How RoutineBridge handles personal data

Who is responsible

The controller of your personal data is:

Controller

Sebastián Galčík, trading as RoutineBridge

Place of business

Kolónia Hviezda 10951/120, 036 01 Martin, Slovakia

Business registration number (IČO)

56129939

Trade register

District Office Martin (Okresný úrad Martin), registration 550-35721

Contact for privacy requests

sebastian@routinebridge.com

What we collect and where it comes from

If we contacted your business

We find businesses by researching the web, public map data (such as OpenStreetMap), public business listings and public registers (for UK companies, for example, Companies House), and then read the business's own public website. From these public sources we record:

• the business name, category and website and, where we used a listing or map, the business address and phone number shown in it;
• a business email address published on the company's own website;
• where the website publishes them, a contact's name and role;
• the page where we found these details, and short notes on what the business says it does, used to judge whether our email is relevant.

We only use email addresses the business itself publishes; we do not guess addresses. Most of this is information about a business rather than a person. It is personal data where it identifies someone, for example a named contact or a sole trader.

Our emails are plain text. We use no tracking pixels and no tracked links, so we do not know whether or when you opened a message.

If you email us

Your name and email address, what you write, any attachments and our replies. If you reply to one of our emails, we also record that you replied and, if you ask, that you do not want further contact.

If you use the contact form on the homepage, we receive your name, email address, optionally your company name, the topic you chose and your message. The form sends them to our server at api.routinebridge.com, which delivers them to us by email. We use them only to reply and keep them like other correspondence.

If you enquire or work with us

The information you choose to give about your business, your process and your project; the contact details of the people involved; the written scope, quotes, invoices and payment records. Please send redacted examples and never send customer details, passwords or access tokens unless we have agreed how to handle them.

You do not have to give us any personal data. Without an email address, we cannot reply to an enquiry.

When you visit this website

The main pages set no cookies, have no analytics or trackers, and load nothing from other websites. The only form that sends anything is the contact form described above.

• The hosting provider (the OpenAI Sites service) may keep standard technical access logs to deliver and protect the site. These typically include your IP address, the time, the page requested and your browser's user agent. We do not use them to identify visitors.
• The demonstration pages under /ukazky/ are fictional example websites for businesses. They load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so when you open them your browser sends your IP address and browser details to Google. Their forms are demonstrations and send nothing. Some keep data (for example a demo shopping cart or demo booking) in your browser's localStorage on your own device. It never reaches us.
• If you use the light/dark switch or choose a language, your choice is saved in your browser's localStorage. It stays on your device and is never sent to us. You can clear it in your browser settings.
• On your first visit to the home page, the language of the website (Slovak, Czech or English) is chosen from the language set in your browser. Your browser decides this itself; nothing is sent and we do not use your location.
• Email links open your own email program. Apart from the contact form, the website sends nothing. Links to other websites, such as the portfolio at sebastiangalcik.com, lead to sites with their own privacy practices.

Why we use it and on what legal basis

• Business outreach and correspondence. To offer our automation services to businesses that may need them, answer messages and keep a record of what was said. Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in offering our services to other businesses and handling our correspondence. We limit outreach to contact details the business publishes itself, and we stop as soon as you object.
• Enquiries and projects (including messages from the contact form). To answer your enquiry, prepare a written scope and quote, and deliver an agreed project. Legal basis: steps taken at your request before entering into a contract, and performance of that contract (Article 6(1)(b)). Where the contract is with your company rather than with you, we rely on legitimate interests (Article 6(1)(f)) for your contact details.
• Accounting records. Invoices and related records we must keep. Legal basis: legal obligation (Article 6(1)(c)) under Slovak accounting and tax law.
• Respecting an objection. The suppression record described above. Legal basis: legitimate interests (Article 6(1)(f)) in making sure we never contact you again.
• Running this website. The host's technical logs. Legal basis: legitimate interests (Article 6(1)(f)) in delivering the site and keeping it secure.

Who receives your data

We do not sell personal data or share it for anyone else's marketing. These service providers process it for us:

• the website hosting provider (OpenAI Sites), for the site and its technical logs;
• Cloudflare, for the DNS of routinebridge.com and for the server that delivers messages from the contact form;
• the mailbox providers we write from: Google (Google Workspace) and Microsoft (Microsoft 365), supplied through ScaledMail (Beanstalk Consulting), and Gmail from Google for our ordinary mail;
• artificial-intelligence providers we use to help research, sort and draft emails (Anthropic and OpenAI). A person reviews and approves every batch of emails before it is sent;
• GitHub, for the private repository holding our automation.

Some providers may process data outside the European Economic Area, notably in the United States. Where they do, the transfer relies on a safeguard the GDPR recognises: an adequacy decision (the EU–US Data Privacy Framework, where the provider is certified) or the European Commission's standard contractual clauses.

We disclose personal data to public authorities only where the law requires it.

How long we keep it

• Outreach data (the contact record, its source page and our emails) when you do not reply: up to 12 months after our last contact, then deleted.
• Correspondence and enquiries that do not lead to a project: up to 24 months after the last message.
• Project records: for the duration of the project, then as long as needed to handle warranty or legal claims.
• Accounting records: for the period Slovak accounting and tax law requires.
• Suppression record: for as long as needed to honour your objection.
• Website technical logs: for the hosting provider's own retention period.
• Theme and language preference: in your browser until you clear it.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected (rectification);
• have your data erased;
• restrict how we use it;
• receive data you gave us in a portable format, where processing is based on a contract and carried out by automated means;
• object at any time to processing based on legitimate interests. An objection to direct marketing is always honoured.

Some rights have conditions or legal exceptions. For example, accounting records cannot be erased while the law requires us to keep them. If you ask us to erase your data, we still keep the minimal suppression record so that we do not contact you again.

To use any of these rights, email sebastian@routinebridge.com. We will reply within one month and may ask for information to confirm who you are before releasing any data.

You can complain to the Slovak supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk. You may also be able to complain to the data protection authority where you live or work.

Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. Software helps us find and sort businesses; a person decides whether to contact one.

Changes to this notice

We will update this page when the way we use personal data changes. The date at the top shows the current version.