Privacy Policy
Last updated: January 10, 2026
Rules of Online Applications of the Controller
(hereinafter referred to as the "Rules")
This document regulates selected rights and obligations of the Controller,
as well as authorized persons and data subjects regarding the processing of personal data
within all applications (hereinafter referred to as the "Application") provided
by the Controller in the information system through relevant
internet domains or through other platforms, which include
in particular, but not limited to, iOS (Apple App Store), Android (Google Play),
the Facebook social network, and the Amazon platform (hereinafter referred to as "Platforms"), in
accordance with Act No. 18/2018 Coll. on Personal Data Protection (hereinafter referred to as the "Act") and GDPR.
The Controller is:
- Name: Cold Pipe Studio, s.r.o.
- Registered seat: Landauova 1814/28, 841 01 Bratislava, Slovak Republic
- ID No. (IČO): 57361223
- Tax ID (DIČ): 2122684245
- VAT ID: SK2122684245
- Phone number: +421908773848
- E-mail: support[a]coldpipestudio.com
Article 1 - PREAMBLE
We process personal data in the information system of the provided Applications in accordance with good morals and exclusively in
accordance with applicable legal regulations and international treaties by which the Slovak Republic is bound.
The Controller always ensures, in particular, that the fundamental rights and freedoms
and legally protected interests of the data subjects are not violated, especially regarding their right to the preservation of
human dignity or other unauthorized interference with their right to privacy.
Article 2 - DEFINITIONS OF BASIC TERMS
Address – is a set of data about the residence of a natural person, which includes the street name, orientation and/or registration number of the house, name of the municipality or part of the municipality, postal code, name of the district, and name of the state.
Blocking of personal data – is the temporary or permanent suspension of personal data processing, during which only those operations with personal data may be performed that are necessary to fulfill obligations imposed by the Act.
Cross-border flow of personal data – is the transfer of personal data outside the territory of the Slovak Republic or into the territory of the Slovak Republic.
Data Subject – for the purposes of the Application, is a natural person older than 16 years, to whom the personal data relates and who, prior to using the Application, confirmed their familiarity with the General Terms and Conditions and the Personal Data Protection Rules related to the Application (hereinafter also referred to as the "User").
Application – is an information system communicating with the user (hereinafter also "Data Subject" or "User") through a graphical and/or audio interface for the purposes of entertainment, education, or providing digital content and services.
User – see Data Subject.
User Identification Code generated by the relevant Platform – are technical identifiers, which may vary depending on the platform used, in particular Device ID, Advertising ID, IDFA, Android ID, Google Advertiser ID, and similar identifiers.
Personal Data Information System – is an information system in which any organized set of personal data accessible according to determined criteria is systematically processed or is to be processed for a pre-defined or established purpose, regardless of whether the system is centralized, decentralized, or distributed on a functional or geographical basis; for the purposes of the Act, an information system also means a set of personal data processed by partially automated or non-automated means.
Liquidation of personal data – is the cancellation of personal data by deleting, decomposing, or physically destroying material carriers so that the personal data cannot be reproduced.
Marketing to the User – is the advertising of products or services displayed in the Controller's Application, directed at the User, including personalized advertising.
Product Marketing – is the promotion of the Controller's products and services through other websites or platforms for the purpose of their visibility and acquiring new users.
Authorized Person – is any natural person who comes into contact with personal data within an employment relationship or based on authorization and processes personal data to the extent and in the manner determined by the Controller in accordance with the Act.
Personal Data – are data relating to an identified or identifiable natural person whom can be identified directly or indirectly, in particular based on an identifier or one or more characteristics constituting their physical, physiological, psychological, mental, economic, cultural, or social identity. Personal data within these Rules are categorized into:
- a) Essential personal data – User's personal data necessary for the use of the Application, without which its provision is technically impossible,
- b) Extended personal data – personal data processed based on the User's consent,
- c) Personal data processed based on legitimate interest – personal data processed based on the legitimate interest of the Controller in accordance with these Rules.
Provision of personal data – is the disclosure of personal data for the purpose of enabling the use of the Application; in a broader sense, it also means the transfer of personal data to other authorized entities.
Controller – the company Cold Pipe Studio, s.r.o.
Processing of personal data – is the performance of operations or a set of operations with personal data, in particular their acquisition, collection, recording, organization, alteration, retrieval, use, storage, blocking, liquidation, transfer, provision, or disclosure.
Processor – is an entity that processes personal data on behalf of the Controller based on a written contract and in accordance with the Act.
Consent of the Data Subject – is any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which the Data Subject signifies agreement to the processing of personal data relating to them.
Purpose of personal data processing – is a pre-defined unambiguous intention of processing personal data linked to a specific activity.
Office – Office for Personal Data Protection of the Slovak Republic, a state administration body with nationwide jurisdiction headquartered in Bratislava.
Third Party – is any entity that is not the Data Subject, Controller, processor, or authorized person.
Disclosure of personal data – is making personal data available to the public through publicly accessible networks, media, or other public means.
Article 3 - THE DATA SUBJECT
The Data Subject is any natural person to whom the personal data processed by the Controller for the purposes of the Application relates, and who is older than 16 years (hereinafter also "User"). By agreeing to these Rules, the User declares that:
- they are older than 16 years and do not need the consent of their parents or other holders of parental rights and obligations to grant consent to the processing of personal data by the Controller,
- they provided the essential personal data necessary for the use of the Application to the Controller voluntarily, only after thoroughly familiarizing themselves with the General Terms and Conditions (hereinafter "GTC") and the Personal Data Protection Rules (hereinafter "Rules") related to this Application; by providing personal data, they also acknowledge the GTC and these Rules,
- in some regions, the Application may be intended exclusively for persons over 18 years of age in accordance with local legislation; in the event that the User does not reach this age and the Controller has demonstrable knowledge of this, an age restriction warning will be displayed upon launching the Application, and access to the Application will be denied.
- information about the scope of personal data processed about them,
- access to their personal data,
- rectification, restriction of processing, or liquidation of personal data that the Controller processes about them,
- object to the processing of personal data and their transfer.
In the event that the exercise of the User's right is not accepted by the Controller, the User has the right to file a complaint with the relevant Office.
If the User requests the deletion of their personal data, the Controller will assess this request in accordance with applicable personal data protection laws and these Rules. If the request is justified, the Controller will perform the liquidation of personal data no later than 60 days from the date of receipt of the request.
Article 4 - PERSONAL DATA PROCESSED BY THE CONTROLLER
The Controller processes the User's personal data based on the following legal bases:
- processing of personal data is necessary for the performance of a contract concluded between the Controller and the User (provision and operation of the Application),
- processing of personal data is necessary for the purposes of the legitimate interests of the Controller, in particular for the analysis and statistics of Application usage for the purpose of its improvement and user experience optimization,
- the User has granted the Controller consent to the processing of personal data to the extent determined by these Rules.
- first name and surname (if part of the email address, if the User voluntarily provides them in the Application, or if made available by the Platform* through which the User uses the Application),
- User's photograph (only if the Application allows its upload and the User voluntarily uploads it, or if made available by the Platform*),
- e-mail address,
- IP address,
- login times and Application usage times,
- User's country,
- User Identification Code generated by the relevant Platform.
* The stated data may be made available to the Controller through third parties (e.g., Facebook, Google, Apple) to whom the User provided this data. More detailed information on the processing of personal data by these third parties is available in their privacy policies.
The Controller's legitimate interest is the processing of personal data for the purposes of statistical and analytical activities concerning the use of the Application and for the purposes of marketing the Controller's products. In this way, the Controller ensures the proper operation of the Application, its optimization, and further development for the benefit of Users. Within the scope of legitimate interest, the Controller processes mainly the following personal data:
- location data derived from the IP address,
- e-mail address,
- the country where the User's device is located,
- User Identification Code generated by the relevant Platform.
The User may grant the Controller consent to the processing of extended personal data through the Application in the relevant contextual interface of the Application. The User may revoke this consent at any time. Extended personal data is processed by the Controller exclusively after the User's consent has been granted, mainly to the following extent:
- location data (IP address) for the purposes of marketing to the User and displaying advertising, including personalized advertising in the Controller's Applications,
- e-mail address for marketing or informational purposes,
- the country where the User's device is located for marketing and advertising purposes,
- User Identification Code generated by the relevant Platform, mainly for marketing and personalized advertising purposes.
Revocation of consent to the processing of extended personal data shall be performed by the User by sending an email to the Controller's address listed in the header of these Rules, which must clearly imply that the User is revoking consent to the processing of specific personal data. If the User has an email address linked to their user account in the Application, they are obliged to revoke consent from this email address. To speed up the processing of the request, it is recommended to state the name of the Application and the account or server identification.
For the purposes of using the Application, the User is obliged to provide exclusively true, current, and accurate data. The User is solely responsible for the truthfulness and correctness of the provided data.
The Controller bears no responsibility for the provision of personal data by the User to third parties, especially in connection with making payments through external payment systems. Such provision of personal data creates no obligations for the Controller beyond applicable personal data protection laws.
Personal data, such as name, surname, and postal address, may be individually requested by the Controller from the User in the event that the User wins a prize in a competition organized by the Controller or their business partner. This data will be used exclusively for the purpose of delivering the prize. The User has the right to refuse to provide this data, but in such a case, they lose the right to receive the prize.
For the purpose of improving the Application and providing technical support, the Controller is authorized to make records of Application usage exclusively within it, using their own tools or third-party tools. No other activity on the User's device is recorded. Since these records do not serve to identify a specific User and do not allow their unique identification, they are not considered personal data processing.
Article 5 - THIRD PARTIES
If the User notifies the Controller or exercises their right,
or if the Controller discovers that they provided incorrect, incomplete,
or outdated data to a third party, or provided it without a
legal basis, the Controller is obliged to notify everyone to whom they provided it
without undue delay in a demonstrable manner. In the notification, the Controller shall state
what corrective measures they have taken, especially whether they blocked, supplemented,
corrected, modified, updated, or liquidated the personal data, and what measures they request
the third party to take. The third party is obliged, based on the Controller's notification, to
carry out the measures requested by them, in particular to block personal data in the information
system and to supplement, correct, modify, update, or liquidate them without undue delay.
Notification may be waived only if it is objectively impossible and/or possible only
with disproportionate effort. A Controller who waives notification for
objective reasons mentioned in the previous sentence is obliged to prove to the
Office upon request that such waiver was justified.
The Controller is authorized to provide the User's personal data to the necessary extent
only to those third parties with whom they have a contractual cooperation that also regulates the area of
personal data protection, exclusively for the purpose of fulfilling the subject of such a contract. Such
provision of data is considered, in particular, its provision to a third party ensuring
accounting, payment services provision, data storage, or
technical infrastructure for the Controller (e.g., credit card issuing companies, banks,
PayPal, mobile operators, web hosting providers, statistics and analytical data processors,
etc.), including abroad, but always only to the
extent necessary to provide support to the User or to ensure the
proper functioning of Applications and always in accordance with the Act.
Third parties whose advertisements are displayed in the Application, or whose websites
the User visits after clicking on links available in the Application, may store and install
cookies on the User's device. Detailed information on personal data processing
and the use of cookies is provided in the privacy policies of the relevant third parties.
When registering or logging in via the Facebook social network, the
User's username may be automatically filled in according to the data listed in their
profile on this social network. The User's email address linked to their
social network account may be stored in the Controller's database.
All transactions carried out through payment methods provided by
third parties (e.g., PayPal, Skrill, etc.) are governed by the personal data protection
policies of the respective providers of these payment services.
The User acknowledges that by using Applications through individual
platforms, the privacy policies of these platforms also apply to them.
The processors listed below may process personal data provided by the User:
The Controller may use the services of their processor Google (https://admob.google.com/home/) and cooperating companies (https://support.google.com/admob/answer/3245073?hl=sk&ref_topic=7383089) for the purpose of mediating (displaying) video advertising to the User, Marketing to the User and Product Marketing.
Article 6 - SECURITY AND CONTROL
The Controller is responsible for the security of personal data processing. The Controller is obliged to protect
personal data, in particular against damage, destruction, loss, alteration,
unauthorized access, disclosure, provision, or publication, as well as against any other
impermissible forms of processing. For this purpose, the Controller has adopted
appropriate technical, organizational, and personnel measures corresponding to the method and scope of
personal data processing.
The measures mentioned in the previous sentence are documented by the Controller in an internal
Security Directive, which they are obliged to update continuously to correspond to
all changes that occur during personal data processing.
The Controller processes personal data obtained from Users exclusively in accordance
with applicable personal data protection laws. All persons who come into contact with
Users' personal data on behalf of the Controller are duly authorized for such
processing and have been demonstrably instructed on the obligation to observe
confidentiality, secrecy, and personal data protection principles.
Article 7 - COOKIE POLICY
Cookies are small amounts of information in the form of text files that the Application stores on the
User's terminal device. Cookies allow the Controller to monitor Application usage,
analyze its traffic, and simplify its use for the User (for example, by remembering
the selected language or other User preferences). Temporary cookies are also used
to maintain the User's session. Without these temporary cookies, it would be necessary to log in
again every time the User moves between individual parts of the Application.
The User grants the Controller consent to store cookies on their device
through the relevant consent (popup) window. If the User does not wish the
Application to store cookies on their device, they can refuse such consent. Granted
consent can be revoked by the User at any time through cookie settings available in the
footer of the website or in the Application interface. Detailed information about individual categories
of cookies is available directly in the consent window of the specific website or Application.
More detailed information on the options for disabling or restricting the use of cookies
via browser settings is available in the "Help" section of the
relevant internet browser (or on the information page about cookie usage).
The User acknowledges that disabling certain types of cookies may lead to limitation
or inability to use the full functionality of the Application.
Advertising companies or other third parties may use cookies via the Application
to display advertisements. Some cookies allow ad display based on
previous visits to the Application or other websites. The User has the option to
restrict or disable the use of such cookies via cookie settings or
via tools provided by the relevant third parties.
Article 8 - LIQUIDATION OF PERSONAL DATA
Deletion of the User Account
In the event of deletion of the User's account from the Application, the Controller will delete the User's
Extended personal data, as well as Essential personal data that is necessary
for using the Application. These personal data will be deleted no later than 60 days
from the deletion of the user account from the Application, unless they are subject to mandatory
archiving under applicable laws.
Extended personal data
Upon revocation of consent to the processing of Extended personal data, the User's personal data
processed based on this consent will be deleted immediately, no later than
60 days from the delivery of the revocation of consent to the Controller.
Revocation of consent is performed by the User by sending an email to the
Controller's email address listed in the header of these Rules, which will clearly
imply that they are revoking consent to the processing of Extended personal data. If the
User has an email address linked to their account in the Application, the revocation of
consent must be performed from this email address. To speed up the processing of the request, it is
recommended to state the name of the Application, the user account identifier, and possibly the Application server.
Personal data processed based on legitimate interest
The User may request the deletion of their personal data processed based on
legitimate interest by sending an email to the Controller's address listed in the header of these
Rules, stating the precise identification of the Application, user account, and possibly
the server. The request must explicitly state that the User requests the deletion of personal
data processed based on legitimate interest.
In the event that such an explicit request is not stated in the email, the Controller
will not delete this personal data. If the User has an email linked to their account in the
Application, the request must be sent from this email address. These personal data
will be deleted no later than 60 days from the delivery of a justified request or until the
termination of the Controller's legitimate interest.
Essential personal data
The User may request the deletion of their Essential personal data necessary for
using the Application by sending an email to the Controller's address listed in the header of these
Rules, stating the precise identification of the Application, server, and user account. In
the request, it must be explicitly stated that they request the deletion of Essential personal data
necessary for using the Application.
In the event that the User requests the deletion of Essential personal data, their
user account will be deleted. If the email request does not explicitly state
that the User requests the deletion of Essential personal data, this personal data will not be
deleted. If the User has an email linked to their account in the Application, the request must be
sent from this email address.
Essential personal data will be deleted no later than 60 days from the deletion of the
user account from the Application, unless subject to archiving. The User acknowledges
that by deleting Essential personal data, they lose access to their current
progress in the Application, its content, and all accounts linked via the deleted
Essential personal data.
Final provisions on data liquidation
By expressing consent to these Rules, the User grants the Controller consent to the
processing and storage of personal data provided by them in accordance with applicable
personal data protection laws for the purposes of the Application. The Controller declares that
email addresses of deleted accounts will not be used to send information about the Application,
other projects of the Controller or their partners, and will not be provided to third parties
for these purposes.
The Controller is authorized to retain selected personal data, in particular the email address,
IP addresses, login times, and the User's country, even after a request for their deletion or
after the deletion of the User's account from the Application, if this is necessary to fulfill their legal
obligations, in particular obligations arising from Article 58 of Directive 2006/112/EC on the common
system of value added tax and Article 24f of Council Implementing Regulation (EU) No 1042/2013.
In such a case, this personal data will be retained for the period strictly necessary,
maximum 10 years.
The fact that the User does not actively use the Application does not constitute a revocation
of consent to the processing of Extended personal data nor does it establish a reason for
automatic deletion of personal data processed based on legitimate interest
or Essential personal data. The User may exercise their rights at any time
using the procedure set out in this article; otherwise, personal data will be processed until the purpose of their processing ceases.
Article 9 - FINAL PROVISIONS
These Rules are subject to updates following potential
changes to the law and are binding for the Controller, Users, and third
parties to the necessary extent. The Controller is responsible for additions or potential changes made to
these Rules.
The Controller reserves the right to change these Rules without prior
notice, and any change will always be published on the relevant page of the Application.
The User will be notified of the change in Rules directly in the Application no later than on the day of publication of the
new Rules. This does not relieve the Controller of their obligations arising from the law.
By registering in the Application, installing the Application on their device, or accepting
these Rules, the User confirms their unconditional consent to these Rules,
acknowledges that these Rules are available only in English and Slovak,
agrees to this fact, and understands their content.
The Rules become effective on the day of issuance.
In Bratislava, January 8, 2026