Login

Language

Cart

Your cart is empty

Privacy policy

Privacy Policy

Effective: May 2026 | In accordance with Regulation (EU) 2016/679 (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2, Official Gazette of the RS no. 163/22) and the Electronic Communications Act (ZEKom-2).

1. Data controller

The controller of the personal data collected through the online store dglow.si is:

Lun Maligator d.o.o.
Pot na Dobrotin 3a,
3212 Vojnik, Slovenia
Company registration number: 7516665000
Tax number: 44633335
Email: info@dglow.si
Online store: dglow.si

Given the scope and nature of the processing, dglow.si has not appointed a Data Protection Officer (DPO), as it is not legally required to do so under Article 39 of the GDPR. For any questions regarding the processing of personal data, you can contact: info@dglow.si.

2. What personal data we process

We process various categories of personal data, depending on how you use our services:

Identification and contact data: name and surname, address, email address, phone number.

Order and payment data: order number, ordered products, amount, payment method, delivery address, billing address, bank account number (in the case of a refund).

User account data (if you create one): username, email address, password (hashed), preferences, purchase history, wishlist.

Technical data: IP address, browser type, operating system, device identifiers, website usage data (which products you viewed, for how long, click path), referrer URL.

Communication data: the content of your messages via email, contact form or other channels, including any attachments you send.

We do not knowingly collect sensitive data (health data, biometrics, ethnic origin, etc.). If you share information about your skin concerns or allergies when communicating with us, we process that data solely for the purpose of providing advice and do not retain it longer than necessary.

3. Purposes of processing and legal bases

We base every processing of personal data on one of the legal bases in Article 6 of the GDPR. Overview of purposes and legal bases:

Conclusion and performance of the sales contract (order processing, delivery, payment, returns) - legal basis: contract (Art. 6.1.b GDPR). Duration: until fulfilment of the contract + 10 years.

Retention of invoices and tax documents - legal basis: legal obligation (Art. 6.1.c GDPR, ZDavP-2). Duration: 10 years.

Sending newsletters and promotional messages - legal basis: consent (Art. 6.1.a GDPR, ZEKom-2 Art. 226). Duration: until consent is withdrawn.

Marketing to existing customers (soft opt-in after purchase) - legal basis: legitimate interest (Art. 6.1.f GDPR) + ZEKom-2 Art. 226. Duration: until withdrawal or 2 years from the last purchase.

Analytics cookies (Shopify analytics, Google Analytics) - legal basis: consent (Art. 6.1.a GDPR). Duration: up to 14 months.

Marketing cookies (Meta Pixel, Klaviyo, retargeting) - legal basis: consent (Art. 6.1.a GDPR). Duration: up to 2 years or until withdrawal.

Essential cookies (cart, login, security) - legal basis: legitimate interest (Art. 6.1.f GDPR). Duration: browser session or up to 1 year.

Customer support and communication - legal basis: legitimate interest (Art. 6.1.f) or contract (Art. 6.1.b). Duration: 2 years from the end of the communication.

Fraud prevention and security protection - legal basis: legitimate interest (Art. 6.1.f). Duration: up to 1 year.

Customer reviews and opinions - legal basis: consent (Art. 6.1.a). Duration: until withdrawal.

4. Processors and data recipients

To provide our services, we work with the following processors, who process your personal data on our behalf. We have concluded a data processing agreement (DPA) with each of them in accordance with Article 28 of the GDPR.

  • Shopify International Limited - online store platform, hosting, payment processing, analytics. Location: Ireland, Canada.
  • Klaviyo Inc. - email marketing, customer segmentation, automation. Location: USA (Standard Contractual Clauses).
  • Judge.me Reviews - collecting and displaying product reviews. Location: Hong Kong / Canada (SCC).
  • Pošta Slovenije - parcel delivery. Location: Slovenia / EEA.
  • Stripe Payments Europe (once activated) - payment processing. Location: Ireland / USA (SCC).
  • PayPal (Europe) S.à r.l. (once activated) - PayPal payment processing. Location: Luxembourg.
  • Google Ireland Ltd. (once GA4 is activated) - web analytics. Location: Ireland / USA (SCC + Data Privacy Framework).
  • Meta Platforms Ireland Ltd. (once Pixel is activated) - advertising and retargeting. Location: Ireland / USA (SCC + Data Privacy Framework).

Processors may process your personal data solely in accordance with our instructions and may not use it for their own purposes.

5. International data transfers

Some of our processors are based outside the European Economic Area (in particular in the USA and Canada). For transfers of personal data to third countries, we ensure one of the following safeguards:

  • an adequacy decision by the European Commission (e.g. the EU-US Data Privacy Framework for certified companies in the USA);
  • the European Commission's Standard Contractual Clauses (SCC) (Decision 2021/914);
  • Binding Corporate Rules (BCR), where they exist;
  • in certain exceptional cases, the explicit consent of the user.

You may request a copy of the safeguard mechanisms (e.g. SCC) at info@dglow.si.

6. Your rights

In accordance with the GDPR (Art. 15-22) and ZVOP-2, you have the following rights regarding personal data:

  • Right of access (Art. 15 GDPR) - the right to find out whether we process your data and to receive a copy of that data.
  • Right to rectification (Art. 16 GDPR) - the right to request correction of inaccurate data.
  • Right to erasure ("right to be forgotten", Art. 17 GDPR) - the right to request deletion of personal data.
  • Right to restriction of processing (Art. 18 GDPR) - the right to request that we temporarily suspend processing in certain cases.
  • Right to data portability (Art. 20 GDPR) - the right to receive a copy of your data in a structured format.
  • Right to object (Art. 21 GDPR) - the right to object to processing based on legitimate interest.
  • Right to withdraw consent (Art. 7.3 GDPR) - where processing is based on consent.
  • Right not to be subject to automated decision-making (Art. 22 GDPR).

How to exercise your rights: Send your request to info@dglow.si. We respond without undue delay and no later than one month of receiving the request. We may extend this period by two additional months in the case of complex or numerous requests.

We may require additional information to confirm your identity. The service is free of charge; if requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act (Art. 12.5 GDPR).

7. Right to lodge a complaint with a supervisory authority

If you believe that our processing of your personal data infringes applicable law, you have the right to lodge a complaint with the competent supervisory authority. In Slovenia this is:

Information Commissioner of the Republic of Slovenia
Dunajska cesta 22, 1000 Ljubljana
Phone: 01 230 97 30
Email: gp.ip@ip-rs.si
Website: www.ip-rs.si

8. Automated decision-making and profiling

dglow.si does not use automated decision-making, including profiling, that would produce legal or similarly significant effects for you (Art. 22 GDPR).

For marketing purposes and to personalise our offer, we may use segmentation based on your behaviour on the website (e.g. product views, purchase history), but this does not constitute automated decision-making within the meaning of Article 22 of the GDPR. You may object to such segmentation at any time.

9. Is providing data mandatory

Providing certain personal data is necessary to conclude and perform the sales contract (e.g. name, address, email, payment details). Without this data, we cannot fulfil your order and deliver the product.

Providing other data, such as newsletter sign-up, creating a user account or consent for marketing cookies, is voluntary, and you always have the right to give or refuse consent for it.

10. Cookies and similar technologies

The dglow.si online store uses cookies and similar technologies for tracking, analytics and marketing. You will find details about the types of cookies, providers and duration in our Cookie Policy.

On your first visit to the website, we show you a cookie consent banner where you can choose which categories to accept. You can change your consent at any time via the cookie settings.

11. Children and minors

Our online store is suitable for users of all ages, but minor customers must, in accordance with Slovenian law (the Obligations Code, ZVPot-1), obtain the consent of their legal representative to conclude contracts where the law requires it. For small purchases of everyday importance, minors over 15 years of age may conclude contracts independently (Article 108 of the Obligations Code).

In accordance with Article 8 of the GDPR and ZVOP-2, we do not knowingly process the data of children under 15 years of age without the consent of a legal representative. If you learn that a child under 15 has provided us with personal data without consent, notify us at info@dglow.si and we will delete the data.

12. Security of processing

We implement appropriate technical and organisational measures to protect personal data, including:

  • HTTPS traffic encryption (SSL/TLS);
  • use of Shopify's security system (PCI DSS Level 1 for payments);
  • restricted access to data for authorised persons only;
  • storing passwords in hashed form (user accounts);
  • regular security reviews and system updates.

In the event of a personal data breach, we will immediately take measures to limit the damage and, in accordance with Articles 33 and 34 of the GDPR, notify the Information Commissioner within 72 hours.

13. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The specific periods are stated in section 3 of this policy.

After the retention period expires, we delete or anonymise the data, unless further retention is necessary for asserting legal claims or fulfilling legal obligations.

14. Changes to this policy

We may update this Privacy Policy from time to time due to changes in our practices, technology, legislation or for other reasons. We will publish the updated policy on this website with the date of the last change indicated.

15. Contact

For all questions, requests or complaints regarding the processing of your personal data, contact us:

Lun Maligator d.o.o.
Pot na Dobrotin 3a,
3212 Vojnik
Email: info@dglow.si

We usually respond within 1-2 business days, and we handle formal requests regarding the rights in section 6 within the statutory period of 1 month.