Privacy policy

PERSONAL DATA PROTECTION
CardAnvil — Dominik Forró — CARD ANVIL
Effective from: 11 October 2026

CONTROLLER

Dominik Forró — CARD ANVIL
Registered office: Váhovce 94, 925 62 Váhovce, Slovakia
Company ID (IČO): 57 310 041
E-mail: cardanvilsk@gmail.com
Phone: +421 949 759 023

WHAT DATA WE COLLECT

In connection with concluding a purchase contract, we process the following personal data of the buyer:
- Name and surname
- Delivery and billing address
- E-mail address
- Phone number
- Payment details (account number for refunds)
- Order history

When you visit cardanvil.sk, we automatically collect:
- IP address
- Browser and device type
- Cookies and browsing data

When we buy cards from you (Buylist form), we process:
- Name, e-mail address and phone number
- The list of cards offered (name, set, condition, language, quantity) and your note
- After you accept our offer: how the cards are handed over and paid for, and your IBAN if paid by bank transfer

For giveaways, we process the name, e-mail address and number of the order through which the customer entered the giveaway.

PURPOSES OF PROCESSING

We process personal data for the following purposes:
- Performance of the purchase contract (order processing, delivery of goods, invoicing)
- Compliance with legal obligations (accounting, tax obligations, complaints)
- Legitimate interests of the seller (communication with customers, improving our services)
- Marketing communication (only with the buyer's consent)
- Buying cards (assessing the offer, price offer, payment and purchase record)
- Giveaways (drawing the winner, contacting the winner and publishing the winner as first name and initial of the surname, e.g. “John K.”)
- Loyalty programme (assigning a loyalty level to the customer account based on total orders)

LEGAL BASIS

- Art. 6(1)(b) GDPR — performance of a contract and pre-contractual steps (orders, buylist, giveaway rules, loyalty programme)
- Art. 6(1)(c) GDPR — compliance with a legal obligation
- Art. 6(1)(f) GDPR — legitimate interest (communication, fraud prevention, publishing the giveaway winner)
- Art. 6(1)(a) GDPR — consent (marketing)

RETENTION PERIOD

- Order data and invoices: 10 years from the end of the year in which the invoice was issued (tax and accounting regulations)
- Buylist data: if the purchase takes place, the purchase record for 10 years (tax and accounting regulations); if it does not, no longer than 12 months from the last communication
- Published name of a giveaway winner: in the list of past giveaways until the winner objects
- Complaint data: 5 years from the settlement of the complaint
- Marketing consent: until withdrawn
- Cookies: depending on type (session cookies are deleted when the browser is closed, analytics cookies max. 2 years)

RECIPIENTS OF DATA

Personal data may be provided to the following third parties:
- Carriers (Packeta, InPost, DPD, Slovenská pošta) — to deliver the goods
- Payment gateways — to process payments
- Shopify — e-commerce platform provider
- Providers of e-mail and store management tools (Google – Gmail, Anthropic – Claude) — for communication and processing of orders, buylist offers and giveaways
- Accounting and tax advisers — to comply with legal obligations
- Public authorities — on the basis of a legal obligation

Some of these recipients (e.g. Shopify, Google, Anthropic) may also process data outside the EU/EEA. In such cases, the transfer is based on a European Commission adequacy decision or the EU standard contractual clauses.

RIGHTS OF THE DATA SUBJECT

You have the right:
- Of access to your personal data (Art. 15 GDPR)
- To rectification of inaccurate data (Art. 16 GDPR)
- To erasure (“right to be forgotten”, Art. 17 GDPR)
- To restriction of processing (Art. 18 GDPR)
- To data portability (Art. 20 GDPR)
- To object to processing (Art. 21 GDPR), for example to the publication of your name as a giveaway winner
- To withdraw consent (where processing is based on consent)
- To lodge a complaint with the supervisory authority — Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk

COOKIES

The cardanvil.sk website uses cookies for:
- Essential site functions (session cookies, cart)
- Analytics (traffic, user behaviour)
- Marketing (only with consent)

Visitors can refuse or manage cookies in their browser settings.

DATA SECURITY

The seller has adopted appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including:
- SSL encryption of data transmission
- Restricted access to personal data
- Regular backups

CHANGES

The seller reserves the right to amend this privacy policy. The current version is always available at cardanvil.sk.

CONTACT

For any questions about the protection of personal data, contact us:
E-mail: cardanvilsk@gmail.com
Address: Dominik Forró — CARD ANVIL, Váhovce 94, 925 62 Váhovce, Slovakia