Legal
Privacy Policy
This Privacy Policy explains how Pritrdi.me ("we", "us", "our") collects, uses, and protects your personal data when you visit our website or place an order. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Slovenian data protection law.
1. Data Controller
If you have any questions about how we handle your data, you can contact us at the email address above at any time.
2. Data We Collect
When you place an order, we collect the following personal data:
- Full name - required to process and address your order
- Phone number - required so we can contact you about delivery
- Email address - optional; used to send order confirmation if provided
- Shipping address - required to deliver your order
- Order details - product, quantity, payment method, discount code, order status history
- Tracking code - a randomly generated reference for your order
We do not collect payment card details directly. Card payments are processed entirely by Stripe, Inc. (see Section 6).
We do not use advertising tracking pixels, third-party analytics, or behavioral profiling.
3. Purpose and Legal Basis
- Contract performance (GDPR Art. 6(1)(b)) - Processing your name, phone, address, and order details is necessary to fulfil your order, arrange delivery, and handle returns or queries.
- Legal obligation (GDPR Art. 6(1)(c)) - We may retain certain order records as required by Slovenian accounting and tax law.
- Legitimate interests (GDPR Art. 6(1)(f)) - We maintain server logs for security and fraud prevention purposes.
We do not process your data on the basis of consent. If you provide your email address voluntarily, we use it solely to communicate about your specific order.
4. How We Use Your Data
- Fulfilling and shipping your order
- Contacting you about your order status or delivery
- Handling returns, refunds, or support requests
- Meeting our legal accounting and tax obligations
- Detecting and preventing fraud
We do not sell, rent, or share your data with third parties for marketing purposes.
5. Data Retention
- Order records - retained for a minimum of 5 years as required by Slovenian tax law (ZDavP-2).
- Support communications - retained for up to 2 years after resolution.
- Server logs - retained for up to 30 days.
After the applicable retention period, your data is deleted or anonymised.
6. Third-Party Processors
Stripe, Inc.
If you pay by card, your payment is processed by Stripe, Inc. (San Francisco, CA, USA). Stripe operates as an independent data controller for your payment data. Stripe is certified under the EU-US Data Privacy Framework and complies with PCI DSS standards. We never receive or store your full card number. See stripe.com/privacy.
Hosting
Our website and order database are hosted on infrastructure we control within the European Union. Order data is stored in an SQLite database on our own server and is not replicated to third-party cloud services.
7. Cookies and Local Storage
We use sessionStorage (a browser feature similar to cookies) solely to maintain your shopping cart and admin session during your visit. No data is sent to third-party servers from this storage.
Stripe.js sets cookies on the payment page to detect fraud. These are strictly necessary for payment processing and cannot be disabled when using card payment.
We do not use advertising cookies, analytics cookies, or cross-site tracking. See our Cookie Policy for full details.
8. International Transfers
Your data is stored and processed within the EU. If you pay by card, Stripe may process transaction data in the United States under adequate safeguards (EU-US Data Privacy Framework and Standard Contractual Clauses).
9. Your Rights Under GDPR
You have the following rights regarding your personal data:
- Right of access - You may request a copy of the personal data we hold about you.
- Right to rectification - You may ask us to correct inaccurate data.
- Right to erasure - You may request deletion of your data, subject to our legal retention obligations.
- Right to restriction - You may ask us to restrict processing in certain circumstances.
- Right to data portability - You may request your order data in a machine-readable format (CSV).
- Right to object - You may object to processing based on legitimate interests.
- Right to lodge a complaint - You may lodge a complaint with the Slovenian Information Commissioner (ip-rs.si) or another EU supervisory authority.
To exercise any of these rights, contact us at info@pritrdi.me. We will respond within 30 days.
10. Data Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include HTTPS encryption for all data in transit, bcrypt password hashing for admin credentials, JWT-based session management with short expiry, and server-side rate limiting.
11. Children's Privacy
Our website is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Material changes will be highlighted for 30 days. Continued use of our site after changes constitutes acceptance of the updated policy.
13. Contact
For any privacy-related questions or requests: