PORTOFINO B&F
Privacy notice
Effective 22 September 2026
1. Controller and scope
Portofino B&F s. r. o., company number 55639038, Mramorová 25553/9, 821 06 Bratislava, Slovakia, is the controller for this catalogue and its enquiry form. Contact info@portofinobf.sk or the postal address above for privacy questions and rights requests. This notice covers the Portofino catalogue hosted through ChatGPT Sites, not every other company system.
2. Data we collect
You provide your name, email, delivery country, selected products and quantities. We record the enquiry time and reference. Company buyers also provide their company name. Phone, registration number, VAT ID and notes are optional. Do not enter health information, identity documents or other sensitive data in notes. Hosting and content delivery also process connection data such as IP address, request time and browser information. When handling an enquiry, we also record its status, assigned team member, quoted price and internal notes relevant to your request. Enquiries from the same email address are grouped to retain the communication history.
3. Purposes and legal bases
Handling an individual’s enquiry and preparing a contract at their request: GDPR Article 6(1)(b). Communicating with company employees and representatives: Article 6(1)(f), with the legitimate interest of responding to requested business communications. Security, abuse prevention and delivering a functioning website: Article 6(1)(f). Handling statutory rights requests: Article 6(1)(c). Optional YouTube content is loaded with consent under Article 6(1)(a). Sending an enquiry does not subscribe you to a newsletter.
4. Required information and automation
Fields marked * are needed to prepare and answer your enquiry; the form cannot be submitted without them. Providing them is not a general statutory obligation. Optional fields may be left blank. We do not make solely automated decisions with legal or similarly significant effects about your enquiry, and the form does not perform advertising profiling.
5. Recipients and international processing
Authorised Portofino B&F personnel and necessary technical providers can access enquiries: OpenAI/ChatGPT Sites and Cloudflare infrastructure, including the database. Our business email provider also processes correspondence when we respond. External product photographs connect to DJI (djiits.com), Apple (apple.com) and Starlink (starlink.com), which receive technical request data, not enquiry contents. Allowing a video connects your browser to YouTube/Google. These providers operate globally, including in the USA; EU-only storage cannot be promised. Their notices linked below describe transfers and their applicable mechanisms, such as adequacy decisions or standard contractual clauses depending on the service. Contact us for details and copies of safeguards applicable to your enquiry.
6. Retention
We need enquiry data while communicating and preparing an offer. Once discussions end, further retention depends on a resulting contract, a legal obligation or a specific legal claim; possible future advertising alone is not a retention reason. Data without a remaining purpose should be erased or anonymised. A resulting contract is subject to applicable statutory and accounting periods, explained when concluding it. Video choices last until the browser tab is closed or the choice is changed. Providers’ technical logs are subject to their retention policies linked below.
7. Your rights
Subject to GDPR conditions, you can request access and a copy, rectification, erasure, restriction and portability. You may object to legitimate-interest processing on grounds relating to your particular situation. Withdraw video consent at any time through Privacy settings; this does not affect earlier lawful processing. Email info@portofinobf.sk, preferably from the address used for the enquiry and with its reference. A special form or ID copy is not automatically required. We normally respond within one month and will inform you within that period of any lawful extension.
8. Complaints and changes
You may complain to the Slovak Office for Personal Data Protection, Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk, or the supervisory authority where you habitually reside, work, or believe an infringement occurred. We update this notice when purposes or processing change; the version date appears above.
Loyalty programme
Portofino B&F processes your name, email, country, company and registration number where applicable, registration date, accepted rules version, voucher, expiry and redemption records to administer membership and fulfil the programme rules. Email is not verified during registration. Registration is not consent to advertising. Membership records are needed during membership and to check the one-time reward; after the purpose ends we erase or anonymise them unless needed for a legal obligation or a specific legal claim. Contact info@portofinobf.sk to end membership or exercise your rights.
Emails and welcome voucher
Once sending is activated, we send welcome vouchers and operational notifications through our Google Workspace account and Google Apps Script. Google processes the recipient address and message content: name, voucher code, expiry and discounts for a welcome voucher; the relevant enquiry, order or recorded payment details for an administrator notification. The administration retains message content and sending status to handle requests and resolve errors under the retention criteria above. This connection does not read the inbox or track email opens.
Customer account sign-in (28 September 2026)
We send a one-time code through Google Workspace and Google Apps Script, which process your email address and this message. The code lasts 10 minutes and is bound to the requesting browser. The server stores only its hash, expiry and attempt count. The technical cookie __Host-pf-login lasts up to 10 minutes; __Host-pf-customer up to 7 days or until sign-out. Sessions expose only data assigned to the verified email. Abuse prevention stores hashed email/IP identifiers and counters valid for up to one hour. Expired challenges, sessions and counters are removed on the next available sign-in code request. Codes are not stored in the administrator email overview.