Privacy Policy

Privacy Policy

Effective from: 24 August 2026

Protecting your personal data is a priority for us. This policy explains what data we collect, why we collect it, and what rights you have under Regulation (EU) 2016/679 (the „GDPR“).

I. Data controller

As the controller, we are responsible for the processing of your personal data. Given the nature and scope of our processing we have not appointed a Data Protection Officer; for any data protection matter please contact us at the e-mail address above.

II. What data we process, why, and for how long

1. Processing your order and performing the contract

When you buy from our e-shop we need the data required to process your order properly.

• Data processed: name and surname, billing and delivery address, e-mail address, phone number, order details, and where you pay by bank transfer or return goods also your bank account number; for business purchases also company ID and VAT ID.
• Purpose: concluding and performing the purchase contract, issuing accounting and tax documents, communicating about the status of your order, handling complaints and withdrawals, and complying with legal obligations.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Art. 6(1)(c) GDPR), in particular accounting and VAT rules including the OSS scheme.
• Retention: accounting documents for 10 years from the end of the accounting period they relate to. Other order data for the warranty period and 3 years thereafter.

2. Custom production and personalised goods

If you order made-to-measure or personalised goods, we also process the materials you send us for that purpose.

• Data processed: the text, name or motif to appear on the product, and where applicable a 3D model, photographs, sketches or other materials you supply.
• Purpose: producing the goods according to your brief.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Retention: 3 years from delivery, so that we can handle a possible complaint or reproduce the same item. We do not use these materials for any other purpose and do not share them with third parties.

3. Customer support

If you contact us with a question or request by e-mail, phone or the contact form.

• Data processed: name and surname, e-mail address, phone number and the content of your message including any attached photographs.
• Purpose: communicating with customers and providing support before, during and after a purchase.
• Legal basis: performance of a contract or steps taken prior to entering into a contract (Art. 6(1)(b) GDPR); for enquiries that do not lead to an order, our legitimate interest in answering the enquiry (Art. 6(1)(f) GDPR).
• Retention: no more than 3 years from the last communication, unless a contractual relationship arose from it.

4. User account

• Data processed: login credentials, contact and billing details, order history.
• Purpose: maintaining your account and making future purchases easier.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Retention: for as long as the account exists. We may close an account after more than a year of inactivity and then delete the data, except data we must retain by law.

5. Marketing communication

• For our customers (legitimate interest): if you have purchased from us, we may send you commercial messages about similar products on the basis of our legitimate interest (Art. 6(1)(f) GDPR). You can unsubscribe at any time using the link in the footer of every e-mail. We process the data for no more than 3 years from your last purchase unless you unsubscribe sooner.
• Based on consent: if you are not our customer and sign up for our newsletter, we send it only on the basis of your consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time using the unsubscribe link. We process the data for as long as the consent lasts.

6. Purchase ratings and reviews

• Data processed: name, e-mail address, content of the review.
• Purpose: measuring satisfaction and publishing verified reviews.
• Legal basis: legitimate interest in improving our services (Art. 6(1)(f) GDPR); for verified-by-customers programmes, your consent (Art. 6(1)(a) GDPR).
• Retention: for as long as the review is published, no more than 3 years.

III. Who has access to your data

We process your data primarily ourselves. To run our services we use trusted partners who have access to the data to the extent necessary and under a data processing agreement:

• E-shop platform: Shoptet, a.s.
• Carriers: General Logistics Systems (GLS), Packeta Slovakia s. r. o. and Zásilkovna s. r. o., Slovenská pošta, a.s.
• Payment services: Shoptet Pay (Shoptet, a.s. and Adyen N.V.) and comgate. We neither process nor have access to your card details; these are handled directly by the payment service provider.
• E-mail marketing: Ecomail.cz, s.r.o.
• Analytics and advertising: Google Ireland Limited and Google LLC (Google Analytics, Google Ads), Meta Platforms Ireland Limited (Facebook, Instagram), Microsoft Corporation (Microsoft Clarity), Stape Inc. (server-side measurement).
• Accounting and IT support: our accounting firm and IT service providers.

We also disclose data to public authorities where required by law.

Transfers to third countries

Some of our processors have parent companies outside the European Union, in particular in the United States. Using their services may involve a transfer of personal data outside the EU. Any such transfer is safeguarded by Standard Contractual Clauses approved by the European Commission, or by the recipient's participation in the EU-U.S. Data Privacy Framework.

IV. Cookies

Our website uses cookies to ensure it works correctly and to improve your experience.

• Strictly necessary (functional) cookies: required for basic functionality such as the shopping cart or login. No consent is required.
• Analytics cookies: help us understand how the site is used and improve it. We use them only with your consent.
• Marketing (advertising) cookies: allow us and our partners to show you relevant advertising. We use them only with your consent.

You can change or withdraw your consent to analytics and marketing cookies at any time in the cookie bar settings on our website. Cookies can also be managed in your browser settings.

V. Your rights

Under the GDPR you have in particular the following rights:

• Right of access (Art. 15 GDPR), to find out what data we hold about you.
• Right to rectification (Art. 16 GDPR) of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR) where the purpose of processing no longer exists.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR) in a structured, commonly used format.
• Right to object (Art. 21 GDPR) to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent (Art. 7(3) GDPR) at any time, without affecting the lawfulness of processing carried out before withdrawal.

You can exercise your rights by sending a request to shop@minimarvels.sk. We will handle it without undue delay and at the latest within one month of receipt. For more complex requests we may extend this period and will inform you if we do.

If you believe we are not processing your data lawfully, you have the right to lodge a complaint with a supervisory authority. Our lead authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk. Customers in the Czech Republic may also contact the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz. You may also lodge a complaint with the supervisory authority in your country of residence.

VI. Changes to this policy

We may update this policy from time to time, in particular if our providers or the scope of processing change. The current version is always published on this page together with its effective date.