Privacy Policy

1. Data controller

The controller who determines the purposes and means of processing your personal data is:

Given the scope and nature of the processing, the controller is not required to appoint a Data Protection Officer (DPO). For any matter concerning the processing of your personal data, please contact us using the details above.

2. What personal data we process

We process only the personal data you provide to us yourself or that arises from your purchase and communication with us. This mainly covers the following categories:

• Identification and contact data — first name and surname, delivery and billing address, e-mail address, telephone number; for business customers also Company ID, Tax ID and VAT ID.
• Order and payment data — the ordered goods, order value and number, delivery and payment method, purchase history, and data needed to issue an invoice or handle a complaint.
• Communication — the content of messages, e-mails and phone calls you exchange with us (e.g. enquiries, complaints, returns).
• Website usage data — IP address, browser and device type, pages visited and cookies – to the extent and under the conditions set out in the Cookie Policy.

We do not process special categories of personal data (e.g. data on health, religion or political opinions) and we do not knowingly process personal data of persons under 16 years of age.

3. Purposes and legal bases of processing

We always process your personal data for a specific purpose and on one of the legal bases under Article 6 GDPR:

• Processing your order and performing the contract — processing and delivering your order, communicating about its status, returns and withdrawal from the contract. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Compliance with legal obligations — issuing and archiving invoices and accounting documents, handling complaints, and meeting obligations under tax and accounting law. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Sending newsletters — sending commercial messages and offers to your e-mail if you have subscribed to them. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Legitimate interests of the controller — improving our services and website, basic analytics, ensuring security, preventing fraud, and establishing or defending legal claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Cookies and marketing tools — we use analytics and marketing cookies only with your consent given through the cookie banner. Legal basis: consent (Art. 6(1)(a) GDPR).

Providing the data needed to process your order is a contractual requirement – without it we cannot process and deliver your order. Providing data for marketing purposes is voluntary and does not affect your ability to shop with us.

4. How long we keep your data

We keep personal data only for as long as necessary to achieve the purpose for which it was obtained, or for the period required by law:

• Order and invoice data — for the period required by accounting and tax law, generally 10 years.
• Complaint-handling data — for the duration of the warranty period and then for the time needed to demonstrate that we have met our obligations.
• Data processed on the basis of consent (newsletter) — until consent is withdrawn, and at most for the period for which consent was granted.
• Cookie data — for the period stated in the Cookie Policy.

Once the relevant period expires, we securely delete or anonymise the personal data.

5. Whom we share your data with (recipients)

We do not sell your personal data. We share it only to the extent necessary with trusted partners (processors) who process it for us under a contract and solely on our instructions:

• Carriers and delivery companies — Packeta, GLS, Slovak Post and DPD – to deliver your ordered goods.
• Payment service providers — GoPay and PayPal – to securely process online payments.
• Accounting and invoicing services — the provider of our invoicing system (e.g. SuperFaktura or iDoklad) and our accountant.
• IT and hosting providers — the provider of the servers and cloud storage on which the online store runs.
• E-mail and analytics tools — tools for sending e-mails and measuring website traffic (analytics and marketing only to the extent of the consent granted).

We may also disclose personal data to public authorities where required by law (e.g. the tax office, courts, or law-enforcement bodies).

6. Transfers to third countries

We process your personal data primarily within the European Union and the European Economic Area (EU/EEA). However, some of our providers (e.g. analytics or e-mail delivery tools) may process data outside the EU/EEA. In that case we ensure an adequate level of protection – either on the basis of a European Commission adequacy decision, or through Standard Contractual Clauses approved by the European Commission, or other safeguards under the GDPR.

7. Cookies and analytics

We use cookies and similar technologies on our website. Necessary cookies are required for the online store to work correctly; analytics and marketing cookies are used only with your consent, which you can change or withdraw at any time. Details of the cookies we use can be found in the Cookie Policy.

8. Your rights

In connection with the processing of personal data, you have the following rights under the GDPR, which you can exercise with us at any time:

• Right of access — to obtain confirmation of whether we process your data and a copy of that data.
• Right to rectification — to have inaccurate data corrected or incomplete data completed.
• Right to erasure ("right to be forgotten") — to have your data deleted where it is no longer needed or where you withdraw consent and no other legal basis exists.
• Right to restriction of processing — to request that the processing of your data be temporarily restricted.
• Right to data portability — to receive the data you provided to us in a structured, commonly used and machine-readable format.
• Right to object — to object to processing based on legitimate interest, as well as to direct marketing.
• Right to withdraw consent — to withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
• Right to lodge a complaint — to contact the supervisory authority (see below).

You can send a request to exercise your rights by e-mail to vrobel.andrej@orava.sk or by post to the place of business. We will respond within one month of receiving your request at the latest. Exercising your rights is free of charge.

9. Right to lodge a complaint with the supervisory authority

If you believe that the processing of your personal data breaches the law, you have the right to lodge a complaint with the supervisory authority. In Slovakia this is:

If you are located in another EU Member State, you may also contact the supervisory authority in your country of habitual residence – for example, in the Czech Republic the Office for Personal Data Protection (www.uoou.cz) and in Poland the President of the Personal Data Protection Office (www.uodo.gov.pl).

10. Security of personal data

We have implemented appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, destruction or loss – in particular encrypted data transmission (HTTPS), access-rights management, regular backups, and careful selection of processors that provide sufficient guarantees of protection.

11. Automated decision-making and profiling

When processing your personal data, we do not carry out automated decision-making, including profiling, that would have legal effects on you or similarly significantly affect you.

12. Changes to this policy

We may update this policy from time to time, for example when the law or the way we process personal data changes. The current version is always available on this page, together with its effective date.