DRAFT. Requires legal review before publication.

Privacy Policy (Draft)

Last updated: September 20, 2026

This Privacy Policy explains how Pawenn ("we", "us", or "our"), accessible at pawenn.com, processes information when you use our online pet services directory.

Pawenn is designed as a privacy-first, browse-first platform. You do not need to create an account, register, or provide personal details to search, filter, and discover pet care services in Bratislava.

1. Data Controller

The operator and data controller responsible for the processing of data on this website is:

• Entity / Operator: {OPERATOR}
• Registered Address: {ADDRESS}
• Contact Email: {EMAIL}

(Note: Legal entity details and official contact addresses will be completed upon formal operator establishment.)

2. Our Core Privacy Principles

1. No User Accounts: We do not offer or require user registration, profiles, or logins.
2. No Tracking Cookies: We do not deploy advertising cookies, remarketing trackers, or cross-site behavioral tracking scripts.
3. No Monetization of Personal Data: We do not sell, rent, or trade user data to third parties or data brokers.
4. Data Minimization: We collect only the minimal data strictly necessary to operate a functional directory and deliver transparent public information.

3. What Data We Process and Why

A. Anonymous Interaction & Click Tracking

When you interact with a business listing (for example, clicking to initiate a phone call, visit an external website, open navigation routes, or send an email), our server records an interaction event via an internal endpoint (/api/click).

• What is recorded: The type of interaction (CALL, WEB, ROUTE, EMAIL), the internal listing ID, the page from which the click originated, the referrer hostname, and the timestamp.
• What is NOT recorded: We do not record, capture, or store your IP address, browser fingerprint, or individual user identifier. No cookies are stored.
• Purpose: To calculate aggregate, anonymized referral metrics for local businesses and monitor directory performance.
• Legal Basis: Legitimate interests under Article 6(1)(f) GDPR (operating and evaluating the directory service).

B. Website Analytics

We utilize a privacy-respecting, cookieless web analytics solution (such as Plausible Analytics or Umami).

• Processing Details: Analytics scripts measure aggregate page visits, device types (mobile vs. desktop), and country-level geographic location without storing persistent identifiers or setting cookies on your device.
• Purpose: To understand aggregate platform usage and improve site responsiveness without personal profiling.
• Legal Basis: Legitimate interests under Article 6(1)(f) GDPR.

C. "Suggest an Edit / Add a Listing" Form

If you choose to submit a correction, update prices, or suggest a new pet care facility through our on-site submission forms, we collect:

• The business information provided (name, address, services, pricing).
• Any contact details you voluntarily provide (such as your name or email address) so we can verify the submission or confirm when the update is published.
• Purpose: Verifying directory accuracy and communicating regarding your update request.
• Legal Basis: Consent under Article 6(1)(a) GDPR and legitimate interest under Article 6(1)(f) GDPR in maintaining accurate, up-to-date directory information.

D. Public Business Directory Data

The directory contains business information regarding pet grooming salons, veterinary clinics, pet boarding hotels, training academies, and pet stores operating in Bratislava.

• Nature of Data: This information consists of publicly available business contact information (company trade name, commercial address, public business telephone, public business email, website URL, and publicly advertised service fees).
• Rights of Business Representatives: Business owners may claim, correct, update, or request the immediate removal of their business listing at any time by contacting {EMAIL}.

4. Legal Bases for Processing Under the GDPR

In accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR"), our processing of information is grounded on:

• Legitimate Interests (Art. 6(1)(f) GDPR): Delivering a reliable, functional public directory of local pet services; generating anonymous aggregate metrics; preventing malicious abuse; and ensuring website security.
• Consent (Art. 6(1)(a) GDPR): When you voluntarily provide personal contact information to submit a feedback form, update request, or business correction.

5. Data Retention Periods

• Anonymous Interaction Metrics: Aggregated statistical data (counts of calls, website clicks, route requests) is stored indefinitely in non-identifiable, aggregated form.
• Form Submissions & Correspondence: Communications and contact information submitted via feedback forms are retained only for as long as necessary to process the submission and verify data accuracy, after which correspondence is routinely archived or deleted.
• Public Business Listings: Business data is maintained for the duration of the business's active operation and is subject to re-verification every 90 days. A listing will be promptly modified or removed upon verified request from the business owner.

6. Recipients of Data and Third-Party Processors

We do not transfer your personal information to third parties, except for technical service providers (data processors) strictly necessary for hosting and delivering the platform:

• Hosting and Cloud Infrastructure: Platform hosting and CDN edge delivery (e.g., Vercel / Cloudflare).
• Database Infrastructure: Managed PostgreSQL database via Prisma Postgres (see docs/database.md).
• Analytics Provider: Cookieless analytics provider operating under GDPR-compliant EU data processing agreements.

All service providers process data strictly on our behalf under compliant Data Processing Agreements (DPAs).

7. Your Rights Under the GDPR

As a data subject within the European Union / European Economic Area, you hold the following statutory rights under the GDPR:

1. Right of Access (Art. 15 GDPR): The right to request confirmation of whether your personal data is processed and obtain a copy thereof.
2. Right to Rectification (Art. 16 GDPR): The right to have inaccurate or incomplete data corrected.
3. Right to Erasure (Art. 17 GDPR): The right to request the deletion of your personal data ("Right to be Forgotten").
4. Right to Restriction of Processing (Art. 18 GDPR): The right to restrict the processing of your data under statutory circumstances.
5. Right to Data Portability (Art. 20 GDPR): The right to receive personal data provided to us in a structured, commonly used, and machine-readable format.
6. Right to Object (Art. 21 GDPR): The right to object to processing based on legitimate interests.
7. Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us at {EMAIL}.

You also have the right to lodge a complaint with a supervisory authority. In the Slovak Republic, the relevant supervisory authority is:

• Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic)
• Hraničná 12, 820 07 Bratislava 27, Slovak Republic
• Website: https://dataprotection.gov.sk

8. Updates to This Policy

We may update this draft policy from time to time as platform features develop or following formal legal counsel. Any modifications will be reflected with an updated date at the top of this document.

9. Contact Us

If you have questions regarding this Privacy Policy or our data practices, please contact us at:

• Email: {EMAIL}