Privacy Policy

1. Data Controller

The controller of personal data processed through the www.trofion.com online store is:

PROJECT PLUS s.r.o.
Svätoplukovo námestie 3/127
949 01 Nitra
Company ID No.: 44 842 350
Tax ID No.: 2022871103
VAT ID No.: SK2022871103

(hereinafter referred to as the “Controller”)

Contact details:
E-mail: info@trofion.com
Telephone: +421 902 555 230
Website: www.trofion.com

2. What Personal Data We Process

The Controller processes personal data of customers and visitors to the online store primarily to the extent necessary for the specific purpose of processing, in particular:

first name and surname,
title, if provided by the data subject,
billing and delivery address,
telephone number,
e-mail address,
data concerning orders and purchased goods,
data necessary for payment and payment identification,
data necessary for delivery of the shipment,
data provided in contact or other forms,
data necessary for handling claims and exercising rights arising from liability for defects,
data necessary for withdrawal from the contract and the return of goods or payments,
the e-mail address and order number used to identify an order in the “My Order” section,
data concerning consent to marketing communications or refusal of marketing communications,
technical and analytical data to the extent specified in the Cookie Policy.

3. Purposes and Legal Bases for Processing Personal Data

Order Processing and Performance of the Purchase Contract

We process personal data for the purposes of receiving and processing orders, communicating with customers, preparing or personalising goods, processing payments, dispatching goods and fulfilling other obligations arising from the purchase contract.

Legal basis:
Article 6(1)(b) GDPR – performance of a contract or taking steps at the request of the data subject prior to entering into a contract.

Invoicing, Accounting and Legal Obligations

We process personal data for the purposes of issuing and keeping accounting and tax documents and complying with obligations arising from accounting, tax and other applicable legal regulations.

Legal basis:
Article 6(1)(c) GDPR – compliance with a legal obligation to which the Controller is subject.

Delivery of the Order

In order to ensure delivery of the shipment, we provide the selected carrier with personal data only to the extent necessary for delivery, in particular the first name and surname, delivery address, telephone number, e-mail address and data necessary to identify the shipment.

The Seller uses, in particular, the services of GLS General Logistics Systems Slovakia s.r.o. and Packeta Slovakia s. r. o. for the delivery of shipments.

Legal basis:
Article 6(1)(b) GDPR – performance of a contract.

Payment Services

When making a payment through Shoptet Pay, personal data may be processed by entities providing the payment service to the extent necessary to execute, verify and record the payment.

Legal basis:
Article 6(1)(b) GDPR – performance of a contract,
and, where applicable, Article 6(1)(c) GDPR – compliance with a legal obligation.

Claims and Exercise of Rights Arising from Liability for Defects

We process personal data for the purposes of receiving, recording, assessing and handling claims, notification of defects, communication with customers, repair or replacement of goods, provision of a discount, refund of payments and the establishment, exercise or defence of legal claims.

Legal basis:
Article 6(1)(b) GDPR – performance of a contractual relationship,
Article 6(1)(c) GDPR – compliance with legal obligations,
Article 6(1)(f) GDPR – legitimate interest in establishing, exercising and defending legal claims.

Withdrawal from the Contract and the “My Order” Online Function

We process personal data for the purposes of receiving and handling withdrawals from contracts, identifying orders, returning goods and payments, and related communication with customers.

When using the online function in the “My Order” section, the customer enters, in particular, the e-mail address used for the order and the order number. These data are used to identify the relevant order and subsequently to create and submit the notice of withdrawal from the contract.

Legal basis:
Article 6(1)(b) GDPR – performance of a contractual relationship and actions related to its termination,
Article 6(1)(c) GDPR – compliance with the Controller's legal obligations.

Contact Form and General Communication

If you contact us through a contact form, by e-mail or in another manner, we process the data necessary to respond to your question or request.

Legal basis:
Article 6(1)(f) GDPR – the Controller's legitimate interest in communicating with customers and handling their requests,
or Article 6(1)(b) GDPR where the communication is aimed at entering into or performing a contract.

Newsletter Based on Consent

If a visitor or customer gives consent to receive a newsletter or marketing communications, we use their contact details to send information about products, news, promotions, competitions and offers from the TROFION online store.

The newsletter may be sent technically through the Shoptet system.

Legal basis:
Article 6(1)(a) GDPR – consent of the data subject.

Consent may be withdrawn at any time, in particular by clicking the unsubscribe link in a marketing message received or by contacting the Controller at info@trofion.com. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Marketing of Our Own Similar Products to Existing Customers

If the Controller has obtained a customer's e-mail address in connection with the sale of goods or services, it may, under the conditions laid down by applicable legal regulations, also use it to send marketing information about its own similar goods or services without separate marketing consent.

Such communications may be sent, in particular, through the Shoptet system.

The customer always has the option to object easily and free of charge to such use of their e-mail address, both when the contact details are collected and subsequently in every marketing communication, for example by using an unsubscribe link.

If the customer objects to marketing communications, we will no longer use their contact details for this purpose, with the exception of the minimum data necessary to record the objection or unsubscribe request.

Legal basis for the processing of personal data:
Article 6(1)(f) GDPR – the Controller's legitimate interest in the reasonable promotion of its own similar products to existing customers.

The sending of electronic marketing communications is also carried out under the conditions laid down by Act No. 452/2021 Coll. on Electronic Communications.

Contact details obtained in connection with the sale of goods or services are used for this type of direct marketing only for the period permitted by applicable law.

4. Analytical and Marketing Tools

For the purposes of evaluating website traffic, improving the online store and marketing, we use or may use in particular:

Google Analytics 4,
Google Ads, including remarketing and conversion functions.

Analytical and marketing tools that require user consent are activated only on the basis of consent given through the cookie banner.

If the visitor does not give consent or withdraws it, analytical or marketing cookies that depend on consent must not be activated to the extent that their use requires consent.

Detailed information about cookies and similar technologies is provided in the separate Cookie Policy.

5. Recipients of Personal Data

Personal data may, to the extent necessary, be disclosed or provided in particular to:

the provider of the e-commerce platform, Shoptet, a.s.,
entities providing payment services through Shoptet Pay,
GLS General Logistics Systems Slovakia s.r.o. and Packeta Slovakia s. r. o. – providers of transport and delivery services,
providers of IT, hosting, technical support and online store administration services,
providers of analytical and marketing services, in particular Google Ireland Limited, where the relevant services are active,
accountants, tax advisers, legal advisers and other professional advisers to the extent necessary,
public authorities and other entities where disclosure of the data is required by law.

Depending on the nature of the service, individual recipients may act as processors, independent controllers or joint controllers within the meaning of the GDPR.

6. Transfers of Personal Data to Third Countries

When using certain services, in particular Google services, personal data may under certain circumstances be processed or transferred outside the European Economic Area.

Such transfers are carried out only under the conditions laid down by the GDPR, in particular on the basis of an adequacy decision of the European Commission, an applicable framework recognised by the European Commission, or Standard Contractual Clauses and, where appropriate, additional suitable safeguards.

7. Retention Period for Personal Data

We retain personal data only for as long as necessary to fulfil the purpose for which they were collected or for the period required by applicable law.

accounting and tax documents: for the statutory retention period, generally 10 years,
order data: for the duration of the contractual relationship and subsequently for the period necessary to comply with legal obligations and protect legal claims,
claims and defects: for the period necessary to handle the claim and subsequently for the period necessary to establish, exercise or defend legal claims,
withdrawal from the contract: for the period necessary to process the withdrawal and subsequently for the period necessary to comply with legal obligations and protect legal claims,
contact forms and general communication: for the period necessary to handle the request and for a reasonable subsequent period depending on the nature of the communication,
newsletter based on consent: until consent is withdrawn or the relevant marketing purpose ends,
marketing of our own similar products to existing customers: until the customer objects to such communication, but no longer than for the period permitted by the Electronic Communications Act,
data concerning withdrawn consent or an objection to marketing: to the minimum extent necessary for the period required to demonstrate compliance with legal obligations and to ensure that further communications are not sent contrary to the data subject's wishes.

8. Rights of Data Subjects

Subject to the conditions laid down by the GDPR, the data subject has in particular the right:

to receive information about the processing of personal data,
of access to their personal data,
to rectification of inaccurate or incomplete data,
to erasure of personal data,
to restriction of processing,
to object to processing based on legitimate interests,
to object at any time to the processing of personal data for direct marketing purposes,
to data portability in the cases provided for by the GDPR,
to withdraw consent that has been given,
to lodge a complaint with a supervisory authority.

If personal data are processed for direct marketing purposes, the data subject has the right to object at any time to such processing. Once an objection has been made, the personal data will no longer be processed for direct marketing purposes.

To exercise your rights, you may contact us at info@trofion.com.

The supervisory authority is:

Office for Personal Data Protection of the Slovak Republic
Hraničná 4826/12
820 07 Bratislava
Slovak Republic
www.dataprotection.gov.sk

9. Security of Personal Data

The Controller has adopted appropriate technical, organisational and personnel measures to protect personal data against unauthorised or unlawful processing, loss, destruction, damage, misuse or unauthorised access.

Access to personal data is limited to persons and service providers who need such access to perform their tasks or provide the relevant service, and only to the extent corresponding to their authorisation.

10. Cookies

The use of cookies and similar technologies is governed by the separate Cookie Policy, which is available on the Controller's website.

Visitors may change or withdraw their consent to optional cookies in the manner specified in the cookie banner or in the Cookie Policy.

11. Related Processing in the Online Store

Personal data may also be processed when using other functions of the online store, in particular the Claim Form, Withdrawal Form and the “My Order” online function. In each case, only the data necessary to process the relevant request and comply with the related legal obligations are processed.

12. Final Provisions

This Privacy Policy enters into force on 30 August 2026.

The Controller is entitled to update this Privacy Policy, in particular where there are changes to the methods of processing personal data, the services used or legislative requirements.

The current version is always available on the www.trofion.com website.

If you have any questions concerning the processing of personal data, you may contact us at info@trofion.com.