Privacy and Cookie Policy of the Online Store

"Everyday Objekts"
Effective as of: 01.08.2026
Version: 1.0

This document consists of two parts. Part A (Privacy Policy) explains how Studio Sadar d.o.o. (hereinafter: the Controller or we) processes the personal data of visitors to the website and customers of the online store available at www.studiosadar.com (hereinafter: the Website). Part B (Cookie Policy) explains the use of cookies and similar technologies. The two parts complement each other and should be read together.



PART A – PRIVACY POLICY


1. Controller of Personal Data
The controller of personal data is Studio Sadar d.o.o., Architectural Design, Zemljemerska ulica 12, 1000 Ljubljana, Slovenia, company registration number 9078509000, VAT ID SI55704875.
If you have any questions regarding the processing of your personal data or wish to exercise your rights, you may contact the Controller by email at info@studiosadar.com or by post at the Controller's registered office.
The Controller is not required to appoint a Data Protection Officer (DPO). Should a Data Protection Officer be appointed, their contact details will be published on the Website.


2. Categories of Personal Data and Sources
The Controller processes the following categories of personal data:
a) Basic identification and contact details: first name, surname, postal address, email address and telephone number.
b) Order and delivery data: delivery address, order details and specifications relating to custom-made Products.
c) Payment data: information required to process payments (payment card processing is carried out by the payment service provider; the Controller does not store payment card details).
d) Invoice data: including VAT identification number where required.
e) Technical data: IP address, browser type, device information and data relating to use of the Website collected through cookies and similar technologies.
f) Marketing communication data: email address and consent records where you subscribe to our newsletter.
Please note that a natural person's VAT identification number constitutes personal data. We process your VAT identification number only where necessary for issuing invoices or complying with tax obligations.
We collect personal data directly from you when you place an Order, subscribe to our newsletter, contact us, or through cookies when you visit the Website.


3. Purposes of Processing and Legal Bases
We process personal data for the following purposes and on the following legal bases:
a) Performance of Orders and Conclusion and Performance of the Contract.
This includes processing Orders, manufacturing and delivering Products, communicating regarding Orders, and handling complaints.
Legal basis: performance of a contract or taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
b) Compliance with Legal Obligations.
This includes issuing and retaining invoices, complying with tax and accounting obligations, and fulfilling obligations under consumer protection legislation.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
c) Newsletters and Marketing Communications
We send newsletters and updates based on:
-your consent (Article 6(1)(a) GDPR), which may be withdrawn at any time; or
-in certain cases, our legitimate interest in direct marketing where we inform existing customers about our own similar products and/or services (Article 6(1)(f) GDPR).
In such cases, we process your email address and, where relevant, basic information confirming that you have previously purchased from us, solely for the purpose of sending such communications.
You may object to this processing or unsubscribe at any time in the same manner as for consent-based communications, for example by clicking the unsubscribe link included in every email or by contacting the Controller. Upon receiving your objection, we will cease processing your personal data for direct marketing purposes.
d) Advertising on Social Media (Instagram)
The legal basis for advertising through social media is your consent to the use of the relevant cookies and tracking technologies together with our legitimate interest in marketing and promoting our products and/or services (Article 6(1)(a) GDPR in conjunction with the Slovenian Electronic Communications Act (ZEKom-2), and Article 6(1)(f) GDPR where applicable).
Where we carry out social media advertising based on our legitimate interest, we may provide the social media platform (for example Meta Platforms / Instagram) with a limited set of your contact details, such as your email address, typically in hashed form, for the purpose of creating or matching target audiences (for example Custom Audiences), displaying our advertisements and measuring their effectiveness.
In such cases, the social media platform compares your information with that of its users and generally does not disclose your identity to us, providing only aggregated campaign statistics.
You may object to this processing at any time by contacting the Controller. In that case, we will cease using your personal data for this purpose. You may also manage advertising preferences through the privacy and advertising settings provided by the relevant social media platform.
Notwithstanding the above, advertising cookies and similar tracking technologies on our Website (where used) are deployed only on the basis of your consent, as described in Part B (Cookie Policy).
e) Personalisation of Website Content
This includes, for example, displaying recently viewed Products.
Legal basis: our legitimate interest in improving the user experience (Article 6(1)(f) GDPR), or your consent where this functionality relies on cookies that are not strictly necessary.
Such personalisation does not involve automated decision-making producing legal effects concerning you or similarly significantly affecting you.
f) Website Security and Fraud Prevention
We process personal data to ensure the proper functioning and security of the Website and to prevent abuse and fraud.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

Providing personal data is necessary for entering into and performing the Contract. If you do not provide the required personal data, we will be unable to process your Order. Subscription to our newsletter is entirely voluntary.


4. Automated Decision-Making and Profiling
The Controller does not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR.

5. Recipients of Personal Data and Data Processors
We process personal data ourselves. For certain processing activities, however, we disclose personal data to external service providers acting either:
- as data processors on our behalf under a data processing agreement concluded in accordance with Article 28 of the GDPR; or
- as independent controllers, where this follows from the nature of the service provided.
The categories of recipients of personal data are as follows:

We may also disclose personal data to competent public authorities where required by law.
The Controller requires all data processors to provide appropriate guarantees regarding the implementation of suitable technical and organisational measures to protect personal data.


6. Transfers of Personal Data to Third Countries
Some of the above service providers may be established in, or process personal data in, third countries (outside the European Union or the European Economic Area). This applies in particular to certain providers of information technology and communication services (for example Dropbox, GoDaddy, Mailchimp and Meta Platforms).
Where personal data is transferred to a third country, the Controller shall ensure that an appropriate legal basis for such transfer exists in accordance with Chapter V of the GDPR, including, where applicable:
-an adequacy decision adopted by the European Commission (for example, the EU–US Data Privacy Framework for certified recipients); or
-the Standard Contractual Clauses (SCCs) adopted by the European Commission, together with supplementary safeguards where required.
Further information regarding the safeguards applied may be obtained by contacting the Controller using the contact details provided above.


7. Retention Periods for Personal Data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or for as long as required by applicable legislation. Once the relevant purpose has been fulfilled or the applicable statutory retention period has expired, the personal data is deleted or anonymised.

Where a Product is covered by a commercial guarantee or where claims relating to the legal guarantee of conformity are made, the relevant personal data may be retained until the expiry of the applicable guarantee period, the conclusion of the relevant proceedings and any applicable statutory limitation periods.

8. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:
a) the right of access to your personal data;
b) the right to rectification of inaccurate personal data;
c) the right to erasure ("right to be forgotten"), subject to the conditions laid down in the GDPR;
d) the right to restriction of processing;
e) the right to data portability;
f) the right to object to processing based on legitimate interests; and
g) the right to withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal.

You may exercise your rights by contacting us at info@studiosadar.com. The Controller shall respond to your request without undue delay and, in any event, within one month of receiving it. Where necessary, the Controller may request additional information in order to verify your identity before responding to your request.

You may withdraw your consent to receive newsletters at any time by clicking the unsubscribe link included in each newsletter or by contacting the Controller using the contact details provided above.

If you believe that the processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority. For processing carried out by the Controller, the competent supervisory authority is the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, Slovenia, email: gp.ip@ip-rs.si).

PART B – COOKIE POLICY

This Part explains what cookies are, which cookies and similar technologies are used by the Website, and how you can manage your cookie preferences. Any processing of personal data through cookies is described in greater detail in Part A (Privacy Policy) of this document.


9. What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet or mobile phone) when you visit a website.

They enable the Website to recognise your device on subsequent visits, ensure the proper functioning of the Website, and analyse how the Website is used.

In addition to cookies, similar technologies may also be used, including pixel tags, browser local storage and other tracking technologies. For the purposes of this Policy, all such technologies are collectively referred to as cookies.


10. Types of Cookies We Use

Depending on their purpose, we use the following categories of cookies:

a) Strictly Necessary Cookies
These cookies are essential for the operation of the Website and the Online Store (for example, the shopping basket, checkout functionality and security features). Without these cookies, the Website cannot function properly. Your consent is not required for the use of strictly necessary cookies.

b) Functional Cookies
These cookies enable enhanced functionality and allow the Website to remember your preferences (for example, your selected language using the Polylang plugin).

c)Analytics Cookies
These cookies enable us to analyse how the Website is used in order to improve its performance and user experience. Analytics cookies are used only with your consent.

d) Advertising Cookies
These cookies enable personalised advertising, including advertising on the Instagram social media platform. Advertising cookies are used only with your consent.

11. List of Cookies

The Website may contain embedded content from third-party websites (such as videos, images or other media). Embedded content behaves in the same way as if you had visited the originating website directly.

Such third-party websites may collect information about you, use their own cookies, embed additional third-party tracking technologies and monitor your interaction with the embedded content, including where you have an account with, and are logged into, the relevant third-party website.

12. Consent to and Management of Cookies

When you first visit the Website, you will be informed of our use of cookies through a cookie banner, and we will request your consent for the use of cookies that are not strictly necessary.

Strictly necessary cookies are placed without your consent, as they are required for the proper functioning of the Website.

Your consent is voluntary and may be modified or withdrawn at any time through the cookie settings available on the Website.

Withdrawal of consent shall not affect the lawfulness of any processing carried out on the basis of your consent before its withdrawal.

You may also manage cookies through your web browser settings, where you can refuse or delete cookies. Please note that disabling strictly necessary cookies may affect the proper functioning of the Website.

13. Cookies and Personal Data

Some cookies may process personal data, such as your IP address.

The processing of such personal data is governed in greater detail in Part A (Privacy Policy) of this document, including information regarding your rights as a data subject and any transfers of personal data to third countries.

14. Amendments to the Privacy and Cookie Policy

The Controller may update this Privacy and Cookie Policy from time to time.

The current version will always be published on the Website together with its effective date.