Privacy Policy
Last updated: 21 June 2026
1. Data controller
The controller of personal data is AKVAtour d.o.o., Slovenčeva ulica 24, 1000 Ljubljana, Slovenia (company registration no. 9086668000, VAT ID SI99258021), e-mail: [email protected].
2. What data is processed
- identification and contact data,
- order and payment data,
- website usage data (IP address, cookies),
- communication history,
- data from forms and enquiries.
3. Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Order fulfilment, delivery, billing | Article 6(1)(b) GDPR |
| User account | Article 6(1)(b) GDPR |
| Legal obligations (invoices) | Article 6(1)(c) GDPR |
| Newsletter | Article 6(1)(a) GDPR |
| Analytics and improvements | Article 6(1)(a)/(f) GDPR |
| Direct marketing | Article 6(1)(a)/(f) GDPR |
4. Recipients and data processors
Personal data is transmitted to contractual processors who process it exclusively on our instructions:
- payment providers: PayPal and Revolut,
- delivery services: GLS,
- hosting and e-mail: Hostinger,
- analytics and services: Google (Google Analytics, Google Tag Manager, sign-in with Google),
- abuse protection: Cloudflare (Turnstile),
- accounting: Minimax,
- state authorities, where required by law.
5. Transfers to third countries
As a rule, we do not transfer data outside the EU/EEA. When using Google and Cloudflare services, a transfer to the USA may occur; such transfers are carried out on the basis of standard contractual clauses (SCC) or the EU-US Data Privacy Framework.
6. Obligation to provide data
The provision of certain data (e.g. delivery address, tax data) is a condition for concluding the contract. Without this data, the order cannot be processed.
7. Data retention
- accounting data: 10 years,
- marketing data: until withdrawal,
- user accounts: until deletion,
- cookies: in accordance with the Cookie Policy.
8. Rights of individuals
An individual has the right to access, rectification, erasure, restriction of processing, data portability, objection (in particular to direct marketing) and withdrawal of consent. A complaint may be lodged with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec RS).
9. Data security
Data is protected by technical and organisational measures (encryption, access control).
10. Automated decision-making
We do not carry out automated decision-making or profiling with legal or comparably significant effects.
11. Cookies
The website uses essential cookies (without consent) as well as analytical and advertising cookies (only with consent). Details are provided in the Cookie Policy.
12. Changes to the policy
We reserve the right to make changes. The last published version applies.
Web analytics and advertising (Google Analytics 4 / Google tag)
Our online store uses Google Analytics 4 (GA4), loaded via Google Tag Manager (the "Google tag"), to understand how visitors use our website and to measure and improve our store and our advertising. These tools are provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); data may also be processed by Google LLC in the United States.
Consent first
No analytics or advertising tags are activated and no related cookies are set until you give your consent in our cookie banner. By default, all such storage and processing is denied (Google Consent Mode v2, default-denied). You can accept or refuse each purpose (analytics, advertising) separately; refusing is as easy as accepting; and you can change or withdraw your choice at any time via the persistent "Cookie settings" control.
What we collect (analytics — requires your "analytics" consent)
- the pages you view, the time and sequence of your visit, the referring website and campaign parameters;
- your approximate, city-level location (derived from your IP address; your full IP address is not stored);
- device and browser information (type, operating system, screen, language);
- your interactions: product views, product-list views, clicks on products, adding and removing items from the cart, cart views, checkout steps (shipping and payment selection), completed purchases (including the products, value and currency of the order), site searches, scrolling, clicks on outbound links, file downloads, form interactions, contact/enquiry submissions, and sign-in and registration events;
- a pseudonymous identifier stored in the _ga cookie (the Google "client ID");
- for signed-in customers, a pseudonymous User-ID: a one-way, irreversible hash of your internal customer number. This is not your e-mail address, name or any directly identifying data; it allows us to recognise the same customer across devices for more accurate statistics.
Advertising features (require your separate "advertising" consent)
- Google Signals — if you are signed in to your Google account and have turned on Ads Personalization, Google may associate your visit with information from your Google account (which may include location, search history, YouTube history and data from Google's partner sites). This lets us see cross-device journeys and aggregated demographic and interest data (age group, gender, interests). This constitutes profiling for measurement and advertising purposes.
- User-provided data collection (hashed) — to improve the accuracy of our conversion measurement, contact data from the checkout (your e-mail address and telephone number) may be hashed with the irreversible SHA-256 algorithm and shared with Google in this hashed form only. We do not send your raw e-mail address or telephone number.
- These features also enable, where a Google Ads account is linked, the building of advertising audiences and the measurement of advertising conversions. Such data is used for advertising purposes only with your advertising consent.
Legal basis
The storage of, and access to, information on your device is based on your consent (Article 5(3) of the ePrivacy Directive, as transposed into national law). The subsequent processing of your personal data is based on your consent (Article 6(1)(a) of the GDPR).
International transfer
Where data is transferred to Google LLC in the United States, the transfer is covered by the EU-U.S. Data Privacy Framework, under which Google LLC is certified; as an additional safeguard, we also rely on the European Commission's Standard Contractual Clauses.
Retention
User-level and event-level analytics data is retained by Google for 14 months; aggregated reports may be kept for longer. Cookies expire as shown below.
Cookies set after consent
- _ga — Analytics: distinguishes users (client ID) — up to 2 years.
- _ga_GWVV1Z8E8Q — Analytics: maintains session state — up to 2 years.
- _gid — Analytics: distinguishes users — 24 hours.
- _gcl_au — Advertising: measures ad clicks and conversions (Conversion Linker) — up to 90 days.
Your choices and rights
You can withdraw your consent at any time via "Cookie settings", which stops any further collection. You may also opt out through your Google account at myactivity.google.com and install Google's browser opt-out add-on at tools.google.com/dlpage/gaoptout. You have the right to access, rectify, erase, restrict and port your data and to object to its processing; you may request deletion of the data held about you in Google Analytics. You can contact us at [email protected].
Behavioural analytics (Microsoft Clarity)
Our online store uses Microsoft Clarity to understand how visitors use our website — through session recordings, heatmaps and aggregated behavioural insights — so we can improve the store's usability. Clarity is provided, for customers in the EU, under contract with Microsoft Ireland Operations Limited ("Microsoft"); the underlying service may be delivered by Microsoft Corporation in the United States.
Consent first
Clarity's script loads on every page, but until you grant your consent (via our cookie banner), it runs in a reduced, cookie-free mode: it does not set any cookie and does not link your separate page views into one session — each page view is treated as an anonymous, one-off, non-persistent visit. Only once you give your "analytics" consent does Clarity set its cookies (below) and start recording a full, cookie-linked session for your visit. By default, all such storage and processing is denied (Google Consent Mode v2, default-denied — Clarity honours the same signal we already use for our other analytics tools). You can accept or refuse this separately from other purposes, and change or withdraw your choice at any time via the persistent "Cookie settings" control.
What we collect (requires your "analytics" consent)
- how you move your mouse, where you click and scroll, and which pages you navigate through, used to generate session-replay video and click/scroll heatmaps;
- the pages you view, the time of your visit, your browser/device type and approximate screen size;
- your approximate, city-level location (derived from your IP address);
- a pseudonymous Clarity user ID (see cookies below).
What is masked by default
Clarity treats the content of input/form fields, numbers and e-mail addresses as sensitive and masks them before anything is captured — masked content is never uploaded to Clarity's servers. We have not unmasked any additional content on our site.
Cookies set only after your consent
- _clck — first-party — persists your Clarity user ID across visits to our site;
- _clsk — first-party — links your page views together into one session recording;
- CLID, MUID, ANONCHK, MR, SM — third-party (set by Microsoft) — identify your browser across sites that use Clarity/other Microsoft services, for fraud-prevention and to keep Microsoft's own identifiers in sync; Microsoft states ANONCHK is always set to a non-advertising value for Clarity traffic.
Legal basis
The storage of, and access to, information on your device is based on your consent (Article 5(3) of the ePrivacy Directive, as transposed into national law). The subsequent processing of your personal data is based on your consent (Article 6(1)(a) of the GDPR).
International transfer
As an EU customer, we contract with Microsoft Ireland Operations Limited; Microsoft Ireland Operations Limited has Standard Contractual Clauses in place with its US affiliate, Microsoft Corporation, covering any transfer of this data to the United States.
Retention
Individual session recordings are retained for 30 days from the time of recording; a sample of recordings, together with heatmaps and any labels we apply, may be retained for up to 9 months. Microsoft Clarity does not support deleting an individual visitor's data on request — the only way to remove all Clarity data is to delete the entire project, which would also remove every other visitor's data; please contact us if you wish to exercise a deletion request and we will assess the available options with you.
Your choices and rights
You can withdraw your consent at any time via "Cookie settings", which stops any further collection and prevents new cookies from being set. You have the right to access, rectify, erase, restrict and port your data and to object to its processing; given the retention/deletion limitations described above, please contact us directly at [email protected] so we can assess and action your request.