Home / Privacy Policy

Privacy Policy

PERSONAL DATA PROTECTION AND COOKIE POLICY

Principles and information on personal data protection provided by the Controller to the Data Subject when obtaining personal data from the Data Subject, and information on cookies used by the magneticlove.sk online store.

I. Controller

1.1. Identity and contact details of the Controller:

Business name: Doll shirt s. r. o.
Registered office: Furdekova 19, 851 04 Bratislava – Petržalka, Slovak Republic

Registered in the Commercial Register of the Bratislava III Municipal Court, Section: Sro, Insert No.: 201334/B
Company ID No.: 57727112

Tax ID No.:
Bank account: SK61 1100 0000 0029 4130 4216

The Seller is not registered for value-added tax.

1.2. Email and telephone contact details of the Controller:

Email: info@magneticlove.sk
Telephone: +421 915 983 346

1.3. Address of the Controller for written correspondence:

Doll shirt s. r. o., Furdekova 19, 851 04 Bratislava, Slovak Republic

1.4.

In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC – the General Data Protection Regulation (hereinafter referred to as the "Regulation"), Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts, as amended, and Act No. 452/2021 Coll. on Electronic Communications, as amended, the Controller hereby provides the Data Subject – the Buyer – from whom the Controller – the Seller – obtains personal data relating to that person, with the following information, instructions and explanations:

II. References

2.1.

These Personal Data Protection Principles and Information form part of the General Terms and Conditions published on the Seller's website.

2.2.

The Trader informs consumers that there are no specific applicable codes of conduct that the Seller has undertaken to comply with.

A code of conduct means an agreement or a set of rules defining the conduct of the Seller, who has undertaken to comply with such a code concerning one or more specific commercial practices or business sectors, where these are not governed by law, another legal regulation or a measure issued by a public authority. This also includes information about how the consumer may become acquainted with or obtain the wording of such a code.

III. Retention Period

3.1.

The Controller retains the Data Subject's personal data only for the period strictly necessary for the performance of the contract and its subsequent archiving following the statutory retention periods imposed on the Controller by applicable legislation.

Where the Data Subject has consented to receiving promotional emails and similar offers, the Data Subject's personal data will be processed for these purposes until the Data Subject withdraws their consent, but no longer than five years.

IV. Personal Data Processed

4.1.

The Controller processes the following personal data through its website:

First name, surname, residential address, email address, landline telephone number, mobile telephone number, billing address, delivery address, data obtained from cookies and IP addresses.

V. Contact Details of the Data Protection Officer

5.1.

The Controller has not appointed a Data Protection Officer under Regulation (EU) 2016/679 on the protection of natural persons regarding the processing of personal data and on the free movement of such data.

5.2.

The Controller is also the Seller within the meaning of the term defined in the General Terms and Conditions of this website.

VI. Purposes and Duration of the Processing of the Data Subject's Personal Data

6.1. The purposes for processing the Data Subject's personal data include, in particular:

6.1.1.

The registration, preparation and processing of contracts and customer data for entering into contracts with third parties.

6.1.2.

The processing of accounting documents and documents related to the Controller's business activities.

6.1.3.

Compliance with legislation concerning the archiving of documents and records, for example under Act No. 431/2002 Coll. on Accounting, as amended, and other applicable legislation.

6.1.4.

Activities of the Controller related to fulfilling the Data Subject's request, order, contract or similar legal arrangement.

6.1.5.

Newsletters, marketing and similar promotional activities of the Controller, provided that the Data Subject has given the Controller consent to carry out marketing and similar promotional activities.

VII. Legal Basis for Processing the Data Subject's Personal Data

7.1.

Where the Controller processes personal data based on the Data Subject's consent, such processing will begin only after the Data Subject has granted the relevant consent.

7.2.

Where the Controller processes the Data Subject's personal data for the purposes of pre-contractual negotiations, entering into and performing a purchase contract, and the associated delivery of goods, products or services, the Data Subject is required to provide the personal data necessary for the proper performance of the purchase contract. Otherwise, performance of the contract cannot be ensured.

Personal data processed for this purpose is processed without the Data Subject's consent.

VIII. Recipients or Categories of Recipients of Personal Data

8.1.

Recipients of the Data Subject's personal data will or may include:

8.1.1.

The Controller's statutory bodies or their members.

8.1.2.

Persons performing work for the Controller under an employment relationship or a similar relationship.

8.1.3.

The Controller's commercial representatives and other persons cooperating with the Controller in performing the Controller's tasks.

For the purposes of this document, the Controller's employees include all natural persons performing dependent work for the Controller under an employment contract or an agreement for work performed outside an employment relationship.

8.1.4.

Recipients of the Data Subject's personal data will also include the Controller's associates, business partners, suppliers and contractual partners, particularly:

  • an accounting company;
  • a company providing software development and maintenance services;
  • a company providing legal services to the Controller;
  • a company providing consultancy services to the Controller;
  • companies arranging the transport and delivery of products to Buyers and third parties;
  • marketing companies;
  • companies operating social networks;
  • companies providing payment gateways and other payment methods.

8.1.5.

Recipients of personal data may also include courts, law enforcement authorities, tax authorities and other public authorities where required by law.

The Controller will provide personal data to such authorities and public institutions based on and following the laws of the Slovak Republic.

8.1.6. List of third parties – processors and recipients processing the Data Subject's personal data:

Slovenská pošta, a.s.
Partizánska cesta 9, 975 99 Banská Bystrica, Slovak Republic
Company ID No.: 36631124
A third party providing transport and delivery services.

Packeta Slovakia s. r. o.
Sliačska 1E, 831 02 Bratislava – Nové Mesto, Slovak Republic
Company ID No.: 48136999
A third party providing transport and delivery services.

Shoptet, a.s.
Dvořeckého 628/8, 169 00 Prague 6, Czech Republic
Company ID No.: 28935675
Tax ID No.: CZ28935675
A third party providing the COMGATE payment gateway.

JJ top, s. r. o.
Arménska 6, 821 07 Bratislava – Vrakuňa, Slovak Republic
A third party providing accounting services

X. Information on the Transfer of Personal Data to Third Countries and the Retention Period

 

9.1.

 

Applicable. The Controller transfers personal data in the form of cookies to the following entities in third countries:

 

GOOGLE Pixels: Google HQ, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Further information about privacy protection is available at:

 

https://business.safety.google/privacy/

 

https://business.safety.google/privacy/google-services/

 

https://business.safety.google/privacy/display-advertising/

 

META Pixels: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Further information about privacy protection is available at:

 

https://www.facebook.com/about/privacy/

 

X. Information on the Relevant Rights of the Data Subject

 

10.1.

 

The Data Subject has, among others, the following rights:

 

10.1.1.

 

Section 10.1 is without prejudice to any other rights of Data Subjects.

 

10.1.2.

 

The Data Subject's right of access under Article 15 of the Regulation includes:

 

The right to obtain confirmation from the Controller as to whether personal data concerning the Data Subject is being processed and, where that is the case, the extent of such processing.

 

Where personal data is being processed, the Data Subject also has the right to access its content and request information from the Controller regarding the reasons for its processing, particularly information about:

 

  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organisations;
  • the expected period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
  • the existence of the right to request that the Controller rectify or erase personal data concerning the Data Subject or restrict its processing;
  • the existence of the right to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the personal data was not collected from the Data Subject, any available information regarding its source;
  • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, in such cases, meaningful information about the logic involved, as well as the significance and expected consequences of such processing for the Data Subject;
  • the appropriate safeguards under Article 46 of the Regulation relating to personal data transferred to a third country or an international organisation.

 

10.1.3.

 

The right to receive a copy of the personal data undergoing processing, provided that the provision of such a copy does not adversely affect the rights and freedoms of others.

 

10.1.4.

 

The Data Subject's right to rectification under Article 16 of the Regulation includes:

 

  • the right to have the Controller rectify inaccurate personal data concerning the Data Subject without undue delay;
  • the right to have incomplete personal data completed, including by providing a supplementary statement;
  • the Data Subject's right to erasure of personal data, also known as the "right to be forgotten", under Article 17 of the Regulation, which includes the following:

 

10.1.5.

 

The right to obtain from the Controller the erasure of personal data concerning the Data Subject without undue delay where one of the following grounds applies:

 

  • the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • the Data Subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;
  • the Data Subject objects to the processing under Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing;
  • the Data Subject objects to the processing under Article 21(2) of the Regulation;
  • the personal data has been unlawfully processed;
  • the personal data must be erased to comply with a legal obligation under European Union law or the law of a Member State to which the Controller is subject;
  • the personal data was collected in connection with the provision of information society services referred to in Article 8(1) of the Regulation.

 

10.1.6.

 

Where the Controller has made the Data Subject's personal data public and is obliged to erase it, the Data Subject has the right to require the Controller, taking account of available technology and implementation costs, to take reasonable measures, including technical measures, to inform other controllers processing the personal data that the Data Subject has requested the erasure of any links to, copies of or replications of such personal data.

 

The right to erasure under Article 17(1) and (2) of the Regulation does not apply where processing is necessary:

 

10.1.7.

 

For exercising the right to freedom of expression and information.

 

10.1.8.

 

For compliance with a legal obligation requiring processing under European Union law or the law of a Member State to which the Controller is subject, or for performing a task carried out in the public interest or in the exercise of official authority vested in the Controller.

 

10.1.9.

 

For reasons of public interest in the area of public health following Article 9(2)(h) and (i), as well as Article 9(3), of the Regulation.

 

10.1.10.

 

For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes under Article 89(1) of the Regulation, where the right referred to in Article 17(1) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or for the establishment, exercise or defence of legal claims.

 

10.1.11.

 

The Data Subject's right to restriction of processing under Article 18 of the Regulation includes:

 

10.1.12.

 

The right to require the Controller to restrict the processing of personal data where one of the following applies:

 

  • the Data Subject contests the accuracy of the personal data, for a period enabling the Controller to verify its accuracy;
  • the processing is unlawful, and the Data Subject opposes the erasure of the personal data and requests the restriction of its use instead;
  • the Controller no longer requires the personal data for processing purposes, but the Data Subject requires it for the establishment, exercise or defence of legal claims;
  • the Data Subject has objected to processing under Article 21(1) of the Regulation, pending verification of whether the legitimate grounds of the Controller override those of the Data Subject.

 

10.1.13.

 

Where processing has been restricted, such personal data may, apart from storage, be processed only:

 

  • with the Data Subject's consent;
  • for the establishment, exercise or defence of legal claims;
  • for the protection of the rights of another natural or legal person; or
  • for reasons of important public interest of the European Union or a Member State.

 

10.1.14.

 

The right to be informed by the Controller before the restriction of processing is lifted.

 

10.1.15.

 

The Data Subject's right concerning the notification obligation regarding rectification or erasure of personal data or restriction of processing under Article 19 of the Regulation includes:

 

  • the right to have the Controller notify every recipient to whom the personal data has been disclosed of any rectification or erasure of personal data or restriction of processing carried out following Article 16, Article 17(1) and Article 18 of the Regulation, unless this proves impossible or involves disproportionate effort;
  • the right to be informed by the Controller about those recipients if the Data Subject requests it.

 

10.1.16.

 

The Data Subject's right to data portability under Article 20 of the Regulation includes the right to receive personal data concerning the Data Subject, which the Data Subject has provided to the Controller, in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from the Controller where:

 

a) the processing is based on the Data Subject's consent under Article 6(1)(a) or Article 9(2)(a) of the Regulation, or on a contract under Article 6(1)(b) of the Regulation; and

 

b) the processing is carried out by automated means.

 

10.1.17.

 

The right to receive personal data in a structured, commonly used and machine-readable format and to transmit that data to another controller without hindrance from the Controller must not adversely affect the rights and freedoms of others.

 

10.1.18.

 

The right to have personal data transmitted directly from one controller to another, where technically feasible.

 

10.1.19.

 

The Data Subject's right to object under Article 21 of the Regulation includes:

 

10.1.20.

 

The right to object, at any time and on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning the Data Subject that is based on Article 6(1)(e) or (f) of the Regulation, including profiling based on those provisions.

 

10.1.21.

 

Where the Data Subject exercises the right to object, at any time and on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning the Data Subject based on Article 6(1)(e) or (f) of the Regulation, including profiling based on those provisions, the Data Subject has the right to require the Controller to cease processing the personal data unless the Controller demonstrates compelling legitimate grounds for the processing that override the Data Subject's interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.

 

10.1.22.

 

The right to object at any time to the processing of personal data concerning the Data Subject for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

 

Where the Data Subject objects to processing for direct marketing purposes, the personal data must no longer be processed for such purposes.

 

10.1.23.

 

In connection with the use of information society services, the right to exercise the right to object by automated means using technical specifications.

 

10.1.24.

 

The right to object, on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning the Data Subject for scientific or historical research purposes or statistical purposes under Article 89(1) of the Regulation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

 

10.1.25.

 

The Data Subject's rights concerning automated individual decision-making under Article 22 of the Regulation include:

 

10.1.26.

 

The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects the Data Subject, except in the cases provided for in Article 22(2) of the Regulation, namely where the decision:

 

a) is necessary for entering into or performing a contract between the Data Subject and the Controller;

 

10.1.27.

 

b) is authorised by European Union law or the law of a Member State to which the Controller is subject and which also lays down suitable measures to safeguard the Data Subject's rights, freedoms and legitimate interests; or

 

c) is based on the Data Subject's explicit consent.

 

XI. Information on the Data Subject's Right to Withdraw Consent to the Processing of Personal Data

 

11.1.

 

The Data Subject has the right to withdraw consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

 

The Data Subject may withdraw consent to the processing of personal data at any time, either in full or in part.

 

A partial withdrawal of consent may relate to a specific type of processing operation or several processing operations. The lawfulness of the remaining processing operations will remain unaffected.

 

A partial withdrawal of consent may also relate to a particular purpose or several specific purposes of personal data processing. The lawfulness of processing for all other purposes will remain unaffected.

 

The Data Subject may exercise the right to withdraw consent:

 

  • in writing, by sending the withdrawal to the address registered as the Controller's registered office in the Commercial Register at the time the consent is withdrawn; or
  • electronically, by sending an email to the Controller's email address stated in the Controller's identification details in this document.

 

XII. Information on the Data Subject's Right to Lodge a Complaint with a Supervisory Authority

 

12.1.

 

The Data Subject has the right to lodge a complaint with a supervisory authority, particularly in the Member State of the Data Subject's habitual residence, place of work or place of the alleged infringement, if the Data Subject considers that the processing of personal data concerning them infringes the Regulation. This right is without prejudice to any other administrative or judicial remedy.

 

The Data Subject has the right to be informed by the supervisory authority with which the complaint has been lodged about the progress and outcome of the complaint, including the possibility of seeking a judicial remedy under Article 78 of the Regulation.

 

12.2.

 

The supervisory authority in the Slovak Republic is:

 

Office for Personal Data Protection of the Slovak Republic

Galvaniho Business Center II

Galvaniho 7/B

821 04 Bratislava

Slovak Republic

 

Telephone: +421 2 32 31 32 14

Email: statny.dozor@pdp.gov.sk

 

XIII. Information Concerning Automated Decision-Making, Including Profiling

 

13.1.

 

As the Controller does not process the Data Subject's personal data through automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, the Controller is not required to provide the information under Article 13(2)(f) of the Regulation.

 

This includes information about automated decision-making, including profiling, the logic involved, and the significance and expected consequences of such processing for the Data Subject.

 

Not applicable.

 

XIV. Personal Data Protection and the Use of Cookies – Information and Explanation Regarding Cookies, Scripts and Pixels

 

14.1.

 

The website Controller provides the following brief explanation of the functions of cookies, scripts and pixels:

 

14.1.1.

 

Cookies are text files containing small amounts of information that are downloaded to your device when you visit a website.

 

They allow a website to remember information about your actions and preferences for a certain period, such as your login name, language, font size and other display preferences. Therefore, you do not have to re-enter this information whenever you return to the website or browse its individual pages.

 

A script is a piece of programming code used to ensure the proper and interactive functioning of a website. This code runs either on the Controller's server or on your device.

 

A pixel is a small, invisible piece of text or image on a website used to monitor website traffic. For this purpose, various data is stored using pixels.

 

14.1.2. Cookies are divided into the following categories:

 

Strictly necessary cookies – These ensure the proper functioning and use of the Controller's website. These cookies are used without consent.

 

Functional cookies – These relate to users' choices regarding the use of cookies on the website, including the option to accept, reject or customise cookie settings according to their privacy preferences.

 

Analytics cookies – These allow the Controller to obtain statistics about the use of its website. These cookies are used only with consent.

 

Advertising cookies – These are used to create advertising profiles and carry out similar marketing activities. These cookies are used only with consent.

 

14.2. How to control cookies

 

14.2.1.

 

You may control and/or delete cookies at your discretion. Further information is available at:

 

https://www.aboutcookies.org/

 

You may delete all cookies stored on your computer or another device, and you may configure most web browsers to prevent cookies from being stored.

 

14.3.1. Cookies used

 

Strictly necessary cookies

 

tempSessionKey__

 

First-party cookie

Duration: 1 year and 1 month

 

This cookie is used to temporarily store session data to improve the user's browsing experience by ensuring smooth navigation and proper website functionality. It usually stores information that does not personally identify the user and is deleted after the session ends.

 

tempUUID

 

First-party cookie

Duration: Session

 

This cookie assigns a temporary, unique identifier to a user during their browsing session to ensure smooth navigation and user interactions on the website.

 

PHPSESSID

 

First-party cookie

Duration: Session

 

This cookie is generated by PHP-based applications. It is a general-purpose identifier used to maintain user session variables.

 

It usually consists of a randomly generated number. Its specific use may vary depending on the website, but a typical example is maintaining a user's logged-in status when navigating between pages.

 

Functional cookies

 

language

 

First-party cookie

Duration: 11 months and 4 weeks

 

Many different types of cookies are associated with this name, and it is generally advisable to examine how the cookie is used on the particular website.

 

In most cases, it is used to store language preferences and potentially display content in the saved language. The ICC category stated here is based on this use.

 

currencyCode

 

First-party cookie

Duration: 59 minutes and 58 seconds

 

This cookie remembers the currency selected by the user on the website so that prices can be displayed and transactions can be completed in the selected currency.

 

poptin_previous_url

 

First-party cookie

Duration: 1 minute and 54 seconds

 

This cookie stores the last page visited by the user, allowing for a more personalised and engaging user experience, such as displaying relevant pop-up windows based on the content of the previously visited page.

 

poptin_session

 

First-party cookie

Duration: 29 minutes and 54 seconds

 

This cookie tracks the user's session to improve the browsing experience by enabling features such as remembering the user's actions across individual pages.

 

It is necessary for the website's interactive functions and for improving the customer experience without storing personal data.

 

inco_session_temp_browser

 

First-party cookie

Duration: 59 minutes and 54 seconds

 

This cookie temporarily stores session information to improve the user's browsing experience without permanently storing personal data.

 

poptin_old_user

 

First-party cookie

Duration: 2 days

 

This cookie distinguishes between new and returning website visitors. It helps analyse user behaviour and improve the website's user experience.

 

poptin_user_id

 

First-party cookie

Duration: 11 months and 4 weeks

 

This cookie identifies unique website visitors using a unique ID. It helps track user engagement and interactions with pop-ups and forms on the website, improving the user experience by remembering user preferences.

 

Analytics cookies

 

_ga

 

First-party cookie

Duration: 1 year and 1 month

 

This cookie name is associated with Google Universal Analytics, which is a significant update to Google's commonly used analytics service.

 

The cookie distinguishes unique users by assigning a randomly generated number as a client identifier. It is included in every page request on the website and is used to calculate visitor, session and campaign data for the website's analytics reports.

 

permId

 

Third-party cookie

Duration: 4 weeks and 2 days

 

This cookie identifies unique visitors and tracks visitor sessions on the website for performance measurement purposes.

 

_ga_DQDCZ99ZWL

 

First-party cookie

Duration: 1 year and 1 month

 

This cookie is used by Google Analytics to maintain the session state.

 

Advertising cookies

 

incomaker_p

 

First-party cookie

Duration: 1 year and 1 month

 

This cookie stores the user's preferences and choices to provide personalised content and potentially targeted advertising on the website.

 

It tracks user behaviour and interactions to optimise the user experience.

 

14.3.2. Cookies made available to third parties

 

Google HQ

1600 Amphitheatre Parkway

Mountain View, CA 94043

USA

 

Further information about privacy protection is available at:

 

https://business.safety.google/privacy/

 

https://business.safety.google/privacy/google-services/

 

https://business.safety.google/privacy/display-advertising/

 

META Pixels: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

 

Further information about privacy protection is available at:

 

https://www.facebook.com/about/privacy/

 

XV. Final Provisions

 

15.1.

 

These Personal Data Protection Principles and Information and this Cookie Policy form an integral part of the General Terms and Conditions and the Complaints Procedure.

 

The General Terms and Conditions and the Complaints Procedure of this website are published on the Seller's website.

 

15.2.

 

These Personal Data Protection Principles become valid and effective upon their publication on the Seller's website on 2 June 2026.

 

This online store is certified by:

 

https://www.pravoeshopov.sk