Lei & Lu elegance s.r.o. (registered address: Bidovce 316, 044 45 Bidovce, Slovakia; Company ID (IČO): 47364301; VAT No. SK2023839785; email: info@vilborgova.eu) (“we“, “us“, or “our“) is the controller of your personal data within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and Act No. 18/2018 Coll. on Personal Data Protection of the Slovak Republic.
Our e‑commerce website, vilborgova.eu, is built on WooCommerce and uses the services listed in section 4 below.
2. The Personal Data We Collect
Category
Examples
Source
Identification & Contact Data
name, billing/shipping address, email, phone
provided by you during checkout or account creation
Account Credentials
username, hashed password
provided by you
Transaction Data
purchased products, order value, payment status
generated by WooCommerce & payment gateway
Technical Data
IP address, device ID, browser type/version, time‑stamp
automatically collected via server logs & cookies
Usage Data
pages visited, actions on site, referring URLs
collected via Google Analytics & Tag Manager
Marketing Preferences
newsletter opt‑in, email engagement
provided by you / Mailchimp
Support Interactions
emails, chat messages, complaint details
provided by you
We do not intentionally collect special categories of data (Art. 9 GDPR) or data about criminal convictions (Art. 10 GDPR).
3. Purposes & Legal Bases
Purpose
Legal Basis (Art. 6 GDPR)
Processing and delivering your order; providing customer support
b) contract performance
Accounting and tax compliance
c) legal obligation
Fraud detection and security monitoring
f) legitimate interest
Website analytics and performance optimisation
a) consent (cookie banner) & f) legitimate interest
Direct e‑mail marketing (newsletter)
a) consent
Maintenance and improvement of our website (Elementor, WooCommerce plugins)
f) legitimate interest
Responding to data‑subject requests
c) legal obligation
If we rely on our legitimate interests, we balance those interests against your rights and freedoms and will not proceed where they override our interests.
4. Cookies & Tracking Technologies
We use CookieYes to present a granular cookie‑consent banner. Non‑essential cookies are set only after you opt in. Details on individual cookies (name, purpose, expiry, provider) can be found at any time by clicking “Cookie Settings” in the banner.
Main providers:
Google Tag Manager & Google Analytics — anonymised statistics, custom events. IP addresses are truncated within the EU.
Elementor — stores preferences necessary for page rendering.
WooCommerce — shopping‑cart and order‑processing cookies.
You can withdraw consent at any time via the banner or by clearing cookies in your browser.
5. E‑mail Marketing via Mailchimp
If you opt in to our newsletter, your email address and analytics about email opens/clicks are processed by The Rocket Science Group LLC d/b/a Mailchimp, USA. Mailchimp acts as our processor under a Data Processing Agreement incorporating the European Commission’s Standard Contractual Clauses (SCCs).
You may unsubscribe at any time by clicking the link in any newsletter or contacting us.
6. Disclosure to Third Parties
We share data only where necessary —
Payment service providers & banks (e.g. card acquirers) for transaction processing
IT service providers (hosting, maintenance, backup)
Analytics & marketing vendors listed above
Logistics companies for delivery
Tax advisors & public authorities where required by Slovak or EU law All recipients are bound by confidentiality and data‑processing agreements in line with Art. 28 GDPR.
7. International Data Transfers
Some providers (Google, Mailchimp) are located outside the European Economic Area. We transfer data only:
to countries with an EU adequacy decision; or
under SCCs or comparable safeguards (Art. 46 GDPR).
You may obtain a copy of the SCCs on request.
8. Retention Periods
Data Set
Retention
Order & invoice data
10 years (Slovak accounting law)
Customer account
until you close the account or 5 years of inactivity
Newsletter list
until you withdraw consent or 2 years after last interaction
Analytics logs
26 months (Google Analytics default)
Server logs
up to 12 months
We may retain data longer where required for legal claims.
9. Your Rights
Under GDPR and Slovak law you may:
Access your data
Rectify inaccurate data
Erase data (“right to be forgotten”)
Restrict processing
Object to processing based on legitimate interests or direct marketing
Port data to another controller
Withdraw consent at any time (without affecting prior processing)
Lodge a complaint with a supervisory authority (see below)
To exercise any right, contact us at info@vilborgova.eu. We will respond within one month.
10. Automated Decision‑Making
We do not use your data for automated decision‑making or profiling that produces legal effects within the meaning of Art. 22 GDPR.
11. How We Protect Your Data
TLS 1.3 encryption of all web traffic
Role‑based access control & strong passwords
Regular security updates of WooCommerce / plugins
Server‑level firewalls & intrusion detection
Data‑processing agreements with all vendors
12. Children
Our webshop is aimed at adults. We do not knowingly process data of persons under 16 years of age. If you believe we have inadvertently collected such data, please contact us for deletion.
13. Changes to This Notice
We may update this notice to reflect legal or operational changes. The latest version is always available at vilborgova.eu/privacy-policy. Significant changes will be notified via the website or email.
14. Contact & Supervisory Authority
Controller: Lei & Lu elegance s.r.o. (see section 1)
Supervisory Authority: Office for Personal Data Protection of the Slovak Republic Hraničná 12, 820 07 Bratislava 27, Slovakia https://dataprotection.gov.sk Tel.: +421 2 3231 3214 Email: statny.dozor@pdp.gov.sk
If you believe that your personal data have been processed unlawfully, you can lodge a complaint with the Supervisory Authority or with the data‑protection authority in the EU Member State of your habitual residence.
This notice is intended to meet the transparency requirements of Articles 12–14 GDPR and sections 19–22 of Slovak Act No. 18/2018 Coll., and to be interpreted in line with guidance from the European Data Protection Board (EDPB).
