LUPUS STUDIO, agencija za digitalni marketing d.o.o., Jurčičeva cesta III 10, 1290 Grosuplje, Tax Number: SI76826538, provides information in the following document about which personal data it processes, the purposes, bases, and types of processing of various types of personal data, the transmission of data to third parties, the storage period of individual types of personal data, rights related to the processing of personal data, the right to lodge a complaint regarding the processing of personal data, the contact of the authorized data protection officer, and the contact information of LUPUS STUDIO d.o.o.

What personal data do we process?

If you use our services, we collect various types of your data, such as your contact details and other settings. We track what items you view in our online store and through which device. If you make a purchase from us, we also process your first and last name, your orders, and the data you set up on your account.

We process the following personal data:

• Identification data, which mainly comprise first and last name, and VAT ID if you are a legal entity;
• Contact data, which comprise personal data with the help of which we can contact you, mainly email address, telephone number, delivery address, billing address, and your profiles on social networks;
• Your settings, which comprise your account details, mainly saved delivery addresses, profiles, shopping lists, searched items, your ratings, and comments on items and services;
• Data about your orders, which mainly comprise data about ordered items and the method of payment, including the bank account number;
• Data about your online habits, including instances when you browse the web via our mobile application, mainly data about items and services you look for, links you click on, the method of searching and scrolling through our website, and data about devices from which you access the web, such as IP address and associated location, device ID, its technical parameters such as operating system, version, screen resolution, selected browser and its version, as well as data obtained from cookies and similar device recognition technologies;
• Derived data, which include personal data obtained from your settings, data about items you buy from us, data about your online habits, and behavior in connection with reading messages we send you; these are mainly data about gender, age, financial situation, consumer habits, and attitude towards various items and services.

Why do we process personal data and why are we entitled to do so?

We process your personal data in various situations for different purposes. If you visit the website of our online store, where we also use cookies, we use your data mainly to determine the number of visitors and improve our services. If you make a purchase from us, we use your data to process your order, protect our legal claims, and fulfill our statutory obligations. With your consent, we pass data to third parties to display offers on other websites as well as to enable you to access certain additional services. We have the right to process your personal data based on the preparation or implementation of a contract with you, compliance with legal obligations, our legitimate claims, or your consent.

Within our activity, we process personal data for various purposes and to a varying extent, namely:

• without your consent based on the implementation of a contract, our legitimate interest, or for the purpose of fulfilling legal obligations, or
• based on your consent.

What data processing we can perform without your consent depends on the purpose with which the relevant processing is connected and what relationship you have to us – whether you are just a visitor to our online store or a buyer. We can also process your data if you are the recipient of goods or services ordered from us, or if you communicate with us or visit our pick-up point.

If you visit our online store

Use of cookies and other technologies, passing data to advertising and social networks

If you visit our online store, we store and read cookies on your device. A cookie is a small set of letters and digits that we store on your web browser or the hard drive of your computer. Some cookies allow us to link your activities while browsing our pages from the moment you open a web browser window until the moment you close it. The moment you close the web browser window, the associated cookies are deleted. Some cookies remain on the device for a set time and are activated with each visit to the websites that created the associated cookies. We store and read cookies on your device. In the remainder of this document, for simplicity, we will speak only about storing.

Some cookies are stored directly on your device by our websites. Such cookies help us:

• in ensuring security, e.g., so that we can verify that your connection to our web domain has not been misused and that someone is not trading on your behalf;
• in detecting, studying, and removing errors and shortcomings of our websites.

Such cookies and other files are strictly necessary for the operation of our online store. If you disable cookies on your browser, it may happen that our websites will not work properly, as a result of which we will not be able to offer you items from our offer and services.

On your device, we also store cookies from our websites that allow us to:

• track the number of visits to our websites or individual contents, create statistics and overviews, and measure the effectiveness of advertisements;
• display different variants of our websites if we are testing new functionalities;
• adapt the content of our website to your needs, e.g., preferentially displaying items you have already searched for, and displaying other offers according to your wishes on our websites;

we enable the storage of cookies to third parties who can use them:

• to collect data about your behavior on our or other websites;
• to display tailored offers and customized advertisements within advertising and social networks on other websites outside our domain;

For the purpose of displaying tailored offers and customized advertisements within advertising and social networks on other websites outside our domain, we also pass data about your online behavior to advertising and social networks. However, we do not pass your identification data to such partners. The list of social and advertising networks we use is listed in the section “Who processes your personal data and with whom do we share them?”.

If, after our warning, you click on any link on our websites (outside the warning box) or click on the “I understand” button, which is an integral part of the warning, it is considered that you agree to the use of the stated cookies and the transmission of your data to advertising and social networks.

Use of personal data of website visitors

If you visit the online store lupo-san.com, we process data about your online behavior based on our legitimate interest (i.e., without your consent) for the purposes of:

• obtaining data on the basis of which we will be able to improve the online store for you in the future to create better conditions for shopping; our legitimate interest in this case is to improve our services for you;
• creating statistics and overviews, mainly tracking the number of visits to our websites or individual contents and measuring the effectiveness of ads; our legitimate interest in this sense is to measure the effectiveness of our websites and advertising costs; for this purpose, we can obtain and use other derived data through your online behavior; or we can pass derived data to our partners for calculating commission, as described in the chapter “Who handles your personal data and to whom do we pass them”.
• testing new functions and applications before introduction, so that we can avoid problems with the operation of these novelties during actual operation, which could worsen your shopping experience with us; our legitimate interest in this case is the flawless operation of our services for you;
• measures against attacks on our websites and threats to their operation, and to ensure the security of your data; our legitimate interest in this case is the flawless operation of our services for you and the security of your data.

We do not obtain data about your behavior on websites only through cookies. We also supplement them with the following data:

• IP address of your device (the address of your device through which you communicate with other devices on the internet);
• operating system of your device, its version, and language settings;
• browser you use on your device, its version, and language settings;
• web address (URL address) of the page from which you access our website.

For this purpose, we use personal data for a maximum of 38 months, and we keep data only in pseudonymized form. If you have concerns about this, you can find more information here (click).

We also process data about your behavior on websites based on our legitimate interest (i.e., without your consent) for the purpose of preparing tailored offers and customized advertisements that we display on the web. Our legitimate interest in this case is a tailored and as effective an offer for you as possible. For this purpose, we expand the named data with the help of analysis and obtain derived data from them.

Therefore, if you searched for a product in our online store, this product may appear on the front page of our online store during your next visit. Depending on what product you were looking for, we can assess which group of customers you belong to. Based on this, we can offer you other items in our online store that we estimate might interest you. For this purpose, we use personal data for 1 month.

If you make a purchase from us

In order to make a purchase from us, you must visit our online store, so the processing described under the chapter “If you visit our websites” applies to you. If you make a purchase from us, the data processing expands in the following way:

Processing based on the implementation of a contract

If you make a purchase from us as a natural person, we process your personal data for the purpose of processing your order. These are identification and contact data and data about your orders. If you make a purchase from us as a representative of a legal entity, we process the same data for the same purpose based on our legitimate interest, which is based on the conclusion and implementation of a contract with the person you represent.

The use of data for the purpose of processing your order means that we use the data specifically for:

• the possibility of completing the order online, i.e., so that, for example, items you added to the shopping cart or data from an order in preparation are not deleted;
• the possibility of communicating with you, e.g., sending confirmations for orders or warning about the dispatch of items;
• needs of payment for goods,
• needs of delivery of goods; in connection with this, we can also pass your data to our transport partners, exclusively for the needs of delivery of these goods, as described in the chapter “Who processes your personal data and with whom do we share them?”;
• in connection with your other requirements that you address to us, e.g., via emails, as described in the section “If you communicate with us through various channels”.

For this purpose, we use personal data for the time strictly necessary to process your order or resolve contractual obligations.

Processing based on legitimate interest

If you make a purchase from us, we store your identification and contact data and data about your orders based on our legitimate interest (without your consent) for the purposes of protecting legal claims and our internal records and control. Our legitimate interest in this case is represented by the protection of legal claims and control over the regular implementation of our services.

Furthermore, based on our legitimate interest (i.e., without your consent), we process your identification and contact data, your settings, and data about your orders (if you make a purchase from us later) for the purposes of:

• obtaining data on the basis of which we will be able to improve our services for you in the future to create better conditions for shopping, especially by determining your satisfaction with our services; our legitimate interest in this case is to improve our services for you.

To protect legal claims and maintain our internal records and controls, we process data for a period of 3 years and a further 1 year thereafter in connection with claims enforced by the end of the limitation period. In the case of legal, administrative, or other proceedings, we process your personal data for the period necessary for the duration of such proceedings and for the remainder of the limitation period after its conclusion.

For the purpose of protecting legal claims and our internal records and control, we process data for the duration of the limitation period, which is 5 years, and if necessary one more year after its expiry in the case of a claim enforced at the end of the limitation period. When initiating a court, administrative, or other proceeding, we process your personal data for the time strictly necessary for the implementation of such proceedings, and until the expiry of the remaining part of the limitation period after its conclusion.

For other stated purposes, we use personal data for a maximum of 6 months. You can object to such processing performed on the basis of our legitimate interest.

Processing based on compliance with legal obligations

If we process your personal data for a legally determined reason, we do not need your consent for such data processing. On this legal basis, we process your identification and contact data, order data, due to compliance with currently applicable laws, which at the time of drafting this memorandum are especially the following:

• Obligations Code (OZ),
• Consumer Protection Act (ZVPot-1),
• Value Added Tax Act (ZDDV-1),
• Tax Certified Invoices Act (ZDavPR),
• Accounting Act (ZR),
• Electronic Communications Act (ZEKom-2),
• Prevention of Money Laundering and Terrorist Financing Act (ZPPDFT-1).

For this purpose, we use personal data for a maximum of 10 years (plus the current year) after the last issued document regarding your order.

If you are the recipient of goods or services ordered from us

If you are the recipient of goods or services ordered from us, we process your identification and contact data:

• based on our legitimate interest for the purpose of preparation, conclusion, and implementation of a contract with our customer. The implementation of this contract is also our legitimate interest;
• based on our legitimate interest for obtaining data on the basis of which we can improve our services for you in the future, or data for the preparation of our internal statistics and overviews; our legitimate interest in this case is to improve our services for our customers;
• for the purpose of implementing legal obligations, especially on the basis of applicable laws listed in the subsection “Processing based on compliance with legal obligations”;
• for the purpose of protecting legal claims and our internal records and control; our legitimate interest in this case is represented by the protection of legal claims and control over the regular implementation of our services.

For the preparation, conclusion, and implementation of a contract with our customer, we use personal data for the time strictly necessary to process the order. After this time, we continue to store data based on our legitimate interest for the purpose of protecting legal claims and our internal records and control, for the duration of the limitation period, which is 5 years, and if necessary one more year after its expiry in the case of a claim enforced at the end of the limitation period. When initiating a court, administrative, or other proceeding, we process your personal data for the time strictly necessary for the implementation of such proceedings, and until the expiry of the remaining part of the limitation period after its conclusion. Our legitimate interest in this case is represented by the protection of legal claims and control over the regular implementation of our services. For the purpose of fulfilling legal obligations, we use personal data for a maximum of 10 years for an individual order.

If you communicate with us through various channels:

If you communicate with us through various channels, mainly via email, telephone, and social networks, we process your identification and contact data and records of mutual communication based on our legitimate interest (i.e., without your consent) for the purposes of:

• processing your requirements; if you made a purchase from us and your requirement relates to the order, we can carry out the processing based on the implementation of a contract with you;
• records of your requirements so that we can verify their regular and timely fulfillment;
• proving that we received and processed your requirement, e.g., if you order goods from us in this way;
• analysis of requirements to improve the quality of our services.

For these purposes, we keep personal data for a period of 3 months. If you place an order through one of our channels, we can keep the data to protect legal claims for a limitation period of 5 years and a further 1 year after expiry in connection with claims enforced at the end of the limitation period. In the case of legal, administrative, or other proceedings, we process your personal data to the extent necessary for the duration of such proceedings, and the remainder of the limitation period after its termination.

Who processes your personal data and with whom do we share them?

In most cases, we process your data for our own purposes as their controller. In such a case, we pass your data to our partners to ensure payments, transport, and other matters related to your order. We also pass data to our processors who process them in accordance with our instructions. With your consent, we can also pass data to advertising and social networks to display custom ads on other websites.

All described personal data are processed by us as the controller. This means that we determine the purposes defined above for which we collect your personal data and the methods of processing and are responsible for the proper implementation of it.

We can also pass your personal data to other entities that also have the function of a controller, namely:

• in connection with the processing of your order to our partners involved in order processing, as stated in the section “If you make a purchase from us”, specifically partners who manage payment systems to ensure payments, especially in connection with payment cards and banks with which we cooperate;
• transport partners, mainly companies Pošta Slovenije d.o.o., Slomškov trg 10, 2500 Maribor, Slovenia, Tax ID 25028022, GENERAL LOGISTICS SYSTEMS, logistične storitve d.o.o., Cesta v Prod 84, Ljubljana, 1000 Ljubljana, Tax ID SI74531891 and DPD d.o.o., Celovška cesta 492, 1210 Ljubljana-Šentvid, Slovenia, Tax ID SI46749845, if they deliver the ordered goods to you.

From which sources do we obtain personal data?

We mostly obtain personal data directly from you via our online store or when communicating with you. We mostly process personal data that you provide to us directly in the context of ordering items and services, in the online store, or when communicating with us, for example via telephone. We also obtain personal data directly from you by monitoring your browsing habits while you scroll through our online store.

If you make a purchase from us, we may receive additional data about your orders in connection with the implementation of the concluded purchase contract from banks, our partners who manage payment systems, and transport partners, e.g., data about your account number, successfully executed payments, or the delivery and collection of goods.

What are your rights regarding the processing of personal data?

You have numerous rights in connection with your personal data. These include the right of access, review, erasure, restriction of processing, portability, objection, and complaint. Just as we have our rights and obligations when processing your personal data, you also have certain rights under data protection regulations. These rights include:

Right to be informed (Right of access)

Simply put, you have the right to know what data we collect about you, for what purposes and for how long, where we collect your personal data from, to whom we pass it, who else processes it besides us, and what your other rights are in connection with the processing of your personal data. You can read all of this under “Terms and Conditions: Protection of Customer Personal Data”. However, if you are still not completely sure what personal data we collect about you, you can request confirmation from us as to whether or not we collect personal data related to you, and if we do, you have the right to get acquainted with this data. In accordance with the right to be informed, you can request a copy of the processed data from us, whereby we will provide you with the first copy free of charge, and any subsequent copy against payment.

Right to rectification

If you notice that the personal data we hold about you is incorrect or incomplete, you have the right to request that we correct or supplement it as soon as possible.

Right to erasure (Right to be forgotten)

In some cases, you have the right to request the erasure of your personal data. We will delete your personal data as quickly as possible if one of the following reasons is met:

• we no longer need your personal data for the purposes for which we processed it;
• you have withdrawn your consent for data processing, where this involves data for which your consent is necessary, and at the same time we have no other reason for further processing of this data;
• you have exercised your right to object to data processing (see the section Right to object to data processing below) for personal data that we process based on our legitimate interest, and we find that we no longer have legitimate interests that would justify further processing of this data; or
• you assume that the processing of personal data carried out by us is no longer in accordance with generally binding legal regulations.

Please be aware that even if one of the described reasons is met, it does not mean that all your personal data will be deleted immediately. This right cannot be exercised if the processing of your personal data continues to be necessary for the fulfillment of our legal obligations or for the establishment, exercise, or defense of our legal claims (see above the subsection “Why do we process personal data and why are we entitled to do so?”).

Right to restriction of processing

In some cases, in addition to the right to erasure, you can also exercise the right to restrict the processing of personal data. This right allows you to request, in certain cases, that your personal data be specifically marked and excluded from any processing operations – in this case, the effect is limited in time (and not permanent as with the right to erasure). We must restrict the processing of personal data:

• if you contest the accuracy of the personal data, until we agree on which data is correct;
• if we process your personal data without an appropriate legal basis (e.g., beyond the intended scope), but instead of deleting such data, you prefer only to restrict it (e.g., if you assume that you will still provide us with this data in the future);
• if we no longer need your personal data for the purposes described above, but you need it to establish, exercise, or defend your legal claims; or
• if you file an objection against the processing of data. The right to object is described in more detail below under the title Right to file an objection against data processing. During the time your objection is being considered, we must restrict the processing of your personal data.

Right to data portability

You have the right to obtain from us all your personal data that you provided to us and which we process based on your consent and based on the implementation of a contract. We provide your personal data to you in a structured, commonly used, and machine-readable format. Simple data transfer is only possible for data that we process automatically in our electronic databases.

Right to object to data processing

Based on reasons related to your specific situation, you have the right to object to the processing of personal data based on point (e) or (f) of Article 6(1) of REGULATION (EU) 2016/679, as well as to object to the processing of data for direct marketing purposes (see subsection “Why do we process personal data and why are we entitled to do so?”). We will immediately stop processing your data for marketing activities; in other cases, we will do the same, unless we have legitimate reasons for processing that override your rights or for enforcing legal claims.

Right to lodge a complaint

Exercising the rights listed above in no way affects your right to lodge a complaint with the competent authority. You can exercise this right in particular if you assume that we are processing your personal data unjustifiably or contrary to generally binding legal regulations. You can complain about the data processing carried out on our part to the Information Commissioner (Informacijski pooblaščenec) at the address Dunajska cesta 22, 1000 Ljubljana.

How can you exercise certain rights?

Send us an email at info@lupus.studio or call us. We will fulfill your request as quickly as possible, and definitely within one month. In exceptional cases, especially when it comes to more complex requests, we have the right to extend this period by two additional months. In the event that such an extension is necessary, we will of course inform you.

Data Protection Officer

Our data protection officer is available to you in all matters related to the processing of your personal data. You can contact the officer at the email address: info@lupus.studio.

PayLike card system and data protection

The PayLike card system acts as a data controller regarding data about your payment instrument. For more information about processing, see their privacy policy: paylike.io/privacy/end-users.

This concludes the text you provided. If there is another part or a final tab, please send it over!