it (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- data portability for data processed on the basis of a contract or consent (Art. 20 GDPR),
- object to processing based on our legitimate interest (Art. 21 GDPR),
- withdraw consent at any time, for example to the publication of your review (Art. 7(3) GDPR),
- lodge a complaint with the supervisory authority (Art. 77 GDPR): Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk, or with the authority in your EU country of residence.
Send your request to [email protected]. We will respond without undue delay and in any event within one month of receipt; in complex cases this period may be extended by two further months, of which we will inform you. Before acting on a request we may ask you to verify your identity. Exercising your rights is free of charge.
9. Automated decision-making and profiling
We do not carry out automated individual decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
10. Security of personal data
We have adopted appropriate technical and organisational measures, in particular encrypted connections (HTTPS), protection of the website by a content delivery and security network, protection of forms against cross-site request forgery and automated spam, rate limiting of form submissions, administration access protected by a password and two-step verification, and access to personal data limited to the people who need it.
11. Final provisions
- We may update this policy, in particular when our processing or the law changes. The current version is always published on this page, with its effective date at the top.
- This policy is available in English and Slovak.