Privacy Policy

This policy explains how OakBag processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Slovak Personal Data Protection Act (No. 18/2018 Coll.). OakBag is an educational and research tool; we collect as little data as possible and never sell it.

1. Controller

JSA Consulting s. r. o.
Dolné Hámre 289, 966 61 Hodruša-Hámre, Slovakia
Company ID (IČO): 50 768 042
Email: info@jsastudios.com

Given the scope of processing, we are not required to appoint a Data Protection Officer (DPO). For any data-protection matter, contact us at the email above.

2. What data we process and the legal basis

• Account & sign-in — your email address, a one-way hashed password (we never store or can see your actual password) and timestamps (registration, terms acceptance, last login). Legal basis: Art. 6(1)(b) GDPR — performance of a contract (providing the service you requested).
• Account security — technical sign-in data (e.g. failed-attempt counts for temporary lockout). Legal basis: Art. 6(1)(f) — legitimate interest in protecting accounts from abuse.
• Transactional email — email confirmation and password reset. Legal basis: Art. 6(1)(b).
• Cookie consent — a record of your consent choice (stored locally in your browser).
• Analytics — if (and only if) you opt in, we use Google Analytics 4 and Microsoft Clarity to understand how the site is used (pages viewed, aggregated usage and, for Clarity, anonymised session replays and heatmaps). IP addresses are anonymised and we enable no advertising or ad-personalisation signals. Legal basis: Art. 6(1)(a) — your consent. Nothing loads until you accept, and you can withdraw at any time.

3. Recipients and processors

We do not sell or share your data for advertising. We use trusted processors that handle data solely on our behalf under a data-processing agreement:

• Email delivery — Resend (Plus Five Five, Inc., USA) for transactional email.
• Hosting — our web-hosting provider (Websupport s. r. o., Slovakia) for this site and an EU-based server provider for the application.
• Analytics (only with your consent) — Google Analytics 4 (Google Ireland Ltd. / Google LLC) and Microsoft Clarity (Microsoft Ireland Operations Ltd. / Microsoft Corporation). These run only if you opt in and can be withdrawn at any time.

4. International transfers

Account and security data are processed within the European Economic Area (EEA). Transactional email is delivered through Resend, whose primary processing takes place in the United States; that transfer is safeguarded by Resend's certification under the EU–US Data Privacy Framework and by the European Commission's Standard Contractual Clauses in our data-processing agreement. If you consent to analytics, Google and Microsoft may also process data in the United States under the same safeguards. Without your consent no analytics data leaves your browser and no analytics transfer takes place.

5. Retention

We keep account data while you have an account with us. After you delete your account we erase or anonymise the data within a reasonable period, unless the law requires us to keep it longer. Security-related technical records are kept only briefly.

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, port and object to processing based on legitimate interest, and to withdraw any consent at any time (without affecting the lawfulness of prior processing). Exercise these rights by email at info@jsastudios.com; we respond within one month. You can request deletion of your account (and its data) at any time.

7. Right to lodge a complaint

If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava 27, Slovakia
dataprotection.gov.sk

8. Automated decision-making

Scores, rankings and the "traffic-light" colours are general educational model outputs applied to market data. They are not an individual automated decision about you within the meaning of Art. 22 GDPR and do not take your personal financial situation into account.

9. Cookies

For details about cookies see our Cookie Policy. You can change your consent at any time via the "Cookie settings" button in the footer.

10. Changes to this policy

We may update this policy from time to time. The current version is always available on this page with the date of the last update.

This document is general information for an educational project and is not a substitute for legal advice.