Legal
Privacy policy
1. Controller
The controller of personal data is ZORC K. trgovsko podjetje d.o.o., Ulica bratov Učakar 4, 1000 Ljubljana, which operates the HEJZ brand and online store. For privacy questions, write to info@hejz.si.
2. What data we process
Depending on how you use the store, we may process identification and contact data, billing and delivery addresses, order data, payment status, communications, customer account data, consent choices, technical device and log data, site usage data and review content. We do not receive full payment card data if it is processed directly by the contracted payment provider.
3. Purposes and legal bases
| Purpose | Data and legal basis |
|---|---|
| Order, payment, delivery, pickup, returns and support | Data needed to perform the contract and take steps before concluding it; where necessary, also to meet legal obligations. |
| Invoices, tax and accounting records | Legal obligation. Invoices and related records are kept for the statutory period, as a rule 10 years after the end of the year to which they relate. |
| Security, abuse prevention and legal claims | Legitimate interests in protecting the store, customers and legal claims, weighed against the rights of the individual. |
| User account | Performing the service the user requests; an account is not a condition for purchase. |
| Newsletters | Consent with double confirmation. You can withdraw consent at any time without affecting the lawfulness of past processing. |
| Abandoned cart | Only on a documented and valid basis. If consent is used, messages are sent only after such consent and always allow unsubscribing. |
| Customer reviews | Performing the request to review an actual purchase and the legitimate interest in ensuring credible reviews; publication of a name or pseudonym is explained before submission. |
| Analytics, advertising and embedded content | Consent for each optional category of cookies or similar technologies. |
4. Who we disclose data to
We disclose data only to the extent needed for a particular service, in particular to the Shopify platform provider, the contracted payment provider, Pošta Slovenije, the accounting and Birokrat system provider, the email provider, Judge.me, the analytics and advertising providers Google and Meta, the consent management provider and the developer or maintainer of the online store. The final list, roles and links to their privacy notices are published in the current version of this policy.
We disclose data to public authorities when required by law. We do not sell data.
5. Transfers outside the European Economic Area
Some technology providers may process data outside the European Economic Area. We carry out such a transfer only if an appropriate legal mechanism is in place, for example an adequacy decision or standard contractual clauses, and additional safeguards where necessary. You can request details of the providers actually used at info@hejz.si.
6. Retention
We keep data only as long as needed for the stated purpose and then delete or anonymise it, unless the law requires longer retention. Invoices and tax-relevant records are as a rule kept for 10 years after the end of the year to which they relate. We keep newsletter data until you unsubscribe, and proof of consent for as long as needed to demonstrate compliance. Other specific periods are set according to the actual service settings and the valid internal retention record.
7. Your rights
Under the conditions set by law, you may request access, rectification, erasure, restriction of processing or data portability, or object to processing. You can withdraw consent at any time. Send your request to info@hejz.si. Before replying, we may verify your identity to a reasonable extent. We cannot delete accounting data required by law before the mandatory retention period ends.
If you believe we are not handling your data correctly, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia.
8. Security and access
We use appropriate technical and organisational measures, including limited user rights, individual user accounts and two-step sign-in where available. Only people who need access for their work have it.
9. Marketing and cookies
Newsletters are not a condition for purchase. Consent to newsletters is separate from consent to cookies. We use your phone number for the order and delivery, not for SMS advertising. More about optional technologies is in the Cookie policy; you can change your settings at any time.
10. Changes to this policy
The current version is published on hejz.si with the date of the last change. We announce important changes that affect your rights or consents in an appropriate way.