Privacy Policy

Last updated: 21 September 2026

This policy explains what personal data Degriz d.o.o. collects, why, on what legal basis, who receives it, how long we keep it and what rights you have. It applies to our websites www.degriz.eu (English) and www.degriz.net (Slovenian), to our services as a Magento agency, and to the Magento extensions we publish, including those sold through the Adobe Commerce Marketplace. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and the Slovenian Electronic Communications Act (ZEKom-2).

1. Who is responsible (controller)

Degriz d.o.o.
Gorica pri Šmartnem 45a
3000 Celje, Slovenia
Registration number: 3595935000
VAT ID: SI67287743
E-mail: [email protected]
Phone: +386 40 807 231

We have not appointed a data protection officer, because we are not required to. For any question about this policy or your data, write to [email protected].

2. Overview of what we process

3. Visiting our websites

When you open a page, our web server records the usual technical data: your IP address, the page requested, date and time, browser and operating system, and the page you came from. We use this to deliver the site, keep it secure and find errors. Our websites are hosted on servers in Slovenia (EU) by our hosting provider Neoserv.

We derive your approximate country from your IP address using a database on our own server, in order to offer you the right language version. This lookup does not involve any third party.

www.degriz.net is served through Cloudflare, Inc. (USA), which acts as a content delivery and security network and therefore sees the requests to that site. Cloudflare is certified under the EU-US Data Privacy Framework and processes data under its standard data processing terms. www.degriz.eu is served directly from our hosting provider in Slovenia.

4. Cookies, consent and tracking

On your first visit we show a cookie banner. Cookies that are strictly necessary for the site to work are always set. All other cookies and tracking tools are used only if you choose "Accept all" or select them under "Settings". You can change or withdraw your choice at any time via the "Edit cookie settings" link in the footer. Rejecting non-essential cookies does not limit the use of the site.

Cookies and browser storage we use

Google Analytics 4

We use Google Analytics 4 (Google Ireland Limited) to understand how the site is used. The Google tag is loaded with Google Consent Mode set to "denied" by default: until you give consent for analytics cookies, no analytics cookies are set, but the tag still sends Google cookieless technical signals (for example that a page was viewed, together with your IP address and browser data as part of the request), which Google uses in aggregated form. If you accept analytics cookies, Google sets the cookies listed above, and in our store the completed order (order number, value and products, without your name or e-mail) is reported as a purchase event. Google may transfer data to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework and Google's data processing terms for Google Analytics apply. You can also block Google Analytics with the browser add-on.

Microsoft Clarity

If you accept analytics cookies, we also load Microsoft Clarity (Microsoft Ireland Operations Limited), which records how visitors move through pages (clicks, scrolling, mouse movement) and produces heat maps and session replays. Clarity masks text typed into form fields by default. Microsoft may process this data in the USA under the EU-US Data Privacy Framework. Without your consent Clarity is not loaded at all.

Advertising and marketing choices

The banner also offers "Advertising cookies" and "Marketing cookies". At present we do not load any advertising pixels or remarketing tags (no Google Ads, Meta or similar tags) on our websites. Your choice for these categories is stored and passed to Google Consent Mode. If you accept marketing cookies, we also keep the "dg_attrib" record described above and load embedded YouTube videos automatically. Should we add advertising tools, we will update this policy first.

Other third-party content

• Google reCAPTCHA protects the contact form and the support form against spam. When you open those pages, Google loads the reCAPTCHA script and evaluates your interaction (including your IP address and browser data). Your IP address and these data are transferred to Google, including Google LLC in the USA. We use it on the basis of our legitimate interest in preventing abuse (Art. 6(1)(f)). Google's privacy policy applies.
• Google Maps: the contact page shows our location as a static map image served from our own server. Nothing is loaded from Google when you open the page. Google receives your data (such as your IP address) only if you click the link to open the map on Google Maps, which opens in a new tab under Google's privacy policy.
• YouTube videos on some product and category pages are shown as a preview image served from our own server. The video player is loaded from YouTube in privacy-enhanced mode (youtube-nocookie.com) only when you click the video, or automatically if you have accepted marketing cookies. Only then does Google (YouTube) receive your IP address and browser data and may store data in your browser; Google may transfer this data to Google LLC in the USA.
• All fonts are served from our own servers; no font is loaded from Google or any other third party.
• Google Calendar booking links open Google's own page; whatever you enter there is governed by Google's privacy policy.
• Links to our Facebook page are plain links. We do not embed Facebook plug-ins or the Meta pixel.

5. Contact form, e-mail and phone

When you write to us through the contact form, by e-mail or call us, we process the data you give us (name, e-mail address, phone number, company, your message) in order to answer you. Messages are delivered to our mailbox on our own mail server, hosted by Neoserv in Slovenia. If your enquiry leads to a project, the correspondence becomes part of the project file and is kept for the duration of our relationship and the statutory retention periods; otherwise we keep it only as long as needed to handle the enquiry and any follow-up questions.

6. Online store configurator and quotes

The configurator lets you assemble an online store project and request a quote. When you submit it we store your name, company, e-mail address, phone number, message, the selected items and price, your IP address and, if available, the advert or campaign that brought you to our site (from the "dg_attrib" record described above) and the person who recommended us, if you tell us. We use this to prepare the quote, answer your questions and, if you agree to a project, to draw up the contract and a project page in our guides centre. Project pages are hidden from search engines and show only the company or shop name, never a personal name.

If you do not finish the configurator, your selections are kept in your browser (local storage) for 14 days so you can continue. If, within that time and on the same device, you enter your e-mail address in the configurator or in our newsletter form, we save the configuration together with that e-mail address as a quote request, so that we can send you the estimate and follow up. After a quote request we may send you a small number of automated follow-up e-mails about that quote; you can stop them at any time by replying or writing to us. This follow-up is based on our legitimate interest in concluding the contract you enquired about (Art. 6(1)(f)).

Quotes that do not lead to a contract are kept only as long as needed to answer and follow up on your request; accepted quotes are kept with the contract for the duration of the project and for the statutory periods that apply to business records.

7. Technical support and maintenance

Support requests submitted through the support form on our website or by e-mail to [email protected] are recorded in our ticketing system, which runs on our own server. We store your name, e-mail address, the subject and content of the request, attachments, the time spent and the resolution. Clients with a maintenance package are prioritised according to their contract. Any access details you give us (for example administrator or server logins) are used only for the agreed work, stored in the ticket, and should be changed by you after the work is done.

Support time is billed monthly. Invoicing data (company, address, VAT ID, contact person, items and amounts) is transferred to our online accounting software, Minimax, and kept for 10 years as required by Slovenian tax law.

To existing clients we occasionally send a short check-in e-mail asking how their shop is doing, and information about our services that are similar to those they have already used. This is based on our legitimate interest in maintaining the client relationship (Art. 6(1)(f) GDPR and the rules on existing customers in ZEKom-2). You can object at any time by replying to the e-mail or writing to [email protected], and we will stop.

8. Customer account, purchases and newsletter in our store

Account and orders

You can buy our extensions and services in our store as a guest or with an account. We process the data needed for the order: name, company, address, e-mail, phone number, VAT ID, ordered items, licence domain and payment status. Passwords are stored only as a salted hash. You can update your data in your account at any time and ask us to delete the account; order and invoice records must be kept for 10 years under tax law.

If you choose "Continue with Google" to log in, Google sends us your name, e-mail address and Google account identifier, which we use to create and sign in to your account. We receive no other data from your Google account.

Payments

Payment is made by bank transfer (pro-forma invoice / UPN), by PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) or by card through Stripe (Stripe Payments Europe, Ltd., Ireland). Card and account details are entered directly with the payment provider; we never see or store your full card number. The provider sends us only the confirmation and reference of the payment. Each provider's own privacy policy applies to the data you enter there.

Newsletter

You can subscribe to our newsletter with your e-mail address after ticking the consent box. Subscriptions are stored in our store and in our own newsletter system (Sendy), which runs on our server. E-mails are delivered through Amazon Web Services (Amazon Simple Email Service, endpoint in the USA); Amazon is certified under the EU-US Data Privacy Framework and processes the data under the AWS data processing addendum. Our newsletters contain open and click tracking, so we can see which subscribers opened a message or clicked a link. You can unsubscribe at any time using the link in every e-mail or by writing to us; we then stop sending immediately and remove your address from the list.

9. AI assistant (chat)

Our website runs a chat assistant that answers questions about what we offer. It is marked as being in testing. This section describes what it processes.

What data is created

• The conversation. Your questions and the assistant's answers. You can type anything, so please do not enter sensitive personal data, passwords or payment details into the chat.
• Your IP address. Stored only in hashed (irreversibly transformed) form. We use it to limit the number of messages per day and prevent abuse, not to identify individuals.
• The page you wrote from, a conversation identifier and technical measurements (response time, number of tokens, cost).
• Your e-mail address and message, if you choose to use the contact form inside the chat. In that case we also receive the conversation that led to it, so we can reply without asking you to explain again.

Who else processes it

We use OpenAI, L.L.C. (USA) as our processor to generate answers and to check messages for abuse. The text of your question and the relevant extracts of our own content are sent to them. We do not send your IP address, your e-mail address or any order data.

This is a transfer to a third country. It takes place under the European Commission's Standard Contractual Clauses and a data processing agreement concluded with OpenAI. Under OpenAI's API terms, the data is not used to train their models and may be retained by them for up to 30 days for abuse monitoring.

Legal basis

The assistant operates on our legitimate interest (Art. 6(1)(f) GDPR) in helping visitors find information quickly. When you send an enquiry through the chat, we process the data to take steps prior to entering into a contract, or on the legitimate interest of replying to your message (Art. 6(1)(b) and (f) GDPR).

How long we keep it

Conversations and refusal logs are kept for 90 days and then deleted automatically. Enquiries sent through the form are kept as part of ordinary business correspondence.

Storage in your browser

So that a conversation is not lost as you move between pages, we store it in your browser's local storage for up to two hours. Nothing is written until you send your first message. This data stays on your device, is never transmitted to our server, and you can clear it at any time along with your other browsing data.

Limits of the assistant

The assistant is automated and may answer incompletely or incorrectly. Its answers are not a binding offer and do not replace legal, tax or professional advice. For binding information, please contact us directly. The assistant does not make any decision that has legal or similarly significant effects on you.

Shopping by AI agents

Our store also publishes machine-readable product data and a checkout interface for AI shopping agents (Agentic Commerce Protocol and Universal Commerce Protocol). If you ask such an agent to buy from us, we receive from the agent platform the data it sends for the order (items, and your name, e-mail and address for checkout) and process it as an ordinary order under section 8. The agent platform is a separate controller for what happens inside it.

10. Magento extensions and the Adobe Commerce Marketplace

Buying our extensions

We sell our Magento extensions in our own store and through the Adobe Commerce Marketplace, operated by Adobe. When you buy through the Marketplace, your contract of sale is with Adobe, and Adobe provides us with the data we need to fulfil the licence and support you: typically your name, company, e-mail address, the product purchased, the order or licence reference and the licensed domain. We use this data to deliver and verify the licence, provide support and updates, and keep the records required by law (Art. 6(1)(b), (c) and (f) GDPR). Adobe's own privacy policy applies to your Marketplace account. We keep licence records for the duration of the licence and for the statutory periods afterwards.

What our extensions collect

Our extensions run on your own Magento installation. They contain no licence-activation calls, no usage telemetry and no "phone home" function: they send no data of any kind to Degriz. Where an extension is built to integrate with an external service, it communicates only with that service, using your own credentials. For example, our Pošta Slovenije shipping extension exchanges shipment data with Pošta Slovenije's own services under the merchant's account and loads map tiles from OpenStreetMap for the pick-up point map; nothing goes to us. The exact integrations of each extension are described in its documentation.

Personal data of your customers that an extension processes (for example order and address data for a shipping label) stays in your systems. You are the controller of that data; we do not receive it unless you engage us for support and grant us access, in which case section 11 applies.

Support for extension buyers

Support requests for our extensions are handled as described in section 7. If you send us log files, screenshots or database extracts, please remove any customer data that is not needed to reproduce the problem.

11. Clients' shops: when we act as a processor

When we develop, migrate, maintain or host an online store for a client, we necessarily have access to the client's Magento or WordPress installation and therefore to the personal data stored in it, such as the client's customers, orders and newsletter subscribers. In this role we are a processor under Article 28 GDPR and the client is the controller. We act only on the client's documented instructions and keep the data confidential. We conclude a data processing agreement with the client (as part of the contract or our general terms); we send a template on request.

• The client's data stays on the client's systems. For migrations, upgrades and testing we may run a temporary copy of the client's shop on our development servers in Slovenia (hosted by Neoserv). Such copies are protected against public access and search engines and are removed within a reasonable period after the project ends, at the latest within 3 months, unless the client requests a maintenance copy.
• Our sub-processor for these copies and for our own systems is our hosting provider Neoserv (Slovenia). We do not use any other sub-processor for client data unless agreed with the client.
• If you are a customer of one of our clients and wish to exercise your rights, please contact the shop you bought from; we will assist that shop in answering you.
• Access credentials given to us are used only for the agreed work. We recommend clients revoke or change them when the work is complete.

12. Other processing on our websites

• Website analysis tool. If you enter the address of a website into our free analysis tool, we send that address to Google's PageSpeed Insights API and to MageReport (Sansec, Netherlands) and store the address, the results and a screenshot of the page. Enter only websites you are entitled to have analysed.
• Blog comments. Where comments are open on a blog post, we store the name, e-mail address, optional website, comment text and IP address you submit. The name and comment are published; the e-mail address and IP address are not. Spam checking runs on our own server.
• Google reviews. We display reviews published on our Google Business Profile as they appear there, together with the reviewer's public name.
• Business outreach. We sometimes write to companies that may need our services, using business contact details that are publicly available (for example on the company's website). This is based on our legitimate interest in promoting our services to businesses (Art. 6(1)(f)). Each such e-mail contains an unsubscribe link; when you reply or unsubscribe we stop and place the address on a suppression list so that it is not contacted again. We record whether the e-mail was opened or a link was clicked.
• Push notifications. If you allow push notifications, we store the delivery address your browser creates, the type of device and the topics you chose. Notifications are delivered by your browser's service (Google, Apple, Mozilla or Microsoft); the content is encrypted and that service cannot read it. You can unsubscribe at any time in your browser settings or with the bell icon. The basis is your consent to the notification we show (Art. 6(1)(a)); delivery and click statistics rest on our legitimate interest. Records of individual notifications are deleted after 180 days.

13. Recipients and processors

We share personal data only with the following categories of recipients, and only to the extent needed:

• Neoserv (Slovenia): hosting of our websites, mail server, ticketing system and development servers.
• Cloudflare, Inc. (USA): content delivery and security network for www.degriz.net.
• Google Ireland Limited / Google LLC: Google Analytics 4, reCAPTCHA, Maps (only if you open the link), YouTube (only when a video is loaded), "Continue with Google" sign-in, Calendar booking links and the PageSpeed Insights API.
• Microsoft Ireland Operations Limited: Microsoft Clarity, only with your analytics consent.
• OpenAI, L.L.C. (USA): generating the AI assistant's answers.
• Amazon Web Services (Amazon SES): delivery of newsletters.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. and Stripe Payments Europe, Ltd.: payments in our store.
• Adobe: operator of the Adobe Commerce Marketplace, which transmits buyer data to us.
• Minimax online accounting: invoicing and bookkeeping records.
• Sansec (MageReport, Netherlands): website analysis tool.
• Public authorities, courts, banks and legal advisers where the law requires it or where we need to establish, exercise or defend legal claims.

We do not sell personal data and do not share it with anyone for their own marketing.

14. Transfers outside the European Economic Area

Most of our processing takes place in Slovenia and the EU. Data is transferred to the USA in the following cases: Google (Analytics, reCAPTCHA, Maps, YouTube, sign-in), Microsoft Clarity, Cloudflare (www.degriz.net), Amazon SES (newsletter delivery), Adobe (Marketplace) and OpenAI (AI assistant). Google, Microsoft, Cloudflare, Amazon and Adobe are certified under the EU-US Data Privacy Framework, which the European Commission has recognised as providing adequate protection; in addition, or where a provider is not certified (OpenAI), the transfer is covered by the European Commission's Standard Contractual Clauses. You can obtain a copy of the relevant safeguards by writing to [email protected].

15. How long we keep data

We keep personal data only for as long as needed for the purpose it was collected for, and afterwards only where a law requires it or where we need it to establish, exercise or defend legal claims. The specific periods are given in the sections above; in summary: invoices and accounting records 10 years (tax law); contracts and project files for the duration of the relationship and the general limitation period afterwards; server logs up to 12 months; enquiries and quotes until they are dealt with; newsletter until you unsubscribe; AI assistant conversations 90 days; cookies as listed in the cookie table. Data that is no longer needed is deleted or anonymised.

16. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure ("right to be forgotten"), unless we must keep the data by law or need it for legal claims (Art. 17);
• restriction of processing (Art. 18);
• data portability: receive the data you gave us in a structured, machine-readable format (Art. 20);
• object to processing based on our legitimate interest, including direct marketing, at any time (Art. 21); after an objection to direct marketing we will stop immediately;
• withdraw consent at any time, with effect for the future, for example by unsubscribing from the newsletter or changing your cookie settings (Art. 7(3));
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you; we do not make such decisions (Art. 22).

To exercise these rights write to [email protected] or to our postal address above. We will reply within one month; where a request is complex we may extend this by two further months and will tell you. We may ask you to confirm your identity before acting. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

Right to lodge a complaint

If you believe that we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec Republike Slovenije), Dunajska cesta 22, 1000 Ljubljana, e-mail [email protected], www.ip-rs.si. You may also complain to the supervisory authority of the EU country where you live or work.

17. Security

We protect personal data with technical and organisational measures appropriate to the risk: all pages and forms are served over HTTPS; passwords are stored only as salted hashes; access to our servers, administration panels and ticketing system is limited to authorised persons with individual accounts and SSH keys; session data is kept on the server, and the session cookie is marked secure and HttpOnly; public forms are protected against automated abuse by reCAPTCHA and honeypot fields; the IP addresses used by the AI assistant are hashed. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we will inform you and the supervisory authority of any personal data breach as required by Articles 33 and 34 GDPR.

18. Children

Our websites and services are intended for businesses and adults. We do not knowingly collect data from children under 15. If you believe a child has provided us with personal data, please contact us and we will delete it.

19. Changes to this policy

We update this policy when our services, the tools we use or the law change. The date at the top shows when it was last revised. For material changes we will notify you on the website or, where we have your e-mail address for that purpose, by e-mail. If our company is merged with or acquired by another company, personal data may be transferred to the successor so that our services can continue; we will inform you in that case.

This version was last updated on 21 September 2026. The Slovenian version of this policy is available at www.degriz.net; in case of doubt about the processing described here, the version applicable to the website you are using prevails.