Shopping Cart
This policy explains which personal data we process when you use the online shop interfood-adria.eu, why we use it, who we share it with and how you can exercise your rights. It applies to website visitors, customers, account users and anyone who sends us a message or a request.
1 Data controller and contact details
The data controller is INTERFOOD ADRIA, trgovina in storitve, d.o.o., with the abbreviated name INTERFOOD ADRIA d.o.o., Kotnikova ulica 5, 1000 Ljubljana, Slovenia. Company registration number: 9843213000. VAT identification number: SI90194373.
For questions about personal data protection and to exercise your rights, email office@interfood-adria.eu or write to the controller at the postal address above.
2 Personal data we process
For purchases and delivery, we process your full name, billing and delivery address, email address, a telephone number for delivery where you provide one, and information about the products ordered, your order, payment and delivery. For business purchases, we also process the company and contact person details you provide.
For customer accounts, we process the data you enter when registering and using your account, login details and order history. For communications, withdrawal from contracts, returns and complaints, we process your contact details, message content, purchase details and any evidence you provide. We process bank account details where needed for an agreed refund by bank transfer.
When you use the website, technical data may be processed, such as your IP address, access time, device and browser information, and website operation logs. Where you consent to analytics, cookie identifiers and website usage data are also processed. We also record your choices and consents where you provide them.
We obtain data mainly from you. We also receive information about payment, delivery and order processing from payment and logistics providers and through our order management system.
3 Purposes and legal bases
Orders, payments and delivery. We use data to process your order, enter into and perform the contract, process payment, prepare and deliver the goods, and send order updates. The legal basis is performance of the contract or steps taken at your request before entering into it, under Article 6(1)(b) of the General Data Protection Regulation (GDPR).
Customer accounts. We use data to create and manage your account, enable login and provide access to your order information. The legal basis is performance of the customer account service you request, under Article 6(1)(b) GDPR.
Invoices and statutory records. We process data to issue and email invoices, carry out fiscal verification of invoices where required, keep accounting records and meet tax and other legal obligations. The legal basis is Article 6(1)(c) GDPR.
Withdrawals, returns and complaints. We process data to handle your requests, verify purchases, refund payments and meet our obligations as the seller. Depending on the request, the legal basis is performance of the contract or compliance with a legal obligation, under Article 6(1)(b) or 6(1)(c) GDPR.
Responding to enquiries. Where your message concerns an order or a prospective purchase, we handle it under Article 6(1)(b) GDPR. We handle other business enquiries on the basis of our legitimate interest in communicating and responding to messages received, under Article 6(1)(f) GDPR.
Security and legal claims. We use technical logs and necessary business data to protect the online shop, prevent misuse and establish, exercise or defend legal claims. The legal basis is our legitimate interest in secure operation and protecting our rights, under Article 6(1)(f) GDPR. We also take your rights and interests into account when processing data for these purposes.
Website analytics. We use Google Analytics to measure visits statistically and understand how the website is used. The legal basis for processing personal data for this purpose is your consent, under Article 6(1)(a) GDPR. Analytics is not a condition of purchasing from us.
Newsletters and marketing messages. If you subscribe to these messages and give your consent, we use your contact details to send information about our offers. The legal basis is consent under Article 6(1)(a) GDPR. You can withdraw consent at any time by unsubscribing through a message or by emailing office@interfood-adria.eu. Order, invoice, delivery and complaint updates form part of handling your purchase and are sent independently of marketing consent.
4 Required and optional data
Data marked as required when ordering is necessary to enter into and perform the contract or meet legal obligations. If you do not provide it, we cannot process or fulfil your order. To create an account, we need the data marked as required during registration.
Providing other data and consenting to analytics or marketing is optional. Refusing or withdrawing these consents does not prevent you from making a purchase. Please do not send personal data in messages or attachments unless it is necessary for handling the matter.
5 Recipients of personal data
We share data only to the extent needed for the particular service or legal obligation. We work with the following recipients or categories of recipients:
GLS Slovenia, GLS Fulfillment and the delivery and logistics partners involved in fulfilling an order, for order preparation, warehousing, delivery and handling returns, as relevant to their services. We share only the recipient, delivery and order details needed to provide each service. For cash on delivery, which is available only for delivery to Slovenia, we also share the amount to be collected.
MetaKocka d.o.o., the provider of the Meta Kocka system, for managing orders, invoices, payments and logistics data associated with order fulfilment.
Stripe for processing card payments and refunds and related transaction security checks. Card data is processed by the payment service provider; we use transaction information and payment status to process your order. Stripe may also act as an independent controller for certain purposes, including its own legal obligations and fraud prevention. Further information is available in the Stripe Privacy Policy.
Google as the provider of Google Analytics and Google Tag Manager. Google Analytics is used for website analytics; Google Tag Manager manages the tags through which analytics is enabled. Details of Google’s processing are available in How Google uses information from sites or apps that use its services.
Hosting, email, technical support and online shop maintenance providers, including Pro marketing d.o.o. for technical support, and accounting service providers to the extent necessary for their work.
Competent public authorities where disclosure is required by law, and legal advisers and other authorised recipients where necessary to establish or defend legal claims.
Providers that process data on our behalf may do so only for the agreed purposes, in accordance with our instructions and appropriate processing arrangements under Article 28 GDPR. Recipients acting as independent controllers are responsible for their own processing in accordance with applicable law and their privacy notices.
6 Google Analytics and cookies
We use Google Analytics through Google Tag Manager to measure website visits. Analytics processing may include pages viewed, visit times, interactions, traffic sources, approximate location, device and browser information, together with cookie identifiers. When connecting to Google’s service, technical data needed for the connection, including the IP address, is also processed.
We use analytics to monitor visits and improve the online shop. We do not send your name, email address or delivery address to Google for this purpose. Analytics data and identifiers are not necessarily anonymous, so we handle them in accordance with personal data protection rules.
We enable non-essential analytics cookies and the associated processing only after you actively consent. You can refuse consent or withdraw it later in the cookie settings. Continuing to use the website does not, in itself, constitute consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
We use essential cookies for functions you request, such as the shopping cart, login and storing your cookie preferences. Consent is not required for these cookies where they meet the statutory conditions for an exemption. Depending on the purpose, the legal basis for the associated processing of personal data is performance of the requested service or our legitimate interest in the secure operation of the online shop.
Information about individual cookies, providers, purposes and durations is available on the Cookies page, where you can also access your preference settings.
7 Transfers outside the European Economic Area
Using Google and Stripe services may involve processing data outside the European Economic Area, particularly in the United States. Such transfers rely on an appropriate basis under Chapter V GDPR. For transfers to certified US recipients under the EU–US Data Privacy Framework, the European Commission’s adequacy decision applies where the transfer falls within the scope of their valid certification.
Google LLC and Stripe, LLC state in their published policies that they participate in this framework. For transfers not covered by an applicable adequacy decision, the European Commission’s standard contractual clauses under Decision (EU) 2021/914 may be used, together with additional safeguards where necessary.
Further information is available in Google Legal frameworks for data transfers and Stripe Data Privacy Framework. You can request information about the basis for a particular transfer and a copy of the appropriate safeguards by emailing office@interfood-adria.eu; when providing this information, we take account of confidentiality and the rights of others.
8 Data retention
We retain invoices for ten years after the end of the year to which they relate, in accordance with the Slovenian Value Added Tax Act (ZDDV-1). Data forming part of other statutory records is retained for the periods required by the legislation governing those records.
We retain order, payment, delivery, return and complaint data until the matter is concluded, and afterwards to the extent necessary to meet legal obligations and establish or defend claims until the relevant limitation periods expire. Where proceedings or a dispute remain ongoing, we retain the necessary data until they are concluded. We do not retain data that is unnecessary for these purposes merely because part of the documentation must still be retained.
We retain customer account data while the account is in use and until it is closed. Closing an account does not entail deleting invoices or other documentation for which there is a separate legal obligation or another valid basis for continued retention.
We retain data from general enquiries until communications are concluded, and afterwards only as long as needed in view of the matter concerned, for example to evidence an agreement or defend a claim. We retain technical and security logs for the time needed to resolve errors, handle security incidents and protect the system; we consider the type of log and the risk that gave rise to it.
We use marketing contact details until consent is withdrawn or the purpose ends. After you unsubscribe, we may retain evidence of consent and unsubscription to the extent needed to demonstrate lawful processing, and the information needed to respect your unsubscription.
In our Google Analytics account, event data retention is set to 2 months and user data retention to 14 months. Reset on new user activity is enabled: new activity restarts the 14-month retention period for the user’s identifier. Google deletes data whose retention period has expired through its regular monthly process. These settings do not determine the lifetime of individual cookies and do not limit retention of standard aggregated reports in Google Analytics. For further information about retention, email office@interfood-adria.eu.
Once there is no longer a valid basis for retention, we delete or irreversibly anonymise the data. Data in backups is deleted when those backups are routinely overwritten; until then, the backups remain protected and are not used for ordinary business operations.
9 Your rights
Subject to the conditions in the GDPR, you have the right to access your personal data and obtain a copy, correct inaccurate data or complete incomplete data, request erasure or restriction of processing, and exercise data portability where the conditions for each right are met. The right to erasure does not cover data we must retain to comply with a legal obligation or legitimately need for legal claims.
Where processing is based on a legitimate interest, you may object on grounds relating to your particular situation. In that case, we stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed for legal claims. You may object to processing for direct marketing at any time; following an objection, we will no longer process your data for that purpose.
You can withdraw consent at any time. Withdrawal is free of charge and does not affect the lawfulness of processing before withdrawal. For analytics, you can use the cookie settings; for marketing messages, you can unsubscribe through a message. In either case, you can also email office@interfood-adria.eu.
Send requests to exercise your rights to office@interfood-adria.eu or to the controller’s postal address. If there are reasonable doubts about your identity, we may request only the additional information needed to confirm it and prevent unauthorised disclosure of data.
We respond without undue delay and no later than one month after receiving your request. Where an extension is necessary because of the complexity or number of requests, the period may be extended by up to two additional months. We will notify you of the extension and its reasons within the first month. If we do not grant your request, we will explain the reasons and your options for lodging a complaint or seeking a judicial remedy.
Exercising your rights is normally free of charge. For manifestly unfounded or excessive requests, particularly because of their repetitive character, we may, subject to the GDPR, charge a reasonable fee based on administrative costs or refuse the request. The controller bears the burden of proving that a request is unfounded or excessive.
If you believe processing breaches applicable rules, you can lodge a complaint with the Slovenian Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, Slovenia. Information about complaints is available on the Information Commissioner’s website. You can also complain to the competent supervisory authority in the country of your habitual residence, place of work or the alleged infringement.
10 Automated decision making
When selling through our online shop, we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We use analytics for website statistics, rather than such decision making. Payment service providers may use automated checks for fraud prevention and payment security; their processing is described in their privacy notices.
11 Data security
We use technical and organisational measures suited to the type of data and the processing risks to protect against unauthorised access, loss, alteration or disclosure. We restrict access to people and providers who need it for their tasks. If a breach presents a high risk to your rights and freedoms, we will notify you in accordance with the applicable legal requirements.
12 Changes to this policy
We update this policy when our processing or the law changes. We publish the current version on the website and notify you appropriately of significant changes. A change to the policy does not, in itself, replace consent where your consent is required for new processing.
Effective date: 29 September 2026.