GDPR and Act No. 18/2018 Coll.
Privacy policy
We take your privacy seriously. Here you will find what personal data we process about you, for what purpose and on what legal basis, how long we keep it, who we share it with and what rights you have.
Valid from 12 October 2026
This English version is provided for convenience. The Slovak version is legally binding.
Controller and contact details
The controller of your personal data is:
- TERRI-M s.r.o., Mariánska 2226/2, 811 08 Bratislava, Slovak Republic
- Company ID (IČO): 54694264, registration: Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 162058/B
- E-mail: info@fightshop.sk
- Phone (online shop customer line): +421 904 316 813
- Stores: Fightshop Bratislava, Ivanská cesta 26, 820 01 Bratislava; Fightshop Trnava, Hospodárska 3611/53, 917 01 Trnava
We have not appointed a data protection officer (DPO), as the law does not require us to do so. For all matters relating to the protection of personal data, contact us at info@fightshop.sk.
Why we process data and on what basis
We process only the data necessary for a specific purpose. An overview of the purposes, data, legal bases under Article 6(1) of Regulation (EU) 2016/679 (GDPR) and retention periods:
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Processing the order, delivery and related communication | name, e-mail, phone, billing and delivery address (for delivery to another person, also the recipient’s name, address and phone); for purchases on behalf of a company, business name, Company ID (IČO), Tax ID (DIČ) and VAT ID (IČ DPH); order contents and any note on the order, delivery and payment method, payment and shipment status | performance of a contract — point (b) | for the duration of the contract; thereafter as part of the accounting records (below) and for handling warranty claims |
| Accounting and taxes (invoices, credit notes) | data stated on tax documents | legal obligation — point (c); Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax | 10 years from the end of the year to which the document relates |
| Warranty claims, withdrawal from the contract and returns | order data, description and photos of the defect, content of the notice, account number for the refund | legal obligation — point (c) (Civil Code, Act No. 108/2024 Coll.) and performance of a contract — point (b) | while the matter is being handled and then for 3 years (limitation period); payment records for 10 years |
| Customer account and customer profile (a profile is created with every order, even without registration) | e-mail, password (only in irreversibly encrypted form), name, phone, addresses, company details, history of orders, warranty claims and correspondence, newsletter consent, internal staff notes (e.g. arrangements made for a warranty claim) | account — performance of a contract, point (b); profile without registration and internal notes — legitimate interest, point (f) (customer service, handling further orders and warranty claims) | the account until it is closed; a profile without registration for 3 years from the last order or contact; orders thereafter as set out in the rows above |
| Answering your questions (contact form, e-mail, phone) | name, contact details, content of the message (we also keep e-mail correspondence in our administration system) | legitimate interest in answering you — point (f); for questions about an order, performance of a contract — point (b) | as long as necessary to deal with the matter, no more than 3 years |
| Newsletter and commercial communications | consent — point (a) (subscribing) | until consent is withdrawn — unsubscribe at /newsletter/odhlasenie (the link is in every newsletter), in your customer account or by e-mail to info@fightshop.sk | |
| Product reviews | name or nickname and the text of the review (published), e-mail (not published — used to verify the purchase) | consent — point (a) (submitting the review) | while the review is published or until you ask us to remove it |
| Heureka “Verified by customers” (Overené zákazníkmi) satisfaction survey | e-mail and the codes of the purchased products, which we pass on to Heureka Group, a.s. so that it can send you the survey | legitimate interest — point (f) (assessing customer satisfaction and the quality of the shop); you can refuse the survey by ticking the box at checkout, or object at any time | passed on once, straight after the order is placed (for card payments, once it has been paid); thereafter in accordance with Heureka’s policy |
| Favourite products | random browser identifier (cookie fs_wid), the list of favourite products and the history of its changes; once you sign in or place an order from the same browser, we link them to your customer profile | performance of a contract — point (b) (a feature you use); linking to your profile and an overview of product popularity (visible to authorised employees, e.g. in customer service and when ordering stock) — legitimate interest, point (f) | as long as you use the list, no more than 3 years from the last change |
| Analytics and traffic source | data about your visit to the website (Google Analytics 4), Heureka conversion tracking, traffic source (e.g. an advertising campaign) stored with the order | consent — point (a) and Section 109(8) of Act No. 452/2021 Coll. (cookie settings) | cookies as set out on the /cookies page; in Google Analytics no more than 14 months; traffic source together with the order |
| Advertising on Facebook and Instagram (Meta) | data about visits and purchases (products viewed, cart, order, amount), browser identifiers (cookies _fbp, _fbc), IP address and browser data; e-mail, phone, name, city and postcode from the order in hashed form only | consent — point (a) and Section 109(8) of Act No. 452/2021 Coll. (marketing cookies) | cookies 90 days; at Meta in accordance with its policy |
| Protecting the online shop against misuse | IP address and browser data (reCAPTCHA); a list of contacts (e-mail, phone, name and reason) whom we do not allow to make purchases because of repeated failure to collect parcels or fraudulent conduct | legitimate interest — point (f) (security, prevention of fraud and damage) | reCAPTCHA in accordance with Google’s policy; the list for as long as the reason persists, no more than 3 years |
| Database backups (recovery after a failure or attack) | all data stored in the online shop’s database, in encrypted form | legitimate interest — point (f) (security and availability of data) | no more than 30 days, after which the backup is deleted automatically |
| Displaying the store map in the website footer | IP address and technical browser data that your browser sends to Esri servers when loading the base map | legitimate interest — point (f) (showing you where to find us) | we do not keep it; Esri in accordance with its policy |
| Establishing and defending legal claims | data necessary to prove the claim | legitimate interest — point (f) | during the limitation period and for the duration of any dispute |
We rely on legitimate interest only where it is not overridden by your interests and rights. You can object to such processing at any time.
Do you have to provide your data?
We need the data marked as mandatory at checkout to conclude and perform the contract — without it, we cannot process your order. Providing data on the basis of consent (newsletter, review, analytics cookies) is voluntary, and you can withdraw your consent at any time without affecting the lawfulness of processing before its withdrawal.
We do not carry out profiling or automated decision-making with legal effects, with two exceptions to protect against misuse: you will not be able to complete an order (or sign in or register) if your e-mail, phone or name matches an entry on the list of customers whom we have blocked from purchasing — a member of our staff always decides on adding someone to that list; and a form will not be submitted if reCAPTCHA protection assesses it as sent by a bot. If you think this is a mistake, contact us at info@fightshop.sk or +421 904 316 813 — a person will review your case, and you can express your point of view and contest the decision.
Where we get the data from
Most of the data is provided directly by you — in your order, in your customer account or in forms. If we deliver goods to another person, the person placing the order provides us with their name, address and phone. We receive information about payment from the payment gateway and the bank, and information about the delivery status of your parcel from carriers. For purchases on behalf of a company, we may verify the details in public registers. We have transferred customer and order data from our previous online shop (the Fultio platform) to this system.
Who we share data with
We do not sell your data. We share it only to the extent necessary with the following recipients:
- Direct Parcel Distribution SK s.r.o. (DPD) — courier delivery or delivery to a pick-up point or locker, and collection of cash-on-delivery payments: name, address, phone, e-mail, the chosen pick-up point, cash-on-delivery amount and, where applicable, your note on the order.
- Packeta Slovakia s. r. o. and Packeta group companies — delivery to the Czech Republic: name, e-mail, phone, address or pick-up point.
- ComGate Payments, a.s. — card payment processing. You enter your card details directly in the payment gateway; we never see or store them.
- Fio banka, a.s. — maintaining the account to which we receive bank transfers; when matching payments, we process data from the bank statement (payer’s name, account number, amount, message for the recipient).
- Plus Five Five, Inc. (Resend service, USA) — sending e-mails (order confirmation, invoice, account verification, warranty claim and withdrawal confirmations, the newsletter and our correspondence with you).
- Supabase, Inc. (USA) — database and file storage (e.g. photos for warranty claims); data centre in the EU.
- Vercel Inc. (USA) — hosting of the online shop; data centre in the EU.
- GitHub, Inc. (USA) — storage of encrypted database backups (no more than 30 days).
- The provider of the e-mail inbox we use to communicate with you — receiving and storing e-mails.
- IT service provider — development, administration and technical support of the online shop and its administration (accesses the data only to the extent necessary for this work).
- Google Ireland Limited and Google LLC — Google Analytics 4 (only with your consent), reCAPTCHA to protect forms, and the e-mail inbox in which we receive notifications of new orders.
- Heureka Group, a.s. — the “Verified by customers” (Overené zákazníkmi) satisfaction survey and conversion tracking (tracking only with your consent).
- Meta Platforms Ireland Limited — measuring and targeting ads on Facebook and Instagram (Meta Pixel and Conversions API), only with your consent to marketing cookies.
- Environmental Systems Research Institute, Inc. (Esri, USA) — the base map for the store map on the website; when the map is displayed, your browser connects to Esri servers, which will see your IP address.
- External accounting firm and accounting software provider — bookkeeping (data on tax documents, including the customer’s e-mail and phone).
- Public authorities (e.g. the Slovak Trade Inspection (Slovenská obchodná inšpekcia), the Financial Administration, courts, the police) — only where required by law.
The carriers, the payment gateway, the bank, Heureka and public authorities process data as independent controllers in accordance with their own policies and regulations. The others are our processors — they process data only on our instructions on the basis of a contract and are bound by confidentiality.
Transfers outside the EU: the online shop’s database and hosting run in data centres in the EU; however, providers based in the USA (Resend, Supabase, Vercel, GitHub, Google, Esri) and Meta (parent company Meta Platforms, Inc.) may also process data outside the European Union. Transfers take place on the basis of the European Commission’s adequacy decision (EU–US Data Privacy Framework) for certified companies, and otherwise on the basis of standard contractual clauses approved by the European Commission.
How we protect data
The website communicates exclusively over an encrypted connection (HTTPS). We store passwords only in irreversibly encrypted form (hash), encrypt database backups and do not process payment card data at all. Only authorised employees and our IT service provider have access to the data, and only to the extent necessary for their work.
Your rights
In connection with the processing of your personal data, you have the right:
- of access — to obtain confirmation as to whether we process your data, and a copy of it,
- to rectification — to have inaccurate data corrected and incomplete data completed,
- to erasure — if the data is no longer needed, if you have withdrawn your consent or if we are processing it unlawfully,
- to restriction of processing — for example while the accuracy of the data is being verified,
- to data portability — to receive the data you provided to us on the basis of a contract or consent in a structured, machine-readable format,
- to object — to processing based on legitimate interest; if you object to direct marketing, we will no longer process your data for that purpose,
- to withdraw consent — at any time, without affecting the lawfulness of processing before its withdrawal.
You can exercise your rights by e-mail to info@fightshop.sk, by phone on +421 904 316 813 or in person at a store. We will respond without undue delay and within one month at the latest; in justified cases, we may extend this period by a further two months, in which case we will let you know. To avoid disclosing data to someone else, we may ask you to verify your identity.
Complaint to the supervisory authority
If you believe that our processing of your personal data infringes the law, you have the right to file a petition to initiate proceedings with the supervisory authority:
- Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
- Hraničná 12, 820 07 Bratislava 27
- Website: www.dataprotection.gov.sk
Feel free to contact us first — we will be glad to find a solution. However, filing a petition with the Office is not conditional on contacting us first.
Changes to this information
We update this information when our processing or the legislation changes. The current version is always available on this page, and the date of the last change is stated in its header.
Have a question?
We’re happy to help. Get in touch by phone, by e-mail or via the contact form.
