Legal
Privacy Policy
What personal data Moriarty Karabinier processes, why, on what legal basis, for how long, who receives it, and how you exercise your rights under the GDPR.
Template prepared for the operator — to be reviewed by a lawyer before launch.
1. Controller
The controller of your personal data is Moriarty Karabinier, [to be completed], company ID [to be completed], e-mail [email protected]. We have not appointed a data protection officer; write to the address above with any privacy question.
2. What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing and delivering orders, payment, customer service | name, e-mail, phone, delivery and billing address, order contents, payment status (no card numbers) | Performance of a contract — Art. 6(1)(b) GDPR | For the duration of the contract and the limitation period for claims (typically 4 years) |
| Accounting and tax records (invoices) | invoice data, order data | Legal obligation — Art. 6(1)(c); Act 431/2002 Coll. on accounting, Act 222/2004 Coll. on VAT | 10 years from the end of the year the invoice relates to |
| Customer account | name, e-mail, password (stored only as an Argon2 hash), order history | Contract — Art. 6(1)(b) | Until you delete the account |
| Complaints and withdrawals | contact data, order, description of the defect, correspondence | Legal obligation — Art. 6(1)(c); Act 108/2024 Coll. | 5 years from the resolution of the complaint |
| Mailing list | e-mail, language, date of consent | Consent — Art. 6(1)(a) (at checkout: Art. 6(1)(f) with § 116(15) Act 452/2021 Coll. for our own similar products) | Until you unsubscribe (every e-mail contains a link) |
| Statistics (only if you allow statistics cookies) | random visitor ID, pages and products viewed, add-to-bag and checkout steps, referring website, campaign tags, device type, browser, language — no IP address | Consent — Art. 6(1)(a) and § 109(8) Act 452/2021 Coll. | 13 months |
| Proof of cookie consent | choice made, policy version, time, random visitor ID | Legal obligation to demonstrate consent — Art. 7(1) GDPR | 3 years |
| Security, fraud and abuse prevention | IP address in server logs, rate-limit counters, login events | Legitimate interest — Art. 6(1)(f) | Logs up to 30 days; counters minutes |
Providing data marked as required at checkout is necessary to conclude the contract; without it we cannot process the order. We do not use automated decision-making or profiling with legal effects.
3. Recipients
- Stripe Payments Europe, Ltd. (Ireland) — card payments. Stripe may transfer data to Stripe, Inc. (USA) under the EU–US Data Privacy Framework and standard contractual clauses.
- The carrier you choose (Packeta, DPD, SPS, Slovenská pošta, DHL Express) — name, delivery address, phone, e-mail, and the amount to collect for cash on delivery.
- Our hosting, e-mail delivery and backup providers acting as processors under Art. 28 GDPR, located in the EU/EEA.
- Our accountant and public authorities where the law requires it.
We never sell personal data and use no advertising networks or third-party analytics.
4. Your rights
You have the right of access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20), to object to processing based on legitimate interest (21), and to withdraw consent at any time without affecting prior processing (7(3)).
Signed-in customers can download all their data and delete their account themselves under Account → Your data. Cookie consent can be changed at any time via “Cookie settings” in the footer. Otherwise write to [email protected]; we reply within one month.
You may lodge a complaint with the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk — or with the authority in your EU country of residence.
5. Security
Connections are encrypted (HTTPS/HSTS); passwords are stored only as Argon2 hashes; the administration is reachable only from a private network; access is logged. Card data never touches our systems.