Privacy policy

How we protect your privacy

This document explains what personal data we process about you, for what purposes and on what legal basis, how long we keep it, who we share it with and what rights you have. We process your data in accordance with Regulation (EU) 2016/679 (GDPR).

1. Who we are and how to reach us

The controller is Vladimír Obuch, Podhorská 3, 902 01 Pezinok, Slovakia, registered in the Trade Register (Živnostenský register), reg. no. 1634/99, company ID (IČO): 36981729, tax ID (DIČ): 1020150659, VAT ID: SK1020150659, telephone +421 2 3307 0445 or +421 918 112 650, e-mail: info@lotsi.sk.

We operate the online shops lotsi.sk and lotsi.at.

We have not appointed a data protection officer. For any question about this document or to exercise your rights, write to info@lotsi.sk or to the address above.

2. What data we process and why

2.1 Purchase and order fulfilment
Name and surname, e-mail address, delivery address, telephone number, the subject and value of the order, payment and delivery method, order history. Without this data we cannot process and deliver your order.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for issuing and retaining invoices, compliance with a legal obligation (Art. 6(1)(c) GDPR).
Providing this data is a contractual requirement. Without it the contract cannot be concluded or performed.

2.2 Customer account
Login credentials, name and surname, e-mail address, postal address, telephone number, saved addresses and order history.
Legal basis: performance of the contract for operating the account (Art. 6(1)(b) GDPR). An account is not required in order to shop.

2.3 Complaints and withdrawal from the contract
Identification and contact details, order data, the content of the withdrawal notice including the date and time it was sent, a description of the defect claimed, and where applicable a bank account number for the refund.
Legal basis: performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).

2.4 Newsletter
E-mail address and name. Sign-up uses double opt-in.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via the unsubscribe link in every message or by e-mail to info@lotsi.sk. Withdrawal does not affect the lawfulness of processing before it.

2.5 LOTSI Klub loyalty programme
Identification and contact details, points balance and the history of earning and redeeming points.
Legal basis: performance of the loyalty programme contract (Art. 6(1)(b) GDPR).

2.6 Wishlist and back-in-stock notifications
Browser or account identifier, list of saved products; for back-in-stock alerts also the e-mail address to which we send the notification.
Legal basis: our legitimate interest in providing the requested function, or your consent when signing up for a notification (Art. 6(1)(f) or (a) GDPR).

2.7 Communication and customer support
The content of e-mails, chat messages on our website and telephone enquiries, together with contact details.
Legal basis: performance of a contract and our legitimate interest in handling your request (Art. 6(1)(b) and (f) GDPR).

2.8 Visiting our website, cookies and marketing
Device and browser data, IP address, pages visited, searches, add-to-cart and checkout events, referral source, identifiers from cookies and similar technologies.
Legal basis: for strictly necessary cookies, our legitimate interest in operating the website; for analytics and marketing cookies and tools, your consent only(Art. 6(1)(a) GDPR), which you give in the cookie banner and may change or withdraw at any time.

2.9 Security and protection of rights
Data needed to secure our services, prevent fraud, establish and defend legal claims and take part in proceedings before public authorities.
Legal basis: our legitimate interest or compliance with a legal obligation (Art. 6(1)(f) and (c) GDPR).

3. Cookies and consent

Cookies are small files stored in your browser or on your device while you browse websites. Some are deleted when you close the browser (session cookies), others remain stored for longer (persistent cookies).

Strictly necessary cookies make the website work — logging in, the shopping cart, security. The shop would not function without them, so no consent is required for these.

Analytics and marketing cookies and third-party tools are used only after you have given consent in the cookie banner. Until consent is given, these tools are not loaded. Consent is voluntary and can be withdrawn or changed at any time in the cookie settings on our website; withdrawal does not affect the lawfulness of processing before it.

You can also manage, block or delete cookies directly in your browser. Disabling some cookies may limit how the website works. If you use several devices, the setting must be made in each browser separately.

4. Who we share data with

We do not publish or sell your personal data. We share it only with recipients who process it on our behalf under a data processing agreement, and only to the extent needed for the given purpose:

Operating the online shop
Shopify International Limited (Ireland), part of the Shopify Inc. group (Canada) — the platform our shop runs on, including the website chat.

Delivery
Packeta Slovakia s. r. o., company ID: 48136999, Kopčianska 3338/82A, 851 01 Bratislava, Slovakia.
Depending on the destination country, the carrier selected at checkout — including DPD, Österreichische Post, Hermes, Post Nord, Omniva, Matkahuolto, Mondial Relay, Colis Privé, BoxNow, Express One, ACS, Correos, MRW and the national postal operators of the delivery country.

Payment processing
Global Payments Europe, s.r.o., V Olšinách 626/80, Strašnice, 100 00 Prague 10, Czech Republic, ID: 27088936. Supervision in the area of payment services is exercised by the Czech National Bank.

Accounting and invoicing
ProZuma s.r.o., company ID: 31436790, Mladoboleslavská 1, 902 01 Pezinok, Slovakia — bookkeeping.
SuperFaktura, s.r.o., company ID: 46655034, Fraňa Kráľa 986/35, 811 05 Bratislava, Slovakia — issuing and managing invoices. Privacy policy.
Rac Development s. r. o., company ID: 56692293, Karpatské námestie 7770/10A, 831 06 Bratislava, Slovakia — operator of the GoodEshop service, which transfers order data from the shop to the invoicing system. Privacy policy.

Marketing, analytics and advertising
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Google Analytics, Google Ads and Google Merchant Center. See the Google privacy policy.
Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland — advertising measurement and targeting on Facebook and Instagram. See the Meta privacy policy.

Additional shop functions
APPSOLVE SRL, Grigore Mora 11, 011885 Bucharest, Romania — wishlist. Privacy policy.
MAMA media s.r.o., Na Hrebienku 1, 811 02 Bratislava, Slovakia — LOTSI Klub loyalty programme. Privacy policy.
REZ Commerce, Vietnam — back-in-stock notifications. Privacy policy.
Mintt Studio, Rua Parque da Republica 116, 4430-164 Vila Nova de Gaia, Portugal — Instagram gallery on our website. Privacy policy.
Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA — hosting of our withdrawal and returns portal. Privacy policy. EU representative: DP-Dock GmbH, Ballindamm 39, 20095 Hamburg, Germany.

Other recipients
We may also share data with courts, authorities competent to supervise our activity, resolve disputes or enforce decisions, and with our legal, tax and accounting advisers, where necessary to comply with our obligations or to establish and defend legal claims.

5. Transfers to third countries

Some of the recipients listed above belong to international groups, so your data may also be processed outside the European Economic Area, in particular in the United States and Canada.

Such transfers take place on the basis of an adequacy decision of the European Commission — for recipients in the United States certified under the EU-U.S. Data Privacy Framework, and for Canada under the adequacy decision covering commercial organisations — or, where no adequacy decision applies, on the basis of the standard contractual clauses approved by the European Commission together with appropriate supplementary safeguards.

6. Automated decision-making and profiling

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you.

If you consent to marketing cookies, more relevant advertising and content may be shown to you based on your behaviour on our website. You may object to this processing at any time or simply withdraw the relevant consent in the cookie settings.

7. How long we keep data

• Invoices and accounting records — 10 years following the year to which they relate, under the Slovak Accounting Act.
• Order data beyond the accounting records — for as long as needed to handle any complaints and to establish or defend legal claims, as a rule 4 years from delivery.
• Customer account — for as long as the account exists. After it is closed we delete the data within 10 days; removal from backups may take longer, but no more than 60 days.
• Newsletter — until consent is withdrawn.
• Loyalty programme — for the duration of your participation.
• Communication and customer support — as a rule 2 years from the last communication.
• Cookies and data from analytics and marketing tools — according to the lifetime of the individual files, which you can find in the consent settings, and in any event no longer than until consent is withdrawn.

8. How we protect your data

We have put in place appropriate technical and organisational measures to protect your data against unauthorised access, alteration, destruction, loss and misuse — in particular encrypted data transfer, access management, regular backups and the selection of providers offering sufficient guarantees. Our staff and partners who come into contact with personal data are bound by confidentiality, which continues after the end of their cooperation with us.

9. Your rights

• Right of access — to obtain confirmation as to whether we process personal data about you and, if so, information about what data, for what purpose, to whom it has been disclosed, whether it has been transferred to a third country and how long we will keep it, together with a copy of that data.
• Right to rectification — to have inaccurate data corrected and incomplete data completed. Most data can be corrected by you in your account settings.
• Right to erasure — where the data is no longer needed for the purpose, where you withdraw consent and there is no other legal basis, where you successfully object to the processing, or where the data was processed unlawfully. This right does not apply where we are legally required to keep the data, for example in our accounting records.
• Right to restriction of processing — while the accuracy of the data is verified, in the case of unlawful processing instead of erasure, where you need the data to establish legal claims, or while your objection is being assessed.
• Right to data portability — to receive the data we process on the basis of consent or a contract by automated means, in a structured, commonly used and machine-readable format, and where technically feasible to have it transmitted to another controller.
• Right to object — to processing based on our legitimate interest, on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time and without giving reasons; we will then stop processing your data for that purpose.
• Right to withdraw consent — where we process data on the basis of your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it.
• Right to lodge a complaint — with a supervisory authority, if you believe that our processing infringes the law.

10. How to exercise your rights

Simply e-mail info@lotsi.sk or write to the address in section 1. Please state your name, surname and e-mail address, and where relevant your home address — we need to verify your identity so that we do not disclose data to an unauthorised person.

We will respond within one month of receiving your request. If the request is complex or we receive several requests, we may extend this period by up to two further months; we will inform you of the extension and the reasons within one month of receipt. Handling your request is free of charge.

11. Supervisory authority

Our lead supervisory authority is the Office for Personal Data Protection of the Slovak Republic: Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovakia, e-mail: statny.dozor@pdp.gov.sk, telephone +421 2 32 31 32 14, dataprotection.gov.sk.

You may also lodge a complaint with the supervisory authority of the EU Member State in which you reside or work, or in which the alleged infringement took place.

We would appreciate it if you told us about any concern first — most things can be resolved quickly and directly.

12. Changes to this document

We may update this document from time to time, in particular if our services or the tools we use change. The current version is always available on this page.

Effective from 28.08.2026