Your privacy, considered.

The controller

The seller operating Damcart is the controller of personal data used to run this store. Contact us for privacy matters at info@damcart.com.

Legal seller

Damir Mavrinac

Registered address

Slakova ulica 35, 8210 Trebnje, Slovenia

Email

info@damcart.com

Telephone

+386 51 873 547

Enquiries and customer support

We process the name, contact information, message and project or purchase details you submit to answer your request. Steps you request before a purchase and order support use the contract basis (GDPR Article 6(1)(b)). Other correspondence uses our legitimate interest in answering enquiries and managing our business (Article 6(1)(f)). Do not send payment-card data or unnecessary sensitive information. Required form fields are marked. Without enough contact and request details, we may be unable to answer.

Orders, accounts and legal records

For a purchase, we process your name, billing and delivery addresses, email, any required delivery contact, goods, quantities, amounts, delivery agreement, payment references and order status to perform the contract. An optional account holds the details needed for sign-in and order management. Order and contract records include the applicable terms, delivery agreement, relevant dates and payment status. We may also record the actual delivery date for an item.

We process invoices and required accounting records to meet legal duties (Article 6(1)(c)). Withdrawal and complaint records include identification of the purchase, the request, relevant dates, correspondence and the delivery status of acknowledgements. Their legal bases are performance of the contract and compliance with consumer-protection duties. Necessary records for establishing or defending claims use our legitimate interest in resolving disputes fairly (Article 6(1)(f)). Providing the information needed for a purchase is a contractual requirement; without it we cannot fulfil the order. Creating an account is not a condition of exercising consumer rights.

Security, abuse prevention and dispute evidence

The shop may record the order IP address and browser user-agent alongside order timestamps and transaction references. We use proportionate technical records to protect the store, detect misuse, investigate payment or delivery disputes and establish what happened. The basis for this security and evidence processing is our legitimate interest in preventing fraud and defending legitimate claims (Article 6(1)(f)), balanced against your rights; it is not a request for marketing consent.

Short-lived attempt counters protect public forms and order lookups from spam and guessing. Their keys use hashed identifiers, not raw contact details or raw IP addresses, and expire within 15 minutes. Withdrawal notices are kept privately with restricted administrative access; a time-limited receipt link is a way to obtain your acknowledgement, not a public directory. No card security code or full card number belongs in store logs, enquiries or the preserved contract.

Who receives information

Authorised people handling your request or order can access information needed for their work. Relevant recipients may include hosting and email services, payment providers, delivery services, accounting providers and professional advisers. We share information for the purposes described in this notice, or with competent authorities where law requires or permits it. Providers acting on our instructions process information on our behalf; a provider may be an independent controller for its own legal or operational purposes.

Payment information

When you select an online payment method, the payment provider processes the information needed for that transaction. This can include payment-method, customer, order and technical data. The store uses payment status, transaction references and limited payment-method information to manage your order and refunds. A payment provider may act on our instructions for some services and as an independent controller for purposes such as fraud prevention, financial compliance or payment-network operations. The provider’s own privacy information applies to those independent activities.

International access and transfers

If a service provider or its subprocessor accesses personal data from outside the European Economic Area, the transfer must meet applicable data-protection requirements. Such access may relate to hosting, email delivery, payment processing, fraud prevention or support. Contact info@damcart.com for information about relevant destinations, safeguards and how to obtain a copy of those safeguards.

How long records are kept

We retain personal information for the time needed for its purpose, taking account of the enquiry or contract, required accounting and consumer records, and applicable periods for establishing, exercising or defending legal claims. Ongoing complaints or disputes can require relevant records to be retained longer. The same considerations apply to related correspondence and backups.

You may request erasure, subject to any legal obligation or justified need to retain the information. Expiry of a receipt-download link does not mean the underlying order or withdrawal record has been deleted.

Browser storage and marketing

This storefront does not add advertising pixels or analytics. Products you save for later are stored in your browser until you clear them or this website’s storage. Shopping, sign-in and payment functions may use necessary storage. See Cookies & browser storage for the purposes and controls. Sending an enquiry does not subscribe you to marketing. Where an optional activity requires consent, you can choose whether to allow it.

Your rights

Subject to the GDPR, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where a particular activity relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Contact info@damcart.com. We may ask for proportionate information to confirm your identity. We normally respond within one month; where the GDPR permits an extension, we explain it within that first month.

You may complain to the Slovenian Information Commissioner at ip-rs.si or another competent supervisory authority, including in your country of residence. The storefront itself does not make solely automated decisions with legal or similarly significant effects about you. Banks and payment providers may apply their own authentication or fraud decisions under their notices.