Mali Krog respects your privacy. This Policy explains how personal data is collected, used, stored and protected when you visit our website, become a member, rent toys or contact us.
1. Who is responsible for your data?
The data controller is:
Legal business name: [Insert registered name]
Address: [Insert registered business address]
Email: [Insert privacy contact email]
For privacy-related questions or requests, contact us using the details above.
2. What personal data do we collect?
Depending on how you use Mali Krog, we may collect:
- Account information: name, email address, login details and account preferences.
- Membership information: membership status, subscription dates, billing history and TOYken balance.
- Rental information: bookings, toy selections, rental dates, return records and communications about a rental.
- Delivery information: delivery address, recipient details and relevant tracking information.
- Payment information: payment status, transaction references and limited payment details supplied by our payment provider. Full card details should be handled by the payment provider rather than stored directly by Mali Krog.
- Customer communications: messages, support requests, complaints and information you choose to provide.
- Technical information: IP address, device and browser information, security logs and website usage data, as applicable.
- Cookie information: information collected through cookies and similar technologies, according to your preferences and applicable law.
Please do not send unnecessary sensitive personal information through our contact form.
3. Why do we use your data?
We process personal data for the following purposes:
- Creating and managing member accounts.
- Processing subscriptions, payments and deposits.
- Managing toy bookings, availability, delivery and returns.
- Communicating about rentals, billing, safety and customer support.
- Handling complaints, disputes and legitimate outstanding amounts.
- Maintaining website security and preventing misuse.
- Meeting accounting, tax and other legal obligations.
- Sending optional newsletters or marketing communications where we have a valid legal basis.
- Understanding website performance through analytics where permitted and, where required, after obtaining your consent.
We do not use personal data for purposes incompatible with the purposes explained here.
4. Legal bases for processing
Under the General Data Protection Regulation (GDPR), we rely on the legal basis appropriate to each processing activity.
Contract: processing needed to create your membership, manage bookings, process payments and provide the rental service.
Legal obligation: processing required for accounting, tax, consumer protection or other applicable legal duties.
Legitimate interests: processing necessary for proportionate purposes such as website security, preventing fraud, handling legal claims and maintaining business records, where those interests do not override your rights.
Consent: processing based on your freely given consent, such as optional marketing or non-essential cookies where consent is required.
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
5. Who may receive your data?
We may share relevant personal data with service providers that help us operate Mali Krog, including:
- Website hosting and technical support providers.
- Membership and subscription software providers.
- Payment processors.
- Postal and courier services.
- Email and customer-support providers.
- Accounting, legal and other professional advisers.
- Public authorities where disclosure is required by law.
Service providers will receive only the information needed for their role and will be subject to appropriate contractual and legal safeguards.
We do not sell personal data to third parties.
6. International transfers
If a service provider processes personal data outside the European Economic Area, we will ensure that any transfer complies with the GDPR, including the use of an applicable adequacy decision or appropriate safeguards where required.
Details of relevant safeguards may be requested using our privacy contact email.
7. How long do we keep your data?
We keep personal data only for as long as necessary for the purpose for which it was collected, subject to legal retention requirements.
Examples include:
- Account and membership information: while your account is active and for a necessary period afterwards.
- Booking and transaction records: for the periods required by applicable accounting, tax and consumer law.
- Customer complaints and disputes: for as long as reasonably necessary to resolve the matter and establish, exercise or defend legal claims.
- Marketing preferences: until you unsubscribe or the relevant processing is otherwise ended.
- Security logs: for a defined period appropriate to the security purpose.
[Insert the actual retention periods for each category before publication.]
8. Your rights
Subject to the conditions and limitations in applicable law, you may have the right to:
- Access your personal data.
- Correct inaccurate or incomplete information.
- Request erasure.
- Restrict processing.
- Receive certain data in a portable format.
- Object to certain processing.
- Withdraw consent where consent is the legal basis.
- Lodge a complaint with a competent data protection supervisory authority.
You may exercise your rights by contacting [Privacy email]. We may need to verify your identity proportionately before acting on a request.
In Slovenia, the competent supervisory authority is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec).
9. Marketing communications
If you subscribe to our newsletter, we will use your contact details for the purposes described when you sign up.
You can unsubscribe at any time using the link in the email or by contacting us.
Service-related messages, such as booking confirmations, payment notices and important safety communications, are separate from optional marketing.
10. Children’s data
Mali Krog is intended to be managed by adults. A parent or legal guardian should create and manage the account and rental bookings.
We do not intentionally request children’s personal data unless it is genuinely necessary for a stated service purpose. Please do not provide children’s names, photographs or other identifying information unless requested for a specific, justified reason.
11. Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and disclosure.
No online service can guarantee absolute security, but we take reasonable steps to protect the information entrusted to us.
12. Changes to this Policy
We may update this Policy when our services, providers or legal obligations change.
The latest version will be published on our website with its updated date.
13. Contact and complaints
For privacy questions or requests, contact [Privacy email].
You may also contact the Slovenian Information Commissioner if you believe your personal data has been processed unlawfully.