Privacy Policy.

1. Controller

GALILEON, razvoj naprednih tehnologij, d.o.o., Ulica Koroškega bataljona 26, 1231 Ljubljana - Črnuče, Slovenia (registration no. 7544383000, tax no. 95297804) is the controller of personal data described in this policy. Contact: info@galileon.si. We have not appointed a Data Protection Officer, as we fall below the threshold in Art. 37 GDPR that would require one; all privacy requests and questions can be sent to info@galileon.si.

2. Scope

This policy covers this marketing website (galileon.si). For customers using the SolveR product, Galileon processes case content (uploads, 8D records, analysis data) as a processor on the customer's behalf, under the data processing agreement that comes with the pilot or subscription contract; that processing is governed by those agreements, not this policy. We never use customer data to train AI models, and we never sell it.

3. What we process today

• If you write to us at info@galileon.si, we process your name, your email address and the content of your message in order to answer you. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) or pre-contractual steps (Art. 6(1)(b)).
• When you book a Discovery Session, Calendly LLC, acting as our processor, collects the details you enter: name, email address, chosen time and any optional notes. Calendly is a US provider, and transfers are safeguarded by the EU-US Data Privacy Framework and/or Standard Contractual Clauses. See Calendly's privacy notice. Legal basis: pre-contractual steps (Art. 6(1)(b)).
• The site is served from Amazon Web Services: the files sit in Amazon S3 in the Europe (Ireland) region and are delivered through the Amazon CloudFront content delivery network. Our provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, acting as our processor. CloudFront has edge locations worldwide, so a request may be served from outside the EU or EEA; such transfers are safeguarded by the EU-US Data Privacy Framework and/or Standard Contractual Clauses. AWS processes your IP address and request metadata as technically necessary to deliver the site, and keeps standard short-lived access logs. Legal basis: legitimate interest in operating and securing the site (Art. 6(1)(f)).
• Fonts are self-hosted on our own infrastructure, so loading this site sends no font request to Google or any other third party.
• Only if you accept analytics cookies in the cookie banner: Google Analytics 4 (Google Ireland Limited, as our processor) collects aggregate usage statistics, pages viewed, approximate country, device and browser type, which call to action buttons are clicked and when a Discovery Session is booked, with your IP address truncated before storage. Google may transfer data to the United States, safeguarded by the EU-US Data Privacy Framework and Standard Contractual Clauses. Nothing is loaded and no request reaches Google until you accept. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via Cookie Settings in the footer. See Google's privacy information.

We set no advertising or profiling cookies; see the Cookie Policy.

4. Processing we intend to add

The following is planned. It will only start after this policy is updated and, where required, your consent has been collected first.

• Email capture for resource downloads and newsletter updates, on the basis of your explicit opt-in.

5. Recipients

We share personal data only with the processors named above (Calendly, Amazon Web Services, Google) and only as needed for the purposes described. We do not sell personal data and do not share it with advertisers.

6. Retention

We keep personal data only as long as needed for the purpose it was collected for:

• Email correspondence in our email inboxes: up to 24 months after our last contact with you, then deleted.
• Booking data (Calendly and our own calendar): up to 24 months after the meeting.
• Hosting and CDN access logs (Amazon Web Services, including IP addresses): short-lived, kept by our hosting provider under its standard log-retention policy.
• Google Analytics 4: user and event data are retained for 14 months.

7. Your rights

Under the GDPR you can request access, rectification, erasure, restriction of processing, data portability, and object to processing based on legitimate interest; where processing is based on consent, you can withdraw it at any time without affecting prior processing. Write to info@galileon.si. You also have the right to lodge a complaint with the Slovenian supervisory authority: Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.

8. Changes

We will update this policy before any planned processing goes live and revise the "last updated" date. Material changes will be highlighted on this page.