We take your privacy seriously. This document explains what personal data we process when operating the e-shop www.puffhouse.eu, why, how long we store it, and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on the protection of personal data.
1. Controller
MEXCOR s.r.o., Matúšova 8027/54, 811 04 Bratislava – mestská časť Staré Mesto, Company ID: 50 455 605. Contact for personal data matters: web@puffhouse.eu, +421 911 600 430. We have not appointed a Data Protection Officer (not required); requests are handled by an authorised employee.
2. What data we process, why and for how long
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, email, phone, language | customer account management, order communication, delivery | performance of a contract (Art. 6(1)(b)) | until account deletion (+30 days for anonymisation); guests 3 years from last order |
| Delivery and billing address | delivery, invoicing | performance of a contract | until account deletion; in accounting documents 10 years |
| Orders, invoices, credit notes, payments | performance of a contract, accounting, taxes, complaints | legal obligation (Accounting Act, VAT Act) | 10 years from the end of the accounting period |
| Age verification (result, method, time, reference) | legal obligation to sell only to persons 18+ | legal obligation (Art. 6(1)(c)) | 3 years; we do not store identity documents or dates of birth |
| Payment tokens (stored card) | quick payment, top-up | consent | until card removal or account deletion; card number is only visible to the payment gateway |
| Puff Points, top-up, favourites, saved carts | loyalty programme and account services | performance of a contract | until account deletion |
| Consents (newsletter, cookies) and preferences | demonstrating consent, notification settings | legal obligation / consent | 3 years after consent withdrawal |
| Email for newsletter | sending news and offers | consent (Art. 6(1)(a)); can be withdrawn at any time via the link in the email or in the account | until consent withdrawal |
| Search and browsing in the e-shop | improving search and offers, personalisation | legitimate interest (Art. 6(1)(f)) – you can object | 90 days, without linking to a person |
| Support communication, complaints, withdrawals | handling requests, demonstrating compliance | performance of a contract / legal obligation | 3 years, for complaints 10 years (documents) |
| Technical records (IP address, time, device) | security, fraud prevention, protection against account misuse | legitimate interest | 90 days |
| B2B: contact details of company representatives | wholesale cooperation, company approval, invoicing | performance of a contract / legitimate interest | for the duration of cooperation + 10 years (documents) |
Providing the data marked as mandatory during ordering is a condition for concluding the contract – without them we cannot deliver the order. Other data you provide voluntarily.
3. Who we share data with
- Carriers – Packeta Slovakia s. r. o., GLS General Logistics Systems Slovakia s.r.o. (name, address, phone, email, information about the obligation to verify age);
- Payment gateway – Tatra banka, a.s. (TatraPay+) and card schemes; the card number is processed solely by the bank;
- IT service providers – hosting and operation of the e-shop (server in the EU), email service (Websupport, s.r.o.), enterprise system (Microsoft Dynamics 365 Business Central);
- Accounting and tax advisory, legal representatives – to the extent necessary to fulfil legal obligations;
- Public authorities (SOI, financial administration, courts, police) – if required by law.
We have concluded data processing agreements with our processors. We do not transfer data outside the EU/EEA; if it were necessary (e.g. a cloud service with support outside the EU), we would ensure it via EU standard contractual clauses.
4. Cookies and analytics
We always use necessary cookies (cart, login, age verification, consents). Analytical and marketing cookies are only enabled with your consent, which you can change at any time in the footer of the site (Cookie Settings). For details, see the Cookie Policy.
5. Your rights
- access to data and information about processing (you can download a copy of your data in the account → Privacy),
- rectification of inaccurate data (in the account or upon request),
- erasure ("right to be forgotten") – we anonymise data within 30 days; documents we must keep by law remain without any link to your person,
- restriction of processing and objection to processing based on legitimate interest (e.g. personalisation) – we will always comply with an objection to direct marketing,
- portability of data you have provided to us, in a machine-readable format,
- withdrawal of consent at any time without affecting the lawfulness of prior processing,
- the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.
You can exercise your rights in your customer account (Privacy and data) or by email at web@puffhouse.eu. We will respond within one month; for complex requests we will extend the period by a maximum of two further months and inform you. If there are doubts about the identity of the requester, we may ask for additional verification.
6. Automated decision-making and profiling
We do not make decisions based solely on automated processing with legal effects. Product recommendations and assistant content are personalised only to the extent that you can disable in your account (Personalisation).
7. Security
We protect data with encrypted transmission (HTTPS), access restricted to authorised persons, regular backups in the EU, and access logging. Login is protected by password, login link or passkey (Face ID / Touch ID); we store passwords only in the form of a secure hash.
8. Changes to the policy
We may update the policy when services or legislation change; the current version is always on this page. Version 2026-09, effective from 12. 9. 2026.