Privacy Policy

Privacy Policy

1. About this Privacy Policy

The purpose of this Privacy Policy is to inform users of www.petovar.com, customers of the online store, registered users, persons who send us enquiries and other individuals about what personal data we process, for what purposes and on what legal grounds we process it, to whom it may be disclosed, how long it is retained and what rights individuals have in relation to the processing of their personal data.

The controller of personal data is:

Petovar d.o.o.
Gradiška cesta 4
2230 Lenart
Slovenia

Registration number: 8410143000
VAT ID: SI84496126
Phone: 02 620 46 00
Email: info@petovar.com
Website: www.petovar.com

We handle personal data carefully and responsibly and process it in accordance with applicable data protection legislation, in particular Regulation (EU) 2016/679 – the General Data Protection Regulation (GDPR) – and applicable Slovenian data protection legislation.

We use personal data only for specified, explicit and legitimate purposes and do not process it in a manner incompatible with those purposes.

We use appropriate organisational and technical measures to protect personal data against unauthorised access, disclosure, alteration, loss, destruction or other unlawful processing.

2. Who this Privacy Policy Applies To

This Privacy Policy applies primarily to:

• visitors to www.petovar.com,

• customers of the Petovar online store,

• registered users of the online store,

• persons making purchases without registration,

• persons who send us enquiries or otherwise contact us,

• recipients of our electronic communications where they have subscribed to them,

• other individuals whose personal data we lawfully process in the course of our business activities.

3. Personal Data We Collect

The type of personal data we process depends on how an individual uses the Petovar website and services.

We may process the following categories of personal data:

• first and last name,

• delivery and/or billing address,

• postal code and city,

• country,

• email address,

• telephone number,

• user account information,

• information about orders and purchased products,

• selected delivery and payment method,

• information required to issue an invoice,

• company details where the customer requests an invoice issued to a company,

• tax number or VAT ID where required,

• the content of enquiries, messages, complaints and other communications,

• information and instructions provided by the customer for a personalised product,

• IP address and certain technical information concerning use of the website,

• information concerning consents and privacy or cookie preferences,

• information relating to subscriptions to newsletters or other marketing communications where the individual has subscribed to such communications.

We do not collect all of the above information about every individual. We process only the personal data required for the particular relationship or purpose.

4. Data Processed When Visiting the Website

When an individual visits the website, certain technical information may be processed automatically, including the IP address, date and time of access, browser information, device information, operating system and other technical data necessary for the operation, security and maintenance of the website.

The use of cookies and similar technologies is described in greater detail on the separate Cookies page.

Where the use of a particular cookie or similar technology requires the user's consent, that technology is used only after the appropriate consent has been obtained, except for strictly necessary technologies for which consent is not required.

5. Data Processed When Purchasing from the Online Store

When a customer places an order, we process the information necessary to:

• receive and process the order,

• identify the customer,

• communicate regarding the order,

• process the payment,

• prepare and dispatch the order,

• arrange delivery or personal collection,

• issue an invoice,

• handle complaints, returns and other claims,

• comply with legal obligations.

A purchase may be made as a guest or as a registered user.

If a customer purchases without registration, a user account is not necessarily created. However, information relating to the order is retained for as long as necessary to perform the contract and comply with legal obligations.

6. Registered Users

If a user registers with the Petovar online store, we process the information required to create and manage the user account.

The user account may allow a registered user to view and manage their information and use other features available in the online store at the relevant time.

Passwords must be appropriately protected. Users are responsible for safeguarding their login details.

7. Enquiries and Communication

If an individual contacts us by email, telephone, contact form or another method, we may process their contact information and the content of the communication.

We use this information to respond to the question or enquiry, prepare an offer, continue communication and, where appropriate, enter into or perform a contractual relationship.

Where necessary to prepare an offer, we may also request additional information such as an address, company details or tax number.

8. Personalised Products

If a customer orders a personalised product, we may process the information provided by the customer for the purpose of carrying out the personalisation.

This may include, for example, a name, text, dedication or other instructions required to produce the ordered product.

We use such information only to the extent necessary to prepare and fulfil the order, unless another legal basis exists for its continued retention.

Customers are asked not to provide personal data relating to third parties for personalisation unless such information is necessary to fulfil the order.

9. Purposes and Legal Bases for Processing

We process personal data only where an appropriate legal basis exists.

Depending on the circumstances, processing may be based on:

• performance of a contract or steps taken prior to entering into a contract,

• compliance with a legal obligation,

• the legitimate interests of the controller or a third party,

• the individual's consent.

9.1 Processing for the Performance of a Contract

Where an individual places an order, requests an offer or wishes to enter into another business relationship with Petovar d.o.o., we process personal data where necessary to take steps prior to entering into a contract or to perform a contract.

For these purposes, we may process personal data in particular to:

• prepare an offer,

• receive and confirm an order,

• process payment,

• prepare ordered products,

• carry out personalisation,

• arrange delivery or personal collection,

• communicate regarding the order,

• handle complaints and returns,

• perform other obligations arising from the contractual relationship.

9.2 Processing for Compliance with Legal Obligations

We are required to process and retain certain personal data in order to comply with legal obligations.

This applies in particular to information required for:

• issuing and retaining invoices,

• accounting and tax records,

• documenting business transactions,

• complying with other obligations imposed on the provider by applicable law.

Information that must be retained by law is retained for the period required by the relevant legislation.

9.3 Processing Based on Legitimate Interests

We may also process personal data where this is necessary for the legitimate interests of Petovar d.o.o. or a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the individual.

Such legitimate interests may include in particular:

• ensuring the secure and stable operation of the website and online store,

• preventing misuse, fraud and other unlawful conduct,

• ensuring information and network security,

• establishing, exercising or defending legal claims,

• recovering outstanding debts,

• documenting business communications and transactions,

• improving business processes and the user experience where such processing complies with applicable law.

Where we process personal data on the basis of legitimate interests, the individual may object to such processing under the conditions set out in the GDPR.

9.4 Processing Based on Consent

In certain cases, we process personal data on the basis of the individual's consent.

This may include in particular:

• receiving email newsletters,

• receiving information about offers, new products and benefits,

• the use of certain analytical or advertising cookies or similar technologies.

An individual may withdraw their consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Consent to electronic marketing communications may be withdrawn using the unsubscribe option provided in the communication, where available, or by sending a request to  info@petovar.com .

10. Payment Data

When electronic payment methods are used, certain payment-related information may be processed by external payment service providers.

Petovar d.o.o. generally does not receive or store complete payment card details where payment is processed through an external secure payment system.

Where a payment service provider acts as an independent controller, its own privacy policy may also apply to its processing of personal data.

11. Disclosure of Personal Data to Recipients and Processors

We do not sell personal data.

To the extent necessary for a particular purpose, we may disclose personal data to processors, business partners or other recipients where this is necessary to provide our services, perform a contract or comply with legal obligations.

Depending on the circumstances, such recipients may include:

• website hosting and maintenance providers,

• IT and software service providers,

• payment service providers,

• banks,

• accounting and other professional service providers,

• Pošta Slovenije,

• DHL and other delivery service providers,

• email and communication service providers,

• other contractors required to provide a particular service.

Where external processors process personal data on our behalf, they may process such data only in accordance with our instructions and for the agreed purposes.

Where a recipient acts as an independent controller, it processes personal data on the basis of its own legal obligations and privacy rules.

We may also disclose personal data to courts, police, tax authorities, supervisory authorities and other competent public authorities where there is an appropriate legal basis for doing so.

12. International Transfers of Personal Data

When using certain IT, payment, analytics, communication or other service providers, personal data may in some cases be transferred to or accessed from countries outside the European Economic Area (EEA).

Where such a transfer takes place, we ensure that it is carried out on an appropriate legal basis and in accordance with the requirements of the GDPR.

This may include, in particular, transfers to a country for which the European Commission has adopted an adequacy decision, the use of the European Commission's Standard Contractual Clauses or another valid mechanism ensuring an appropriate level of protection for personal data.

13. Retention of Personal Data

We retain personal data only for as long as necessary to achieve the purpose for which it was collected or further processed, or for as long as required by applicable legislation.

The retention period depends on the type of data, the purpose of processing and the applicable legal basis.

Information relating to orders and contractual relationships is retained for as long as necessary to fulfil the order, handle any claims and until the expiry of the relevant limitation periods.

Invoices and other documentation subject to mandatory statutory retention periods are retained for as long as required by applicable tax, accounting and other legislation.

User account information is retained for as long as the user account remains active or for as long as another appropriate legal basis exists for continued retention.

Personal data processed on the basis of consent is generally processed until consent is withdrawn or until the purpose of processing ceases to exist, unless another legal basis exists for continued retention.

Information relating to enquiries and communications is retained for as long as necessary to deal with the relevant enquiry or communication and, where appropriate, to document the content of the business relationship.

After the applicable retention period has expired, personal data is deleted, anonymised or otherwise no longer processed, unless applicable law requires further retention.

14. Rights of Individuals

Individuals have rights in relation to the processing of their personal data under the GDPR and applicable legislation.

Depending on the circumstances, an individual may exercise in particular:

• the right of access to personal data,

• the right to rectification,

• the right to erasure,

• the right to restriction of processing,

• the right to data portability,

• the right to object,

• the right to withdraw consent,

• the right to lodge a complaint with the competent supervisory authority.

14.1 Right of Access

An individual has the right to obtain confirmation as to whether personal data concerning them is being processed.

Where we process their personal data, the individual has the right to access that data and obtain the information required by the GDPR, including information concerning:

• the purposes of processing,

• the categories of personal data concerned,

• the recipients or categories of recipients to whom the data has been or will be disclosed,

• the envisaged retention period or the criteria used to determine that period,

• the individual's rights,

• the right to lodge a complaint with a supervisory authority,

• the source of the personal data where it was not obtained directly from the individual,

• other information that the controller is required to provide under the GDPR.

14.2 Right to Rectification

An individual has the right to request that inaccurate personal data concerning them be corrected without undue delay.

Taking into account the purposes of the processing, the individual also has the right to have incomplete personal data completed.

14.3 Right to Erasure

An individual may request the erasure of their personal data in the circumstances provided for by the GDPR.

The right to erasure is not absolute. We will not erase personal data where continued processing is necessary to comply with a legal obligation, to establish, exercise or defend legal claims, or where another legal basis permits or requires continued processing.

14.4 Right to Restriction of Processing

An individual may request restriction of the processing of their personal data under the conditions provided for by the GDPR.

This may apply in particular where the individual contests the accuracy of the data, where processing is unlawful and the individual requests restriction instead of erasure, where we no longer require the data for processing purposes but the individual requires it for legal claims, or where the individual has objected to processing and the assessment of overriding grounds is still pending.

14.5 Right to Data Portability

Where the conditions of the GDPR are met, an individual has the right to receive personal data that they have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.

Where technically feasible and the statutory conditions are met, the individual may also request that the personal data be transmitted directly to another controller.

14.6 Right to Object

Where we process personal data on the basis of legitimate interests, the individual has the right to object at any time to such processing on grounds relating to their particular situation.

In such a case, we will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the individual's interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, the individual has the right to object to such processing at any time. After receiving an objection, we will no longer process the personal data for direct marketing purposes.

14.7 Right to Withdraw Consent

Where processing is based on consent, the individual may withdraw their consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Consent may be withdrawn in the manner indicated when consent was obtained, through an unsubscribe option where available, or by sending a request to  info@petovar.com .

15. Exercising Your Rights

An individual may submit a request to exercise their rights:

by email: info@petovar.com

or

by post:
Petovar d.o.o.
Gradiška cesta 4
2230 Lenart
Slovenia

We will respond to requests without undue delay and generally no later than one month after receiving the request.

Taking into account the complexity and number of requests, this period may, where permitted by the GDPR, be extended by up to two additional months. The individual will be informed of any extension and the reasons for it within one month of receipt of the request.

Where there are reasonable doubts concerning the identity of the person submitting the request, we may request additional information necessary to confirm the individual's identity.

The exercise of rights is generally free of charge.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive nature, we may, in accordance with the GDPR, charge a reasonable fee taking into account the administrative costs or refuse to act on the request.

16. Right to Lodge a Complaint with a Supervisory Authority

If an individual believes that we are processing their personal data in breach of applicable data protection legislation, they have the right to lodge a complaint with the competent supervisory authority.

In the Republic of Slovenia, the competent supervisory authority is:

Information Commissioner of the Republic of Slovenia
Dunajska cesta 22
1000 Ljubljana
Slovenia

Before lodging a complaint, the individual may also contact Petovar d.o.o. directly at  info@petovar.com so that we can attempt to resolve the question or request appropriately.

This does not restrict the individual's right to lodge a complaint with the supervisory authority.

17. Security of Personal Data

We protect personal data using appropriate technical and organisational measures, taking into account the nature of the data, the scope and circumstances of processing and the risks to the rights and freedoms of individuals.

These measures are intended in particular to protect personal data against:

• unauthorised access,

• unlawful disclosure,

• loss,

• destruction,

• unauthorised alteration,

• misuse,

• other forms of unlawful processing.

Access to personal data is limited to persons who require such access to perform their duties or provide agreed services.

Where processors participate in the processing of personal data, we require them to provide appropriate protection of personal data in accordance with applicable law and contractual obligations.

18. Automated Decision-Making and Profiling

In the ordinary operation of the online store, Petovar d.o.o. does not make decisions based solely on automated processing of personal data that produce legal effects concerning an individual or similarly significantly affect them, unless such processing is specifically disclosed and an appropriate legal basis exists.

If such processing is introduced in the future, we will provide individuals with the information and rights required by the GDPR.

19. Children

The Petovar online store is not specifically directed at children, and we do not intentionally collect children's personal data for purposes that would require the consent of the child or their legal representative.

If we become aware that we have received a child's personal data without an appropriate legal basis, we will take appropriate action according to the circumstances.

20. Links to Other Websites and Services

The website may contain links to websites, platforms or services operated by third parties.

The controllers of those external websites or services are responsible for the processing of personal data carried out through their services in accordance with their own privacy policies.

We recommend that users review the applicable privacy policies before using external services.

21. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time due to changes in legislation, our processing of personal data, website functionality, business processes or other justified reasons.

The current version of the Privacy Policy is always published at www.petovar.com.

Where appropriate, we will additionally inform users of significant changes in an appropriate manner.

We recommend that users periodically review the current version of this Privacy Policy.

22. Contact Regarding Personal Data Protection

For questions concerning this Privacy Policy, the processing of personal data or the exercise of your rights, please contact:

Petovar d.o.o.
Gradiška cesta 4
2230 Lenart
Slovenia

Phone: 02 620 46 00
Email: info@petovar.com
Website: www.petovar.com

23. Effective Date of this Privacy Policy

This Privacy Policy is effective from 1 October 2026.