Privacy policy

The controller of your personal data is Oto Méheš - MARS, which operates the oringy.sk shop. We are the single point of contact for all questions about your data.

Email

privacy@oringy.sk

The controller’s full identification details (company ID, registered office, VAT ID) are on the Contact page and in the Terms & Conditions.

We process only as much data as we genuinely need. For each category we cite the GDPR legal basis.

• Account and contact details

  Email, name, shipping and billing addresses.

  Legal basis

  Performance of a contract (Art. 6(1)(b) GDPR).

  Retention

  For the lifetime of the account, or as long as statutory invoice archival applies.

• Order data

  Product lists, prices, billing details, payment receipts.

  Legal basis

  Performance of a contract (Art. 6(1)(b)) + legal obligation (Art. 6(1)(c) — accounting law).

  Retention

  10 years (Slovak Accounting Act No. 431/2002 Coll., § 35).

• Shopping cart (oringy.cart.v1 cookie)

  The contents of your cart so you don't lose them when you refresh.

  Legal basis

  Performance of a contract — the cart is essential to making a purchase (Art. 6(1)(b)).

  Retention

  30 days from the last cart change.

• Consent record (oringy_consent cookie)

  Your decision about cookies (allowed categories + date), so we don't have to ask on every visit.

  Legal basis

  Consent (Art. 6(1)(a)). The consent record also lets us demonstrate compliance with Art. 7(1) GDPR.

  Retention

  180 days from the last decision.

• Traffic and marketing attribution (Google Analytics 4, Sentry, PostHog, attribution cookies)

  Data about how you use the site (errors, clicks, traffic sources, visits). This includes Google Analytics 4 from Google. Without your consent nothing activates and no data is sent. After you consent, Google Analytics data may also be processed in the USA — on the basis of the EU Standard Contractual Clauses (SCCs) and Google's certification under the EU–US Data Privacy Framework.

  Legal basis

  Consent (Art. 6(1)(a)).

  Retention

  Google Analytics cookies (_ga, _ga_<container-id>): 2 years (lifetime set by Google); 180 days for the attribution identifier; 30 days for PostHog session recordings; per processor DPA for Sentry.

• Company data verification (Company ID, company name, VAT ID)

  When you enter a Company ID at checkout, or start typing a company name, our server sends what you entered to openfinstat.sk, which returns the registered name, registered seat address, Tax ID and VAT ID — these prefill your billing details. When you enter a VAT ID on an order, our server verifies it on submission against the European Commission VIES system, which confirms whether the number is validly registered — always for invoice payment and for billing to another EU country; without that check we cannot apply the reverse charge. openfinstat.sk is operated by a party separate from the operator of this shop — it is not part of Oto Méheš - MARS. The European Commission is not our processor under Art. 28 GDPR: in verifying a VAT ID it acts as an independent controller performing a task carried out in the public interest. openfinstat.sk and the European Commission are, to that extent, recipients of your data under Art. 13(1)(e) GDPR. Both checks run on our server and use no cookies to do so.

  Legal basis

  Performance of a contract (Art. 6(1)(b)) — prefilling billing details; legal obligation (Art. 6(1)(c)) — VAT ID verification for correct tax determination.

  Retention

  The service response stays in server memory only — 10 minutes for openfinstat.sk and 30 minutes for VIES; we do not store the name and address VIES returns. Only the outcome of the VAT ID check is written to the database, in the audit record attached to your order. Data you submit with the order is kept under the Order data category.

Here is the full list of cookies we may use. "Essential" cookies cannot be turned off — without them the site doesn't work. "With your consent" cookies do not activate until you click Accept in the cookie banner.

We keep data only as long as we need it. Here is a summary of the periods we apply:

Under GDPR you have a number of rights over your data. We list them in plain English — not just legal jargon.

• Right of access (Art. 15)

  You can ask us for a copy of the personal data we hold about you.

• Right to rectification (Art. 16)

  If something is incorrect, we'll fix it.

• Right to erasure / "right to be forgotten" (Art. 17)

  We delete your account data. Invoice rows are pseudonymized but kept (accounting law requires us to keep them for 10 years before deletion).

• Right to restriction of processing (Art. 18)

  You can ask us to store but not actively process your data.

• Right to data portability (Art. 20)

  We export your data in a machine-readable JSON format.

• Right to object (Art. 21)

  Where we process data on the basis of legitimate interest, you can object. We'll review the request and either stop or explain why the interest overrides.

• Right to withdraw consent (Art. 7(3))

  You can withdraw cookie and analytics consent at any time. Open cookie settings from the footer, or clear the oringy_consent cookie and the banner will reappear.

• Right to lodge a complaint with a supervisory authority

  If you believe we are infringing GDPR, you can contact the Slovak Data Protection Office at https://dataprotection.gov.sk or your local EU supervisory authority.

The fastest route is email — we respond within 30 days (usually much sooner).

Send your request to

privacy@oringy.sk

Tip: state what you want (e.g. "data export" or "account deletion") so we can handle it quickly.

If you have an account, you can run the data export and the account-deletion request yourself — in Account settings, section Privacy and my data. After you submit a deletion request you have 30 days to cancel it; after that the deletion is irreversible. If you are the owner of an organisation on oringy.sk, self-service deletion completes only after you transfer ownership to another team member. The email address above remains a fully valid way to exercise your rights — including for people without an account.

For any question or request about data protection:

Data controller

Oto Méheš - MARS (oringy.sk)

Email

privacy@oringy.sk

Full company details (company ID, registered office) are on the Contact page.

These terms were last updated: 11 May 2026

We update this policy whenever there's a meaningful change and, if you have an account with us, we'll let you know by email.

Document version: 1.0

We use Google Analytics 4 from Google to measure traffic and conversions. This service activates only after you consent to analytics cookies; without consent it does not load and sends no data.

Processor

The processor for Google Analytics is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). In providing the service, Google Ireland engages its US-based parent company, Google LLC, as a sub-processor.

Transfer to the USA

Because Google LLC is based in the USA, your analytics data may — after you consent — be processed outside the European Union, specifically in the USA. This differs from our other tools (Sentry, PostHog), which process data within the EU.

Legal basis for the transfer

The transfer to the USA relies on the EU Standard Contractual Clauses (SCCs) and supplementary technical and organisational measures. Google LLC is also certified under the EU–US Data Privacy Framework, which is a valid mechanism for transferring personal data to the USA.

Data retention

The lifetime of Google Analytics cookies is set by Google (the _ga and _ga_<container-id> cookies default to 2 years). The default retention of event-level data in Google Analytics 4 is 2 months, which Google allows to be extended to up to 14 months.

Consent and withdrawal

We start Google Analytics only with your consent to the Traffic measurement category. Consent is voluntary and you can withdraw it at any time in the cookie settings in the site footer; after withdrawal, Google Analytics stops loading.