Privacy policy

Who we are (controller)

The data controller is:

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR).

What data we process

• Identification & contact — name, e-mail, phone, shipping and billing address; for business purchases the company name and tax IDs.
• Order data — order contents, price, delivery and payment method, order note, purchase history, order-related communication (incl. withdrawals and complaints).
• Payment data — information needed to process the payment; card details are entered directly with the GP webpay gateway (Global Payments) and are never stored by or accessible to us.
• Account data — login details, saved addresses, watched products (availability/price watchdog).
• Reviews — review text, rating and any photos you volunteer.
• Technical data — IP address, device/browser type, cookies and similar identifiers (section 10).
• Facebook/Google login data — your name and e-mail address (section 4).

Purposes & legal bases

• Order fulfilment, delivery, withdrawals and complaints — performance of a contract (Art. 6(1)(b) GDPR).
• Accounting & tax (invoices) — legal obligation (Art. 6(1)(c) GDPR).
• Customer account, support, availability watchdog — contract / legitimate interest (Art. 6(1)(b), (f) GDPR).
• Newsletter — your consent (Art. 6(1)(a) GDPR), given by submitting the signup form; we do not send a confirmation (double-opt-in) e-mail. You can withdraw consent at any time via the link in every e-mail.
• E-mails to existing customers (similar-product offers, review invitations, abandoned-cart reminders after you enter your e-mail) — legitimate interest (Art. 6(1)(f) GDPR) in conjunction with Section 116 of Slovak Act No. 452/2021 Coll. on electronic communications; opt out at any time via the link in the e-mail.
• Publishing reviews — consent expressed by submitting them (Art. 6(1)(a) GDPR); reviews are published with your first name.
• Analytics & marketing cookies — consent given in the cookie banner (Art. 6(1)(a) GDPR).
• Fraud prevention, security, defence of claims — legitimate interest (Art. 6(1)(f) GDPR).

Sign in with Facebook and Google

If you use “Sign in with Facebook” or “Sign in with Google”, we receive your name and e-mail address from that service so we can log you in or create an account. We do not receive your password or friends list and we never post to your profile. You can unlink the account in your Facebook/Google settings or ask us to delete your data (section 9).

Who we share data with

We never sell your data. We share it only with recipients that help us run the shop, to the extent necessary:

• Hosting & infrastructure — Hetzner Online GmbH (Germany; servers running the e-shop and its database) and netcup GmbH (Germany; server infrastructure and backups). Data is stored exclusively in EU data centres; a data processing agreement under Art. 28 GDPR is in place with both providers.
• Carriers — Packeta Slovakia s. r. o. and Direct Parcel Distribution SK s.r.o. (DPD) — delivery details.
• GP webpay payment gateway (Global Payments s.r.o.) — online payments; for card payments it acts as an independent controller of payment data. Banks — transfers.
• E-mail services — Websupport, s.r.o. (SMTP for transactional e-mail) and ECOMAIL.CZ, s.r.o. (newsletters and marketing e-mails).
• Analytics & advertising — Google Ireland Ltd. (Google Analytics 4) and Meta Platforms Ireland Ltd. (Meta Pixel/Conversions API) — only with cookie consent (section 10).
• Address suggestions — Google Ireland Ltd. (Google Places) — text typed into the checkout address field is sent to fetch suggestions; nothing is stored.
• Cookie consent management — Cookie-Script (Objectis, UAB).
• Hosting & IT — the cloud infrastructure provider and persons developing and maintaining the shop.
• Accounting — accounting software and our accountant.

Transfers outside the EU

Some providers (notably Google and Meta) may process data outside the EU/EEA, mainly in the USA. Transfers are protected by appropriate GDPR safeguards — the adequacy decision for the EU-U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

Retention

• Orders and related communication — for the duration of defect liability and limitation periods (usually 4 years from purchase).
• Invoices and accounting records — 10 years (accounting and VAT law).
• Customer account — until deleted.
• Newsletter and marketing — until consent is withdrawn or you object.
• Reviews — while the product is published, or until consent is withdrawn.
• Cookies — per each cookie’s lifetime (section 10).

Your rights

Under the GDPR you have the right to access, rectification, erasure (“right to be forgotten”), restriction, data portability, to object to processing based on legitimate interest and to direct marketing, and to withdraw consent at any time. Exercise them by e-mailing [email protected]. You may also lodge a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk).

Data deletion

You can request deletion of your personal data (including data obtained via Facebook or Google login) at any time by e-mailing [email protected] with the subject “Data deletion”. We handle requests without undue delay, within 30 days at the latest; data we must retain by law (e.g. issued invoices) is deleted after the statutory period.

Cookies

The site uses cookies and similar technologies in three categories: necessary (cart, login, saved consent — always on), statistics (Google Analytics 4) and marketing (Meta Pixel, Ecomail) — the latter two are loaded only with your consent given in the cookie banner (Cookie-Script); you can change your choice at any time. Refusing consent does not limit your purchase. Full details — the individual tools, cookie lifetimes and how to change your consent — are in the separate Cookie Policy.

Changes

We may update this policy; the current version is always available on this page with its effective date.