Privacy Policy

1. Data Controller

The data controller for the processing of data on this website is:

Igor Knez s.p. — Tepih center Knez
Cesta na Ostrožno 150b
3000 Celje, Slovenia
Email: info@vsemoraven.si
Phone: +386 41 736 120

2. Data Protection Officer

A data protection officer has not been appointed as the legal requirements for this do not apply.

3. Types of Data Processed

We process the following personal data:

• Master data: Name, address, email address, phone number
• Order data: ordered products, order date, order status
• Payment data: payment method, transaction IDs (credit card data is processed exclusively by the payment service provider)
• Usage data: IP address, browser type, operating system, referrer URL, access times
• Communication data: content of enquiries via email or contact form

4. Purpose of Processing

The processing of personal data is carried out exclusively for the following purposes:

• Processing of orders and deliveries (Art. 6(1)(b) GDPR)
• Customer communication and support (Art. 6(1)(b) GDPR)
• Fulfilment of legal obligations, in particular tax and commercial law retention obligations (Art. 6(1)(c) GDPR)
• Website analysis and optimisation based on legitimate interests (Art. 6(1)(f) GDPR)
• Newsletter dispatch upon consent (Art. 6(1)(a) GDPR)

5. Cookies

Our website uses cookies. These are small text files that are stored on your device.

Technically necessary cookies: These cookies are required for the operation of the website (e.g. shopping cart, session). Legal basis: Art. 6(1)(f) GDPR.

Analytics cookies: These cookies are only set with your consent and are used to analyse user behaviour. Legal basis: Art. 6(1)(a) GDPR. You may revoke your consent at any time via the cookie banner.

6. Google Analytics

This website does not currently use Google Analytics. Should a web analytics service be used in the future, this section will be updated accordingly, and use will only occur with your prior consent.

This website may use Google Analytics, a web analytics service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Use is only with your prior consent via the cookie banner.

Google Analytics uses cookies that enable analysis of website usage. The IP address is anonymised (IP masking). The information generated is usually transferred to a Google server and stored there.

Legal basis: Art. 6(1)(a) GDPR (consent).

7. Payment Service Providers

We use the following payment service providers:

Stripe

Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When paying by credit card, your payment data is transmitted directly to Stripe. Stripe is PCI-DSS certified.
Privacy policy: https://stripe.com/privacy

PayPal

Provider: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
Privacy policy: https://www.paypal.com/privacy

Klarna

Provider: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.
Privacy policy: https://www.klarna.com/datenschutz

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

8. Newsletter

When you subscribe to our newsletter, we process your email address for the purpose of sending the newsletter. Registration is done via a double opt-in procedure.

You may revoke your consent at any time, e.g. via the unsubscribe link in each newsletter. Legal basis: Art. 6(1)(a) GDPR.

The newsletter is sent via the shop's own infrastructure.

9. Hosting

This website is hosted by Vercel Inc., 440 N Barranca Ave, Covina, CA 91723, USA.

Vercel participates in the EU-US Data Privacy Framework. Data transfers to the USA are based on the adequacy decision of the European Commission (Art. 45 GDPR). In addition, Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR are in place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a reliable presentation of the website).

10. Your Rights

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Competent supervisory authority in Slovenia:
Informacijski pooblaščenec
Dunajska cesta 22, 1000 Ljubljana
www.ip-rs.si

11. Data Retention Period

Personal data is deleted once the purpose of storage no longer applies, unless statutory retention periods preclude deletion (e.g. commercial and tax law retention obligations of up to 10 years).

12. SSL / TLS Encryption

This website uses SSL/TLS encryption for security reasons. You can recognise an encrypted connection by the browser's address bar changing from "http://" to "https://" and by the lock symbol in your browser bar.