Privacy Policy
Draft for legal review. This text is not final. Items marked [JP] are facts the business must supply; items marked [odvetnik] need the lawyer.
GDPR art. 13 and 14 information. Must be checked against the real data flows of the shop and the apps installed. [odvetnik] [JP] (list of apps and processors in use at launch)
1. Controller
Hit Preless d.o.o., Žlebe 1, 1215 Medvode, Slovenia. Email for privacy requests: [JP]. Data protection officer: [JP] [odvetnik] (whether one is required).
2. What we process, why, and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Orders, payment, delivery, subscription | name, address, email, phone [JP], order details, payment status | art. 6(1)(b) contract |
| Accounting and tax duties | invoices and order records | art. 6(1)(c) legal obligation |
| Customer service | messages, order history | art. 6(1)(b) and (f) |
| Cancellation and withdrawal forms | name, email, contract or order reference, statement, time stamp | art. 6(1)(b) and (c) |
| Newsletter and offers by email | email, name [JP] | art. 6(1)(a) consent (or DE UWG § 7(3) for existing customers) [odvetnik] |
| Fraud prevention in payments | technical data from the payment provider | art. 6(1)(f) |
| Analytics and advertising measurement | cookie and device data | art. 6(1)(a) consent, see Cookie Policy |
[odvetnik] Check every row against the real set-up before release.
3. Recipients
- Shopify (shop platform, hosting, checkout). Shopify International Ltd (Ireland) and Shopify Inc. (Canada, United States) [odvetnik] (role and contract; data transfers)
- Payment providers: [JP]
- Carriers and fulfilment partner: [JP] (names or categories)
- Email and subscription apps: [JP]
- Tax advisers, accountants, IT support under contract. [JP]
4. Transfers outside the EEA
[odvetnik] Transfer tools in use (EU-US Data Privacy Framework for Shopify and others, standard contractual clauses) and the way to obtain a copy.
5. Retention
[JP] [odvetnik] Periods per category (for example: order and invoice data as required by tax law; account data until deletion; marketing consent until withdrawn).
6. Your rights
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent at any time, and the right to complain to a supervisory authority. For Slovenia the authority is the Information Commissioner (Informacijski pooblaščenec). You can also complain in the country where you live. [odvetnik] (add DE/AT/HR authorities as needed)
7. Obligation to provide data
Name, delivery address and email are required to deliver your order. Without them we cannot conclude the contract.
8. Automated decisions
We do not make decisions based solely on automated processing that produce legal effects on you. [JP] [odvetnik] (confirm; check fraud tools)
9. Contact forms and sending
Data you type into the cancellation, withdrawal and contact forms is sent to us by email and used only to handle your request.
Last updated: [JP]
