stello@stello.sk
en
Cart
0
0.00 €

Privacy Policy (GDPR)

1. Identity of the Data Controller

The Data Controller responsible for processing personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR) and applicable personal data protection legislation is:

  • Company Name: STELLO s.r.o.
  • Registered Address: 1.mája 140/14, 900 84 Báhoň, Slovak Republic
  • Company ID (IČO): 44725701
  • Tax ID (DIČ): 2022803123
  • VAT ID (IČ DPH): SK2022803123
  • Commercial Register: Registered in the Commercial Register of the Municipal Court Bratislava III (Mestský súd Bratislava III), Section: Sro, Insert No.: 57907/B
  • E-mail: stello@stello.sk
  • Phone: +421 915 399 662
  • Website: stello.sk

2. Purposes, Legal Bases, and Retention Periods for Personal Data Processing

Order Processing and Delivery

  • Processed Data: First name, last name, delivery address, billing address, e-mail address, phone number, details of ordered goods.
  • Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR).
  • Retention Period: For the duration of the contractual relationship and the applicable warranty period.

Accounting and Tax Compliance

  • Processed Data: Billing details, contracts, payment records.
  • Legal Basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR, relevant tax and accounting legislation).
  • Retention Period: 10 years following the year to which the documents relate.

Customer Account Management

  • Processed Data: Registration details, order history, account preferences.
  • Legal Basis: Consent of the data subject (Art. 6(1)(a) GDPR).
  • Retention Period: Until account deletion or withdrawal of consent.

Inquiry Processing and Contact Forms

  • Processed Data: Name, e-mail address, phone number, content of message or inquiry.
  • Legal Basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR) or pre-contractual measures.
  • Retention Period: For the period necessary to resolve the inquiry, up to a maximum of 12 months.

Complaints Handling and Legal Claims

  • Processed Data: Contact details, details of claimed goods, description of defect, complaint processing history.
  • Legal Basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR) and legitimate interest.
  • Retention Period: 5 years from the resolution of the complaint, or until the expiration of the statutory limitation period.

Direct Marketing for Existing Customers

  • Processed Data: E-mail address, name.
  • Legal Basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR).
  • Retention Period: Until an objection/opt-out is submitted, or up to a maximum of 3 years from the last order.

Newsletter and Marketing for Unregistered Users

  • Processed Data: E-mail address.
  • Legal Basis: Consent of the data subject (Art. 6(1)(a) GDPR).
  • Retention Period: Until withdrawal of consent (via the opt-out link provided in each e-mail).

3. Recipients and Data Processors

To ensure the proper functioning of the e-shop, production, logistics, and compliance with statutory requirements, personal data is shared with vetted third-party partners:

  • Courier and Logistics Providers: To ensure the delivery of ordered products and pallet transportation.
  • E-Commerce and Order Management Platforms: Providers of e-shop software, e-commerce connectors (e.g., BaseLinker), and warehouse/production management software.
  • Payment Service Providers: Banking institutions and online payment gateway operators for processing digital payments.
  • Accounting and Legal Advisors: External accounting firms, tax consultants, and legal counsel.
  • IT and Hosting Service Providers: Server hosting, cloud service providers, and website technical maintenance services.
  • Analytics and Marketing Tools: Providers of web analytics and advertising platforms (e.g., Google, Meta) – strictly based on granted cookie consent.

4. Transfer of Personal Data to Third Countries

Personal data processing is primarily conducted within the European Union (EU) and the European Economic Area (EEA).
When using global service providers (e.g., Google LLC, Meta Platforms Inc.), data may be transferred to third countries (e.g., the United States). Such transfers occur exclusively under appropriate legal safeguards, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (SCCs) approved by the European Commission.

5. Rights of the Data Subject

Under the GDPR, you have the following rights regarding your personal data:

  1. Right of Access (Art. 15 GDPR): The right to obtain confirmation as to whether your personal data is being processed, and to receive a copy of that data.
  2. Right to Rectification (Art. 16 GDPR): The right to request the prompt correction of inaccurate or completion of incomplete personal data.
  3. Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): The right to request the deletion of your personal data if it is no longer necessary for the original purposes or if you withdraw your consent.
  4. Right to Restriction of Processing (Art. 18 GDPR): The right to request the restriction of processing (e.g., while the accuracy of the data is being verified).
  5. Right to Data Portability (Art. 20 GDPR): The right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
  6. Right to Object (Art. 21 GDPR): The right to object at any time to data processing based on legitimate interests or for direct marketing purposes.
  7. Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent free of charge at any time (via e-mail or by clicking the unsubscribe link in e-mails).
  8. Right to Lodge a Complaint: If you believe that your personal data is being processed in violation of applicable laws, you have the right to lodge a complaint with a supervisory authority:
    • In Slovakia (Controller's Jurisdiction): Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, Web: www.dataprotection.gov.sk
    • You may also contact your local national Data Protection Authority (DPA) within your EU member state.

6. Cookies and Tracking Technologies

Our website uses cookies to ensure proper site functionality, analyze traffic, and personalize marketing content.

  • Necessary (Technical) Cookies: Essential for the core operation of the e-shop (e.g., shopping cart functionality, login sessions). Their usage does not require consent.
  • Analytical and Preference Cookies: Help us understand visitor behavior and improve website performance. Used strictly with your consent.
  • Marketing Cookies: Used to display relevant advertising tailored to your interests. Used strictly with your consent.

You can manage or withdraw your cookie preferences at any time via the Cookie Banner on our website or within your browser settings.

7. Security of Personal Data Processing

The Data Controller implements appropriate technical and organizational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access:

  • Data transmission encryption using SSL / TLS protocols.
  • Antivirus protection, firewalls, and encrypted data backups.
  • Access restriction controls – access to personal data is limited strictly to authorized and trained personnel.

8. Final Provisions

  • This Privacy Policy comes into force and effect on October 1, 2026.
  • The Data Controller reserves the right to update this policy in response to changes in legislation, technology, or internal processing operations. The current version will always be published on the Data Controller's website.