The website www.spongecubs.com respects the privacy of its visitors, customers, and other users, and strives to process personal data responsibly, transparently, and in accordance with applicable legislation.
This Privacy Policy explains what personal data we collect, why we use it, how we protect it, to whom we may disclose it, and what rights you have regarding your personal data.
This Policy is primarily based on the provisions of the EU General Data Protection Regulation (GDPR) and applicable Slovenian legislation, including the Personal Data Protection Act (ZVOP-2).
1. Data Controller
The controller of personal data is:
CLOUD NOVA D.O.O.
Registered address: SPODNJE ŠKOFIJE 13, 6281 ŠKOFIJE, Slovenia
Registration number: 7394845000
Tax ID / VAT number: SI61935727
E-mail: spongecubs@gmail.com
Phone: +386 41 727 761
(hereinafter: "SpongeCubs", "controller", "we", "us", or "company").
For any questions regarding the processing of personal data, you can contact us at: spongecubs@gmail.com.
If a Data Protection Officer (DPO) has not been appointed for the company, no specific DPO contact is provided.
2. What Personal Data We Collect
Depending on how you use the website and place orders, we may collect different categories of personal data.
Data Collected Upon Purchase
When placing an order, we may collect:
- First name and last name,
- Delivery address,
- E-mail address,
- Phone number,
- Order details,
- Data required for issuing an invoice,
- Payment data or payment status details.
As a rule, we do not store payment card details ourselves if payments are processed by an external payment service provider. In such cases, payment data is processed by the provider in accordance with their rules and applicable regulations.
Data Collected During Communication
If you contact us via e-mail, phone, or contact form, we may process:
- First name and last name,
- E-mail address,
- Phone number,
- Content of your message,
- Data voluntarily provided in communication.
Website Usage Data
When using the website, technical data may also be collected, such as:
- IP address,
- Browser type and version,
- Operating system,
- Device information,
- Time of access,
- Website usage data,
- Data collected via cookies and similar technologies.
The scope of this data depends on website settings, analytical tools used, and your cookie settings.
3. Purposes for Which We Use Personal Data
We use your personal data only for specified and lawful purposes.
Order Execution
We use data for:
- Order processing,
- Preparation and delivery of products,
- Communication regarding the order,
- Payment processing,
- Issuing invoices,
- Handling complaints and returns.
Customer Communication
We also use your data to answer your questions, requests, complaints, and other messages.
Compliance with Legal Obligations
We may process data when necessary to comply with legal obligations, such as accounting, tax, or other statutory requirements.
Security and Fraud Prevention
We may use data to ensure the security of the online store, prevent abuse, fraud, and other illegal activities.
Website Improvement
If we use appropriate analytical tools and your consent is required for their use, we may use data to analyze website usage and improve user experience.
Direct Marketing
If you subscribed to our newsletter or agreed to receive marketing communications, we may use your e-mail address to send information about products, news, special offers, and other marketing content.
You can unsubscribe from receiving marketing communications at any time using the link/method provided at the bottom of each message.
4. Legal Bases for Processing
We process personal data based on one or more legal grounds set out in the GDPR. Most commonly, these include:
- Performance of a Contract:
- Data processing is necessary for the execution of an order or contract concluded with us.
- Compliance with Legal Obligations:
- We must process certain data due to statutory requirements imposed on us by law.
- Consent:
- Where required, we process data based on your consent, for example for certain forms of electronic direct marketing or the use of non-essential cookies. You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
- Legitimate Interests:
- In certain cases, we may process personal data based on our legitimate interests, provided these interests do not override your interests or fundamental rights.
5. How Long We Retain Personal Data
We store personal data only for as long as necessary to fulfill the purpose for which it was collected, or for as long as required by applicable regulations.
- Data related to orders and invoices may be stored for as long as required for accounting, tax, and other legal obligations.
- Data processed based on consent is stored until consent is withdrawn or until it is no longer needed for the purpose for which consent was given.
- Data related to resolving complaints, claims, or disputes may be retained for as long as necessary to address them or to establish, exercise, or defend legal claims.
6. Who We May Share Personal Data With
We do not sell personal data.
To conduct our business operations, we may share personal data with trusted service providers when necessary to fulfill a specific purpose. This may include:
- Website hosting provider,
- Online store platform/technical provider,
- Payment service providers,
- Delivery and courier services,
- Accounting services,
- IT service providers,
- E-mail service providers,
- Analytics or marketing service providers (where their use is lawful).
These service providers are permitted to process personal data only in accordance with applicable legislation and to the extent necessary to perform their services. When a provider acts as a data processor, the relationship is regulated in accordance with GDPR requirements.
7. Transfer of Personal Data to Third Countries
If the use of specific services involves transferring personal data outside the European Economic Area (EEA), such transfer will take place only if the conditions required by the GDPR are met.
This may include the use of an adequacy decision by the European Commission or other appropriate safeguards.
Note: Since services used may change over time, the actual third-party providers used by the SpongeCubs website should be verified prior to publishing this policy.
9. Direct Marketing and Newsletter
If you subscribe to the SpongeCubs newsletter or another marketing channel, we may use your contact details to send marketing content to the extent permitted by applicable law.
Every marketing e-mail contains an unsubscribe option. You can unsubscribe from receiving the newsletter at any time.
Upon unsubscribing, we will generally no longer use your e-mail address for sending marketing messages, unless another lawful basis for processing exists.
10. Data Protection and Security
SpongeCubs implements appropriate technical and organizational measures to protect personal data against:
- Unauthorized access,
- Loss,
- Destruction,
- Alteration,
- Disclosure,
- Other unlawful processing.
Access to personal data is restricted to individuals and providers who require it to perform their tasks or services. However, no method of transmission or storage of data over the Internet can be guaranteed to be 100% secure.
11. Individual Rights
Under the GDPR, you have specific rights regarding your personal data. Depending on the circumstances, you may request:
- Right of Access: You have the right to know whether we process your personal data and to obtain information about its processing.
- Right to Rectification: If your personal data is inaccurate or incomplete, you can request that it be corrected or completed.
- Right to Erasure ("Right to be Forgotten"): In certain cases, you can request the erasure of your personal data. This right is not absolute and legal exceptions may apply.
- Right to Restriction of Processing: In certain cases, you can request that the processing of your personal data be restricted.
- Right to Object: Where data is processed based on legitimate interest, you may object to such processing in certain cases. You can object to direct marketing at any time.
- Right to Data Portability: In cases specified by the GDPR, you may request to receive your personal data in a structured, commonly used, and machine-readable format, or to have it transferred to another controller.
- Right to Withdraw Consent: If processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
12. How to Exercise Your Rights
To exercise your rights, you can write to us at: spongecubs@gmail.com.
Please state as clearly as possible in your request which right you wish to exercise. To ensure security, we may request additional information to verify your identity in certain cases.
We will respond to your request within the timeframes specified by applicable legislation. The Information Commissioner states that the provisions of the GDPR and ZVOP-2 apply to the exercise of individual rights.
14. Children's Personal Data
The SpongeCubs online store is not intended to knowingly collect personal data from children. If we discover that we have obtained personal data from a child without an appropriate legal basis, we will take appropriate measures in accordance with applicable legislation.
15. Links to Other Websites
The website may contain links to third-party websites. SpongeCubs is not responsible for the processing of personal data on these websites. We recommend that you review the privacy policies of those websites before using them.
16. Changes to This Privacy Policy
SpongeCubs may update this Privacy Policy from time to time due to changes in legislation, technology, business practices, or services used.
The new version will be published on the website www.spongecubs.com. The effective date of the current version will be indicated at the top of the document.
17. Contact
For any questions regarding personal data protection, you can contact us:
CLOUD NOVA D.O.O.
Registered address: SPODNJE ŠKOFIJE 13, 6281 ŠKOFIJE, Slovenia
Registration number: 7394845000
Tax ID / VAT number: SI61935727
E-mail: spongecubs@gmail.com
Phone: +386 41 727 761