Privacy policy

This policy explains what we do with your personal data when you visit paperdealer.eu or buy from us.

1. Who is responsible

The data controller is Magic Draw, Anže Finc s.p. (Paper Dealer), Albrehtova ulica 4, 1291 Škofljica, Slovenia (EU). Registration number 9884157000, VAT ID SI13976346.

For any question about your data, or to exercise any right below, email info@paperdealer.eu. We reply within 24 hours, Monday to Friday, and resolve any formal request within one month.

We are a one-person business. Your data is not sold, rented or shared for anyone else's marketing.

2. What we collect and why

When you place an order we collect your name, email address, delivery and billing address, phone number if you give one, order contents and payment status. We need this to fulfil the contract between us — to take the order, ship it, handle returns and answer questions. We keep it as long as Slovenian tax and accounting law requires.

We never see or store your full card number. Payment details go directly to our payment providers.

When you create an account we store your email, password (hashed, never in readable form), addresses and order history, so you do not have to retype them. You can delete your account at any time.

When you subscribe to release alerts we store your email address and the fact that you consented. Basis: your consent. Unsubscribe from any email and we stop; the link is in every message.

When you request a back-in-stock alert we store your email and which product, send you one message when it returns, and then delete the request.

When you contact us we keep the correspondence so we can follow up and so we have a record if a dispute arises later.

When you browse the site our platform records technical data — IP address, browser, pages viewed — to keep the shop running, prevent fraud and produce aggregate sales statistics. Basis: our legitimate interest in operating a secure and functional shop.

3. Who processes data on our behalf

  • Shopify — the platform this store runs on. Hosts the shop, processes orders, stores customer accounts.
  • Payment providers shown at checkout — process your payment. They receive what they need to take it; we do not receive your card details.
  • Pošta Slovenije and its partner carriers — receive your name, delivery address and phone number so they can deliver, and send tracking data back to us.
  • Mailchimp — our email marketing tool, if you subscribe to release alerts.
  • Judge.me — collects and shows product reviews and may email you once after delivery to ask for one. If you leave a review, it stores your name and the review.
  • Google — Google Analytics and Google Ads conversion measurement, only if you accept them in the cookie banner (see section 4).
  • Other Shopify apps we use to run the shop (for example collection sorting and on-site widgets) — receive only the technical data they need.
  • Our accountant — receives invoice data as required by Slovenian tax law.

Each of these acts on our instructions under a data processing agreement. Some may process data outside the EU/EEA; where that happens it is covered by European Commission adequacy decisions or Standard Contractual Clauses.

4. Cookies and tracking

Essential cookies keep your basket, your session and your language and currency choice working. The shop cannot function without them, so they do not need consent.

Analytics and advertising measurement — only with your consent. When you first visit, a cookie banner asks whether you accept analytics and marketing cookies. If you accept, we use Google Analytics to see how the shop is used and Google Ads conversion measurement to see which of our ads lead to purchases, and Mailchimp may record site visits that follow our emails. If you decline, none of this runs. Basis: your consent, which you can withdraw at any time by deleting this site's cookies in your browser; the banner then asks again.

We do not use Meta (Facebook/Instagram) or TikTok pixels on this site.

You can block or delete cookies in your browser settings. Blocking essential cookies will stop checkout from working.

5. Your rights

Under the GDPR you can ask us to:

  • give you a copy of the personal data we hold about you;
  • correct anything that is wrong;
  • delete your data, where we are not legally required to keep it — invoices, for example, we must retain for tax purposes;
  • restrict or object to our processing;
  • transfer your data to another provider in a machine-readable format;
  • withdraw consent at any time, for anything based on consent, such as release alerts or analytics cookies. Withdrawing does not affect what we did lawfully before.

Email info@paperdealer.eu and we will action it. There is no charge.

If you think we have handled your data badly, you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si) or to the supervisory authority in your own EU country. We would appreciate the chance to put it right first.

6. How long we keep things

Order and invoice data: as long as Slovenian tax and accounting law requires. Account data: until you delete your account. Release alert subscription: until you unsubscribe. Correspondence: as long as needed to handle the matter and any dispute that follows it.

7. Children

This shop is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.

8. Changes

We will update this policy if what we do with data changes, and change the date below. Material changes affecting your rights will be announced on the site.

Last updated: 26 October 2026