1. Who is responsible
The controller for the processing described here is Caps Island, Suché Mýto 19, 811 03 Bratislava, Slovakia, presented as part of Dessa Group. Contact for all privacy questions: hello@capsisland.com.
We have not appointed a data protection officer. Write to the address above for any request about your data.
2. What data we process
| Situation | Data | Source |
|---|---|---|
| Quote and contact forms | Full name, company, business e-mail, optional phone or WhatsApp number, country, optional company website, headwear category, style, quantity, material, branding, delivery destination, timeline, project description, the form you used and the page language | You |
| Files you attach | Logos, artwork, tech packs and reference images. They may contain personal data if you include it (for example a name on a design) | You |
| E-mail correspondence | Your e-mail address, the content of your messages and attachments | You |
| Website use with analytics consent | Pages viewed, referring page, approximate location (country or city), device, browser and operating system, interaction events such as opening the quote form or a confirmed quote request, and a pseudonymous identifier stored in cookies | Your browser, through Google Analytics |
| Every visit | IP address, date and time, requested page and browser information in server logs needed to deliver the site securely | Your browser |
We do not ask for special categories of personal data. Please do not include them in the form or in files.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your inquiry, preparing a quotation, samples and an order | Steps taken at your request before entering into a contract, and performance of a contract (Art. 6(1)(b)) |
| Keeping business correspondence, defending legal claims, preventing spam and abuse of the forms, keeping the website secure | Our legitimate interests (Art. 6(1)(f)) |
| Website statistics with Google Analytics | Your consent (Art. 6(1)(a) GDPR and § 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications) |
| Keeping accounting and tax records when an order is placed | Legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decision-making or profiling, we do not send newsletters, and we do not sell personal data.
4. Quote and contact forms
The forms on this site are delivered by Formspree (Formspree, Inc., USA), which receives the submission, including attached files, filters spam and forwards it to our mailbox. Formspree acts as our processor. Submissions and files are stored in our Formspree account and in our e-mail until we delete them.
Accepted files are PDF, JPG, PNG, WebP, SVG, AI, EPS and ZIP, up to 10 files and 25 MB per file. Files are used only to assess and carry out your project.
A hidden field helps Formspree recognise automated spam. If you submit the form, you confirm with the checkbox that you have read this policy.
5. Cookies, local storage and your choices
Necessary storage: when you make a choice in the cookie banner, the site stores that choice in your browser (local storage key ci-consent-v1) so it does not ask again. This is required to respect your choice and needs no consent.
Analytics cookies are used only after you click Accept analytics or switch analytics on under Manage preferences. Nothing from Google Analytics loads before that. You can change or withdraw your choice at any time with the Cookie preferences link in the footer; withdrawing stops collection immediately and deletes the analytics cookies on this domain.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| ci-consent-v1 (local storage) | Caps Island | Remembers your cookie choice | Until you clear browser data |
| _ga | Google Analytics | Distinguishes visitors (pseudonymous) | 2 years |
| _ga_3SCB6J92H4 | Google Analytics | Keeps the session state | 2 years |
6. Google Analytics
With your consent we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to understand which pages are useful and how visitors reach the quote form. We use Google Consent Mode: advertising storage, ad personalisation and user-data sharing for advertising stay switched off, and Google signals are disabled. Google Analytics 4 does not log or store IP addresses.
We record a quote-form opening and a confirmed quote request as events. These events contain only the form location, the page language and the headwear categories chosen, never your name, e-mail, message or files.
Google processes the data as our processor. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google's data processing terms include the European Commission's Standard Contractual Clauses. Google Analytics data is kept for the retention period set in our property (to be confirmed, see below) and then deleted.
7. Recipients and processors
- Formspree, Inc. (USA): form delivery and storage of submissions and attachments.
- Google Ireland Limited / Google LLC: website analytics, only with consent.
- Our website hosting provider: delivers the site and keeps short technical logs.
- Our e-mail provider: receives and stores correspondence.
- Production partners in Europe, carriers and customs agents, only as far as needed to make and deliver an order you place.
Where a processor is outside the European Economic Area, transfers rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.
8. How long we keep data
- Inquiries that do not lead to an order: deleted when they are no longer needed for follow-up, at the latest when the period confirmed by Caps Island expires.
- Order correspondence, quotations and invoices: as long as Slovak commercial and tax law requires.
- Analytics data: for the retention period of the Google Analytics property.
- Your cookie choice: until you change it or clear your browser data.
9. Security
The site is served only over HTTPS. Forms are sent encrypted to Formspree. Access to submissions and the mailbox is limited to the people handling inquiries. Uploaded files are never displayed or executed on this website.
10. Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict processing, to data portability, and to object to processing based on our legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal; for analytics use Cookie preferences in the footer.
To exercise your rights, write to hello@capsisland.com. We answer within one month, as required by Art. 12 GDPR.
11. Right to complain
You can complain to a data protection supervisory authority, in particular in the EU country where you live or work. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.
12. Changes to this policy
We update this policy when our processing changes, for example when a new service is added. The date at the top shows the current version.