Privacy policy
Effective from: 10 August 2026
Controller of personal data
The controller of personal data is AquaVeya d.o.o., Vodovodna cesta 65, 1000 Ljubljana, Slovenia, company registration number 7551363000, tax number 35922885. For questions regarding privacy, you may contact support@uvinneco.com.
What data we may process
- identification and contact details (name, surname, e-mail, delivery and invoicing address);
- company details and tax/VAT number, if the buyer orders as a company;
- data on the order, purchased products, amount, delivery, returns, complaints and warranty claims;
- payment data that AquaVeya receives from the payment service provider (as a rule, AquaVeya does not receive full payment card details);
- the content of communication via e-mail, the contact form or support;
- technical data such as IP address, device and browser type, cookie identifiers and data on the use of the website, where this is permitted;
- data on newsletter sign-up and marketing consents;
- data that the user voluntarily enters into the UVINNECO AI assistant, if they use it.
- Data marked as mandatory when placing an order are necessary for the conclusion and performance of the contract. If the user does not provide them, the order as a rule cannot be processed or delivered. Data not marked as mandatory are provided voluntarily.
Purposes and legal bases
We process personal data only for specified, explicit and legitimate purposes:
| Purpose | Example of data | Legal basis |
|---|---|---|
| Order fulfilment and delivery | contact details, address, order | performance of a contract or pre-contractual measures |
| Payments and prevention of abuse | transaction data, technical data | performance of a contract and legitimate interest |
| Accounting and legal obligations | invoices, transactions, orders | legal obligation |
| Support, complaints and warranty | communication, order, evidence | performance of a contract, legal obligation and legitimate interest |
| Newsletter | e-mail, record of consent | consent |
| Meta advertising and measurement | online identifiers, events, cookies | consent for non-essential marketing and tracking technologies |
| Website security | IP, logs, technical data | legitimate interest in security and prevention of abuse |
| AI assistant | content of the question and technical data | performance of the user's request; the precise legal basis will be aligned with the actual implementation |
Contact form
If the user uses the contact form, we process the data necessary to reply to their message. The proposed minimum fields are name and surname, e-mail address and message. A telephone number is not required unless it is justified for business reasons.
Newsletter
The user signs up for the newsletter voluntarily. We process the e-mail address for direct marketing on the basis of consent, which the user may withdraw at any time via the unsubscribe link in the message received or via support@uvinneco.com. Unsubscribing does not affect the lawfulness of processing carried out before the withdrawal.
To send newsletters we use Shopify Email, which is part of the Shopify platform. Sign-up is separate and voluntary, and unsubscribing is possible via the link in every message.
Meta advertising
When advertising begins, we intend to use Meta advertising and measurement technologies (e.g. Meta Pixel and, if technically enabled, related server-side measurement). Non-essential marketing technologies may not be activated before the user's valid consent, where the law requires it. The user may subsequently change their choice in the cookie settings.
UVINNECO AI assistant
A clearly marked AI assistant may be available on the contact page. We recommend that users do not enter special categories of personal data, financial data or other sensitive information into it that is not necessary for the question.
The UVINNECO AI assistant operates entirely in the user's browser. It answers on the basis of a pre-prepared database of questions and answers from this website. The content of conversations is not sent to any external provider, is not stored and is not used for profiling or advertising.
To whom we may disclose data
To the extent necessary for the individual purpose, personal data may be received or processed by:
- Shopify and related providers of online store infrastructure;
- payment service providers, including Shopify Payments, PayPal and Klarna, where the buyer selects the individual method;
- Pošta Slovenije and other possible delivery partners;
- providers of hosting, development, maintenance and technical support of the website (including Webnite, where it acts as a contractual processor);
- the newsletter system provider;
- Meta or related providers, where the user consents to marketing tracking;
- the AI assistant provider;
- accounting, legal and other professional contractors, where necessary;
- state authorities, courts or other entitled parties, where disclosure is required by law.
Transfers of data outside the EEA
Some technology providers may also process data outside the European Economic Area. Where such a transfer occurs, appropriate safeguards under the GDPR are applied, for example an adequacy decision or standard contractual clauses, where these are required.
Retention periods
- we retain data on orders, invoices and transactions for as long as required by the applicable tax, accounting and other regulations and by the time limits for asserting legal claims;
- we retain data related to complaints and warranty for as long as necessary to handle the claim and for any statutory time limits;
- we retain contact messages until the communication is concluded and for a reasonable period thereafter, where this is necessary for evidentiary purposes or for the continuation of the relationship;
- we retain newsletter data until consent is withdrawn or for as long as the purpose of direct marketing exists;
- data from cookies and similar technologies are retained according to the lifetime of the individual technology shown in the cookie settings.
Rights of the individual
Under the conditions of the GDPR, the individual has the right of access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, the individual may withdraw the consent at any time. The individual may object to direct marketing at any time. A request may be sent to support@uvinneco.com.
The individual also has the right to lodge a complaint with the Informacijski pooblaščenec Republike Slovenije (Information Commissioner of the Republic of Slovenia) if they consider that their personal data are being processed contrary to the regulations.
Automated decision-making
AquaVeya itself does not, as a rule, take decisions which would have legal or similarly significant effects for the individual and would be based solely on automated processing. Individual payment method providers, for example providers of deferred payment, may carry out their own eligibility checks in accordance with their own rules and privacy policies.
Security and changes to the policy
AquaVeya uses reasonable technical and organisational measures to protect personal data. The policy may be updated due to changes in technology, providers or legislation. The effective date of the current version is always stated at the top.