Privacy policy

Last updated: 27 September 2026

This page explains which personal data we process when you visit our website or contact us, why we do it and what rights you have. We follow Regulation (EU) 2016/679 (GDPR) and the applicable Slovak law. This English version is provided for convenience; the Slovak version prevails.

Who we are

The controller of your personal data is Amalia ateliér, civic association (občianske združenie), registered office Nad mestom 1130/1,963 01 Krupina, company ID (IČO) 57 908 362.

We have not appointed a data protection officer because the law does not require us to.

What data we process and why

When you contact us via the form, by e-mail or by phone

  • Data: name, e-mail address and/or phone number (the form needs only one of them), the content of your message and, where relevant, the product you are interested in, including a link to it.
  • Purpose: to answer your question or enquiry and prepare an offer.
  • Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for general questions, our legitimate interest in replying to messages we receive (Art. 6(1)(f) GDPR).
  • Retention: 12 months after the last message if no contract results from the conversation.

Please do not include information about your health in your message unless it is necessary (for example for made-to-measure items).

When you buy something from us

  • Data: name, contact and delivery details, order, payment and invoice details.
  • Purpose: concluding and performing the contract, delivering the goods and keeping accounts.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations, in particular under the Slovak Accounting Act (Art. 6(1)(c) GDPR).
  • Retention: order correspondence for the duration of the contract and of our liability for defects, then for up to 4 years to prove that we met our obligations; accounting records for 10 years.

Complaints and withdrawals

  • Data: details of the complaint or withdrawal and related correspondence.
  • Purpose: handling the complaint or withdrawal and protecting our legal claims.
  • Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest (Art. 6(1)(f) GDPR).
  • Retention: up to 4 years after it has been resolved.

Running and securing the website

  • Data: IP address, browser type, time of access and the page visited (technical logs).
  • Purpose: delivering the website and protecting it against abuse.
  • Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).
  • Retention: according to the settings of the providers listed below, usually a few days.

Who receives your data

We do not sell your data. The following services help us:

  • Web3Forms (Web3Creative, India) – delivers messages from the form to our mailbox. It keeps a copy of each message for the period set in our account, at most 3 years. To check for spam it passes your IP address and e-mail address to CleanTalk and Akismet (USA).
  • Our e-mail provider – stores the e-mails we receive and send.
  • Cloudflare, Inc. (USA) – hosting and delivery of the website.
  • Sanity (Sanity AS, Norway, and Sanity US Inc., USA) – the content management system of the website. Images and videos are loaded from its network (cdn.sanity.io), which processes your IP address when doing so.
  • YouTube (Google Ireland Limited), Facebook and Instagram(Meta Platforms Ireland Limited) – only if you click Play on a video from these services in a product gallery (see Videos from external services).
  • If you buy something from us, also the carrier delivering the parcel, our accountant and our bank. The carrier processes data as an independent controller under its own rules.
  • Public authorities where the law requires us to share data.

Transfers outside the European Union

Some of these providers also process data outside the EU. For transfers to the USA we rely on the EU-U.S. Data Privacy Framework or on standard contractual clauses approved by the European Commission. For transfers to India (Web3Forms) we rely on the European Commission's standard contractual clauses.

Cookies and similar technologies

Our website itself does not store any analytics or advertising cookies on your device and we do not use visitor tracking tools. The fonts are hosted on our own website. That is why we do not ask for your consent to cookies when you visit the site. We ask for consent only when you play a video from an external service (see below).

Cloudflare may set a technical security cookie (for example __cf_bm) when it detects suspicious traffic; it is necessary to protect the website.

Videos from external services

  • How it works: for videos from YouTube, Facebook and Instagram, the product gallery first shows a notice and a Play button. Content from the provider is loaded only after you click. The provider may then store its own cookies on your device and process your IP address and playback data under its own rules. We embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com).
  • Legal basis: your consent, given by clicking Play (Art. 6(1)(a) GDPR and § 109(8) of the Slovak Electronic Communications Act No. 452/2021 Coll.). The consent applies only to that video.
  • Withdrawing consent: simply close the video; other videos will not load without a new click. You can delete cookies stored by the provider at any time in your browser settings.
  • Joint controllers: when an embedded video loads, we and the provider are joint controllers for collecting your data and passing it on to the provider. The provider is responsible for any further processing under its own privacy policy.
  • Videos uploaded directly to our website play from Sanity's storage without third-party cookies.

Your rights

You have the right to:

  • access your personal data (Art. 15 GDPR),
  • have inaccurate data corrected (Art. 16 GDPR),
  • have your data erased (Art. 17 GDPR),
  • restrict processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • object to processing based on our legitimate interest (Art. 21 GDPR),
  • withdraw your consent at any time where processing is based on consent.

You can exercise your rights by e-mail at amalia.handmade@gmail.com. We will reply without undue delay and within one month at the latest.

If you believe we handle your data unlawfully, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava,dataprotection.gov.sk, or with the supervisory authority in the EU member state where you live or work or where the infringement took place.

Do you have to give us your data?

No, providing data is voluntary. Without an e-mail address or phone number, however, we cannot reply to you, and without contact and delivery details we cannot deliver goods you order.

Automated decision-making

We do not carry out any automated decision-making or profiling.

Changes

We may update this information, for example when we change providers. The current version is always available on this page.