Privacy Policy

Data Controller

The controller of your personal data is:

Viagostar d.o.o., registered office at Gerbičeva ulica 110, 1000 Ljubljana, Slovenija, company registration number 8742472000, VAT ID SI25657755.

For data protection enquiries: info@viagoshop.com, phone +386 30 741 481.

Legal Basis for Processing

We process your personal data on the following legal grounds:

• Article 6(1)(b) GDPR — performance of a contract (placing and delivering your order),
• Article 6(1)(c) GDPR — compliance with legal obligations (accounting and tax law),
• Article 6(1)(f) GDPR — our legitimate interests (fraud prevention, shop security),
• Article 6(1)(a) GDPR — your consent (e.g. newsletter, non-essential cookies).

What We Collect

When you shop with us, we collect:

• first and last name,
• delivery address and billing address,
• email address,
• phone number,
• order details (items, total, payment method, shipping method),
• payment data (handled by the payment provider; we only receive transaction status),
• IP address and basic visit telemetry (browser, language, timestamp).

For age verification we store only the vg_age_ok cookie that confirms the visitor is of legal age. We do not store your date of birth or any other age-identifying data.

Purpose of Processing

We use your data only to:

• fulfil and deliver your order,
• issue invoices and meet statutory record-keeping duties,
• communicate about your order (confirmation, tracking, complaints),
• prevent fraud and abuse,
• improve the shop,
• send newsletters with your explicit consent.

Recipients of Your Data

We share your data only with the following categories of processors:

• delivery provider (courier) — name, address, phone,
• payment provider (Stripe, Mollie or equivalent TBD) — minimal payment information,
• transactional and system email provider (Resend, Inc., USA) — your email address and message content; international transfer under the EU-US Data Privacy Framework and/or standard contractual clauses (SCC),
• newsletter and email-marketing provider (Squalo d.o.o. / SqualoMail, EU) — your email address for sending newsletters,
• hosting and technical support — anonymised technical logs,
• accounting service — invoices and related data.

All processors are bound by contract to comply with GDPR. We do not transfer data outside the EU without adequate safeguards (standard contractual clauses).

Data Retention

• Orders and invoices: 10 years (Slovenian VAT Act).
• Customer correspondence: 2 years after last contact.
• Technical logs: 6 months maximum.
• Newsletter consent: until you withdraw it.
• vg_age_ok cookie: 30 days.

After the stated periods we permanently delete or anonymise the data.

Your Rights

Under GDPR you have the right to:

• access the personal data we hold about you,
• rectification of inaccurate data,
• erasure (right to be forgotten),
• restriction of processing,
• data portability,
• object to processing,
• withdraw consent at any time,
• lodge a complaint with the supervisory authority — Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.

Send requests to info@viagoshop.com. We will respond within 30 days.

Data Security

We use industry standards: HTTPS encryption, least-privilege database access, regular system updates, multi-factor authentication for administrators. We do not store payment card data on our servers.

Changes to This Policy

We may update this policy from time to time. The date of the last update is shown at the top. We will notify you of material changes by email or by a notice in the shop.

Contact

For any questions about this policy or your rights, please write to info@viagoshop.com.