Privacy Policy
This is an English translation provided for convenience. If it differs from the Slovenian version, the Slovenian version prevails.
1. Controller
The controller of the personal data collected in the online store www.zeleznina.si is:
ŽELEZNINA, trgovina na debelo in drobno, d.o.o. Partizanska cesta 2, 3320 Velenje, Slovenia Registration number: 9093451000 · VAT ID number: SI94868026 · registered with the District Court in Celje
For questions about the protection of personal data and to exercise the rights set out in section 7, write to spletna-trgovina@zeleznina.si or to the address of our registered office.
We have not appointed a data protection officer, because we do not carry out the processing referred to in Article 37 of the General Data Protection Regulation (GDPR).
We process data in accordance with the GDPR and the Personal Data Protection Act (ZVOP-2).
2. What we process, why and on what basis
Data marked as mandatory in the forms are necessary for concluding and performing the contract; without them we cannot accept the order. Everything else is optional or depends on your consent.
2.1 Purchase — with an account or as a guest
| What | Why | Legal basis |
|---|---|---|
| first name and surname, delivery address, telephone, e-mail address | performance and delivery of the order, notifications about it | contract (Article 6(1)(b) GDPR) |
| company name and VAT ID number, if you enter them | invoice to a legal entity | contract |
| order contents, amount, payment method and payment status | performance of the contract, issuing the invoice | contract; legal obligation (Article 6(1)(c)) |
| billing address, if different | issuing the invoice | contract; legal obligation |
Delivery and billing addresses are encrypted in our database.
If you create a user account, we also store your e-mail address, a hashed password (we do not know the password), the addresses and wish list you save, and your choices regarding notifications (section 2.6).
If you register or sign in with a Google account, Google provides us with your e-mail address, name and Google account identifier; we store the identifier so that we can recognise you the next time you sign in. Google thereby learns that you have signed in to our store; its processing is governed by Google's privacy policy. Basis: the user account contract (Article 6(1)(b)).
2.2 Payment by card, Apple Pay or Google Pay
Card payments, including via Apple Pay and Google Pay, are carried out by Stripe. We do not receive or store your card number — you enter it directly into Stripe's payment field. From Stripe we receive only the transaction identifier and the payment outcome.
If you pay with Apple Pay or Google Pay, you confirm the payment in the wallet of Apple or Google, respectively, using a card stored on your device or in your Google account, respectively. In doing so, Apple or Google also processes your data under its own terms and privacy policy, which you accepted when using the wallet; Apple and Google are not our processors.
2.3 Delivery
When you choose delivery, we provide Pošta Slovenije with your first name and surname, address, telephone, e-mail address, company name if you entered one, and the parcel details. For in-store pickup we do not provide data to a carrier. Basis: contract.
2.4 Invoices
We retain issued invoices and the data related to them because tax legislation requires us to do so. Basis: legal obligation.
2.5 Contact form
We process your first name and surname, e-mail address and the content of your message so that we can reply to you. Basis: our legitimate interest in replying to the enquiry (Article 6(1)(f)); where the message concerns an order, the contract. If you open the form from a product page, the product name and product code are already entered in the message.
2.6 Newsletter and price-reduction notifications
We send the newsletter only if you subscribe to it and confirm your subscription via the link you receive by e-mail. We store the e-mail address, the IP address used to subscribe, the selected language and the time of subscription and confirmation — so that we can prove consent. We delete an unconfirmed subscription after 30 days. Basis: consent (Article 6(1)(a) GDPR; Electronic Communications Act (ZEKom-2), Article 226). You withdraw consent via the unsubscribe link in every message or by writing to spletna-trgovina@zeleznina.si; withdrawal does not affect the lawfulness of processing before it. When you unsubscribe, we delete your e-mail address and subscription data.
If you received a discount code when confirming your subscription, we store a pseudonymised (hashed) value of the e-mail address and the date it was granted, so that the same address does not receive a new code. The record is kept even after you unsubscribe, and we delete it 24 months after it was granted or upon deletion of the account or of the order data with that e-mail address. Basis: legitimate interest in preventing abuse (Article 6(1)(f)).
We send wish list price-reduction notifications only if you switch them on in your profile (My Profile → Email notifications). When a product on your wish list is reduced in price or a coupon is available for it, we let you know by e-mail, only once for the same reduction. You can switch the notifications off at any time in your profile or via the unsubscribe link in every such message. As long as the account exists, we keep a record of which reductions we have already notified you about. Basis: consent (Article 6(1)(a) GDPR; ZEKom-2, Article 226).
We do not track whether you opened an e-mail or clicked a link in it.
2.7 Returns and complaints
We process the order number, e-mail address, reason for the return and our communication with you. Basis: contract and legal obligation under the Consumer Protection Act (ZVPot-1).
2.8 Visit measurement (only with consent)
If you consent to “Analytics Cookies” in the cookie banner, we collect a random session identifier
(visitor_session), a random erasure identifier (analytics_erasure_id), a hashed value
of the truncated IP address (for IPv4 only the first two numbers; we do not store IPv6), browser data,
the address of the page on which you gave consent, and which products you viewed. If you place an
order in the same session, we store the session identifier with the order.
Purpose: to understand what interests visitors and to improve the store. Basis: consent (Article 6(1)(a)). The measurement is our own; the data remain on our server and we do not pass them on to advertisers; we do not use any external tool (e.g. Google Analytics).
You withdraw consent in the banner (“Cookie Settings” in the page footer). We then delete both cookies and the viewing data from that browser from the last 12 months, and from the visit records we remove the hashed IP address, the browser data and the page address. We delete older data after 25 months. More details in the Cookie Policy.
2.9 Searches with no results
When a search returns no product, we store the search text without a visitor identifier, so that we can see what is missing from our range. Basis: legitimate interest in improving our range.
2.10 Security and abuse prevention
For sign-in, registration, password reset, the contact form, newsletter subscription, return requests, data deletion requests and, when enabled, order placement, we use Cloudflare Turnstile, which distinguishes a human from an automated program; in doing so, Cloudflare receives the IP address and technical data about the browser.
When you look up an order using the order number and e-mail address, we count failed attempts; after 10 failed attempts we temporarily refuse lookups with that e-mail address. We store the counter under a hashed value of the e-mail address and delete it 24 hours after the first attempt.
If, when making a purchase, you use a coupon that each buyer may use only once, we store with the order a hashed (pseudonymised) value of the e-mail address, so that the coupon cannot be used again with the same address. For other coupons we do not store this value. We delete it when the coupon expires or we remove it, or earlier if you request deletion of your data.
Basis for all three: legitimate interest in protecting the store and ensuring a functioning service (Article 6(1)(f)).
2.11 Google Ads (only with consent)
We do not display ads on our site. We display our ads on Google's services, and if you consent to “Marketing Cookies” in the cookie banner, Google learns whether you came via our ad and whether you then made a purchase. Google receives your IP address, technical data about the browser, the pages visited and, on a purchase, the order number and amount. We do not send it your name, e-mail address, telephone or postal address.
Purpose: to measure the effectiveness of our ads and to show them to people who are interested in the store. Basis: consent (Article 6(1)(a)). Google is an independent controller of these data (Google Ireland Limited) and may use them to show personalised ads. Without consent, nothing connects to Google Ads. You withdraw consent in the banner (“Cookie Settings” in the page footer); we then inform Google that consent is no longer given and delete the Google Ads cookies on our domain. The list of cookies is in the Cookie Policy, section 6.
3. What we do not do
- We ourselves do not carry out profiling and do not make automated decisions about you. If you consent to marketing cookies, Google uses the data about your visit to show our ads (section 2.11).
- We do not sell personal data.
- We use advertising cookies (Google Ads) only with your consent; we do not use Google Analytics, Meta Pixel or other advertising networks.
4. To whom we disclose data
We disclose data to contractual processors that provide services for us, and to authorities where this is required by law. We have concluded contracts with the processors under Article 28 GDPR.
| Who | For what | Where |
|---|---|---|
| NORMA SOFT, Računalniški inženiring d.o.o. Velenje, Efenkova cesta 61, 3320 Velenje | development and maintenance of the online store, management of its server and maintenance of the Calculus business system (orders, invoices, stock) | Slovenia |
| Hetzner Online GmbH | server, file storage and encrypted backups | Germany (EU) |
| Pošta Slovenije d.o.o. | parcel delivery | Slovenia |
| Stripe Payments Europe, Ltd. | card payments | Ireland (EU), with transfers to the USA |
| Mega M d.o.o., Rudarska cesta 6, 3320 Velenje | the store's mailbox and sending the store's e-mails and newsletters | Slovenia |
| Cloudflare, Inc. | protection of forms against automated abuse | USA and global network |
We may also disclose data to an accounting service, a lawyer or a debt collector where this is necessary to fulfil obligations or to assert legal claims, and to the competent authorities.
Google is not our processor: it receives data as an independent controller when you sign in with a Google account (section 2.1), pay with Google Pay (section 2.2), start a YouTube video (Cookie Policy, section 8) or consent to marketing cookies for Google Ads (section 2.11). The same applies to Apple when you pay with Apple Pay.
4.1 Transfers to third countries
Processing takes place mainly in the EU. Stripe, Cloudflare, Google and Apple are part of groups with their registered office in the USA, so data may be transferred out of the EU. Transfers take place on the basis of the EU–US Data Privacy Framework (where the provider is included in it) or the standard contractual clauses of the European Commission. You can request a copy of the safeguards at spletna-trgovina@zeleznina.si.
5. How long we keep data
| What | How long |
|---|---|
| user account | as long as the account exists; upon deletion we delete or anonymise the data |
| orders and issued invoices | 10 years after the end of the year to which the invoice relates (Value Added Tax Act (ZDDV-1), Article 86) |
| shipping labels and shipment lists | 90 days; only the status and the tracking number remain |
| visit measurement (with consent) | 25 months |
| Google Ads cookies (with consent) | 90 days in your browser |
| identifier for erasing visit measurement data | 12 months |
| searches with no results | 90 days |
| counter of failed order lookups | 24 hours |
| record of wish list notifications sent | as long as the user account exists |
| newsletter subscription | until you unsubscribe; unconfirmed subscription 30 days |
| hashed value of an e-mail address that received a newsletter code | 24 months from when it was granted |
| hashed value of the e-mail address for a coupon limited to one use per buyer | until the coupon expires or we remove it |
| messages from the contact form | until the matter is resolved and thereafter for as long as necessary for evidence |
| return requests and complaints | until the procedure is concluded and thereafter within the statutory time limits for asserting claims |
| record of cookie consent | 12 months in your browser |
| login session / “Remember me” | 120 minutes of inactivity / at most 400 days |
| encrypted database backups | 30 days |
When the period expires, we delete the data or irreversibly anonymise them, unless we need them to assert or defend legal claims. Data that we delete remain in backups for at most a further 30 days.
6. Security
Traffic is encrypted (HTTPS), addresses are also encrypted in the database, we store passwords only in hashed form, we do not receive card data, and access to the database is limited to persons who need it for their work. Database backups are encrypted. We will inform you of any security breach that is likely to result in a high risk to your rights and report it to the Information Commissioner.
7. Your rights
You have the right of access to the data and to a copy, the right to rectification, to erasure, to restriction of processing, to portability, to object to processing based on legitimate interest, and to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
How to exercise them:
- with a user account: in your profile under “Security” you can export your data, withdraw the consent given at registration and delete the account;
- as a guest: you can request deletion via the form in the store, using the order number and e-mail address;
- at any time: by writing to spletna-trgovina@zeleznina.si.
We reply within one month at the latest; for complex requests we may extend this period by at most two months and will inform you of this. Before fulfilling a request, we verify your identity. We cannot delete data that we are required to retain by law (for example, issued invoices); we will explain to you which data remain and why.
7.1 Complaint to the supervisory authority
Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, 01 230 97 30, www.ip-rs.si
8. Children
The store is not intended for children. Where processing is based on consent, the consent of a child under 15 years of age is valid only if it is given or approved by a parent or guardian (ZVOP-2, Article 8). If you believe that a child has provided us with data, write to us and we will delete them.
9. Changes
We amend this policy when the operation of the store or the legislation changes. The version published on this page applies.
Effective from 27 October 2026.