We process your personal data fairly, securely and transparently, in line with the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2). This policy explains what data we collect, why we collect it, and what rights you have.
Controller
- Maja Antolič s.p., Rudarjevo 19A, 2393 Črna na Koroškem, Slovenia
- Company registration number: 9406697000
- Email: info@mybambuddy.com
- Phone: +386 31 711 989
We are not required to appoint a data protection officer, because we carry out neither large-scale systematic monitoring of individuals nor large-scale processing of special categories of data.
What data and why
Purchases in the online shop
Name and surname, delivery and billing address, email address, phone number, order and payment details. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Without this data we cannot fulfil an order.
Invoice data is kept for 10 years after the end of the year it relates to, as required by tax legislation (legal obligation, Article 6(1)(c) GDPR).
User account
Email address, password in encrypted form, addresses and order history. Legal basis: performance of a contract. We keep this data for as long as the account exists. You may delete your account at any time — write to us and we will remove it, except for data we are required by law to keep.
Newsletter
Email address and date of sign-up. Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time using the unsubscribe link in every message, or by writing to our email address. We keep the data until you withdraw.
Questions and support
Whatever you send us in your message. Legal basis: our legitimate interest in answering your question (Article 6(1)(f) GDPR). Correspondence is kept for a maximum of two years.
Visiting the website
On each visit the server records the IP address, time of access and browser details. Legal basis: legitimate interest in the security and operation of the site. Logs are kept for a maximum of 30 days.
Who we share data with
We do not sell personal data. We share it only with those who need it to fulfil an order:
- Delivery service — name, address and phone number, in order to deliver the parcel.
- Stripe Payments Europe, Ltd. (Ireland) — card payment processing. We never receive or store card details.
- Hosting provider — server infrastructure in Slovenia.
- Accounting service — data from issued invoices.
- Public authorities — where required by law.
The website is hosted in Slovenia. Fonts are served from our own server rather than from external networks, so your IP address is not transferred to third countries when you view the site.
Your rights
At any time you may request:
- access to your data and a copy of it;
- correction of inaccurate data or completion of incomplete data;
- erasure of data where there is no longer a basis for processing;
- restriction of processing;
- portability of your data in a machine-readable format;
- objection to processing based on legitimate interest;
- withdrawal of consent, without affecting the lawfulness of processing before withdrawal.
Send your request to info@mybambuddy.com. We reply within one month at the latest. If you believe we process your data unlawfully, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
Security
The connection to the site is encrypted (HTTPS). Only people who need the data for their work have access to it. Passwords are stored in encrypted form. Even so, no transfer over the internet is completely secure — if you discover a security weakness, please write to us.
Cookies
Our use of cookies is described separately in the cookie policy.
Changes
We may update this policy. Last updated: 1 September 2026.
This is a translation of the Slovenian original. In case of any discrepancy, the Slovenian version prevails.