Privacy policy

This policy explains how we process your personal data when you visit our store, place an order or contact us, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Slovak data protection law.

1. Controller

{{TODO: legal business name — e.g. your sole-trader name or company name}}, Československej armády 241/28, 972 51 Handlová, Slovakia. Contact for all data protection questions: support@workfish.app.

2. What we process, why, and on which legal basis

Processing and delivering your order, and customer service about it — name, email, phone (if given), shipping and billing address, order contents, payment status, communication. Legal basis: performance of a contract (Art. 6(1)(b)).
Accounting and tax records — invoice and order data. Legal basis: legal obligation (Art. 6(1)(c)).
Handling withdrawals, complaints and legal claims — order data, communication. Legal basis: Art. 6(1)(b) and (c); legitimate interest in establishing or defending legal claims (Art. 6(1)(f)).
Answering messages you send us — email address, name, message content. Legal basis: Art. 6(1)(b) or our legitimate interest in answering enquiries (Art. 6(1)(f)).
Operating a secure, working store (hosting, security, fraud prevention) — IP address, technical request data. Legal basis: legitimate interest in a secure service (Art. 6(1)(f)).
Aggregate store statistics (pages viewed, items added to cart), without profiles of individuals — technical usage data. Legal basis: legitimate interest in improving the store (Art. 6(1)(f)).
Advertising measurement and remarketing (Meta, Google) — cookie/pixel identifiers, pages viewed, purchase events. Legal basis: your consent only (Art. 6(1)(a)).

Providing your order data is necessary to conclude the contract; without it we cannot process your order.

3. Payment data

Payments are processed by Shopify and its payment providers on the checkout page. We do not receive or store your full card details.

4. Recipients and processors

We share personal data only as needed with:

Shopify (Shopify International Ltd. and group companies) — checkout, payment processing and order management;
Cloudflare, Inc. — hosting of the store, security and routing of emails sent to us;
Mailgun Technologies, Inc. — sending our customer-service emails;
CJdropshipping and other fulfilment suppliers and carriers — to pack and deliver your order (name, shipping address, phone, order contents);
Meta Platforms Ireland Ltd. and Google Ireland Ltd. — advertising measurement, only if you have consented;
tax advisors, authorities and courts where required by law.

Processors act on our instructions under data processing agreements.

5. International transfers

Some recipients are located, or process data, outside the European Economic Area (for example in the United States or, for fulfilment, in China). Where no adequacy decision applies, transfers are based on the EU Standard Contractual Clauses or, for certified US companies, the EU–US Data Privacy Framework. Delivering goods shipped from outside the EEA requires sharing your delivery details with the supplier and carriers performing the delivery (Art. 49(1)(b) GDPR where no other safeguard applies). Contact us for more information on the safeguards used.

6. How long we keep data

Order and invoicing data: for the period required by accounting and tax law (generally 10 years).
Communication about orders, withdrawals and complaints: for as long as needed to handle them and for the limitation period of possible claims.
Other support messages: up to 24 months after the conversation ended.
Consent-based advertising data: until you withdraw consent or the cookie expires (see our cookie policy).

7. Your rights

You have the right to: access your data; rectification; erasure; restriction of processing; data portability; object to processing based on legitimate interests; and, where processing is based on consent, withdraw your consent at any time without affecting the lawfulness of processing before the withdrawal. To exercise your rights, email support@workfish.app.

You also have the right to lodge a complaint with a supervisory authority, in particular in your country of residence. In Slovakia: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, Slovakia — dataprotection.gov.sk.

8. No automated decisions

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

9. Cookies

See our cookie policy for details on cookies and similar technologies.

10. Changes

We may update this policy when our processing changes. The current version is always published on this page.