Policies
Privacy Policy
Last updated: 21 October 2026
This policy explains how we process your personal data when you visit guernika.eu, sign up for news, take part in our campaigns or buy from our store. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
1. Controller
Varnas & Sole d.o.o.Rozmanova 5, 1000 Ljubljana, Slovenia
E-mail: info@guernika.eu
Phone: +386 69 758 517
2. What we process, why, and on what legal basis
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You place an order | Name, e-mail, phone, delivery and billing address, preferred parcel locker, items ordered, amount, payment status | Processing and delivering your order, invoicing, customer service, handling returns and complaints | Performance of a contract (Art. 6(1)(b) GDPR); legal obligations such as tax and accounting rules (Art. 6(1)(c)) |
| You pay | Card or wallet details, entered directly with Stripe | Payment processing and fraud prevention. We never receive your full card number. | Performance of a contract (Art. 6(1)(b)); legitimate interest in preventing fraud (Art. 6(1)(f)) |
| You subscribe to news (tick box or footer form) | E-mail, and your name if you gave it; date and source of sign-up | Sending news about new series, artists and events | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| You join “Enter the circle” or answer the QR question | Name (circle), e-mail, your answer (QR), date, IP address and browser type | Contacting you about Guernika as described on the form; for the QR campaign, sending you a one-time e-mail and selecting the most significant answers | Your consent (Art. 6(1)(a)); IP and browser type: legitimate interest in preventing abuse (Art. 6(1)(f)) |
| You ask to be notified when a sold-out size is back (“Notify me”) | E-mail address, the product and size, date of the request, language | Sending you one e-mail when that size is available again | Your consent (Art. 6(1)(a)), which you can withdraw at any time by writing to us |
| You write to us | Your message and contact details | Answering your request | Legitimate interest (Art. 6(1)(f)) or steps prior to a contract (Art. 6(1)(b)) |
| You browse the website | Anonymous page views: page address, referring site, country, device and browser type. No cookies, no IP addresses stored, no cross-site tracking. | Understanding which pages are visited so we can improve the website — only if you click “Accept” in the cookie notice | Your consent (Art. 6(1)(a)), which you can withdraw in “Cookie settings” |
| You visit the website | IP address, browser and device information, time of access (server logs) | Delivering the website securely and fixing errors | Legitimate interest (Art. 6(1)(f)) |
Your cart is stored only in your own browser (local storage) and is not sent to us until you go to checkout. With your consent we measure visits with Vercel Web Analytics, which works without cookies and only reports anonymous, aggregated statistics; see ourCookies page. We do not use advertising or tracking cookies, we do not sell personal data, and we do not use automated decision-making or profiling.
3. Who receives your data
We use the following service providers, who process data on our behalf under data processing agreements, or as independent controllers where indicated:
| Provider | Role | Location |
|---|---|---|
| Stripe | Payment processing (independent controller for its own legal obligations) | EU (Stripe Payments Europe, Ireland); may transfer to the USA |
| Vercel | Website hosting and anonymous visit statistics (Web Analytics) | USA |
| Upstash | Database (orders, sign-ups, form submissions) | Frankfurt, Germany (EU) |
| Resend | Sending order confirmations and newsletters | USA |
| Metakocka | Business software (orders, invoices, stock) | Slovenia (EU) |
| GLS | Parcel delivery (name, address, e-mail, phone for delivery notifications) | EU |
We may also disclose data where required by law, for example to tax authorities or courts.
4. Transfers outside the EU
Some providers are based in the USA. Where personal data is transferred outside the European Economic Area, this is done on the basis of the European Commission’s adequacy decision for the EU–US Data Privacy Framework (for certified providers) or the European Commission’s Standard Contractual Clauses.
5. How long we keep data
- Orders and invoices: for the period required by Slovenian tax and accounting law (currently 10 years for invoices), then deleted.
- Newsletter: until you unsubscribe or withdraw consent.
- “Enter the circle” and QR submissions: until you withdraw consent, and at most 2 years after submission.
- “Notify me” requests: until we send you the one e-mail, then deleted; requests for a size that never comes back are deleted when the series closes, at the latest 1 year after the request.
- Customer correspondence: as long as needed to handle your request and any related claims.
- Server logs: kept by our hosting provider for a short period, usually not longer than 30 days.
6. Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where there is no legal reason for us to keep it;
- restrict processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal. Every newsletter contains an unsubscribe link.
To exercise your rights, write to info@guernika.eu. We will reply within one month. We may need to verify your identity first.
You also have the right to lodge a complaint with the supervisory authority — in Slovenia the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si — or with the authority in the EU country where you live or work.
7. Is providing data required?
Data marked as required at checkout is needed to conclude and deliver your order; without it we cannot accept the order. Signing up for news and taking part in campaigns is voluntary.
8. Children
Our store is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
9. Security
We use encrypted connections (HTTPS), access controls and reputable providers to protect your data. No method of transmission over the internet is completely secure, so please do not send us sensitive information by e-mail.
10. Changes
We may update this policy when our services or legal requirements change. The current version is always published on this page, with the date of the last update.