Privacy Policy

PRIVACY POLICY

Information on the processing of personal data of customers and visitors to the BOOTY online store

Document updated: 24 October 2026

1. Who processes your personal data

The data controller is In Investments s.r.o., with its registered office at Hrušov 140, 049 43 Hrušov, Slovak Republic, Company ID No.: 51 886 545, registered in the Commercial Register maintained by the Municipal Court Košice, Section Sro, File No. 44517/V (hereinafter the “controller”, “we” or “BOOTY”).

We operate the online store www.bootyshop.eu and its language versions. We primarily offer sportswear and leisurewear, fashion accessories and other consumer products, including selected laundry-care products.

For questions concerning personal data protection or to exercise your rights, contact us at bootyshopeu@gmail.com, or write to our registered office. Telephone: +421 918 372 125. The registered office address is not automatically the address for returning goods; the procedure for complaints and returns is governed by our Terms and Conditions.

This information is intended for customers, customer account holders, marketing subscribers, website visitors and people who communicate with us. It also applies to the processing of data in connection with purchases made from other EU countries.

2. What data we process and where we obtain it

Depending on the particular interaction or service, we may process:

Identity and contact details: first and last name, billing and delivery address, email address, telephone number; for business purchases, also business name, company registration number, tax identification number and other necessary invoicing details.

Order details: products and variants ordered, prices, discounts, gifts, delivery and payment methods, order status, order and document numbers, delivery, return and exchange details.

Customer account details: account identifier, login email address, security logs and data saved in your account. Login passwords must not be stored in readable text.

Payment and accounting details: payment amount and status, transaction identifier, selected payment method, details necessary for issuing a refund (e.g. IBAN) and accounting documents. When paying through an external payment gateway, payment card details are entered in the relevant provider's environment. For online payments, BOOTY does not request or store full payment card details or CVV/CVC codes; these details are entered through a secure payment interface.

Complaints and returns data: description of a defect or request, product photographs, correspondence, resolution and, where applicable, refund information.

Communications data: contents of emails, contact forms, customer chat or social media messages, time of communication and information necessary to handle your request.

Marketing data: email address, possibly telephone number, information about voluntary newsletter subscription through the store or during checkout, the time and manner of giving and withdrawing consent, preferences, and information about messages sent, opens and clicks to the extent used by Ecomail and permitted by law.

Technical data and online identifiers: IP address, cookies and similar technology identifiers, browser and device information, time of visits and website activities; the scope depends on your privacy settings and consent.

Product reviews: name or nickname displayed with a review, review text, photographs and any other information you choose to provide.

We obtain data mainly directly from you, through your use of the online store and through communications. We may also receive relevant delivery, payment or transaction data from carriers, payment service providers or partners used for your purchase. If you provide another person's details (such as the recipient of a gift), only provide data necessary for delivery and ensure that the person is informed about its use.

3. Purposes and legal bases for processing

Purpose	Typical data	Legal basis
Creating and fulfilling an order, delivery, purchase-related communications, payment and refunds	Identity, contact, order and transaction data	Article 6(1)(b) GDPR – performance of a contract or steps taken before entering into one
Creating and managing a customer account	Login and account data	Article 6(1)(b) GDPR
Issuing and retaining accounting and tax documents and complying with legal obligations	Invoicing, transaction and accounting data	Article 6(1)(c) GDPR – legal obligation
Complaints, withdrawal from the contract and statutory consumer rights	Order details, contacts, complaint contents, documents and supporting evidence	Article 6(1)(b) and/or (c) GDPR, depending on the action
Answering questions and customer support	Contact details and communications	Article 6(1)(b) or (f) GDPR; (c) where a legal obligation applies
Protecting the online store, preventing fraud, recording security incidents and defending legal claims	Technical data, IP addresses, event logs, documents and communications	Article 6(1)(f) GDPR – legitimate interests in security and protecting rights; (c) where required by law
Newsletters and commercial offers to which you voluntarily subscribe on our website or at checkout; recording and evaluating mailings in Ecomail	Contact details, records of consent and withdrawal, and interactions with messages	Article 6(1)(a) GDPR – consent; for minimum records demonstrating compliance, also (c) and/or (f) as appropriate
Optional website analytics and advertising measurement using cookies and similar technologies	Online identifiers, website events and device data	Article 6(1)(a) GDPR – consent where required, together with Section 109(8) of Slovak Act No. 452/2021 Coll.
Publication of a voluntary product review or photograph	Review contents and details chosen for publication	Article 6(1)(a) GDPR – consent to publication, to the extent required

 

Our legitimate interests include the secure operation of the online store, fraud prevention, protecting and enforcing legal claims and providing reasonable customer support. BOOTY sends newsletters based on voluntary consent, not through automatic inclusion of customers in a marketing database. Before relying on legitimate interests, we assess whether processing would disproportionately affect your rights and freedoms.

Where processing is based on consent, giving it is voluntary and you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, nor does it require deletion of data that must continue to be processed on another legal basis.

4. Information you are required to provide

The information marked as mandatory at checkout is needed mainly to enter into and fulfil the sales contract, deliver your order, issue documents and address related statutory claims. Without it, we may be unable to accept or fulfil an order. However, you do not have to create a customer account where guest checkout is available, or consent to marketing or optional cookies. Refusing these consents must not prevent an ordinary purchase.

5. Payments and security of payment data

We use the Comgate payment gateway to process online payments. Depending on the selected method and technical availability, customers may use Visa, Mastercard, Google Pay, Apple Pay and PayPal. Comgate, participating banks, card schemes and the operator of the selected payment service may process personal and payment data to the extent necessary to execute and secure the transaction. These parties may act as independent data controllers when fulfilling their own legal obligations.

When paying online, the customer enters card information through the secure interface of the payment service provider or its partner. BOOTY does not store full card numbers or CVV/CVC codes. To match a payment to an order, keep accounts, handle transaction disputes and issue refunds, we mainly use the payment method, amount, status and transaction identifier. Where a bank account number (IBAN) is needed for a refund, we process it only to the extent necessary for that purpose and related legal obligations.

The payment provider's own privacy notice also governs its direct processing of personal data.

6. Newsletters and direct marketing

We send BOOTY newsletters and offers only to people who have voluntarily subscribed and consented, either by signing up separately on our website or by expressly opting in during checkout. Newsletter subscription is not a condition of purchase. Consent must be separate, freely given, specific and unambiguous; the consent checkbox at checkout must not be pre-ticked.

We use Ecomail to maintain the subscriber database, send newsletters and evaluate campaigns. For these purposes, we process principally your email address, any additional contact details or preferences you voluntarily provide, records of consent and withdrawal, and information about delivery, opens and clicks insofar as permitted by the service's features and your valid consent.

You can withdraw your consent at any time, particularly by using the unsubscribe link in a marketing email or by contacting bootyshopeu@gmail.com. Once consent is withdrawn, we will stop using your details for that marketing. We may retain only the minimum necessary records of consent, withdrawal and objection to marketing in order to demonstrate compliance and respect your choice. Withdrawal does not affect the lawfulness of prior processing.

Operational communications about orders, payments, delivery, withdrawal or complaints are not newsletters and do not require marketing consent where they are necessary for contractual performance or compliance with a legal obligation. We do not insert marketing offers into such messages in a way that would circumvent the consent requirement.

7. Cookies, analytics and personalised advertising

We use cookies and similar technologies on our online store. Cookies strictly necessary for the proper functioning of the store, security, the shopping basket or saving basic choices may be used without consent within the statutory exemption. Optional analytics and marketing cookies and similar technologies are activated only after you have given prior consent, in accordance with Section 109(8) of Slovak Act No. 452/2021 Coll. and the applicable requirements of GDPR.

With your consent, we use analytics and advertising tools to measure website performance, campaign attribution, remarketing and the personalisation of advertising content. These include technologies and services provided by Google, Meta (Facebook/Instagram) and TikTok. The scope of processing depends on the consent given and the specific features enabled.

The cookie banner allows you to accept or reject optional cookies and manage choices by category, where available. You can subsequently withdraw or change your consent through the cookie settings on the website. Rejecting optional cookies does not prevent you from making a purchase. The detailed list of cookies and similar technologies, including their providers, purposes and duration, is available through the cookie settings on the online store.

If marketing cookies are enabled, advertising partners may process information about products visited, categories viewed and activities on the website to create or evaluate advertising audiences and personalise advertising. This also constitutes marketing profiling within the meaning of GDPR. BOOTY does not use decisions based solely on automated processing that produce legal or similarly significant effects on customers under Article 22 GDPR. Marketing profiling can be limited by refusing or withdrawing the relevant consent and exercising rights under Article 21 GDPR.

8. With whom we share personal data

We disclose data only to the extent necessary for the relevant purpose. Recipients or processors involved in BOOTY's services include in particular:

Shoptet – online store operation, hosting, technical administration and order processing;

Comgate – payment gateway, online payments and settlements; depending on the payment method, Visa, Mastercard, Google Pay, Apple Pay and PayPal, relevant banks and other payment partners may also be involved;

Ecomail – records of marketing consent, newsletter database administration, sending and evaluation of mailings;

Meta Platforms (Facebook and Instagram), Google and TikTok – advertising, analytics, measurement and marketing profiling within the scope of consent and tools currently in use;

carriers and collection-point providers, such as Packeta and other carriers chosen during checkout – delivery and return of shipments;

customer communications, IT support and security service providers, including a chat tool where enabled for the relevant language version;

external accountants, tax advisers and legal advisers – compliance with legal obligations and protection of rights;

public authorities and other authorised entities where disclosure is required by law.

Not every recipient listed receives data about every customer. The scope depends on the order, payment method, carrier selected and marketing or cookie consents. Some companies act as processors under Article 28 GDPR, others as independent controllers (especially in payment processing and compliance with their own legal obligations) or, where applicable, as joint controllers. We govern the relevant relationships through the required agreements and other legal arrangements.

We do not sell customers' personal data as a product in its own right. However, within the scope of valid consents, relevant online identifiers and advertising events may be disclosed to an advertising platform for measurement and ad targeting.

9. Transfers of personal data outside the European Economic Area

Certain cloud, communications or advertising services may involve access to, or transfers of, personal data to third countries outside the European Economic Area (EEA), including through providers with global infrastructure.

Where such a transfer occurs, it takes place only in compliance with Chapter V GDPR, in particular on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework where applicable to the particular certified recipient), or appropriate safeguards such as standard contractual clauses, supplemented by additional measures where necessary.

You may request information about the specific country, recipient, mechanism used and how to obtain a copy of relevant safeguards at bootyshopeu@gmail.com. We periodically review the transfers actually made and their safeguards in light of our contracts and services in use.

10. How long we retain personal data

We do not retain personal data longer than necessary for the stated purpose. Where the same data is needed for several purposes, once one purpose ends, we continue processing only to the extent justified by another valid legal basis.

Category	Retention period or how it is determined
Orders and related customer data	During order processing and contract performance and subsequently to the extent necessary for legal obligations, complaints, and establishing, exercising or defending legal claims.
Accounting documents	Generally 10 years following the year to which they relate, under Section 35 of Slovak Act No. 431/2002 Coll., or longer where a specific legal basis so requires.
Complaints and withdrawals	During their handling and then for the period required by relevant legislation or necessary to protect rights and demonstrate compliance, depending on the case.
Customer account	While the account exists; following closure, information required solely for account administration will be deleted within a reasonable technical period, except data necessary for another lawful purpose.
Consent-based newsletters	Until consent is withdrawn or the purpose ends. Verifiable records of consent to electronic direct marketing and related records of withdrawal are retained to the statutory minimum extent, generally for at least 4 years after withdrawal, pursuant to Section 116(5) and (6) of Slovak Act No. 452/2021 Coll.
Cookies and online identifiers	According to the actual lifetime of each technology stated in the cookie settings; some cookies expire when the browser is closed. We retain records of consent to the extent necessary to demonstrate its validity.
Customer correspondence and security logs	For the period necessary to handle requests, secure the store and reasonably protect legal claims; specific periods depend on the type of record and the associated risk.
Voluntary reviews	For as long as a review is published or until the relevant consent is withdrawn where consent is the legal basis, except where retention is necessary for legal disputes.

 

When there is no longer any reason to process data, we delete, anonymise or securely dispose of it in accordance with internal procedures, taking account of backups and legal obligations.

11. Your rights

Subject to the conditions of GDPR, you have the following rights in particular:

Access to your personal data and related information (Article 15).

Rectification of inaccurate data and completion of incomplete data (Article 16).

Erasure where statutory conditions are met; this right is not absolute, for example where accounting records must be retained (Article 17).

Restriction of processing in circumstances laid down by law (Article 18).

Data portability under Article 20, especially for automated processing based on consent or a contract.

To object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time and without giving reasons (Article 21).

To withdraw consent at any time where processing is based on consent; withdrawal has no retroactive effect (Article 7(3)).

Not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects, subject to statutory exceptions and safeguards (Article 22).

To lodge a complaint with a supervisory authority, namely the Office for Personal Data Protection of the Slovak Republic (www.dataprotection.gov.sk), or seek other legal remedies.

You can exercise your rights by writing to bootyshopeu@gmail.com or to our registered office. We respond without undue delay and generally within one month of receiving the request; where permitted by law, this may be extended by a further two months, and we will inform you in due time. If we have reasonable doubts about your identity, we may request proportionate additional information to verify it. Requests are generally handled free of charge; GDPR permits exceptions for manifestly unfounded or excessive requests.

12. Data protection and security measures

We use appropriate technical and organisational measures to protect data, taking into account the nature of the data, risks and systems used. These include access controls, account security, secure data transfer, appropriate backups, supplier assessments and security incident procedures. We do not publish details of security measures where this could undermine their effectiveness.

13. Children's data

Our online store is not specifically intended for children. Where the processing of data in connection with information society services requires a child's consent, we comply with the age threshold and conditions of the applicable law; in Slovakia, the threshold for Article 8 GDPR is 16 years. This rule does not amount to a general prohibition on processing any data concerning people under 16 on another valid legal basis. If we become aware of unlawful processing of a child's data, we take appropriate remedial measures.

14. Social networks, external links and third-party content

Our social media profiles and external payment, delivery or communications services may also be subject to their providers' own privacy policies. If you access a third-party website or service, we recommend reviewing its privacy practices. In situations involving joint controllership or specific social media features, we comply with the applicable contractual and legal arrangements.

15. Changes to this policy

We may update this information, for example in response to changes in legislation, online store features or data processing practices. We will publish the current version on our website together with its effective date. Where GDPR requires it, we will provide specific notice or seek fresh consent before changing the processing concerned.

Last updated: 24 October 2026.