Privacy policy

The controller of your personal data is Oto Méheš - MARS, who operates the oringy.sk online shop. We are the point of contact for all questions about your data.

Email

privacy@oringy.sk

The controller’s full identification details (company ID, registered office, VAT ID) are on the Contact page and in the Terms & Conditions.

We process only as much data as we genuinely need. For each category we cite the GDPR legal basis.

• Account and contact details

  Email, name, shipping and billing addresses.

  Legal basis

  Performance of a contract (Art. 6(1)(b) GDPR).

  Retention

  For the lifetime of the account, or as long as statutory invoice archival applies.

• Order data

  Product lists, prices, billing details, payment receipts. For the order steps that require it (for example a discount off the list price, a small-order or cash-on-delivery surcharge, payment by invoice or a VAT ID check), we also write to an audit record the IP address and browser details you submitted the order from. We do the same when you download an invoice in your company account. For online payments, we also store the IP address you submitted the order from with the link for completing the payment.

  Legal basis

  Performance of a contract (Art. 6(1)(b)) + legal obligation (Art. 6(1)(c) — Slovak accounting law). Audit record with IP address and browser details: legitimate interest (Art. 6(1)(f)) — so that we can show when, from where and with what prices, fees and payment terms the order was submitted, for example in a tax audit or a dispute.

  Retention

  10 years (Slovak Accounting Act No. 431/2002 Coll., § 35). We keep the audit record with the IP address and browser details for 6 years, and the IP address stored with the online payment completion link for 12 months.

• Online payment (Stripe)

  Online payments – by payment card and by the other payment methods offered to you at checkout – are processed by Stripe. Stripe receives the amount and the order number from us. If, among the payment methods at checkout, you choose the option “Card (Visa, Mastercard)”, Stripe receives no name, email address or address from us: its form itself asks for what the payment needs (for example the country), may also offer you the option of saving your details in the Link service, and if you pay with a payment wallet, Stripe receives the necessary details from the wallet. If the option shown there instead is “Online payment” and you choose it, we pass Stripe the name and email address you entered at checkout as soon as the payment form is shown, that is before you confirm the payment, so that it can prefill them in the Link service (see the next category); when you confirm the payment, we pass it the name, email address and billing address as the payer’s details. When you pay again on the order page, we follow whichever of these two options the checkout offers at that moment. Stripe does not receive your phone number from us; if the chosen payment method or signing up to Link requires it, Stripe’s form will ask for it. You enter the card number and the login details of your payment services directly into Stripe’s form or on the page of your bank or other payment provider, so they never reach us. When you choose card or online payment at checkout, or click “Pay again” on the order page, a Stripe script loads; to detect fraud it collects data about your device and browser and about how you use the page (for example your IP address), and it stores the cookies and other browser data listed in Section 3. To protect against fraud and automated bots, the Stripe script may also load the hCaptcha service, which Intuition Machines, Inc. (USA) operates for Stripe; hCaptcha processes data about your device, browser and connection (for example your IP address) and about how you use the page, and cookies listed in Section 3 are stored on its domains. According to hCaptcha’s privacy policy, the transfer of this data to the USA relies on the EU–US Data Privacy Framework and the EU standard contractual clauses. For the same purpose, the Stripe script may also load a service of Human Security, Inc. (USA), which Stripe uses to detect bots. This service creates a digital fingerprint from the characteristics of your device and browser, assesses it together with data about your connection (for example your IP address) and about how you use the page, and stores the cookies and browser storage data listed in Section 3 on the domain b.stripecdn.com. According to its privacy policy, Human Security processes this data for its customers as a processor, but it may also integrate it into the service it provides to other customers and share it with them to improve fraud protection. According to Human Security’s privacy policy, the transfer of this data to the USA relies on the EU–US Data Privacy Framework. From Stripe we receive the result of the payment and details of the payment method used, for example the card brand and last four digits. We see these details in our Stripe account; in the e-shop’s database we store only the payment’s identifier, status and amount and, if a payment fails, the reason for the decline reported by Stripe. For executing the payment, Stripe is our processor; our contracting party is Stripe Payments Europe, Limited (Ireland). For its own purposes – preventing fraud and financial loss, complying with its legal obligations (for example anti-money-laundering rules), selecting banks and payment method providers, and improving its services – Stripe processes data as an independent controller under its privacy policy: https://stripe.com/privacy. Online payment data is also transferred outside the European Economic Area: to Stripe, LLC in the USA and, according to Stripe’s privacy policy, to other countries such as India. Transfers to the USA rely on the EU standard contractual clauses (SCC) that form part of our agreement with Stripe and on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, with which Stripe, LLC states it complies; transfers to other countries rely on the EU standard contractual clauses or another mechanism described in Stripe’s privacy policy. We will provide a copy of the safeguards on request. We need your name, email address and billing address to handle every order (see “Order data”); without them you cannot complete the order or pay online. If a payment fails, for example because Stripe assesses it as risky, write to us at info@oringy.sk – a person will review the situation.

  Legal basis

  Performance of the contract (Art. 6(1)(b) GDPR) – passing data to Stripe so that the payment can be executed and, if needed, refunded, including the payer’s details that some payment methods require. Legitimate interest (Art. 6(1)(f) GDPR) – protection against fraudulent payments and chargebacks using Stripe’s fraud-detection tools, which also use the payer’s details; processing strictly necessary for preventing fraud is a legitimate interest also under Recital 47 GDPR. Legitimate interest (Art. 6(1)(f) GDPR) is also the basis for passing your name and email address as soon as the form is shown with the “Online payment” option – so that you do not have to enter them again in the Link service. For the purposes for which Stripe processes data as an independent controller, it states the legal basis in its own policy.

  Retention

  In the e-shop’s database we keep payment data according to the category “Order data” and the table in Section 4. Data in Stripe’s systems is kept by Stripe as our processor for the duration of our contract and afterwards for as long as post-termination obligations require, and as an independent controller for as long as it needs it for its own purposes and legal obligations under its policy. The retention of Stripe’s cookies is stated in Section 3.

• Payment through other providers (wallets, PayPal, Link, banks)

  When you pay online, Stripe’s form may also offer you a service that you use under your own agreement with its provider – for example a payment wallet on your phone or in your browser (Apple Pay, Google Pay), a PayPal account, payment through online banking or Stripe’s Link service. What it offers depends, for example, on your device and browser, the amount and the country; whether it offers a payment wallet is determined by Stripe as soon as the form is shown. If you choose such a service, Stripe passes to its provider the data needed to execute the payment, and the provider processes it as an independent controller under the terms you have with it – for a PayPal account, that provider is PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). When you pay with a wallet, Stripe receives the details needed for the payment from the wallet. With Google Pay, Google may also use the data it collects for analytics; Google Ireland Limited is responsible for the data of users in the European Economic Area. Stripe operates the Link service as an independent controller: if you have a Link account, Stripe may recognise it by the email address we pass to it with the “Online payment” option, or that you enter in its form, and ask you to sign in with a one-time code; according to Stripe, it saves your details to Link only if you sign up. Through Stripe we receive the details the provider supplies about the payment – for example, for a payment from a PayPal account, the payer’s name, email address and PayPal ID, and for a payment through online banking, the account holder’s name, the bank and the last four characters of the IBAN. We see these details only in our Stripe account and do not store them in the e-shop’s database. When you pay by card, including through a payment wallet, the bank that issued your card also receives the payment data and processes it as an independent controller; Stripe may also send it its fraud-risk assessment together with data it holds about the payment, such as your IP address and, where it has it, your email address.

  Legal basis

  Performance of the contract (Art. 6(1)(b) GDPR) – passing data to the provider of the payment method you choose so that the payment can be executed and, if needed, refunded. We process the details we receive from the provider through Stripe on the same basis as other payment data (see the previous category). The providers, Stripe for the Link service and the bank that issued your card state the legal basis of their processing in their own policies.

  Retention

  The details we receive from the provider through Stripe are kept by Stripe in its systems as described in the previous category; we do not store them in the e-shop’s database. The providers of the payment methods you choose, Stripe for the Link service and the bank that issued your card keep data under their own policies.

• Shopping cart (oringy.cart.v1 cookie)

  The contents of your cart so you don't lose them when you refresh.

  Legal basis

  Performance of a contract — the cart is essential to making a purchase (Art. 6(1)(b)).

  Retention

  30 days from the last cart change.

• Consent record (oringy_consent cookie)

  Your decision about cookies (allowed categories + date), so we don't have to ask on every visit.

  Legal basis

  Consent (Art. 6(1)(a)). The consent record also lets us demonstrate compliance with Art. 7(1) GDPR.

  Retention

  180 days from the last decision.

• Traffic and marketing attribution (Google Analytics 4, Sentry, PostHog, attribution cookies)

  Data about how you use the site (errors, clicks, traffic sources, visits). This includes Google Analytics 4 from Google. Without your consent nothing activates and no data is sent. After you consent, Google Analytics data may also be processed in the USA — on the basis of the EU Standard Contractual Clauses (SCCs) and Google's certification under the EU–US Data Privacy Framework.

  Legal basis

  Consent (Art. 6(1)(a)).

  Retention

  Google Analytics cookies (_ga, _ga_<container-id>): 2 years (lifetime set by Google); 180 days for the attribution identifier; 30 days for PostHog session recordings; per processor DPA for Sentry.

• Conversion measurement from Heureka.sk (joint controllership under Art. 26 GDPR)

  If you arrived at oringy.sk from a Heureka.sk listing then, after you consent to marketing cookies, we also measure whether the visit ended in an order. For this conversion measurement we are joint controllers under Art. 26 GDPR together with Heureka Group a.s., registered office Karolinská 706/3, 186 00 Praha 8 – Karlín, Czech Republic (the operator of Heureka.sk). The joint controllership covers conversion measurement only and does not extend to the other processing described in this policy. Under Art. 26(2) GDPR you may exercise your rights against either of us; the primary contact point for conversion measurement is Heureka Group a.s., from whom you can also request the essence of that arrangement. Conversion measurement runs only on the Slovak version of the shop.

  Legal basis

  Consent (Art. 6(1)(a)).

  Retention

  Heureka's cookie is deleted 30 days after its first installation, and Heureka processes the conversion-measurement data for 12 months.

• Company data verification (Company ID, company name, VAT ID)

  When you enter a Company ID at checkout, or start typing a company name, our server sends what you entered to openfinstat.sk, which returns the registered name, registered seat address, Tax ID and VAT ID — these prefill your billing details. When you enter a VAT ID on an order, our server verifies it against the European Commission VIES system, which confirms whether the number is validly registered — always for invoice payment and for delivery to a company in another EU country with a VAT ID of that country. For invoice payment the check runs when you submit the order; for delivery to another EU country it runs while you fill in the checkout and again when you submit the order. Without that check we cannot apply the VAT exemption for supplies of goods to another EU member state (0 %, Section 43 of the Slovak VAT Act). openfinstat.sk is operated by a party separate from the operator of this shop — it is not part of Oto Méheš - MARS. The European Commission is not our processor under Art. 28 GDPR: in verifying a VAT ID it acts as an independent controller performing a task carried out in the public interest. openfinstat.sk and the European Commission are, to that extent, recipients of your data under Art. 13(1)(e) GDPR. Both checks run on our server and use no cookies to do so.

  Legal basis

  Performance of a contract and steps taken at your request before entering into it (Art. 6(1)(b)) — prefilling billing details and checking the VAT ID while you fill in the checkout, so that we show you the correct price; legal obligation (Art. 6(1)(c)) — checking the VAT ID when you submit the order and keeping the result, together with the name and address returned by VIES, as the basis for correct tax treatment and the VAT exemption (Section 43 of the Slovak VAT Act); legitimate interest (Art. 6(1)(f)) — an audit record of the check, so that we can show when it ran and with what result, for example in a tax audit or a dispute.

  Retention

  The service response stays in server memory — 10 minutes for openfinstat.sk and 30 minutes for VIES. With your order we store the outcome of the VAT ID check together with the name and address VIES returns, and keep them as long as the order (10 years); if you ordered while signed in, we erase the VIES name and address when you delete your account — on an order placed without an account they stay with the order. The VAT ID check is written to an audit record without the VAT number, name or address: a check while you fill in the checkout is kept for 12 months without your IP address, a check when you submit the order is kept with the order, together with your IP address and browser details, for 6 years. Data you submit with the order is kept under the Order data category.

• Withdrawing from the contract online

  When you withdraw from the contract using the “Withdraw from contract here” function, we store your notice: your name, the order as you entered it, the email address we send the acknowledgement to, whether you are withdrawing from the whole order or from part of it (and the text you wrote about it), the language of the page and the date and time of submission. If we find the order by its number in our records, we link the notice to that order. If the email address you entered differs from the one on the order and you did not send the notice from the account the order belongs to or via the link in an order email, we verify the notice by writing to the email address on the order before taking any further step. If we cannot find the order by its number, we will try to find it manually by your name and email address and, if we find it, link the notice to it later. If you were signed in when you sent the notice, we also link it to your account. We send an acknowledgement of receipt to the address you entered, and the seller’s authorised staff handle the notice. We do not store your IP address or browser details in the record of the notice.

  Legal basis

  Legal obligation (Art. 6(1)(c) GDPR) – to accept a notice through the withdrawal function and acknowledge its receipt without undue delay (Section 20a of Slovak Act No. 108/2024 Coll.); performance of the contract (Art. 6(1)(b) GDPR) – handling the withdrawal (returning the goods and the money); legitimate interest (Art. 6(1)(f) GDPR) – keeping the notice as evidence of whether and when we received it and how we handled it, for example in case of a dispute or an inspection.

  Retention

  For as long as we may need to prove whether and when we received the notice and how we handled it, at most 10 years from its submission. If you delete your account, we do not delete the notice; we only detach it from the account (Art. 17(3)(b) and (e) GDPR).

Here is the full list of cookies we may use. "Essential" cookies cannot be turned off — without them the site doesn't work or an online payment cannot be made securely. "With your consent" cookies do not activate until you click Accept in the cookie banner.

We keep data only as long as we need it. Here is a summary of the periods we apply:

Under GDPR you have a number of rights over your data. Below we list them in plain language that everyone can understand — not just lawyers.

• Right of access (Art. 15)

  You can ask us for a copy of the personal data we hold about you.

• Right to rectification (Art. 16)

  If something is incorrect, we'll fix it.

• Right to erasure / "right to be forgotten" (Art. 17)

  We delete your account data. Orders placed from your account are pseudonymised and kept for 10 years; invoices and accounting documents, including billing details, must by law be kept for 10 years, so we do not delete them earlier. On an order delivered VAT-free to a company in another EU country, the buyer's VAT ID stays on it — the Slovak VAT Act requires it as evidence of the exemption (Section 43).

• Right to restriction of processing (Art. 18)

  You can ask us to store but not actively process your data.

• Right to data portability (Art. 20)

  We export your data in a machine-readable JSON format.

• Right to object (Art. 21)

  Where we process data on the basis of legitimate interest, you can object. We'll review your objection and either stop the processing or explain why our interest prevails.

• Right to withdraw consent (Art. 7(3))

  You can withdraw cookie and analytics consent at any time. Open cookie settings from the footer, or clear the oringy_consent cookie and the banner will reappear.

• Right to lodge a complaint with a supervisory authority

  If you believe we are infringing GDPR, you can contact the Slovak Data Protection Office at https://dataprotection.gov.sk or your local EU supervisory authority.

The fastest way to reach us is by email — we process requests within 30 days (usually sooner).

Send your request to

privacy@oringy.sk

Tip: state what you want (e.g. "data export" or "account deletion") so we can handle it quickly.

If you have an account, you can start the data export and the account-deletion request yourself — in Account settings, in the Privacy and my data section. After you submit a deletion request you have 30 days to cancel it; after that the deletion is irreversible. If you are the owner of an organisation on oringy.sk, self-service deletion completes only after you transfer ownership to another team member. The email address above remains a fully valid way to exercise your rights — including for people without an account.

For any question or request about data protection:

Data controller

Oto Méheš - MARS (oringy.sk)

Email

privacy@oringy.sk

Full company details (company ID, registered office) are on the Contact page.

This policy was last updated: 26 October 2026

We update this policy whenever there's a meaningful change and, if you have an account with us, we'll let you know by email.

Document version: 1.6

Data is processed outside the European Economic Area in particular for online payment – we describe the transfer for payments through Stripe in Section 2, category “Online payment (Stripe)” – and, after your consent, for audience measurement, described below. We use Google Analytics 4 from Google to measure traffic and conversions. This service activates only after you consent to analytics cookies; without consent it does not load and sends no data.

Processor

The processor for Google Analytics is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). In providing the service, Google Ireland engages its US-based parent company, Google LLC, as a sub-processor.

Transfer to the USA

Because Google LLC is based in the USA, your analytics data may — after you consent — be processed outside the European Union, specifically in the USA.

Legal basis for the transfer

The transfer to the USA relies on the EU Standard Contractual Clauses (SCCs) and supplementary technical and organisational measures. Google LLC is also certified under the EU–US Data Privacy Framework, which is a valid mechanism for transferring personal data to the USA.

Data retention

The lifetime of Google Analytics cookies is set by Google (the _ga and _ga_<container-id> cookies default to 2 years). The default retention of event-level data in Google Analytics 4 is 2 months, which Google allows to be extended to up to 14 months.

Consent and withdrawal

We start Google Analytics only with your consent to the Traffic measurement category. Consent is voluntary and you can withdraw it at any time in the cookie settings in the site footer; after withdrawal, Google Analytics stops loading.