Privacy policy

# Privacy Policy

This policy explains what we do with your personal data when you visit paperdealer.eu or buy from us.

### 1. Who is responsible

The data controller is **Magic Draw s.p.**, Albrehtova ulica, 1291 Škofljica, Slovenia (EU). Registration number 9884157000, VAT ID SI13976346.

For any question about your data, or to exercise any right below, email **info@paperdealer.eu**. We reply within 24 hours on business days and will resolve any formal request within one month.

We are a one-person business. Your data is not sold, rented or shared for anyone else's marketing. Ever.

### 2. What we collect and why

**When you place an order** we collect your name, email address, delivery and billing address, phone number if you give one, order contents and payment status. We need this to fulfil the contract between us — to take the order, ship it, handle returns and answer questions. We keep it as long as legally required for tax and accounting purposes under Slovenian law.

We never see or store your full card number. Payment details go directly to our payment providers.

**When you create an account** we store your email, password (hashed, never in readable form), addresses and order history, so you do not have to retype them. You can delete your account at any time.

**When you subscribe to release alerts or our newsletter** we store your email address and the fact that you consented. Basis: your consent. Unsubscribe from any email and we stop; the link is in every message.

**When you request a back-in-stock alert** we store your email and which product, send you one message when it returns, and then delete the request.

**When you contact us** we keep the correspondence so we can follow up and so we have a record if a dispute arises later.

**When you browse the site** our platform records technical data — IP address, browser, pages viewed — to keep the shop running, prevent fraud and produce aggregate sales statistics. Basis: our legitimate interest in operating a secure and functional shop.

### 3. Who processes data on our behalf

- **Shopify** — the platform this store runs on. Hosts the shop, processes orders, stores customer accounts.
- **Payment providers** shown at checkout — process your payment. They receive what they need to take it; we do not receive your card details.
- **Postal and courier services** — receive your name, delivery address and phone number so they can deliver, and provide tracking data back to us.
- **Our email provider** — sends order confirmations, shipping notifications and, if you subscribed, release alerts.
- **Our accountant** — receives invoice data as required by Slovenian tax law.

Each of these acts on our instructions under a data processing agreement. Some may process data outside the EU/EEA; where that happens it is covered by European Commission adequacy decisions or Standard Contractual Clauses.

### 4. Cookies and tracking

**Essential cookies** keep your basket, your session and your language and currency choice working. The shop cannot function without them.

**We do not run advertising or profiling pixels on this site.** There is no Meta Pixel, no Google Ads remarketing tag and no TikTok pixel. Our platform sets a small number of first-party cookies for security, fraud prevention and aggregate shop statistics.

If we ever add advertising or analytics tracking, we will ask for your consent first through a cookie banner and update this policy before it goes live.

You can block or delete cookies in your browser settings. Blocking essential cookies will stop checkout from working.

### 5. Your rights

Under the GDPR you can ask us to:

- **give you a copy** of the personal data we hold about you;
- **correct** anything that is wrong;
- **delete** your data, where we are not legally required to keep it — invoices, for example, we must retain for tax purposes;
- **restrict** or **object to** our processing;
- **transfer** your data to another provider in a machine-readable format;
- **withdraw consent** at any time, for anything based on consent, such as our newsletter. Withdrawing does not affect what we did lawfully before.

Email info@paperdealer.eu and we will action it. There is no charge.

If you think we have handled your data badly, you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si) or to the supervisory authority in your own EU country. We would appreciate the chance to put it right first.

### 6. How long we keep things

Order and invoice data: as long as Slovenian tax and accounting law requires. Account data: until you delete your account. Newsletter subscription: until you unsubscribe. Correspondence: as long as needed to handle the matter and any dispute that follows it.

### 7. Children

This shop is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.

### 8. Changes

We will update this policy if what we do with data changes, and change the date below. Material changes affecting your rights will be announced on the site.