Cubb Toys
Privacy policy
This is a translation for your convenience. The Slovenian text is binding; if the two differ, the Slovenian version prevails.
Who processes your data
The controller of your personal data is Eva Cerar s.p. (Cubb Toys), Soteska pri Moravčah 11, 1251 Moravče. For questions about your data and to exercise your rights, write to [email protected].
What data we process and why
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Carrying out the order and delivery | e-mail address, phone (optional), order note (optional), name and delivery address that Stripe passes to us after payment, ordered sets, amounts, payment method and status, order status history, your confirmations at checkout with time and text version | conclusion and performance of the contract (Article 6(1)(b)); proof of confirmations: legitimate interest (Article 6(1)(f)) | paid orders 5 years after delivery; unfinished orders (payment not completed) 30 days after the last status change |
| Invoicing and bookkeeping | invoice data: name, address, goods, amount | legal obligation (Article 6(1)(c)) | 10 years after the end of the year of issue |
| Withdrawals, conformity claims and questions | your messages and the data in them | performance of the contract and legal obligations under ZVPot-1 (Article 6(1)(b) and (c)) | 5 years after the matter is closed |
| Notice when buying becomes possible | e-mail address, language, the page where you signed up, time of sign-up and the version of the consent text | consent (Article 6(1)(a)) | until the e-mail announcing the start of sales, at most 6 months after sign-up, then deleted automatically |
| Protecting the shop against abuse | IP address and e-mail address, which we use to limit the number of orders and messages from the same address | legitimate interest in security (Article 6(1)(f)) | automatically deleted after 7 days at most |
Notice when buying becomes possible
While buying is not yet possible, you can enter your e-mail address on the site and ask us to let you know when you can buy. We store your e-mail address, language, the page where you signed up, the time of sign-up and the version of the consent text (consent, Article 6(1)(a)). When sales open, we send you one single e-mail. The entry is deleted automatically no later than 6 months after sign-up. You can withdraw your consent at any time by writing to [email protected].
Reminder about an unfinished payment
If you tick the separate optional reminder box at checkout and then do not complete the payment, we send you one single e-mail for that order with a link to complete the purchase (consent, Article 6(1)(a)). Without the ticked reminder box we send no reminder. We delete the data of the unfinished order 30 days after its last status change.
We do not sell your data and do not use it for profiling or automated decision-making.
Who we share data with
- Cloudflare, Inc. (USA): hosting of the online shop and storage of orders and notice sign-ups. As the host it also technically processes your IP address and request data.
- Stripe Payments Europe Ltd. (Ireland): payments. On its payment page it collects your name, delivery address and payment details. Card data is processed by Stripe only. For payment data Stripe is also an independent controller, for example for fraud prevention, so its privacy policy also applies.
- Sendinblue SAS (Brevo) (France): sending order confirmations and other order e-mails.
- Carrier: name, delivery address and phone number if you entered one.
- Invoicing software and accounting: invoice data.
Transfers to countries outside the EU
Cloudflare, Inc. is a US company, so data may also be processed in the USA. The transfer is based on the EU-U.S. Data Privacy Framework, in which Cloudflare participates, and otherwise on the European Commission's standard contractual clauses.
Your rights
- access to your data and a copy (Article 15 GDPR),
- rectification (Article 16) and erasure (Article 17),
- restriction of processing (Article 18) and data portability (Article 20),
- objection to processing based on legitimate interest (Article 21),
- withdrawal of consent at any time; withdrawal does not affect the lawfulness of earlier processing (Article 7).
We reply to requests within one month at the latest. You may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, [email protected], www.ip-rs.si.
Do you have to provide data
Without your e-mail address, name and delivery address we cannot carry out the order. The phone number is optional; we only use it to arrange delivery. Consent to the reminder and to the notice when sales start is optional and does not affect your purchase.
What the site stores in your browser is described on the Cookies page. This policy applies from 21 October 2026.