Privacy Policy

Effective from 29. 9. 2026. This explains what personal data we process, why, who receives it and your rights under the GDPR and the Slovenian Personal Data Protection Act (ZVOP-2).

1. Controller

Spletna prodaja zbirateljskih kart, Urban Vantur s.p., Veluščkova ulica 7, 2000 Maribor, Slovenija, VAT ID SI48046973, registration no. 7340524000. Contact: mintcolacards@gmail.com or by post. We are not required to appoint a data protection officer.

2. What we process, why and on what basis

• Carrying out your order (confirmation, delivery, payment, communication, returns and complaints): name, delivery address, email, phone (optional; required for cash on delivery), ordered cards, amounts, payment method, your note — performance of the contract (Art. 6(1)(b) GDPR); kept until contractual claims expire, normally 5 years.
• Invoices and accounting: invoice data — legal obligation (Art. 6(1)(c); Slovenian VAT, fiscal-verification and accounting law); kept 10 years after the end of the year concerned.
• Fraud prevention and shop security (holds during payment, limits on open cash-on-delivery or bank-transfer orders per email/phone, bot protection): legitimate interest (Art. 6(1)(f)).
• Preventing repeated abuse (e.g. refused cash-on-delivery parcels, fake orders, fraudulent payments): email, phone, address and the order concerned — legitimate interest (Art. 6(1)(f)); kept 2 years from the last such order.
• Establishing or defending legal claims: legitimate interest (Art. 6(1)(f)), until the matter is closed.
• Customer account (optional: log-in, order history, saved addresses, preferred payment method): first and last name, email, password (stored only as a secure hash, never in plain text), saved addresses and phone, sign-up and last log-in dates — performance of the contract for the account (Art. 6(1)(b)); kept until you delete the account; accounts without a log-in for 3 years are deleted.
• Log-in security (protection against password guessing): failed log-in attempts (email or an unreadable hash of the IP address) — legitimate interest (Art. 6(1)(f)); kept 24 hours.
• Newsletter about sales and new arrivals: email, language, time and wording of your consent, confirmation time — consent (Art. 6(1)(a); Slovenian ZEKom-2), confirmed through your email address (double opt-in); until you unsubscribe, with proof of consent kept until claims expire.
• "Remember my details" at checkout: stored only in your own browser, we never receive it — consent (Art. 6(1)(a)), until you delete it or untick the box.

Order data is a contractual requirement: without name, address and email we cannot fulfil the order; cash on delivery needs a phone number. Creating an account is optional — you can always order as a guest. No selling of data, no profiling. We only send newsletters if you explicitly subscribe; every email and your account let you unsubscribe at any time. We take no decisions based solely on automated processing; payment providers may run automated fraud checks as part of their services.

3. Recipients

Processors (acting on our instructions under a data processing agreement): Cloudflare, Inc. (USA) — hosting, order database, security; Resend, Inc. (USA) — order emails; our accounting service. Independent controllers (under their own privacy policies): Stripe Payments Europe, Limited (Ireland) — card and wallet payments and fraud prevention, and Klarna Bank AB (publ) (Sweden) if you choose Klarna; PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg); Pošta Slovenije and its partners abroad — delivery; our bank — transfers and refunds; public authorities where the law requires. Transfers to the USA rely on the EU-US Data Privacy Framework adequacy decision where the provider is certified, otherwise on the European Commission's standard contractual clauses.

4. Cookies and local storage

We use no analytics, advertising or tracking cookies. When you log in, your browser gets one session cookie ("mc_sid", HttpOnly, valid for up to 30 days or until you log out), which is strictly necessary to keep you logged in and needs no consent. Your browser's local storage keeps only what the shop needs to work as you requested — your bag, saved cards, language and country — which needs no consent under the Slovenian Electronic Communications Act (ZEKom-2); your checkout details are kept only if you choose "Remember my details". Our own statistics are anonymous aggregated counts without cookies, IP addresses or identifiers. Should we ever add analytics or advertising tools, they will not load before you consent.

5. Security

The site runs over HTTPS only. We never receive card details. Passwords are stored only as a hash (PBKDF2-SHA256 with a random salt), and log-ins are protected against password guessing. Order data is access-restricted; order-status links contain a random security key.

6. Your rights

You have the right of access, rectification, erasure, restriction, portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting earlier processing). You can delete your account yourself at any time under "My account". Data we must keep by law (e.g. invoices) cannot be erased. Write to mintcolacards@gmail.com or by post to Veluščkova ulica 7, 2000 Maribor, Slovenija. We reply without undue delay and within one month; for complex or numerous requests this may be extended by up to two months, and we tell you so within the first month. Requests made by email are answered by email. If we have reasonable doubts about your identity, we may ask for information to confirm it. For manifestly unfounded or excessive (e.g. repeated) requests we may charge a reasonable administrative fee or refuse to act. You can complain to the Slovenian Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si, or to the supervisory authority of your EU country.

7. Changes

We may update this policy; changes are published on this page with their effective date, and registered users are also told about material changes by email.