Pravilnik o zasebnosti

1. Who we are

The controller responsible for your personal data is:

We have not appointed a Data Protection Officer. Privacy questions and requests should be sent to the email address above.

2. Personal data we collect

Depending on how you use the website, we may collect:

• Order and account data: name, email address, telephone number, billing and delivery addresses, account login details, order history, products, preferences and customer-service correspondence.
• Payment data: payment status, payment method and transaction references. Payments are processed by Stripe or PayPal. We do not see or store complete card details.
• Contact and enquiry data: information you provide through WPForms, including general and corporate-gift enquiries.
• Review data: your name or display name, rating, review, product purchased and any other information you choose to submit.
• Incomplete checkout data: information entered during checkout and technical information needed to identify and maintain the incomplete cart. We do not send abandoned-cart recovery emails.
• Newsletter data: email address, subscription status and evidence of consent, such as the date and source of sign-up.
• Device and usage data: IP address, browser and device information, pages viewed, referring page, approximate location, cookie identifiers and interactions with the website.
• Security and technical logs: information generated by our hosting, security, CDN and anti-spam systems.

3. Why we use personal data

We process personal data for the following purposes and legal bases:

• Orders, delivery, returns and customer accounts: to perform our contract with you or take steps at your request before entering into a contract.
• Payments: to process and confirm transactions and meet contractual and legal obligations.
• Customer support and corporate-gift enquiries: to respond to your request, take pre-contractual steps and pursue our legitimate interest in providing customer service and developing our business.
• Accounting, tax, legal claims and compliance: to comply with legal obligations and establish, exercise or defend legal claims.
• Website operation and security: to protect the website, prevent misuse, troubleshoot problems and maintain service reliability based on our legitimate interests and legal obligations.
• Incomplete carts: to maintain checkout functionality and diagnose checkout problems based on our legitimate interest in operating the store. Incomplete-cart data is retained for no more than 90 days and is not used for recovery emails.
• Product reviews: to publish and manage genuine customer feedback based on your submission and our legitimate interest in informing customers and improving our products.
• Newsletters: only with your consent. You can withdraw consent at any time by using the unsubscribe link in each email or contacting us.
• Analytics, advertising and retargeting: only after you consent through CookieYes. This includes Google Analytics 4, Google Ads and Meta Pixel. You can withdraw or change your cookie choices at any time through Cookie Settings.

Where we rely on legitimate interests, we consider the impact on your rights and use personal data only where our interests are not overridden by your interests or fundamental rights.

4. Cookies and similar technologies

The website uses cookies and similar technologies. Strictly necessary technologies support functions such as the shopping cart, checkout, account login, security and consent management. Other technologies, including analytics and advertising cookies, are used only after consent.

CookieYes records and manages your choices. Google Analytics 4, Google Ads and Meta Pixel must remain blocked until the relevant consent is provided. You may change or withdraw consent at any time through the Cookie Settings link or consent banner. Withdrawing consent does not affect processing that took place before withdrawal.

For details about individual cookies, providers and durations, please see our Cookie Policy and Cookie Settings.

5. Who receives personal data

We share personal data only where necessary with the following categories of recipients:

• Hosting, email, backup and infrastructure: Neoserv and Cloudflare.
• Payments: Stripe and PayPal. Apple Pay and Google Pay transactions are processed through Stripe when selected.
• Delivery: GLS, FedEx and Pošta Slovenije, depending on the destination and selected service.
• Analytics and advertising: Google and Meta, but only after the required consent.
• Spam protection: Google reCAPTCHA v2 on forms.
• Website and store tools: WordPress, WooCommerce, WPForms, CookieYes, CartFlows, The Newsletter Plugin and Really Simple Security, to the extent these tools process or store data for the functions described in this policy.
• Professional and public authorities: advisers, courts, regulators, tax authorities, law enforcement or other public bodies where required by law or necessary to protect legal rights.

Service providers may process personal data only for the services they provide to us and under applicable contractual and legal safeguards.

6. International transfers

Some providers, including Google, Meta, Stripe, PayPal and Cloudflare, may process data outside Slovenia or the European Economic Area. Where required, such transfers are protected by an adequacy decision, the European Commission's Standard Contractual Clauses or another lawful transfer mechanism. More information about the safeguards used by a provider is available in that provider's privacy documentation or from us on request.

7. How long we keep personal data

We keep personal data only for as long as necessary for the purpose for which it was collected and to meet legal obligations:

8. Your rights

Subject to the conditions in applicable law, you may have the right to:

• request access to your personal data;
• correct inaccurate or incomplete data;
• request deletion of your data;
• restrict processing;
• object to processing based on legitimate interests or to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time, without affecting earlier lawful processing; and
• lodge a complaint with a supervisory authority.

To exercise a right, contact [email protected]. We may ask for information needed to confirm your identity. We normally respond within one month, subject to any extension permitted by law.

You may lodge a complaint with:

9. Security

We use appropriate technical and organisational measures designed to protect personal data. These include encrypted HTTPS connections using a Let's Encrypt certificate, access controls, hosting and backup measures, Cloudflare services, security tooling and reCAPTCHA v2 on forms. No online system is completely secure, and we cannot guarantee absolute security.

10. Children

The website is not intended for children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us so we can review and delete it where appropriate.

11. Automated decisions and sale of data

We do not make decisions producing legal or similarly significant effects solely by automated means. We do not sell personal data.

12. Changes to this policy

We may update this Privacy Policy when our services, providers or legal obligations change. The latest version will be published on this page with a revised "Last updated" date. Where appropriate, we will provide additional notice of material changes.

13. Contact

For privacy questions or requests, contact: