Privacy policy

The controller of your personal data is the company named at the foot of this page. For any question about how your data is handled, write to the email address given there.

When you place an order we collect your name, email address, delivery address, and phone number if you provide one. We need this to fulfil the contract. Without it the order cannot be delivered.

We never see or store your card details. Payment is handled entirely by Stripe, which is PCI DSS certified for that purpose.

The legal basis is performance of a contract (Art. 6(1)(b) GDPR) and compliance with tax obligations (Art. 6(1)(c) GDPR).

If you have not ordered again a month after a purchase, we send one reminder with an offer for SPOOF to the email address on the order. We tell you about this on the payment page, and every such email lets you unsubscribe with one click. The legal basis is our legitimate interest in offering our own products to existing customers (Art. 6(1)(f) GDPR).

For every visitor we run our own visit measurement, on our own server and in our own database in Frankfurt. It records which pages you view, how far you scroll, how long a page is on screen, where on the page you click, where you came from (for example an ad or a search engine) and whether the visit ended in a purchase.

Without consent this measurement stores nothing on your device. It joins page views into one visit using a hash of your IP address and browser that changes every day and is deleted after two days. We do not store your IP address, we do not recognise you from one day to the next, and we share this data with no one. The legal basis is our legitimate interest in understanding how the site is used and improving it (Art. 6(1)(f) GDPR).

If you accept in the banner, we also store a random identifier in your browser so we can recognise a return visit, and we load the Meta pixel (Facebook, Instagram), Google Analytics and Microsoft Clarity. Meta and Google record page views, add-to-cart events and purchases. Clarity records how you use the site (movement, clicks, scrolling) so we can see where people get stuck. Anything you type into forms is masked in those recordings.

When an order completes we also send the purchase to Meta directly from our server. Your email address, name and address are hashed with SHA-256 first, so Meta receives an irreversible fingerprint, not the data itself.

This happens only if you accepted. Without consent the pixel and Clarity are never loaded and no server-side send to Meta takes place. Google Analytics loads, but without cookies, and sends only signals Google uses to estimate traffic.

For measurement with consent, the legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

Stripe, to process payments. The delivery carrier, to deliver your parcel. Meta Platforms Ireland, Google Ireland and Microsoft Ireland, to measure advertising and record site use, if you consented. Vercel (hosting) and Neon (database), which store our own visit measurement on our behalf. Our accountants, to issue and retain invoices.

We do not sell personal data, and we do not share it with anyone not listed above.

Stripe, Meta, Google, Microsoft and Vercel may process data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses or on the EU-US Data Privacy Framework.

Order and invoice records are kept for ten years, as tax law requires.

Our own visit measurement, and data collected under consent for measurement, is kept for at most 24 months. Newsletter sign-ups are kept until you unsubscribe.

You may at any time request access to your data, its correction or erasure, restriction of processing, transfer to another provider, or object to processing. You may withdraw consent without affecting the lawfulness of processing carried out before you withdrew it.

Send your request to the email address at the foot of this page. We reply within one month at the latest.

If you believe we are processing your data unlawfully, you may complain to the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.

Strictly necessary: the locale cookie stores your chosen language, and the spoof.consent entry in your browser stores your measurement decision. The site does not work correctly without them and they do not require consent.

Measurement, only with consent: _fbp and _fbc from Meta, _ga and related cookies from Google Analytics, _clck and _clsk from Microsoft Clarity, and the spoof.vid entry in your browser that lets us recognise a return visit.

You can change your decision at any time via the Cookie settings link in the footer.

We may update this policy if the way we process data changes. The date of the last revision is shown at the top of the page. If a change is material, we will ask for your consent again.