Privacy Policy
Last updated: 17 October 2026
1. Controller
[Company legal name, s.p./d.o.o.], [Street and number], [Postal code] [City], Slovenia, VAT ID SI[00000000], e-mail marko.turnsek9@gmail.com, phone +386 (0)40 213 189 ("we"). We have not appointed a data protection officer as we are not required to; contact us at the e-mail above for any privacy question.
2. What we process and why
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Processing and delivering orders | name, e-mail, phone, delivery and billing address, ordered products | Art. 6(1)(b), contract | 2 years after delivery (warranty period) |
| Invoices and accounting | invoice data | Art. 6(1)(c), legal obligation (ZDDV-1, ZDavPR) | 10 years after the year of the invoice |
| Payments | payment status, last digits/brand of card (processed by Stripe) | Art. 6(1)(b) | as for invoices |
| Customer account and sign-in | e-mail, sign-in tokens, session cookie | Art. 6(1)(b) | until account deletion; tokens 20 minutes |
| Wholesale accounts | company data, VAT ID, VIES check result, contact person | Art. 6(1)(b) and (f), verification of business customers | duration of business relationship + 2 years |
| Withdrawals and complaints | declaration, order data | Art. 6(1)(c), consumer law | 2 years |
| Responding to enquiries | e-mail, message | Art. 6(1)(b)/(f) | 1 year |
| Security and abuse prevention | IP address, server logs | Art. 6(1)(f) | up to 30 days |
We do not use your data for automated decision-making or profiling. We send no marketing e-mails without your separate consent.
3. Recipients (processors)
We share data only as far as necessary with:
- Stripe Payments Europe Ltd. (Ireland): card payments; Stripe is an independent controller for fraud prevention and regulatory duties.
- Minimax d.o.o. (Slovenia): accounting and fiscally verified invoices; invoice data is transmitted to the Financial Administration of the Republic of Slovenia (FURS) as required by law.
- Vercel Inc. (hosting, servers in the EU, Frankfurt), Neon Inc. (database, EU region), Resend Inc. (sending e-mails).
- Delivery companies (GLS / Pošta Slovenije / DPD): name, address and phone for delivery.
- Our accountant, bound by confidentiality.
Some providers are established in the USA. Transfers are based on the EU–US Data Privacy Framework and/or Standard Contractual Clauses (Art. 46 GDPR).
4. Cookies
We use only strictly necessary cookies and local storage. Details: Cookie Policy.
5. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. Where processing is based on consent you may withdraw it at any time. Send requests to marko.turnsek9@gmail.com; we respond within one month.
You may lodge a complaint with the supervisory authority: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
6. Security
The site is served only over HTTPS. Card data is entered directly with Stripe (PCI DSS) and never reaches our servers. Access to customer data is limited to authorised persons.