Privacy Policy

About this policy

This privacy policy explains how we process your personal data in the ViagoShop online store. It is written in clear and plain language in accordance with Article 12 of the General Data Protection Regulation (GDPR) and the Personal Data Protection Act (ZVOP-2).

The policy is publicly accessible without logging in, and it is linked from the footer of every page as well as at checkout, registration and newsletter sign-up. The date of the last update is shown at the top of the page, and we retain earlier versions for accountability purposes (Article 5(2) GDPR).

This policy is cross-complemented by two documents:

• Cookie Policy: a detailed description of cookies and tracking technologies and of consent management.
• Terms and Conditions: contractual relationships, payment, delivery, returns and complaints.

1. Controller of personal data

The controller of your personal data is:

Viagostar d.o.o. (ViagoShop brand), with its registered office at Gerbičeva ulica 110, 1000 Ljubljana, Slovenija. Company registration number: 8742472000. VAT identification number: SI25657755. The company is entered in the court register at Okrožno sodišče v Ljubljani, and its share capital is €7,500.00.

Contact for all questions regarding data protection and the exercise of your rights:

• Email: podpora@viagoshop.com
• Phone: +386 30 741 481
• Address: Gerbičeva ulica 110, 1000 Ljubljana, Slovenija

ViagoShop is the brand under which Viagostar d.o.o. operates an online store selling adult products.

2. Data protection officer

Given the sensitivity of our field of activity, we approach data protection with particular care. If we appoint a data protection officer (DPO), their contact details will be published in this policy and we will notify the Information Commissioner of the Republic of Slovenia of the appointment in accordance with ZVOP-2. Until then, all privacy questions are handled through the contacts listed above.

3. Purposes of processing and legal bases

We process personal data only for specified, explicit and legitimate purposes. For each purpose we state the legal basis under Article 6 of the GDPR:

Purpose of processing	Legal basis
Conclusion and performance of the purchase (order, delivery, returns, complaints, user account)	Article 6(1)(b): performance of a contract
Issuing invoices, accounting and tax obligations	Article 6(1)(c): legal obligation (ZDDV-1, ZDavP-2, ZGD-1, SRS)
Customer support and communication (email, chat)	Article 6(1)(b) performance of a contract or Article 6(1)(f) legitimate interest
Back-in-stock notification	Article 6(1)(a): consent
Newsletters and marketing messages	Article 6(1)(a) consent or Article 6(1)(f) in connection with the existing-customer exception under ZEKom-2
Visit analytics and improvements to the store	Article 6(1)(a): consent
Advertising and conversion measurement (Google Ads, Meta)	Article 6(1)(a): consent
Fraud prevention and security	Article 6(1)(f): legitimate interest
Product ratings and reviews	Article 6(1)(a) consent or Article 6(1)(f) legitimate interest
Establishment, exercise or defence of legal claims	Article 6(1)(f): legitimate interest
Wishlist and order history in the account	Article 6(1)(b): performance of a contract

Where we rely on legitimate interest (Article 6(1)(f)), these are specific interests: the security of the store and the prevention of abuse, defence against legal claims, and informing existing customers about similar goods. For each such processing operation we have carried out a balancing assessment between our interests and your rights. You may object to processing on this basis at any time (see the section on rights).

4. What personal data we process

We process the following categories of data:

• Identification and contact data: first and last name, delivery address, billing address, email address, telephone number.
• User account data: username, securely encrypted (hashed) password, order history, wishlist.
• Order data, including the products purchased: items and quantities (that is, the list of purchased products), amounts, the chosen payment and delivery method, and the GLS parcel locker address if you select one.
• Payment data: processed by the payment provider. We do not store the full payment card number on our servers; we receive only the transaction status and the payment reference.
• Communication: the content of messages sent by email and chat and support records.
• Technical and analytics data: IP address, cookie and device identifiers, visit events. We process analytics data only with your consent.

For age verification we store only the vg_age_ok cookie, which confirms that the visitor is of legal age. We do not store a date of birth or any other age data.

5. Adult products and special categories of data

We operate as an online store selling adult products. We recognise that buying an intimate product is a sensitive matter, so we treat this area with particular care.

The purchase of an individual product is not in itself a record of a special category of personal data under Article 9 of the GDPR. However, because data about purchases of intimate products could in theory allow inferences about a person's sex life, we act in accordance with the following commitments:

• We do not infer, derive or record data about sexual orientation or any other special category of data from your purchases (Article 9 GDPR).
• We process data about the products purchased solely for the performance of the contract (order, delivery, invoice, guarantee), and not for profiling intimate preferences.
• We apply the principle of data minimisation (Article 5(1)(c)): we do not segment by intimate preference and we do not advertise on the basis of the content of individual intimate products.
• Discreet delivery and invoicing: shipments are in neutral packaging with no indication of the contents. The description on the bank statement and on the invoice does not reveal the type of product purchased. We pass to the carrier GLS only the data necessary for delivery (name, address, phone).
• Employee access to data is limited on a need-to-know basis and subject to a duty of confidentiality.

6. Recipients and processors of data

We pass your data only to trusted processors with whom we have concluded a processing agreement (Article 28 GDPR). Each processes the data on our instructions and to the extent necessary for its service.

Processor	Role	Location	Basis for transfer
Hosting and infrastructure provider	Hosting of the online store and the database	EU/EEA	No transfer to a third country
Vendure and PostgreSQL (own infrastructure)	Application and data platform	EU/EEA	No transfer to a third country
Mollie B.V.	Processing of card and PayPal payments (Mollie)	Netherlands (EU)	No transfer to a third country
GLS	Parcel delivery (courier and parcel lockers)	EU/EEA	No transfer to a third country
e-racuni (e-racuni.com)	Issuing and storing invoices	EU/EEA	No transfer to a third country
Microsoft (Graph)	Sending transactional email	EU/EEA and USA	DPF and/or standard contractual clauses (SCC)
Resend, Inc.	Sending transactional and system email (SMTP)	USA	DPF and/or standard contractual clauses (SCC)
Squalo d.o.o. (SqualoMail)	Sending newsletters and email marketing	EU/EEA	No transfer to a third country
PostHog	Visit analytics	EU (Frankfurt)	No transfer to a third country
Google Ireland Ltd. / Google LLC	Google Analytics 4, Search Console and Google Ads (analytics and advertising)	Ireland (EU) and USA	DPF and/or SCC
Meta Platforms Ireland Ltd. / Meta Platforms, Inc.	Meta Ads and Meta Pixel (advertising)	Ireland (EU) and USA	DPF and/or SCC
Error monitoring provider (Sentry)	Monitoring and fixing technical errors, where enabled	EU/EEA or USA	SCC where required
Chat widget	Customer support via chat, where used	EU/EEA	No transfer, or SCC where required
Accounting and legal services	Services as required	Slovenia (EU)	No transfer to a third country
Public authorities (tax administration, courts)	Compliance with legal obligations	Slovenia (EU)	Statutory basis

Analytics and advertising services (Google Analytics 4, Google Ads, Meta Pixel) are loaded only with your consent for the relevant category (analytics or marketing). Google Ads and Meta Pixel are switched off by default and do not fire without explicit marketing consent, and they do not pass to third parties any information about which intimate products you have viewed. The scope of data is minimised.

Session replay. Analytics consent covers not only visit measurement but also the recording of how a session unfolds, at the processor PostHog (pointer movement, clicks, sequence of pages). Input fields are masked, so a recording does not contain the text you type into forms; the recorder cannot see card details, because the card field runs inside a separate frame belonging to the payment provider and is not part of our page. A recording does, however, reproduce what was on screen, including the products viewed — which is why it is created and stored exclusively with the processor in the EU (Frankfurt), for at most 30 days, after which it is deleted automatically. Without analytics consent no recording starts, and withdrawing consent stops it for new sessions. Details are in the Cookie Policy.

We do not sell your data and do not share it for third-party marketing purposes.

7. International data transfers

As a rule we process data within the European Economic Area (EEA).

• PostHog is hosted in the EU (Frankfurt), so with PostHog analytics there is no transfer to a third country.
• Microsoft, Google and Meta may also process data in the USA. For those transfers we rely on the EU-US Data Privacy Framework (DPF, European Commission decision of 10 July 2023) and/or on standard contractual clauses (SCC) under Article 46 of the GDPR, with additional safeguards where necessary.

You can obtain further information about transfers and a copy of the relevant safeguards at podpora@viagoshop.com.

8. Retention periods

We retain data only for as long as is necessary for the individual purpose:

Category of data	Retention period
Invoices and tax/accounting records	10 years after the year of issue (Article 86 ZDDV-1); annual reports under ZGD-1 and SRS
Order and contract data	Until performance and until claims become time-barred, generally 5 years (Article 346 OZ); guarantee and conformity under ZVPot-1
User account	Until the account is deleted or after prolonged inactivity
Consent for newsletters and marketing	Until consent is withdrawn (Article 7(3) GDPR)
Back-in-stock notification	Until the notification is fulfilled or cancelled
Analytics data	As a rule up to 24 months; individual cookies according to the period stated in the Cookie Policy
Communication and support	As a rule 1 to 2 years
Data for legal claims	Until a final resolution and the expiry of limitation periods
Records of consent	For accountability purposes, for as long as necessary

After the periods expire we permanently delete or anonymise the data. The statutory 10-year retention of invoices also applies if you delete your user account in the meantime: in that case we retain only the data required by tax and accounting legislation.

9. Your rights

Under the GDPR and ZVOP-2 you have the following rights:

• Right of access to the data we process about you (Article 15).
• Right to rectification of inaccurate or incomplete data (Article 16).
• Right to erasure, the right to be forgotten (Article 17). It does not apply to data we are required to retain by law, such as issued invoices.
• Right to restriction of processing (Article 18).
• Right to data portability (Article 20).
• Right to object to processing based on legitimate interest. You may object to direct marketing absolutely and at any time (Article 21).
• Right to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Article 7(3)). Withdrawing is as easy as giving consent.

Send your request to podpora@viagoshop.com. Handling is free of charge and we will reply within one month at the latest (Article 12(3)); for more complex requests the period may be extended by a further two months, of which we will inform you. Given the sensitivity of the field, we provide a discreet communication channel.

10. Complaint to a supervisory authority

If you believe that the processing of your personal data infringes the law, you have the right to lodge a complaint with a supervisory authority.

The controller's supervisory authority is the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana. Phone: +386 1 230 97 30. Email: gp.ip@ip-rs.si. Web: www.ip-rs.si.

If you have your habitual residence in another EU Member State, you may also lodge a complaint with the supervisory authority of that state.

11. Is providing data mandatory

Providing your name, address and contact details is necessary for the conclusion and performance of the contract (order, delivery, invoicing). Without this data we cannot complete the purchase.

Providing data for marketing purposes (for example an email address for the newsletter) is voluntary. If you do not provide it or you withdraw consent, this has no consequences whatsoever for your purchase.

12. Automated decision-making and profiling

We do not carry out automated decision-making with legal or similarly significant effects under Article 22 of the GDPR.

Product recommendations and sorting in the store are a form of ordinary profiling intended to improve the user experience; they are not based on inferences about intimate preferences and have no legal or similarly significant effects for you.

13. Source of the data

As a rule we collect personal data directly from you. Gift cards are an exception: where a buyer enters the recipient's details, we obtain that data from the buyer. We inform the recipient about the processing in accordance with Article 14 of the GDPR.

14. Data security and breaches

We implement appropriate technical and organisational measures for data security (Article 32 GDPR): encryption of transmission via the TLS protocol (HTTPS), access on a least-privilege and need-to-know basis, secure storage of passwords in hashed form, regular system updates and processing agreements with all processors. We do not store full payment card data.

No technology guarantees complete security, so we commit to careful handling and to continuously improving our protection. In the event of a personal data breach we act in accordance with Articles 33 and 34 of the GDPR: we notify the Information Commissioner of the Republic of Slovenia of a breach that poses a risk to your rights within 72 hours, and where the risk is high we also notify you. We also keep an internal record of processing activities (Article 30).

15. Newsletters and direct marketing

We send newsletters only on the basis of your explicit, voluntary and separate consent (Article 7 GDPR). Consent is not conditional on a purchase and is not pre-ticked.

In accordance with the Electronic Communications Act (ZEKom-2) we may send existing customers messages about similar goods or services, and both when the data is collected and in every message you have the option to unsubscribe simply and free of charge. Marketing consent is separate from analytics consent. Given the sensitivity of the field, we use discreet message subject lines.

You can unsubscribe from newsletters at any time through the link in every message or by writing to podpora@viagoshop.com. We keep a record of your consent and unsubscription for accountability purposes.

16. Cookies and tracking technologies

We use cookies and similar technologies for the operation of the store, for analytics and for advertising. All non-essential cookies are loaded only after your consent, which you can change at any time through the Cookie settings link in the page footer.

A detailed description of all cookies (name, provider, purpose, category, lifetime and any transfer to a third country) and of consent management can be found in the Cookie Policy. By default, advertising cookies do not transmit to third parties any information about the intimate products viewed.

17. Minors

The online store is intended exclusively for persons of legal age (18 or over). On entry we carry out an age check, recorded by the vg_age_ok cookie.

For information society services, the age at which a person can validly consent on their own in Slovenia is 15 (Article 8 ZVOP-2). For persons under 15, the consent of the holder of parental responsibility is required. We do not knowingly collect the data of minors. If we establish that we have obtained data of a person under 15 without the appropriate consent, we delete it. The age limit of 15 for the validity of consent is separate from the requirement of 18 for access to adult products.

18. Changes to the policy

We may update this privacy policy from time to time. The date of the last update is shown at the top of the page, and earlier versions are archived. We will inform you of significant changes by email or by a notice in the online store. Processing is governed by the version of the policy in force at the time of the processing.

19. Contact

For any questions about this policy or about exercising your rights, write to podpora@viagoshop.com or call +386 30 741 481. Address for written communication and returns: Gerbičeva ulica 110, 1000 Ljubljana, Slovenija.