Privacy Policy
925 Srebrnina
Controller: Spiritus trgovina in storitve d.o.o.
Website: 925srebrnina.com
Last updated: 15 September 2026
1. Who controls your personal data
The controller of your personal data is:
Spiritus trgovina in storitve d.o.o.
Polica 67, 1290 Grosuplje, Slovenia
Company registration number: 1233637000
VAT number: SI87496879
Privacy email: info@925srebrnina.com
Website: 925srebrnina.com
For questions about this Privacy Policy or to exercise your rights, please contact us at the email address above.
2. Personal data we process
2.1 Visiting the website
When you visit our website, certain technical data may be processed automatically, such as your IP address, date and time of access, requested URL, browser and device type, server response, error data and security events.
This data is necessary for the operation and security of the website, prevention of misuse and troubleshooting.
2.2 Purchases and order fulfilment
When you place an order, we generally process your first and last name, billing and delivery address, country, email address, telephone number, order contents and value, payment method, delivery information, order status, order-related communications and information required to issue an invoice.
We do not store payment card details in our online store. Card payments are processed by Stripe in its secure environment.
2.3 User account
If you create an account, we process your login and profile information, order history, saved addresses and account settings.
Passwords are stored in a technically protected form and are not visible to the controller.
Creating an account is not required to make a purchase, as guest checkout is available.
2.4 Contact form and other communications
When you contact us, we process your name, email address, selected subject, the content of your message and any information required to respond.
Contact form submissions may also be temporarily stored in the website administration system and forwarded through our email system.
2.5 Newsletters and marketing
If you expressly subscribe to our newsletter, we process your email address, information relating to your consent and unsubscribe status, as well as technical information concerning the delivery and use of messages where you have consented to such processing.
We use Brevo to manage our newsletters.
You may unsubscribe at any time using the unsubscribe link included in each message or by contacting us at info@925srebrnina.com.
2.6 Analytics
Google Analytics 4 is currently not active. If we introduce it in the future, it may be used to understand how visitors use our website, for example which pages they view, their approximate location, device type and events performed on the website. It will only be activated where an appropriate legal basis exists and, where required, after prior consent.
We use Google Search Console to monitor the technical condition and performance of the website in Google Search. It generally does not place tracking cookies on visitors’ devices.
WooCommerce may use its Order Attribution (Sourcebuster) functionality to identify the source of visits and channels that contribute to orders. As this functionality is not necessary to complete a purchase, it must be used in accordance with the visitor’s choices in the consent settings.
2.7 Wishlist
For visitors who are not logged in, wishlist information is generally stored locally in the visitor’s browser using localStorage.
The information remains on the device until the visitor removes it, clears their browser data or the functionality determines otherwise.
3. Purposes and legal bases for processing
We process personal data only where we have an appropriate legal basis:
• performance of a contract and steps taken before entering into a contract: purchases, payments, delivery, returns, complaints, user accounts and customer support;
• compliance with legal obligations: tax, accounting, consumer protection and other legal obligations;
• consent: newsletters, optional analytics and other non-essential cookies;
• legitimate interests: system security, prevention of misuse and fraud, establishment, exercise or defence of legal claims, and basic improvements to website operation where our interests are not overridden by the rights and interests of the individual.
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
4. Recipients and processors of personal data
We disclose personal data only to the extent necessary to provide the relevant service. Depending on your use of the website, recipients may include:
• Hitrost.net or our contracted hosting provider, for hosting, server infrastructure, email services and backups;
• GLS and its local partners in the country of delivery, for preparation and delivery of shipments;
• Stripe and participating payment service providers where you choose a card payment or another payment method processed by Stripe;
• providers of software used to issue and store invoices and maintain business records;
• our external accounting service provider, to the extent necessary to comply with accounting and tax obligations;
• Brevo, if you subscribe to our newsletter;
• Google, where we use Google Fonts to display web fonts and, if activated in the future and where appropriate consent has been obtained, Google Analytics for website analytics;
• Cloudflare, to protect forms against automated abuse through its Turnstile service;
• QUIC.cloud/LiteSpeed, where necessary for optimisation and technical delivery of website content;
• public authorities, courts or other authorised recipients where required by law.
Where service providers process personal data on our instructions, appropriate contractual arrangements and data protection requirements are put in place.
5. Payments
When you make a payment through Stripe, the information required to process the payment is transmitted to Stripe.
Depending on the relevant service, Stripe may act as an independent controller or as a processor. We generally receive only information about the status of the transaction, payment identifier, amount and information necessary to associate the payment with your order.
For bank transfers, personal data is also processed within the banking systems of the payer and recipient.
6. Delivery within the European Union
To deliver your order, we provide GLS or its delivery partner with your first and last name, delivery address, contact details, shipment reference and any other information necessary to complete the delivery.
For cross-border deliveries within the EU, your data may be processed by a local GLS company or contracted delivery partner in the country of delivery.
7. Transfers of personal data outside the EEA
Some of our service providers, particularly Stripe, Google and Cloudflare, operate globally. Personal data may therefore also be processed outside the European Economic Area.
Where this occurs, transfers are made on the basis of an applicable adequacy decision, a valid EU–US data protection framework, European Commission Standard Contractual Clauses or another permitted transfer mechanism, together with additional safeguards where required.
Further information is available in the privacy policies of the respective service providers.
8. Data retention periods
We retain personal data only for as long as necessary for the relevant purpose or as required by law. Our intended retention periods are:
• pending and failed orders: generally 7 days;
• cancelled orders where there is no further legal or business need: generally 30 days;
• completed and refunded orders, invoices and related records: for as long as required by tax, accounting and other applicable legislation; invoices are generally retained for 10 years following the end of the year to which they relate;
• user accounts: until the account is deleted or generally after three years of inactivity, except for information that must be retained due to orders or legal requirements;
• contact communications: generally for up to two years after the communication has concluded, and longer only where a complaint, dispute or other justified need exists;
• newsletters: until consent is withdrawn; minimal information concerning an unsubscribe request and evidence of consent may be retained for as long as necessary to demonstrate compliance and honour the unsubscribe request;
• Google Analytics: if activated, in accordance with the configured retention period, expected to be no longer than 14 months for user-level and event-level data;
• security and technical logs: generally for up to 90 days, and longer where a security incident, misuse or legal claim occurs;
• backups: until the end of the backup provider’s rotation cycle; deleted data may remain in protected backups until then and will not be used for other purposes.
Where information is required for the establishment, exercise or defence of legal claims, it may be retained until the relevant proceedings have concluded or the applicable limitation period has expired.
9. Cookies and similar technologies
The website uses strictly necessary cookies and similar technologies for the shopping bag, checkout, login, security, preference settings and other essential functionality.
These technologies may be used without consent where they are strictly necessary to provide a service expressly requested by the visitor.
Analytics and other non-essential cookies are activated only on the basis of prior consent.
Visitors must be able to reject non-essential cookies as easily as they can accept them and must be able to change their choice later.
Details about cookies, their purposes, providers and duration are available in the consent settings and in our separate Cookie Policy.
10. Cloudflare Turnstile
Our contact form may be protected by Cloudflare Turnstile, which helps distinguish legitimate users from automated abuse.
This may involve processing technical information relating to the device, browser, network connection and interaction with the form.
The purpose of this processing is website security and spam prevention. Turnstile is not used for advertising purposes.
11. Data security
We use appropriate technical and organisational measures, including encrypted HTTPS connections, restricted access, separate user roles, multi-factor authentication for privileged access, login protection, a web application firewall, malware monitoring, backups and regular updates.
Nevertheless, no system can guarantee complete security.
12. Your rights
Subject to applicable law, you may request:
• access to your personal data and a copy of that data;
• correction of inaccurate or completion of incomplete personal data;
• deletion of personal data where there is no legal basis for its continued retention;
• restriction of processing;
• data portability where processing is automated and based on consent or a contract;
• objection to processing based on legitimate interests;
• withdrawal of consent for future processing;
• information about safeguards used for transfers of personal data to third countries.
Please send your request to info@925srebrnina.com.
To protect your personal data, we may request reasonable verification of your identity before responding. We will respond within the period required by law.
13. Right to lodge a complaint
If you believe that your personal data is being processed in breach of applicable data protection law, you may contact:
Information Commissioner of the Republic of Slovenia
Dunajska cesta 22
1000 Ljubljana
Slovenia
Email: gp.ip-rs.si
Website: ip-rs.si
Your right to lodge a complaint is without prejudice to any other administrative or judicial remedy available to you.
14. Automated decision-making
Our online store does not make decisions that produce legal or similarly significant effects for individuals solely on the basis of automated processing.
Payment and security service providers may use automated risk assessments to prevent fraud in accordance with their own rules and privacy policies.
15. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes to our services, service providers or applicable legislation.
The current version will always be published on this page together with the date of the latest update.
If changes materially affect your rights, we will provide an appropriate additional notice.
