When you shop or contact us, you share personal information with us. This notice explains what we use, why we use it, who receives it and how you can exercise your rights.
We operate from Slovakia. The EU General Data Protection Regulation (GDPR) applies to processing in the context of our establishment; it does not cease to apply simply because your delivery address is outside the European Economic Area. Applicable local privacy laws may provide additional protection.
The data controller is MAKY.STORE s. r. o., Lermontovova 911/3, 811 05 Bratislava-Staré Mesto, Slovakia, IČO 57 704 627.
For privacy questions or requests, write to info@maky.store or to our registered office. Describe your request without sending a full payment-card number or other information we do not need.
We use your name, contact details, billing and delivery address, order and payment information and related correspondence. Business orders may include business details. Product-fit questions may include vehicle information or photos you choose to send us.
This lets us prepare and perform the contract, process payment, deliver the goods and respond to questions. The GDPR basis is Article 6(1)(b). For contact with a person representing a business customer, our legitimate interest in managing the business relationship may apply under Article 6(1)(f).
For a cross-border shipment we also use the information genuinely needed for customs clearance and delivery. A carrier or customs authority may require additional information. We ask only for what is relevant and explain a request when needed.
We do not store or have access to your full card number or security code. Stripe processes those details. We receive payment status and other information needed to reconcile, check or refund a payment.
We use identifying, transaction and invoice information for accounting, taxes and obligations to competent authorities. The GDPR basis is legal obligation, Article 6(1)(c).
We use your contact details, purchase information, notice or claim, relevant evidence and the history of its handling. Where needed, we retain records of submission, acknowledgment and confirmation delivery. Processing is based on legal obligations, contract performance and, where necessary, our legitimate interest in establishing, exercising or defending claims under Articles 6(1)(c), (b) and (f).
We do not require marketing consent or a separate consent checkbox for information that must be processed to handle a cancellation or product claim.
Account details are used to provide account access, sign-in and order history. The GDPR basis is the requested service under Article 6(1)(b). You can purchase or send a cancellation notice without an account.
When you choose to subscribe, we use your email and consent record for the newsletter. The GDPR basis is consent, Article 6(1)(a). You can unsubscribe using the message’s link or by emailing us. We keep only the information needed to respect the withdrawal and any necessary record of consent; subscribing is not a condition of purchase.
We use proportionate technical access and error logs, security information and records needed to prevent abuse or protect legal claims. The basis is our legitimate interest, Article 6(1)(f), balanced against your rights. This is not blanket permission for advertising tracking.
Optional analytics, marketing and browser-storage technologies are described on our Cookies and privacy page. Their use must also satisfy the applicable consent or opt-out rules.
Most information comes from you when ordering, opening an account, submitting a form or corresponding with us. The payment provider supplies payment information, and the carrier supplies relevant delivery or clearance information. Technical information is generated when you use the website.
Required fields are limited to the information needed for the relevant purpose. Without a usable delivery address, for example, we cannot ship an order. You need not complete optional fields or agree to optional marketing. If you provide information about someone else receiving an order, make sure they know it is being shared for delivery.
A provider does not automatically receive every customer’s information. The recipient depends on the service used, the order and the website functions involved. The selected carrier receives the details needed to transport and deliver the package, including relevant customs information. Stripe processes payment information.
Technical hosting and service providers, email providers, accounting advisers and, where necessary, legal advisers may access relevant information. Authorities receive it where legally required. Providers may act as processors on our instructions or as independent controllers for their own purposes, depending on their actual role.
| System or service | Purpose |
|---|---|
| Saleor (api.maky.store) | Catalog, cart, orders and customer accounts in our own installation. |
| Payload CMS (cms.maky.store) | Website content and the forms or case records actually enabled in our own installation. |
| Stripe | Payment processing, payment status, refunds and the provider’s fraud-prevention checks. |
| FedEx, Slovenská pošta | Shipping, delivery, customs information and contact with the recipient for the selected service. |
| Cloudflare | Website delivery and security; Web Analytics as described on the cookies page. |
| Google (Tag Manager, Analytics) | Tag management and, according to configuration and choices, measurement and advertising purposes. |
This table identifies systems and purposes, not a legal basis or contracted legal entity for every row. Our own Saleor and Payload installations do not become separate outside controllers just because the software has a name. Contact us for further information about specific recipients and the safeguards used.
We process information in Slovakia and use services that may involve processing in other countries. Delivering to the United States necessarily involves relevant information being used by the carrier and, where required, customs authorities there. Those authorities may have powers under their own laws.
For transfers from the EEA to a third country, we use the applicable GDPR mechanism, such as an adequacy decision covering the actual recipient or appropriate safeguards including standard contractual clauses, together with any required additional measures. We do not assume that every service of a large provider is covered by one certification or mechanism.
You can contact info@maky.store for information about the relevant transfer and, where applicable, a copy of the safeguards, with confidential information appropriately protected. Your applicable privacy rights are not waived by purchasing from a seller outside the United States.
We keep order information for fulfillment and then as needed for legal obligations and claims. Slovak accounting documents are generally retained for 10 years after the relevant accounting year, according to the applicable category and rules. That does not mean every optional message or browser identifier is kept for ten years.
We keep cancellation and product-claim records for handling and the applicable legal, evidence and limitation periods. An account is retained while the service is active, subject to deletion requests and information that must be kept independently for an order or legal obligation.
Newsletter information is used until you unsubscribe, with limited records retained where needed to demonstrate consent or respect your preference. Security logs are kept for a proportionate period based on their purpose and the need to investigate an incident. Browser-storage periods appear on the cookies page.
A legal duty, ongoing dispute or valid preservation requirement may justify keeping specific information longer. We do not retain unrelated information indefinitely just because one record is needed.
Under the GDPR, subject to its conditions, you may request access, correction, deletion, restriction and portability of your personal information. You may object to processing based on legitimate interests for reasons related to your situation. For direct marketing, you can object at any time, and we stop processing for that purpose.
Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Deletion is not absolute: an invoice or evidence required by law may need to be retained. We explain an applicable exception rather than ignoring the request.
Write to info@maky.store. We may request proportionate information to verify identity, not unnecessary documents. GDPR requests are ordinarily answered within one month; a permitted extension for complexity or volume requires notice and reasons within that first month. A different or shorter local deadline is applied where required.
Depending on the state law that applies and whether its coverage conditions are met, you may have additional rights to access, correct, delete or obtain a copy of personal information; opt out of its sale, sharing for cross-context behavioral advertising or targeted advertising; and appeal a decision on a request. California law also provides rights relating to certain uses of sensitive personal information where applicable. These rights have statutory conditions and exceptions; we do not suggest that every state law applies identically.
Send a privacy request to info@maky.store. Tell us the right you want to exercise; you do not need to know a legal provision. We verify requests only as reasonably necessary, allow an authorized agent where required and explain any refusal and applicable appeal route. Exercising a privacy right does not mean you lose the ability to shop or face unlawful discrimination.
Advertising-related transfers can have a legal meaning of “sale” or “sharing” even where no one pays for the data. We therefore do not describe all third-party marketing tools as outside those rules merely because they are called analytics. Where an applicable law requires an opt-out link or recognition of a browser preference signal, those requirements apply in addition to ordinary cookie choices.
Please contact us so we can address a privacy concern. You can also complain to a competent supervisory authority without first obtaining our permission.
The Slovak authority is Úrad na ochranu osobných údajov Slovenskej republiky; its official website is dataprotection.gov.sk. In the United States, you may contact your state’s attorney general or other competent privacy regulator. California residents can find information from the California Privacy Protection Agency at cppa.ca.gov and the Attorney General at oag.ca.gov/privacy/ccpa. The Federal Trade Commission also accepts reports within its remit at ReportFraud.ftc.gov.
Which authority can handle a particular complaint depends on its jurisdiction and the law involved. Naming it does not suggest that it has certified MAKY.STORE.
In the store’s described order process, we do not ourselves make decisions based solely on automated processing that produce legal or similarly significant effects for you, or profile you for that purpose. This does not mean that no technical or security check is automated.
Stripe performs its own payment and fraud-prevention checks as a payment provider. If a payment is declined or another automated outcome appears wrong, contact us and we will review what we can access and help identify the next step. We do not claim to control every independent decision of the payment provider.
We update this notice when processing or services change. A change to this document is not, by itself, consent to a new purpose. Where new information or a new choice is required, it must be provided through the appropriate process.
