Privacy Policy

Who We Are

The controller of your personal data is Martin Gallik – PUNXR, Zimná 1183/11, 059 01 Spišská Belá, Slovakia, IČO 57191000. For anything about your data, write to [email protected]. We have not appointed a data protection officer, as the law does not require one for us.

What We Process and Why

• •Orders and delivery: name, email, phone, delivery and billing address, chosen pickup point and order details. Legal basis: performing the contract (Art. 6(1)(b) GDPR).
• •Payment: payment status and method from Stripe. We never see your full card number. Legal basis: contract.
• •Invoices and accounting: order and billing data. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• •Customer account: email and password (stored only in hashed form), or your name and email from Google if you sign in with Google. Legal basis: contract.
• •Returns, complaints and support: your messages, photos you upload and the related order. Legal basis: contract and legal obligation.
• •Service emails: order confirmation, shipping and delivery updates, a reminder if you leave items in your cart, and a request to review your purchase. Legal basis: contract and our legitimate interest (Art. 6(1)(f) GDPR). You can object at any time.
• •Newsletter: your email, only if you sign up. Legal basis: consent (Art. 6(1)(a) GDPR). Unsubscribe at any time with the link in any email.
• •Visit statistics: our own cookies count visits and the country they come from, and remember which link or ad brought you here, without building a profile of you. Legal basis: legitimate interest.
• •Analytics: only with your consent, Microsoft Clarity records how the site is used (clicks, scrolling, pages viewed). Text you type is hidden. Legal basis: consent.
• •Advertising: only with your consent, the Meta Pixel measures which of our ads lead to visits and purchases. When you place an order, we also send Meta the order value with your email, phone, name and city in hashed (unreadable) form, to measure our ads (Meta Conversions API). Legal basis: legitimate interest. You can object at any time.

Who Receives Your Data

• •Stripe: online payments.
• •Packeta, GLS, DPD, InPost: delivering your parcel (name, address, phone, email).
• •Resend: sending our emails.
• •Hetzner (Germany): the servers our store runs on.
• •Cloudflare: website delivery, security and file storage.
• •Supabase: the database for our internal order overview.
• •Telegram: internal alerts about new orders and returns (your name and country).
• •Google: only if you sign in with Google.
• •Microsoft (Clarity) and Meta: only as described above.
• •Our accountant, and public authorities when the law requires it.
• •We never sell your personal data.

Transfers Outside the EU

Some of these providers (for example Stripe, Resend, Cloudflare, Supabase, Google, Microsoft, Meta and Telegram) may process data outside the EU, including in the USA. Such transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

How Long We Keep Data

• •Orders, invoices and accounting records: 10 years, as Slovak accounting and tax laws require.
• •Complaints and returns: until the legal guarantee and the limitation periods for claims end.
• •Customer account: until you delete it.
• •Newsletter: until you unsubscribe.
• •Cookies: as listed in our Cookie Policy.

Your Rights

• •Access your data, have it corrected or deleted, restrict its use, and receive it in a portable format.
• •Object at any time to processing based on our legitimate interest, including direct marketing.
• •Withdraw your consent at any time. This does not affect processing done before.
• •Lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk, or with the authority in your own country.
• •To use your rights, write to [email protected]. We reply within one month.

Automated Decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Data Security

We use encrypted connections (HTTPS), store passwords only in hashed form, and limit access to your data to the seller and the providers listed above. If a data breach happens, we inform you and the authorities when the law requires it.

Changes to This Policy

We may update this policy. The date at the top shows the current version. If a change significantly affects how we use your data, we will tell you.