Privacy policy

This document is issued in English and Slovenian; both versions are authoritative. Versions in other languages are machine translations provided for convenience; if they differ, the English version applies. This does not limit mandatory consumer rights under the law of your country of residence.

1. Controller and contact#

Noventis d.o.o., Ulica Eve Lovše 18, 2000 Maribor, Slovenia. Registration number: 7472030000. Tax number: 81239700. Email: [email protected]. Fragnatium is the shop operated by Noventis d.o.o.

This notice concerns the Fragnatium shop, customer accounts and communications. Contact the controller at the email or postal address above about personal data. The applicable framework includes GDPR, Slovenia’s ZVOP-2 and ZEKom-2.

2. Data, purposes and legal grounds#

• Orders, delivery, payments and support: name, contact details, billing/delivery address, purchased products, order and payment references, and messages. Processing is necessary for the contract or steps you request before it (Article 6(1)(b)). Required checkout fields are needed to process and deliver an order; without them we cannot fulfil it. Optional fields are marked separately.
• Invoices and legal duties: transaction and accounting records retained to meet tax, accounting and consumer-law obligations (Article 6(1)(c)).
• Accounts: registration details, password hash and order history, to provide the account you request (Article 6(1)(b)).
• Security and claims: IP address, request/device information, security logs and relevant correspondence to prevent fraud, protect the shop and establish or defend claims (Article 6(1)(f)); the legitimate interests are secure operation and protection of legal rights, balanced against your rights.
• Newsletters and promotional messages: email address, preferences and subscription records, based on consent (Article 6(1)(a)), or only where the specific existing-customer exception under ZEKom-2 is met. You can unsubscribe free of charge. Entering an email at checkout alone is not marketing consent.
• Reviews and support requests: submitted content and identifying details needed to handle the request or display a review. Public reviews can display your chosen review name. Do not include sensitive information in a public review. We use contract necessity for support and legitimate interests in authentic customer feedback where applicable.
• Analytics and advertising: online identifiers, page/product interactions, device information and conversion details. These optional purposes require consent (Article 6(1)(a)); shopping is not conditional on agreeing.
• Creator program (referral credit): when you follow a creator’s link or enter a creator’s discount code at checkout, we record which creator to credit. For a link, this is the sharecrew_ref cookie described in our Cookie policy and a record of the click: its time, a one-way hash of your IP address and browser details combined with a secret that changes daily (so we do not store the IP address or browser details themselves, and the hash cannot be linked across days), the referring website’s domain, the creator link or page you arrived through, a country code derived from your IP address, a device type and whether the visit appeared automated. If WooCommerce’s order-attribution data for your visit shows a creator link, we may also use it to credit the order. For an order, we record which creator it was credited to and why (for example a link, a creator’s code, a returning customer or a correction by us). So that your later orders are credited to the same creator, we link your account, or, for a guest order, a one-way hash of your email address, to that creator until 180 days after your last order credited to that creator. Following another creator’s link does not move this link: that creator is credited only for an order you place through their link. Entering another creator’s code does move it: that creator is credited for the order, and your later orders follow them. So that a creator’s code is used only once per customer and creators cannot use their own code, we compare an order’s account and billing email address with that code’s earlier orders and with the creator’s account. We do this on the basis of our legitimate interest in crediting and paying creators accurately (Article 6(1)(f)); the credit on an order is also kept as part of our accounting records (Article 6(1)(c)). Creators never receive your name, email address or delivery address.
• Creator program participants: if you apply to or take part in our creator program, we process your name, email address, account, country, social-media handles and profile links, the follower counts you report, your application, your tax profile, your payout details (stored encrypted), the posts you register, your discount code and the discount you choose for it, gift requests and the delivery details needed to send gifts, and the shares, payouts and statements recorded for you. We use them to review your application and run the program under its terms (Article 6(1)(b)), to keep accounting and tax records and meet any withholding or reporting duty (Article 6(1)(c)), and to prevent fraud and misuse of creator links and codes (Article 6(1)(f)). Within Noventis d.o.o., only administrators can see full bank account numbers and PayPal email addresses. The program terms you accept when you apply give the details.

3. Recipients and services#

Data necessary for fulfilment is shared with our hosting and IT providers, payment providers Stripe and PayPal, the carrier selected for delivery (including Pošta Slovenije where used), and accounting/invoicing providers. Public authorities or professional advisers receive data when legally required or necessary for a claim. We do not sell customer lists.

Creators in our program see, for each order credited to them, its order number, date, amounts and their share. They do not receive customers’ names, contact details or addresses. We pay creators through PayPal or a bank, which receive the payout details needed for the payment.

The site’s integrations include Google Analytics, PostHog analytics, Meta advertising, OpenAI advertising measurement, Tawk.to customer chat and Trustpilot review services. Analytics/advertising can associate visits, product activity and purchases with browser or advertising identifiers. The OpenAI conversion integration can send an event identifier, purchase time, product identifiers/names, quantities, amounts/currency and available click/browser identifiers. This is advertising measurement, not the provision of your order to a ChatGPT conversation. These services and payment providers may act as separate controllers for their own purposes; they are not all merely our processors.

Provider information: Google, PostHog, Meta, OpenAI, Stripe, PayPal, Tawk.to and Trustpilot.

4. Transfers outside the EEA#

Some providers may process data outside the European Economic Area, including in the United States. Such transfers require a valid GDPR Chapter V mechanism: an applicable adequacy decision (including the EU–US Data Privacy Framework only for a currently certified recipient and covered processing) or appropriate safeguards such as European Commission standard contractual clauses and any necessary supplementary measures. Contact us for information about the mechanism and a copy of safeguards relevant to your data. A provider’s privacy-policy link alone is not a transfer safeguard.

5. Retention#

We determine retention by purpose: order and complaint information for fulfilment and the applicable claim periods; invoice/tax records for the statutory accounting period (normally ten years after the end of the relevant year for invoices subject to that obligation); account information while the account is needed, subject to records that must be retained independently; marketing details until withdrawal or a valid objection, with a minimal suppression record to honour that choice; security records for the period needed to investigate incidents and defend claims. Creator-program click records are deleted after 90 days; the daily totals kept afterwards contain no per-visitor data. The sharecrew_ref cookie expires on your device after 30 days. A returning-customer link stops having effect 180 days after the last order credited through it; expired links are deleted automatically within a day, and we delete yours sooner when you ask. The record of which creator an order was credited to, and creators’ shares, payouts and statements, are kept with our accounting records. Data from creator applications that are not accepted is kept only as long as needed to answer questions about the decision or handle a new application, and you can ask us to erase it at any time. An active dispute or legal preservation duty may require longer retention of relevant records. Cookie lifetimes differ from retention of data already received by a provider; see the Cookie policy and provider notices. We assess erasure requests against these purposes and duties rather than promising immediate deletion of legally required records.

6. Your choices and rights#

Depending on the legal conditions, you may request access, correction, erasure, restriction and portability of your data, object to legitimate-interest processing, and withdraw consent at any time without affecting the lawfulness of earlier processing. You may object to direct marketing at any time, including profiling related to it. Contact [email protected]. We may request proportionate verification of identity. We normally reply within one month; if a lawful extension of up to two further months is needed, we explain it within the first month.

You may complain to the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, [email protected], or another competent supervisory authority. You need not complain to us first. Advertising audience selection may personalise ads; this notice does not authorise solely automated decisions producing legal or similarly significant effects on you.

7. Cookies and updates#

Our Cookie policy explains storage and tracking technologies. A privacy notice is information, not consent. Material changes are reflected in the update date; new processing requiring consent requires a separate choice.