Privacy policy

PRIVACY POLICY

Last updated: 27.07.2026

This Privacy Policy explains how Tomaz Smrekar s.p., Slovenia, registration number 9696326000, ("we", "us", the "Controller") collects and processes personal data in connection with this online store, in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Slovenian law (ZVOP-2).

Contact of the Controller for data protection matters: info@unplugged-sleeve.com.

1. Personal Data We Process

a) Order and customer data. Name, delivery and billing address, email address, telephone number (where provided), order contents, order history. b) Payment data. Payments are processed by the payment service providers listed in Section 4. We do not receive or store full payment card numbers. c) Communications. Messages you send to us by email or through forms, and our responses.

d) Technical and usage data. IP address, device and browser information, pages visited, referral source, and events collected through cookies and similar technologies (Section 6).

We do not knowingly process personal data of children below the age of 15, and our services are not directed at them.

2. Purposes and Legal Bases

Purpose

Legal basis (GDPR)

Processing and delivering your order, handling returns and complaints

Art. 6(1)(b) — performance of a contract

Issuing invoices and retaining accounting records

Art. 6(1)(c) — legal obligation

Responding to enquiries

Art. 6(1)(b) or 6(1)(f) — legitimate interest

Fraud prevention and security of the store

Art. 6(1)(f) — legitimate interest

Analytics and advertising measurement (Meta Pixel)

Art. 6(1)(a) — consent

Email marketing (newsletter)

Art. 6(1)(a) — consent, revocable at any time

3. Data Retention

Order and invoicing data are retained for 10 years as required by Slovenian tax and accounting legislation. Marketing consents and related data are retained until consent is withdrawn. Technical and analytics data are retained in accordance with the cookie lifetimes in Section 6, and correspondence for as long as necessary for the purpose it was provided.

4. Recipients and Processors

We share personal data only with service providers necessary for operating the store, acting on our documented instructions:

  • Shopify International Ltd. / Shopify Inc. - e-commerce platform and hosting. Data may be transferred to affiliates in Canada and the United States.
  • Payment service providers - Shopify Payments (Shop Pay, Visa, Mastercard, American Express, Maestro, UnionPay, Apple Pay, Google Pay, Bancontact, BLIK, MobilePay) and Klarna, each processing payment data as independent controllers under their own privacy policies.
  • Pošta Slovenije d.o.o. and its international postal and courier partners - order delivery (name, address, telephone/email for delivery notifications).
  • Meta Platforms Ireland Ltd. - advertising measurement via Meta Pixel, only where you have given consent (Section 6). For the collection and transmission of event data, we and Meta act as joint controllers within the meaning of Art. 26 GDPR; further processing by Meta is governed by Meta's own privacy policy.

5. International Transfers

Where personal data are transferred outside the European Economic Area (in particular to Shopify Inc. and Meta Platforms, Inc. in the United States), such transfers are based on an adequacy decision of the European Commission (EU–U.S. Data Privacy Framework, where the recipient is certified) and/or the European Commission's Standard Contractual Clauses, together with supplementary measures where required.

6. Cookies and Similar Technologies

We use:

  • Strictly necessary cookies (Shopify) - shopping cart, checkout, security, localisation. Legal basis: legitimate interest; these cannot be disabled.
  • Analytics and marketing cookies (Shopify analytics, Meta Pixel) - set only with your prior consent, given via the cookie banner. You may withdraw or change your consent at any time via the cookie settings link in the footer of the store.

Refusing non-essential cookies does not affect your ability to use the store or place orders.

7. Your Rights

Subject to the conditions of the GDPR, you have the right to: access your personal data; rectification; erasure; restriction of processing; data portability; objection to processing based on legitimate interest; and withdrawal of consent at any time with effect for the future.

To exercise these rights, contact us at info@unplugged-sleeve.com. We will respond without undue delay and at the latest within one month.

You also have the right to lodge a complaint with the supervisory authority: Informacijski pooblaščenec Republike Slovenije, Dunajska cesta 22, 1000 Ljubljana, Slovenia, gp.ip@ip-rs.si, www.ip-rs.si.

8. Security

We implement appropriate technical and organisational measures to protect personal data, including encrypted transmission (TLS), access controls, and reliance on certified payment infrastructure. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. Automated Decision-Making

We do not use personal data for automated decision-making producing legal or similarly significant effects concerning you.

10. Changes to This Policy

We may update this Policy from time to time. The current version, with its effective date, is always published on this page. Material changes will be communicated in an appropriate manner.