Privacy policy

Who processes your data

The controller who determines why and how your personal data are processed is Paatchi s.r.o., registered office Podkerepušky 2717/32, 841 06 Bratislava, Slovak Republic, company ID (IČO): 52 867 196, tax ID (DIČ): 2121188212.

• For any data protection matters, contact us at [email protected] or by phone at +421 911 86 86 06.
• We have not appointed a data protection officer (DPO) — the law does not require it, as we do not process special categories of data or carry out large-scale systematic monitoring.

What data we process

• Identification and contact data: first and last name, e-mail address, phone number.
• Delivery data: delivery address or the selected pickup point.
• Billing data: billing address and, for business customers, company name, company ID, tax ID and VAT ID.
• Order data: ordered goods, amount, shipping and payment method, communication about the order.
• Account data, if you create an account: e-mail, hashed password, saved addresses and order history.
• Technical data: IP address and login records that help us protect against misuse.
• Product review, if you choose to write one: name (or its shortened form), number of stars and text.
• We neither see nor store card payment data — they are processed directly by the payment gateway.

Why we process data and for how long

For each purpose we state the legal basis under Art. 6 GDPR and the period after which we delete the data.

Who we share data with

We do not sell data. We share it only with those without whom we could not handle your order, and always only to the necessary extent. Processors handle data solely on our instructions under a contract pursuant to Art. 28 GDPR.

• Carriers delivering the parcel (Packeta, DPD) — name, address or pickup point, phone and e-mail for delivery notifications.
• Payment gateway for card payments (Stripe) — data needed for the payment; the card number never reaches us.
• The bank whose account you pay to by transfer (Fio banka) — data stated in the payment order.
• Hosting provider on whose servers the shop and database run (DigitalOcean, data centre in Frankfurt).
• E-mail service provider through which we send order confirmations, verification codes and the newsletter (Brevo, France).
• Mailbox provider receiving your correspondence (Migadu, Switzerland).
• Provider of website protection and checking that a form is filled in by a human (Cloudflare).
• When buying as a business: public company registers (Slovak RPO register, Czech ARES register) to look up the company by its ID, and the European Commission (VAT ID check in the VIES system).
• Accountant — accounting documents for bookkeeping.
• Public authorities, where required by law.

Transfers outside the European Union

• We process your data in the European Union. The shop's servers are in Frankfurt.
• Some suppliers are companies based in the USA (DigitalOcean, Stripe, Cloudflare). Transfers are safeguarded by their certification under the EU–US Data Privacy Framework or by standard contractual clauses approved by the European Commission.
• The mailbox provider is based in Switzerland, for which the European Commission has issued an adequacy decision.

Cookies

We use only strictly necessary cookies and data stored in your browser without which shopping would not work. They do not require consent (Section 109(8) of Slovak Electronic Communications Act No. 452/2021). We use no analytics or marketing cookies and no advertising pixels.

• The shop's browser storage: cart contents (until you complete the purchase), login to your account (until you log out), a remembered device so we do not have to send a verification code at every login (90 days), checkout details you have typed in (only until you close the browser tab; the password and card details are never stored) and whether you have closed the notice about the shop's new address (also only until you close the tab).
• Cloudflare, through which our website runs — tells humans from automated bots and protects the website against attacks (short-term, at most half an hour).
• Stripe payment gateway, only at checkout — protection of card payments against fraud (at most 1 year).
• At registration the “I am not a robot” check (Cloudflare Turnstile) and, when choosing a pickup point, the Packeta map. They run in the provider's window and are governed by its policies.
• Should we introduce analytics or advertising cookies in the future, we will ask for your consent in advance.
• You can delete or block cookies in your browser settings; without the necessary ones, however, shopping will not work.

Your rights

As a data subject, you have the following rights under Art. 15 to 22 GDPR. You can exercise them by writing to [email protected] and we will handle your request within one month.

• Right of access — to find out what data we process about you and receive a copy.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) where we no longer need the data and no legal obligation prevents it, such as archiving invoices.
• Right to restriction of processing.
• Right to data portability — to receive your data in a commonly used format or have it transferred to another controller.
• Right to object to processing based on legitimate interest and to object to direct marketing at any time.
• Right to withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before it.
• Right to lodge a complaint with a supervisory authority: our competent authority (Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk) or the authority in your country of residence.

Is providing data mandatory?

• Data needed to handle the order (name, address, e-mail, phone) are a contractual requirement — without them we cannot deliver your order or issue a document.
• Other data, such as subscribing to the newsletter or writing a review, are voluntary and not providing them has no effect on your purchase.

How we protect your data

• Communication with the shop is encrypted (HTTPS), we store passwords only in hashed form and require a verification code sent by e-mail at login.
• Only people who need the data to handle orders have access to it, via protected login.
• We back up the database regularly and in encrypted form, and regularly test restoring from backup.

In the event of a data breach

• We document every personal data breach and assess its risk.
• If a breach could endanger your rights, we will report it to the Slovak Office for Personal Data Protection within 72 hours. If there were a high risk, we would also inform you directly without undue delay.
• If you suspect misuse of your data, contact us at [email protected] or +421 911 86 86 06.

Automated decision-making

• We do not use automated decision-making or profiling that would have legal effects on you or similarly significantly affect you.

Changes to this policy

• We may update this policy from time to time, for example when suppliers or the scope of our services change. The current version is always on this page together with the date of the last update.