1. Controller
The controller is OTON, grafične in druge storitve, Darijan Želj s.p., Župančičeva ulica 11, 2000 Maribor, Slovenija. Use the contact shown in Legal information for privacy requests.
2. Data
- identity, contact, address, business and VAT details;
- order, invoice, payment and delivery data;
- uploaded artwork and file metadata;
- account, login and security logs;
- support, complaint, consent and preference records;
- pseudonymous analytics and advertising data only after consent.
3. Purposes and legal bases
- contract: accounts, orders, production, payment, delivery and complaints;
- legal obligation: accounting, tax, consumer and product-safety duties;
- legitimate interests: security, fraud prevention and legal claims;
- consent: Google Analytics, Meta Pixel, newsletters, advertising and non-essential abandoned-cart reminders.
4. Recipients and transfers
Necessary data may be shared with hosting, email, accounting, payment and security providers, DPD and Pošta Slovenije. Google and Meta receive data only after consent. Processors are contractually bound. Transfers outside the EEA rely on an adequacy decision or standard contractual clauses and supplementary safeguards.
5. Retention
- artwork: normally 3 months;
- inactive account: delete or anonymise after 24 months unless an order, claim or law requires retention;
- invoices and tax records: the statutory period;
- orders and complaints: relevant limitation periods;
- consent evidence: as needed to prove compliance;
- security logs: risk-based, normally no more than 12 months.
6. Rights
You may request access, correction, deletion, restriction, portability and object, and may withdraw consent at any time. We normally respond within one month. You may complain to the Slovenian Information Commissioner or your local supervisory authority.
7. Automated checks
Automated artwork checks support technical assessment but no decision with significant legal effects is made solely automatically. Required fields are necessary for the contract or invoice.
8. Marketing
Newsletters require a valid consent or another clear lawful basis and contain an unsubscribe option. Review requests may form limited follow-up communication about a purchase. Advertising profiling and Meta Pixel require consent.