In force from 29 September 2026
In short
- We use personal data to fulfil your order, deliver it and issue the invoice.
- We keep invoices for 10 years, as the law requires.
- We use analytics of site visits only with your consent.
- To exercise your rights, e-mail [email protected].
Data controller
The controller of personal data is Grafline d.o.o., Vojkovo nabrežje 4, 6000 Koper, Slovenia (company registration number 7155450000). Questions about data: [email protected], +386 31 743 787.
What data we collect
You enter most data yourself: when you order, in your account or by e-mail. We collect:
- contact and delivery details of your order,
- e-mail correspondence with us,
- artwork you upload for personalisation, for example a logo,
- account data,
- technical data of your visit, for example your IP address and browser.
The order details are needed to conclude and fulfil the contract. Without them we cannot fulfil the order.
Why we use it
For each purpose we give the legal basis.
- Order, production, payment and delivery (contact and delivery details, uploaded artwork): contract.
- Your account and replies to your messages: contract.
- Issuing and keeping invoices: legal obligation.
- Security of the website and shop (technical data of the visit): our legitimate interest.
- Analytics of site use: your consent.
How long we keep it
We keep invoices for 10 years, because tax law requires it. We cannot erase the data on invoices before that period ends. We keep other data for as long as we need it for the purpose we collected it for, or for as long as the law requires.
Who else processes the data
External providers also process data:
- Hosting: the shop runs on a server of Hetzner Online GmbH (Germany), in the data centre in Nuremberg
- Cloudflare: network protection
- WooPayments (Stripe): card payments
- Delivery: the delivery company that brings your parcel. It receives the name, address and phone number for delivery.
- Microsoft Clarity: analytics of site use. Its script loads on every page. It sets its cookies (
_clck,_clsk) only after you click “Accept”. Without a click, and after “Decline”, it sets none.
Cloudflare, Stripe and Microsoft are based in the USA and may process data outside the EU. They must use the safeguards the GDPR requires, for example the EU-US Data Privacy Framework or standard contractual clauses.
Your rights
You have the right of access, correction, erasure, restriction of processing, portability and objection. You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before it.
Send your request to [email protected]. You can also complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec Republike Slovenije).
Cookies
How we use cookies is explained on the Cookie policy page.