Privacy Policy
Last updated: 16 September 2026
[Review note] Working template prepared for legal review. Fields marked [●] must be completed. Notes in this format must be removed before publishing.
This Privacy Policy explains how we process personal data when you visit the LED Strip Studio online shop, create an account, place an order or contact us.
1. Controller
Showtacle s.r.o. Ľubietovská 8, 851 01 Bratislava, Slovakia Company ID (IČO): 36 735 361 Email for data protection matters: [email protected] Phone: +421 948 280 393
We have not appointed a Data Protection Officer, as our processing activities do not require one.
2. What data we process, why, and for how long
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Processing orders and delivering goods, licences and services | name, billing and delivery address, email, phone, company name, company ID, VAT ID, order contents, payment status | Art. 6(1)(b) — performance of a contract | duration of the contract and limitation period for claims (4 years) |
| Invoicing and accounting | invoice data | Art. 6(1)(c) — legal obligation | 10 years (Slovak Accounting Act) |
| Verifying EU VAT IDs | company name, VAT ID | Art. 6(1)(c) — legal obligation | as part of accounting records |
| Customer account | email, password (stored encrypted), saved addresses, order history | Art. 6(1)(b) — contract | until you delete the account; inactive accounts are deleted after 3 years |
| Withdrawals and complaints | order details, complaint description, photos, correspondence | Art. 6(1)(c) and (b) | 3 years after the complaint is resolved |
| Customer support and pre-sale advice | name, email, phone, message content, project details you share | Art. 6(1)(b) — steps before a contract; Art. 6(1)(f) — legitimate interest in answering enquiries | 2 years after the last communication |
| Product reviews | name or nickname, review text, rating | Art. 6(1)(f) — legitimate interest in showing customer feedback | until you or we remove the review |
| Newsletter | email address | Art. 6(1)(a) — consent | until you unsubscribe |
| Website security and operation | IP address, browser data, server logs | Art. 6(1)(f) — legitimate interest in secure operation | 30 days |
| Analytics and advertising measurement | cookie identifiers, usage data | Art. 6(1)(a) — consent, see the [Cookie Policy] | per the Cookie Policy |
| Establishing and defending legal claims | data relevant to the claim | Art. 6(1)(f) — legitimate interest | until the claim is resolved |
[Review note] Confirm retention periods and the limitation periods for civil and commercial claims. Confirm whether newsletter emails are sent to existing customers without consent (soft opt-in) and, if so, add that basis. Confirm the inactive-account period matches WooCommerce settings.
Providing data marked as required at checkout is necessary to conclude and perform the contract. Without it we cannot process your order.
3. Recipients
We share personal data only to the extent necessary with:
- A2 Hosting (hosting.com) — website and database hosting on a server located in the EU (Bulgaria)
- Cloudflare, Inc. — content delivery and website security
- Stripe Payments Europe, Limited (Ireland) — payment processing. Card details are entered directly with the provider; we do not store them
- Carriers — [●], delivery of goods
- Accounting services — [●]
- Brevo SAS (France) — sending of transactional emails and the newsletter
- Google Ireland Limited — analytics and advertising measurement, only with your consent
- Public authorities — where required by law, such as tax or customs authorities
Processors act on our instructions under data processing agreements.
4. Transfers outside the EU and EEA
Some recipients — for example Cloudflare, Google and Stripe — may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses approved by the European Commission.
When you order delivery to a country outside the EU, we transfer your delivery details to carriers and customs authorities in that country because it is necessary to perform the contract (Art. 49(1)(b) GDPR).
[Review note] Verify the current certification status and transfer mechanism of each provider.
5. Your rights
You have the right to:
- access your personal data;
- have inaccurate data corrected;
- have data erased, where no legal obligation requires us to keep it;
- restrict processing;
- data portability;
- object to processing based on legitimate interest, and at any time to processing for direct marketing;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise your rights, contact us at [email protected]. We will respond within one month.
You also have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, Slovakia, dataprotection.gov.sk.
6. Automated decision-making
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
7. Cookies
We use cookies necessary for the Shop to work, such as the shopping cart and login. Analytics, marketing and preference cookies are used only with your consent, which you can change at any time in the cookie settings. Details are in our [Cookie Policy].
8. Security
We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access control and encrypted password storage.
9. Changes
We may update this Privacy Policy. The current version is always available on this page, with the date of the last update.