Privacy policy
Last updated: 11 May 2026
This document explains what data we hold about you, why, for how long, and what rights you have. We write in plain language — if anything is unclear, just email us.
1. Who we are
The controller of your personal data is Oto Méheš - MARS, which operates the oringy.sk shop. We are the single point of contact for all questions about your data.
- privacy@oringy.sk
The controller’s full identification details (company ID, registered office, VAT ID) are on the Contact page and in the Terms & Conditions.
2. What we collect and why
We process only as much data as we genuinely need. For each category we cite the GDPR legal basis.
Account and contact details
Email, name, shipping and billing addresses.
- Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR).
- Retention
- For the lifetime of the account, or as long as statutory invoice archival applies.
Order data
Product lists, prices, billing details, payment receipts.
- Legal basis
- Performance of a contract (Art. 6(1)(b)) + legal obligation (Art. 6(1)(c) — accounting law).
- Retention
- 10 years (Slovak Accounting Act No. 431/2002 Coll., § 35).
Shopping cart (oringy.cart.v1 cookie)
The contents of your cart so you don't lose them when you refresh.
- Legal basis
- Performance of a contract — the cart is essential to making a purchase (Art. 6(1)(b)).
- Retention
- 30 days from the last cart change.
Consent record (oringy_consent cookie)
Your decision about cookies (allowed categories + date), so we don't have to ask on every visit.
- Legal basis
- Consent (Art. 6(1)(a)). The consent record also lets us demonstrate compliance with Art. 7(1) GDPR.
- Retention
- 180 days from the last decision.
Traffic and marketing attribution (Google Analytics 4, Sentry, PostHog, attribution cookies)
Data about how you use the site (errors, clicks, traffic sources, visits). This includes Google Analytics 4 from Google. Without your consent nothing activates and no data is sent. After you consent, Google Analytics data may also be processed in the USA — on the basis of the EU Standard Contractual Clauses (SCCs) and Google's certification under the EU–US Data Privacy Framework.
- Legal basis
- Consent (Art. 6(1)(a)).
- Retention
- Google Analytics cookies (_ga, _ga_<container-id>): 2 years (lifetime set by Google); 180 days for the attribution identifier; 30 days for PostHog session recordings; per processor DPA for Sentry.
4. How long we keep data
We keep data only as long as we need it. Here is a summary of the periods we apply:
| Data category | Retention period | Reason |
|---|---|---|
| Orders and invoices | 10 years | Slovak Accounting Act No. 431/2002 Coll., § 35 |
| Account data | Until deletion request, or 3 years of inactivity | Performance of a contract + legitimate interest |
| Cart cookie | 30 days | Performance of a contract |
| Consent cookie | 180 days | Consent + proof of consent (Art. 7(1) GDPR) |
| Attribution cookies | 180 days (identifier and UTM); 30 minutes of inactivity (session) | Consent |
| Audit log (security records) | 7 years | Legitimate interest (Art. 6(1)(f)) |
5. Your rights
Under GDPR you have a number of rights over your data. We list them in plain English — not just legal jargon.
Right of access (Art. 15)
You can ask us for a copy of the personal data we hold about you.
Right to rectification (Art. 16)
If something is incorrect, we'll fix it.
Right to erasure / "right to be forgotten" (Art. 17)
We delete your account data. Invoice rows are pseudonymized but kept (accounting law requires us to keep them for 10 years before deletion).
Right to restriction of processing (Art. 18)
You can ask us to store but not actively process your data.
Right to data portability (Art. 20)
We export your data in a machine-readable JSON format.
Right to object (Art. 21)
Where we process data on the basis of legitimate interest, you can object. We'll review the request and either stop or explain why the interest overrides.
Right to withdraw consent (Art. 7(3))
You can withdraw cookie and analytics consent at any time. Open cookie settings from the footer, or clear the oringy_consent cookie and the banner will reappear.
Right to lodge a complaint with a supervisory authority
If you believe we are infringing GDPR, you can contact the Slovak Data Protection Office at https://dataprotection.gov.sk or your local EU supervisory authority.
6. How to exercise your rights
The fastest route is email — we respond within 30 days (usually much sooner).
- Send your request to
- privacy@oringy.sk
Tip: state what you want (e.g. "data export" or "account deletion") so we can handle it quickly.
Self-service buttons to export and delete data are coming to your account page. Until then, email is the official and equally valid channel.
7. Contact the data controller
For any question or request about data protection:
- Data controller
- Oto Méheš - MARS (oringy.sk)
- privacy@oringy.sk
Full company details (company ID, registered office) are on the Contact page.
8. Updates to this policy
These terms were last updated: 11 May 2026
We update this policy whenever there's a meaningful change and, if you have an account with us, we'll let you know by email.
Document version: 1.0
9. Data transfers outside the EU (Google Analytics)
We use Google Analytics 4 from Google to measure traffic and conversions. This service activates only after you consent to analytics cookies; without consent it does not load and sends no data.
- Processor
- The processor for Google Analytics is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). In providing the service, Google Ireland engages its US-based parent company, Google LLC, as a sub-processor.
- Transfer to the USA
- Because Google LLC is based in the USA, your analytics data may — after you consent — be processed outside the European Union, specifically in the USA. This differs from our other tools (Sentry, PostHog), which process data within the EU.
- Legal basis for the transfer
- The transfer to the USA relies on the EU Standard Contractual Clauses (SCCs) and supplementary technical and organisational measures. Google LLC is also certified under the EU–US Data Privacy Framework, which is a valid mechanism for transferring personal data to the USA.
- Data retention
- The lifetime of Google Analytics cookies is set by Google (the _ga and _ga_<container-id> cookies default to 2 years). The default retention of event-level data in Google Analytics 4 is 2 months, which Google allows to be extended to up to 14 months.
- Consent and withdrawal
- We start Google Analytics only with your consent to the Traffic measurement category. Consent is voluntary and you can withdraw it at any time in the cookie settings in the site footer; after withdrawal, Google Analytics stops loading.