IRBIS d.o.o. | Updated version for review | Effective 15 October 2026
Before publication, complete the checks in the Completion Instructions document. This text is part of a set of six IRBIS documents.
Controller
The controller is IRBIS, d.o.o., Ilirska Bistrica, Koseze 32C, 6250 Ilirska Bistrica, Slovenia, company registration number 5411637000. Data protection contact: prodaja@irbis.si, +386 5 710 02 80.
What data we use and why
Orders and quotations. We use your name, address, contact details, ordered products, payment information and communications to prepare quotations and conclude and perform contracts. The legal basis is Article 6(1)(b) GDPR. You can make a purchase without a user account. We process the data of business customers’ contact persons on the basis of our legitimate interest in business communications and carrying out transactions, Article 6(1)(f).
Invoices and claims. We process invoice data and data required for mandatory records to comply with legal obligations, Article 6(1)(c). We process data relating to complaints, returns and legal claims to perform a contract, comply with the law or pursue our legitimate interest in establishing and defending claims.
User account. If you register, we process your login details, contact details and order information to provide your account on a contractual basis. An account is not required to make a purchase.
Newsletters. After you voluntarily subscribe, we use your email address and any name you choose to provide to send offers through SqualoMail. The legal basis is your consent, Article 6(1)(a) GDPR, taking into account ZEKom-2. You can unsubscribe using the link in the message or by contacting prodaja@irbis.si. We do not track newsletter opens or clicks or create recipient profiles based on them.
Analytics. With your consent, we use Google Analytics 4 to collect usage statistics and improve the website. Web identifiers, page views, events, and device and browser information are processed. We retain user and event data in GA4 for two months. This setting is not the same as the duration of cookies and does not necessarily determine how long aggregate reports are retained.
Ad measurement. With your consent, we use Meta Pixel to measure visits, purchases and ad performance. Meta receives events, web identifiers and technical data and may link them to your user account. We do not use advanced matching or send email addresses or phone numbers through Pixel or the Conversions API. The legal basis for our use is your consent, Article 6(1)(a).
Security. We use technical logs, which may contain an IP address, access time, requested address and device information, to ensure secure operation and prevent and investigate misuse, on the basis of our legitimate interest. The scope and retention period are limited to what is necessary for this purpose.
Mandatory fields in the order form are marked. We cannot process your order without the required data. Consent to newsletters, analytics and advertising is not required to make a purchase. We obtain data from you, through your use of the website and, where delivery is made to another person, from the person placing the order. If you provide another person’s details, inform them that you are sharing them; this does not remove our information obligations.
Who has access to your data
Authorised IRBIS personnel and service providers use the data to the extent necessary:
SINUS IKS d.o.o., Slovenia: online store maintenance and hosting management;
Hetzner, Germany: server infrastructure for hosting;
Pošta Slovenije and delivery partners: delivery and shipment notifications;
Stripe: card payments, transaction verification and fraud prevention;
SqualoMail: subscriber list and newsletter delivery;
Google: Google Analytics 4 with your consent;
Meta: Meta Pixel with your consent;
accounting and other essential contractual service providers, and competent authorities where required by law.
Card payments are processed through Stripe. In the store, we process the data necessary to track payments and refunds. Depending on the purpose, Stripe acts as a processor or an independent controller; it describes its legal and security-related processing in its privacy policy.
For the collection and transmission of events through Meta Pixel, joint controllership with Meta Platforms Ireland Limited applies to the extent set out in the relevant arrangement. IRBIS ensures that Pixel is properly implemented, provides information and obtains consent, while Meta fulfils the obligations assigned to it under the arrangement, particularly those relating to its systems and rights. You may also exercise your rights through IRBIS. Details are set out in the agreement with Meta and Meta’s policy.
Processing outside the EEA
The store is hosted by Hetzner in Germany, and maintenance is carried out by SINUS IKS in Slovenia. This does not, in itself, constitute a transfer outside the European Economic Area (EEA). External payment and measurement services may involve processing in the United States and other countries.
Stripe: According to its published Data Transfers Addendum, for transfers to Stripe, LLC in the United States, Stripe primarily relies on the EU–US Data Privacy Framework (DPF) where the transfer falls within the scope of its certification. For transfers not covered by this framework, the addendum includes the European Commission’s Standard Contractual Clauses (SCCs). Details: Stripe Data Transfers Addendum.
Google Analytics: Google LLC relies on the DPF for transfers covered by its certification. Where a transfer is not covered by an adequacy decision, Google states that it uses SCCs. Details: Google’s rules on transfers.
Meta Pixel: For data from its business tools transferred from the EU to the United States, Meta states that it relies on the DPF to the extent covered by its certification. Other transfers are subject to the safeguards set out in Meta’s applicable terms. Details: Meta and the DPF and EU Data Transfer Addendum.
The DPF is based on an adequacy decision by the European Commission under Article 45 GDPR; SCCs are a safeguard under Article 46 GDPR. These mechanisms are relied upon only for transfers and recipients that they actually cover. You can request information and copies of safeguards by contacting prodaja@irbis.si. Consent to cookies does not, by itself, provide a legal basis for an international transfer.
How long we retain data
Invoices: generally ten years after the end of the year to which they relate, in accordance with tax rules.
Contracts and claims: for the performance of the transaction and thereafter for the applicable warranty and limitation periods; in the event of a dispute, until the related proceedings and obligations have concluded.
Enquiries that do not lead to a purchase: no more than six months after communication ends, unless another lawful basis applies.
User account: until it is closed or, at most, 24 months after the last activity. Deletion is carried out manually. Mandatory purchase records are retained separately.
Newsletters: until you unsubscribe. After you unsubscribe, we retain only the minimum data necessary to honour your objection and demonstrate consent and its withdrawal, for as long as required in light of legal obligations and any legal claims.
GA4: user and event data for two months.
Security logs: routine access and error logs for no more than 30 days from the date the record is created. If an incident is detected, only the necessary portion is separated and retained on a limited basis until the investigation or related legal proceedings are concluded; it is then deleted.
Backups: rolling retention for no more than 30 days from the creation of each backup. Data deleted from the live system is also removed from backups within this period. Backups are intended for restoration, not routine use; if a backup is restored, we carry out any previously requested deletions again.
Meta events: after you withdraw your consent, we stop sending further data. Meta’s retention of data already sent depends on the purpose and type of data, including measurement and service operation, security, legal obligations and handling claims. Data may therefore be retained for different periods; the expiry of a cookie does not mean that events are deleted. Details and information on how to exercise your rights are available in Meta’s privacy policy; you may also send your request to us.
When the legal basis ceases to apply, we delete the data or irreversibly anonymise it. Withdrawal of consent does not delete data that is lawfully retained on another basis.
Your rights
Subject to the conditions set out in the GDPR, you may request access to, rectification or erasure of your data, restriction of processing and data portability. Data portability applies to data you have provided that is processed by automated means on the basis of a contract or your consent.
You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing and related profiling at any time; we will then stop this processing. You may withdraw your consent without affecting the lawfulness of processing carried out before withdrawal. To manage online tracking, use “Cookie Settings”; for newsletters, use the unsubscribe link.
Send your request to prodaja@irbis.si or to our registered office. We will generally respond within one month. Where permitted by law, we may extend the deadline by up to two additional months and will inform you of the reasons within the first month. Where necessary, we will verify your identity in a proportionate manner.
Orders at IRBIS are reviewed manually. Online advertising measurement may involve linking events to a profile on Meta; therefore, we do not claim that none of the services involved carries out profiling. Stripe’s processing for payment security is described in its policy.
You may lodge a complaint with the Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si, or with another competent authority in the country of your habitual residence, place of work or the place of the alleged infringement. In Croatia, the competent authority is AZOP, www.azop.hr.
Effective date: 15 October 2026