Home / Privacy Policy

Privacy Policy

This is the English version of our privacy policy; its content is the same as the Slovak version. It describes the processing of personal data in the www.tuningovesvetla.sk online store under Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on the Protection of Personal Data. We have written it so that you know exactly what data we hold about you, what we use it for, who we share it with and how long we keep it.

I. Controller

The controller who determines the purposes and means of processing personal data is:

eStores, s. r. o.
Registered office: Oravická 617/20, 028 01 Trstená, Slovakia
Company ID: 48056561, Tax ID: 2120047545, VAT ID: SK2120047545
Commercial Register of the Žilina District Court, Section: Sro, Insert No. 63492/L
E-mail: info@tuningovesvetla.sk
Phone: +421 43 230 4890

On matters concerning personal data, contact us by e-mail at info@tuningovesvetla.sk or by post at our registered office. We have not appointed a data protection officer (DPO) because the GDPR does not require us to do so given the nature and scope of our processing.

II. What personal data we process and where it comes from

We mainly process:

• identification and contact details: first name and surname, e-mail, phone number,
• delivery and billing address and, where applicable, the chosen GLS pickup point,
• business details if you purchase for a company (company name, Company ID, Tax ID, VAT ID) and the result of the VAT ID check in the VIES system,
• order and payment data (ordered goods, prices, shipping and payment method, order status, parcel numbers; for refunds also the bank account you provide),
• the content of your communication with us (e-mails, order note, a withdrawal from the contract submitted via the form on our website, review text) and any photos you attach to a review,
• data about calls to our number and calls we make to you (phone number, time and length of the call), the recording of a message you leave in our voicemail, and data about text messages we send you,
• technical data from your visit: IP address, browser type, visited address and time (server logs); when you place an order we also store the IP address it came from,
• the ad click identifier (gclid, gbraid, wbraid, fbclid) if you came from an ad, your choice in the cookie banner, which we also store with your order, and cookie data (see Section VI).

You provide most of the data yourself when ordering or communicating with us. If you purchase for a company, we may complete the company name and address from public registers (Slovak Register of Financial Statements, Register of Legal Entities, Czech ARES register) after you enter the Company ID. We verify foreign VAT IDs in the European Commission's VIES system. Carriers tell us the delivery status of parcels and our phone system tells us the caller's number. If we approach you with a collaboration offer as a content creator, we obtained your data from your publicly accessible social media profile (Section III point 15).

We do not process special categories of personal data (e.g. health data). Please do not include them in e-mails or photos.

Some decisions in the ordering process are made automatically because they are necessary for entering into and performing the contract (Art. 22(2)(a) GDPR): we cancel an unpaid prepaid order after the period set in the terms and conditions has expired (after warning you by e-mail), and the system does not accept an order that exceeds the protective limit on the number of orders from one e-mail address or phone number per hour. If you disagree with such a decision, write to info@tuningovesvetla.sk — a human will review it, and you can express your view and contest the decision. Automation also helps us sort e-mails and draft replies and flags a previously uncollected cash-on-delivery parcel (Section III points 5 and 7; point 7 is simple profiling); in those cases a human always decides. If you click “Accept all” in the cookie banner, Google and Meta may add your browser to advertising audiences based on your visit and show you our ads (remarketing) — this is profiling for advertising purposes, which takes place only with your consent.

III. Purposes and legal bases of processing

1. Order fulfilment and performance of the purchase contract: accepting and confirming the order, delivering the goods (including directly from our supplier), order status updates, payment and parcel-collection reminders by e-mail or text message, handling complaints and withdrawals. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
2. Card payment: for card payments we redirect you to the GoPay payment gateway and pass it the data needed for the payment. You enter your card details directly at GoPay; we neither see nor store them. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
3. Accounting and tax: issuing and retaining invoices and credit notes. If you buy for a company from another EU country without VAT, also verifying the VAT ID in VIES and retaining proof of the check. Legal basis: legal obligation, Art. 6(1)(c) GDPR (Act No. 431/2002 Coll. on Accounting, Act No. 222/2004 Coll. on VAT).
4. Customer communication: answering questions by e-mail, phone or WhatsApp. Legal basis: performance of a contract where the question concerns an order, otherwise legitimate interest, Art. 6(1)(f) GDPR (answering customer questions).
5. AI assistance with e-mails: e-mails arriving in our mailboxes are automatically sorted, and a draft reply is prepared, by the AI tool Claude provided by Anthropic. The tool receives the e-mail content, the sender's name and e-mail address and, for e-mails about an order, its number, status, amount and items. We use the same tool to read data from invoices sent to us by carriers and suppliers (they may contain the name and address of a parcel recipient) and to process voice instructions that may contain a customer's name or order number. A human reviews and sends every reply. The tool sends nothing on its own; it only labels an e-mail (e.g. as a regular message or spam) and a human always decides how it is handled. Anthropic processes the data as our processor, does not use it to train its models and generally deletes it within 30 days. Legal basis: legitimate interest, Art. 6(1)(f) GDPR (handling your questions quickly and correctly).
6. Call records and voicemail: calls to our number and calls we make to you go through a virtual phone system. We record the phone number and the time and length of the call. If the number matches the phone number in an order, we link the call to that order so we can help you quickly. We do not record calls. However, if you leave a message in our voicemail, the phone system stores the recording of your message and e-mails it to us together with your phone number so that we can call you back. Legal basis: legitimate interest, Art. 6(1)(f) GDPR (knowing who called us, helping you quickly with your order and calling you back if you left a message).
7. Preventing uncollected cash-on-delivery parcels: when a new order is placed, the system compares its e-mail, phone, address and IP address (the IP only within 90 days) with previous orders that were not collected on delivery. If it finds a match, it alerts us. A human always decides what happens next (e.g. asking for prepayment). This is simple profiling (the system assesses the risk that a cash-on-delivery parcel will not be collected), not automated decision-making under Art. 22 GDPR. Legal basis: legitimate interest, Art. 6(1)(f) GDPR (protection against losses from uncollected parcels).
8. Security and operation of the store: server logs (IP address, browser, visited address, time), limiting repeated attempts against automated attacks, detecting fake orders and database backups. Legal basis: legitimate interest, Art. 6(1)(f) GDPR (security and availability of the store).
9. Back-in-stock notification (“watchdog”): if you enter your e-mail for a sold-out product, we use it solely to send a single notification when the product is back in stock. Legal basis: consent, Art. 6(1)(a) GDPR. You can withdraw consent at any time via the unsubscribe link in the notification e-mail or by e-mail to info@tuningovesvetla.sk; we then delete your address.
10. Abandoned order reminder: if you enter your e-mail at checkout with goods in your basket and do not complete the order, we may send you up to two reminders, only within 7 days. We tell you this directly below the E-mail field. If you do not want reminders, tick the box “Don't send me cart reminders” there — we will then not send you any for this purchase. You can also switch them off at any time via the link “Nechcem dostávať pripomienky na košík” (I don't want basket reminders) in every reminder or by e-mail to info@tuningovesvetla.sk. Legal basis: Section 116(15) of Act No. 452/2021 Coll. on Electronic Communications (an e-mail address you gave us when making a purchase, with the option to refuse such e-mails when entering it and in every reminder).
11. Product review request: about a week after your order has been delivered (for a pickup point, after you collect the parcel) we may send you a single e-mail with a link to rate the purchased products. The same link is also available on your order page after delivery; it is valid for about six months and stops working once we record the return of the order. We collect reviews exclusively from customers who actually bought the product from us (verified purchase); a published review shows your name in the form you confirm in the review form (e.g. “Peter K.”). You may voluntarily attach photos of the part — they are published together with the review; before saving we strip hidden metadata from them (such as GPS location) and we recommend not photographing license plates or people. The e-mail is one-off — no reminders. You can refuse the request with the box at checkout or via the link in the e-mail; once you have refused it, we do not send further requests to the same e-mail address. We keep a published review and its photos for as long as it is published or until you ask us to delete it. Reviews we do not approve or take down, and their photos, are not shown publicly. We keep them as a moderation record (so that we can handle any disagreement you may have with our decision and show that we do not remove critical reviews) for no longer than 3 years from the decision, and delete them earlier on request. You can ask us to delete a review including its photos at any time. Legal basis for sending the request e-mail: Section 116(15) and (16) of Act No. 452/2021 Coll. on Electronic Communications (we obtained your e-mail in connection with a sale, we send the request no later than one year after the purchase, and you can refuse it at checkout and in every e-mail). We process, publish and moderate the review and photos you send us on the basis of our legitimate interest under Art. 6(1)(f) GDPR (truthful product reviews from verified customers).
12. Heureka “Verified by Customers” satisfaction survey: for deliveries to Slovakia or the Czech Republic, after a purchase we pass your e-mail address, order number and the identification of the purchased goods to Heureka Group a.s. so that it can send you a one-off satisfaction questionnaire; the answers are used to evaluate feedback and improve our services, and Heureka publishes a rating of our shop based on them. When sending the questionnaire, Heureka acts as our processor. Legal basis for passing your e-mail address to Heureka and sending the questionnaire: Section 116(15) and (16) of Act No. 452/2021 Coll. (e-mail obtained in connection with a sale, with the option to refuse); for evaluating the answers, legitimate interest under Art. 6(1)(f) GDPR (customer feedback and improving our services). You can refuse the questionnaire with the box at checkout before placing the order, later via the link “Nechcem dostávať žiadosti o hodnotenie” (I don't want review requests) in our review request e-mail, or by e-mail to info@tuningovesvetla.sk; we then no longer pass your address to Heureka for further orders placed with the same e-mail address. An opt-out via the link in the e-mail from Heureka itself is recorded only by Heureka — it is not passed on to us.
13. Traffic measurement and advertising: if you click “Accept all” in the cookie banner, we use Google Analytics 4 (traffic measurement), Google Ads and Meta Pixel (measuring and showing ads, including remarketing on Google, Facebook and Instagram) and Heureka conversion tracking. When you make a purchase, we then also pass your contact details to Google and Meta, mostly in hashed form (the data is encoded one-way; this is not encryption or anonymisation — Google and Meta can use it to match the purchase to their user with the same e-mail or phone number), to match the purchase with the ad (Section V). Legal basis: consent under Section 109(8) of Act No. 452/2021 Coll. and Art. 6(1)(a) GDPR; you can withdraw it at any time via “Cookie settings” in the footer without affecting the lawfulness of prior processing.If you came to us by clicking a Google or Meta ad, the click identifier (gclid, gbraid, wbraid or fbclid) is currently stored in a cookie in your browser (Section VI) and with your order even if you did not consent to cookies; we are preparing a change after which it will not be stored without consent. We pass it to Google only if you had given consent in the cookie banner (“Accept all”) when you placed the order: after the order is paid, we report the order number, amount and payment time for that identifier to Google (without your contact details). We also pass the fbclid identifier to Meta only with your consent (Section V). Without consent, we use the identifier only for our own evaluation of which ad brought the order; the legal basis is then our legitimate interest under Art. 6(1)(f) GDPR (knowing which ads bring orders and managing our advertising spend accordingly). You may object to this at any time by e-mail to info@tuningovesvetla.sk — we will delete the identifier from your order. If you cancel or return the order, we report the order number to Google (without the click identifier and without your details) so that the purchase is no longer counted in the ad results.
14. Establishing and defending legal claims: in disputes, complaints and debt recovery. Legal basis: legitimate interest, Art. 6(1)(f) GDPR (protecting our rights and recovering debts).
15. Collaborations with content creators: if we approach you as a social media content creator with a collaboration offer (e.g. goods in exchange for a post), we use data from your public profile: name or username, profile link, number of followers, city or region, and information about your car and the focus of your content. The AI tool Claude by Anthropic helps us select creators and prepare messages (Section V). We exchange messages via the social network or by e-mail. Legal basis: legitimate interest under Art. 6(1)(f) GDPR (promoting our online store through collaborations with content creators). If we agree on a collaboration, we also process your contact details, delivery address, the content of the agreement and your posts, which we use in our promotion under the agreement. Legal basis: performance of a contract under Art. 6(1)(b) GDPR.
16. Our Facebook page, Instagram profile and competitions: for our Facebook page and Instagram profile, Meta Platforms Ireland Limited provides us with aggregated statistics on visits and interactions (e.g. number of views and followers), which we use to evaluate the reach of our posts. If you react to, comment on or message our page or profile, we see your name or username and the content you publish or send us, and we reply to you (point 4). Legal basis: legitimate interest under Art. 6(1)(f) GDPR (running our page and evaluating its reach). For the statistics of our Facebook page we are joint controllers with Meta (Art. 26 GDPR); under the agreement published by Meta (“Page Insights Controller Addendum”), Meta is responsible for providing information about the statistics and for handling your rights in relation to them. You may also exercise your rights with us. Otherwise, Meta processes data on Facebook and Instagram as an independent controller under its own policies. If we run a competition, details of how we process entrants' data will be set out in its rules; as a rule this is your username and, if you win, your name, address and phone number to deliver the prize (performance of a contract under Art. 6(1)(b) GDPR).

Providing the data needed to fulfil an order is a contractual requirement; without it we cannot process and deliver your order.

IV. Retention period

We keep personal data only for the periods listed below. Basket contents, server logs, Google Analytics data and backups are deleted automatically. Other data whose period has expired is deleted or anonymised at our next regular clean-up, which we carry out once a quarter. Data may therefore remain stored somewhat longer than the stated period, as a rule by no more than three months. If you ask us to erase your data, we do not wait for the clean-up: we handle your request without undue delay and within one month at the latest (Section VII).

• Orders and related communication (including complaints and withdrawals, also with the bank account for a refund): while the order is being handled and then for as long as we are liable for defects in the goods and until claims under the purchase contract become time-barred. For consumers, we are liable for defects for 2 years from delivery of the goods; after the first repair this period is extended by 12 months, and for goods supplied as a replacement we are liable for a new 2 years from their delivery. For business purchases we provide a 12-month quality guarantee from receipt of the goods. Claims arising from a complaint generally become time-barred 3 years after the complaint is made (generally 4 years for business purchases). Without a complaint we therefore keep the data for 5 years from delivery of the goods. If you made a complaint or we are in a dispute, we keep it until the claims arising from the complaint are time-barred or the dispute ends, so the period may be longer. We then delete or anonymise the data, keeping only what forms part of accounting documents.
• Invoices, credit notes and proof of VAT ID verification: 10 years from the end of the year in which they were issued (Accounting Act, VAT Act). We cannot delete them earlier, even at your request.
• E-mails unrelated to an order and draft replies: 3 years from the last message, in our database and in our mailboxes. Invoices and other accounting documents we receive by e-mail are kept like our other accounting documents. Older mail from the time of our previous online store is described in the paragraph at the end of this section.
• Call records in our database: 12 months; the phone system provider keeps records according to its own obligations.
• Voicemail message recordings: 12 months.
• IP address stored with an order: 100 days.
• Your cookie choice stored with an order: together with the order (as a record of your choice).
• Ad click identifier stored with an order: we can report it to Google (only with your consent) no later than 80 days after the order. For now we keep it in the order together with the order; we delete it earlier on request.
• Server logs and technical application logs: generally 30 days (deleted automatically).
• Basket contents: 30 days from the last change (deleted automatically).
• Abandoned order: 30 days from the last change. If you unsubscribe from reminders, we keep only your address and the unsubscribe date so that we do not send you reminders again.
• Watchdog: until the notification is sent (then 30 more days) or until you withdraw consent; unused watches no longer than 12 months.
• Shipping labels (with address): 6 months.
• Data on shipments from our supplier (recipient's name): 12 months.
• Published reviews and photos: while the review is published; we delete it on request.
• Reviews not approved or taken down, and their photos: no longer than 3 years from the decision, earlier on request.
• Records of undeliverable e-mails: 12 months.
• Collaborations with content creators: if no collaboration is agreed, we delete the data from our approach when you decline the offer or ask us to, otherwise no later than 12 months after our approach. If a collaboration is agreed, we keep the data for its duration and then until the limitation period for claims arising from it expires (usually 3 years; 4 years if you are an entrepreneur and the collaboration relates to your business). Data forming part of accounting documents is kept like our other accounting documents.
• Google Analytics: as configured in the tool, no longer than 14 months (deleted by Google automatically).
• Backups: database backups are overwritten automatically — after 14 days on the server and in the backup copy in iCloud (iCloud keeps deleted files in its “Recently Deleted” bin for a further 30 days) and after 30 days in the encrypted backup on Google Drive. Data we delete from the database therefore disappears from backups within 60 days at the latest.

Recipients acting as independent controllers (e.g. GoPay, carriers) retain data according to their own obligations.

Data from our previous online store and older e-mails. Until 30 June 2026 our online store ran on the BiznisWeb platform, operated by BiznisWeb s.r.o. (Trenčín, Slovakia), which processed customer data for us as our processor. We transferred only the product catalogue to the new store, not customer data, customer accounts or orders. Customer data and orders from the previous store remained stored in our account on the BiznisWeb platform, and older correspondence with customers in our mailboxes. We will first save the accounting documents (invoices and credit notes), which we must keep for 10 years from the end of the year in which they were issued. We will then delete the data in the BiznisWeb account and delete from our mailboxes any mail older than the periods stated above, by 31 December 2026 at the latest. Customer accounts from the previous store no longer work. If you want to know what data from that period we hold about you, or want us to delete it sooner, write to info@tuningovesvetla.sk.

V. Whom we share the data with

We do not sell personal data. To the extent necessary, we share it with the recipients below. A processor processes data on our behalf and only on our instructions; an independent controller processes it under its own responsibility.

Delivery

• GLS (General Logistics Systems Slovakia s.r.o.; for deliveries abroad, the GLS partner in the destination country): name, address, phone, e-mail, cash-on-delivery amount. When you choose a pickup point, the checkout loads the GLS map directly from the GLS server, which sees your IP address. Independent controller.
• Packeta (Packeta Slovakia s. r. o., Bratislava; for deliveries to EU countries other than Czechia, Hungary and Poland it hands the parcel to its partner carrier in the destination country, e.g. PostNord, DHL or Colissimo): name, address, phone, e-mail, parcel value for insurance. Independent controller.
• TOPTRANS EU, a. s. (Czech Republic): for bulky goods (e.g. bumpers, hoods) name, address, phone, e-mail. Independent controller.
• Our supplier TUNING-TEC Sp. z o.o. sp.k. (ul. Wodna 14, 32-005 Niepołomice, Poland): if the supplier ships the goods directly, it receives your name, delivery address, phone and e-mail and hands the parcel to its carrier (GLS, UPS or pallet carriers Raben, Ambro or SUUS), who may contact you before delivery. Independent controller.

Payments and accounting

• GoPay (payment gateway operated by Worldline NV through its branch GoPay Czech, Czech Republic): name, e-mail, phone, address, order amount and items. Independent controller.
• Banks: for bank transfers, your bank and ours process the data in your payment order. Independent controllers.
• SuperFaktúra (invoicing software): billing data. Processor.
• External accountant: accounting documents. Processor.
• European Commission (VIES) and public registers: we pass on only the VAT ID or Company ID being verified.

Store operation and communication (processors)

• DigitalOcean, LLC (USA): the server running the store and database, located in a data centre in Frankfurt (Germany).
• Resend (Plus Five Five, Inc.) (USA): sending the store's e-mails (confirmations, order status, reminders). E-mails are sent via servers in Ireland; Resend keeps sending logs in the USA, generally for 30 days.
• Apple (iCloud): a backup copy of the database.
• Anthropic (AI tool Claude, Section III points 5 and 15): e-mail content, the sender's name and e-mail, data about the related order, the text of invoices from carriers and suppliers, voice instructions and, when preparing collaborations, data from content creators' public profiles. Our contractual partner is Anthropic Ireland, Limited (Ireland); the data is processed in the USA by Anthropic, PBC.
• Zadarma – IP Telecom Bulgaria LTD (Burgas, Bulgaria; phone system, voicemail and SMS gateway): phone number, time and length of calls, the recording of a voicemail message, text of messages (order number, collection deadline, cash-on-delivery amount).

Purchase ratings and advertising

• Heureka Group a.s. (Czech Republic): the “Verified by Customers” survey (Section III point 12), only for deliveries to Slovakia and the Czech Republic. Processor. With cookie consent also measuring purchases from Heureka.sk click-throughs.
• Google Ireland Limited — Google Analytics 4 and Google Ads. With cookie consent (“Accept all”): visit data and cookies; on purchase, your e-mail, phone, first name, surname and street in hashed form, plus city, postcode and country, which are not hashed (enhanced conversions); after payment, the ad click identifier together with the order number, amount and payment time (offline conversions, Section III point 13). Without consent: only limited cookieless signals (Section VI) and, if an order is cancelled or returned, its order number so that Google stops counting the purchase. For Google Analytics and enhanced conversions Google processes the data as our processor. For the other Google Ads services (ad conversion measurement including offline conversions, remarketing and ad personalisation) Google is an independent controller and also uses the data for its own purposes under its privacy policy (policies.google.com/privacy). Google also provides our mailboxes (Google Workspace, Gmail) and storage for encrypted backups (Google Drive).
• Meta Platforms Ireland Limited — Meta Pixel and the Conversions API, only with cookie consent: visit data; on purchase, your e-mail, phone number, first name, surname, city, postcode and country in hashed form, IP address, browser details, the _fbp/_fbc identifiers and the order number, contents and value. For collecting this data on our website via the Meta Pixel and passing it to Meta via the Conversions API we are joint controllers with Meta Platforms Ireland Limited (Art. 26 GDPR). The essence of our arrangement (Controller Addendum, www.facebook.com/legal/controller_addendum): we are responsible for providing you with this information and for the legal basis of the collection on our website (your cookie consent); Meta is responsible for handling your rights under Articles 15 to 20 GDPR regarding the data it stores after receiving it. You may exercise your rights with us or directly with Meta; we will forward any request concerning Meta to Meta. For data matching and reports on ad performance Meta processes the data for us as our processor; any further processing after transmission (e.g. ad targeting and improvement) is carried out by Meta as an independent controller under its own responsibility and policy (www.facebook.com/privacy/policy).
• WhatsApp and Meta (Facebook, Instagram): if you message us via these services, their operator also processes the message under its own terms.

Other recipients: public authorities where the law requires it (e.g. the tax office, the Slovak Trade Inspection, the police), and a lawyer or court when resolving a dispute.

Transfers outside the European Union: most recipients process data in the EU. Data may reach the USA through the following recipients, protected as follows:

• DigitalOcean, LLC (the US provider of our Frankfurt server), Google LLC and Meta Platforms, Inc. (the US companies to which our contractual partners Google Ireland Limited and Meta Platforms Ireland Limited pass the data): the European Commission's adequacy decision for companies certified under the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795). The list of certified companies is at www.dataprivacyframework.gov.
• Resend (Plus Five Five, Inc.): certification under the EU–US Data Privacy Framework plus standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914).
• Anthropic, PBC (to which our contractual partner Anthropic Ireland, Limited passes the data): standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914).
• Apple Inc. (iCloud): standard contractual clauses, on which Apple relies according to its privacy policy (www.apple.com/legal/privacy).

The text of the standard contractual clauses is published in the Official Journal of the EU (eur-lex.europa.eu, Implementing Decision (EU) 2021/914). We will provide a copy of the clauses that form part of our contracts with Resend and Anthropic on request.

VI. Cookies

Cookies are small text files that a website stores in your browser; we treat entries in browser storage (localStorage, sessionStorage) the same way.

Essential (no consent needed): cart_id — identifies your basket, 30 days; cookie_consent and cookie-consent in browser storage — your choice in the cookie banner, 12 months (in browser storage until deleted); ot_* — access to your order page after placing the order or opening the link from an e-mail, 7 days; wd_order — the order number used to pre-fill the withdrawal form when you open it from your order page or an e-mail, 1 day; fo_token — the code from the link for opting out of review requests, until you confirm the opt-out, 1 day.

Remembered car: when you view the page of a specific car or of a part that fits only one car, we store that vehicle (make, model, generation) in the tvoje_auto cookie so that we keep showing you parts for it. The cookie is valid for 6 months, contains neither your name nor contact details and is not sent anywhere. It is currently stored even without your consent. You can remove it with the cross in the “Tvoje auto” bar on the Slovak pages of the site or by deleting cookies in your browser.

Only with your consent (“Accept all”): Google Analytics 4 (_ga, _ga_*, up to 2 years); Google Ads (_gcl_au, _gcl_aw, _gcl_gb, 90 days); Meta Pixel (_fbp, _fbc, 90 days); Heureka conversion tracking (hg_ocm_id, in browser storage heureka-conv-*); markers preventing Meta events from being sent twice (meta-purchase-*, meta-search-*).

Technical purchase-measurement marker: after an order is placed, the confirmation page writes the markers ads-conv-* and ga4-purchase-* containing the order number to browser storage (sessionStorage, until the tab is closed) so that the purchase is not sent to Google twice (e.g. when the page is reloaded). It sends nothing and is currently written even without consent.

Ad click identifier: if you arrive by clicking a Google or Meta ad, it is stored in the ads_gclid, ads_gbraid, ads_wbraid or ads_fbclid cookie (90 days) and in browser storage (until the tab is closed). Currently this also happens without consent — details and how to object are in Section III point 13.

Google tools are set to “denied” by default (Google Consent Mode v2, advanced mode), so the Google tag loads even before consent. Until you consent, it neither stores nor reads cookies and sends Google only limited cookieless signals without your contact details: the address of the page visited, the time, basic browser and device information, the consent status, whether you came from an ad, and events in the store (viewing a product, adding to the basket, starting checkout and a purchase with the order number, its value and the items bought). Google also sees your IP address in this transmission. If you came from a Google ad, the click identifier may also be carried in the addresses of further pages of our website (the url_passthrough feature). Google uses these signals to model traffic and conversions statistically. Neither the Meta Pixel nor Heureka tracking loads without consent.

You can change or withdraw your consent at any time via “Cookie settings” in the footer; the tools stop collecting data at the latest after the page is reloaded. You can remove cookies already stored in your browser settings. Withdrawal does not affect the lawfulness of processing before it.

VII. Your rights

As a data subject, in connection with the processing of personal data you have the right:

• to access your personal data and to information about its processing,
• to rectification of inaccurate data and completion of incomplete data,
• to erasure of data (the right “to be forgotten”) where there is no legal ground for its further retention,
• to restriction of processing,
• to data portability,
• to object to processing based on a legitimate interest and, at any time and without giving reasons, to direct marketing (see the “Right to object” box in Section III),
• to withdraw a granted consent at any time (if processing is based on consent),
• to lodge a complaint with the supervisory authority.

You can exercise your rights by e-mail at info@tuningovesvetla.sk or by letter to our registered office. To make sure we do not disclose data to someone else, we may ask you to verify your identity (e.g. by replying from the e-mail address used in the order). We will handle your request without undue delay and within one month at the latest; in complex cases we may extend this by two further months and will let you know. Exercising your rights is free of charge.

VIII. Supervisory authority

If you believe that the processing of your personal data has infringed your rights, you can lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In Slovakia, this is:

Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovakia
web: dataprotection.gov.sk

IX. Final provisions

We update this policy from time to time, in particular when the way we process data, our recipients or the law change. The current version is always available on this page; we will provide the previous version on request.

This policy takes effect on 9 October 2026.

See also our terms and conditions or contact us.