Privacy policy

Effective from Operator: Arfrag s. r. o.

This policy explains what personal data the byRoman website processes, for what purpose, on what legal basis, how long it keeps them and what rights visitors and customers have. The policy applies to this website and to the e-shop that forms part of it.

The processing is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and by Act No. 18/2018 Coll. on Personal Data Protection.

Who processes personal data

The controller is Arfrag s. r. o., with its registered office at Jazerná 639/27, 925 22 Veľké Úľany, Company ID (IČO): 57087288, Tax ID (DIČ): 2122560682, VAT ID (IČ DPH): SK2122560682, registered in the Commercial Register of the Trnava District Court, Section Sro, Insert No. 60103/T.

Contact for personal data protection matters: info@byroman.sk, phone 0918 310 961.

The controller is not obliged to designate a data protection officer under Article 37 GDPR and has not designated one. Please therefore address all data protection questions directly to the contact given above.

What data are processed and why

Contact form

The form on the Contact page asks for a name, an email address, an optional subject and the text of the message. The form cannot be sent without ticking the box giving consent to the processing of the data.

The message is sent by email to the controller's address and at the same time saved in this website's database as a backup record. The database keeps the name, the email address, the text of the message and information on whether the email was sent successfully. The subject of the message is sent in the email but is not saved in the database. The backup record can be read only by the website's administrators.

The purpose is to receive and answer the message. The legal basis is consent under Article 6(1)(a) GDPR, which the visitor gives by ticking the box in the form. If the message concerns an order or steps taken before entering into a contract, the processing also relies on Article 6(1)(b) GDPR.

Orders in the e-shop

For an order, the data needed to handle it are processed: first name and surname, billing address, delivery address, email address, phone number, the contents of the order, the price and the payment and delivery method. For a purchase made on behalf of a company, also the business name, Company ID (IČO), Tax ID (DIČ) and VAT ID (IČ DPH).

Orders are processed and stored directly in this website’s database. The controller does not use an external e-shop platform.

The purpose is the conclusion and performance of the purchase contract, delivery of the goods, handling of any complaint or withdrawal from the contract and compliance with tax and accounting obligations. The legal basis is the performance of a contract under Article 6(1)(b) GDPR and, as regards invoices and accounting documents, compliance with a legal obligation under Article 6(1)(c) GDPR.

Providing these data is necessary for concluding the contract. Without them, the order can be neither accepted nor delivered.

When placing an order, the buyer may create a customer account. The account keeps the email address, name, billing and delivery address, phone number and order history. Registration is voluntary; purchases can also be made without it. The account and the data in it are deleted on request; this does not affect the data that the seller must keep on invoices.

Newsletter subscription

The form in the website footer asks only for an email address and for ticking the box giving consent to receiving the newsletter. Without the consent box ticked, the form does not accept the subscription.

With each subscription, the website’s database stores the email address, the date and time of the subscription, a record of the consent given, the version of the consent wording to which the subscription relates, and the IP address from which the subscription was sent. The IP address and the consent version serve solely to demonstrate consent under Article 7(1) GDPR and are not used for anything else.

The newsletter is sent through the Ecomail service. Ecomail receives the email address and the record of the consent given and processes them on behalf of the controller as its processor.

The purpose is sending news about the products and about what is happening at the brand. The legal basis is consent under Article 6(1)(a) GDPR.

The subscription is currently confirmed in a single step, that is, without a verification email. Unsubscribing is possible at any time, on request, by sending an email to info@byroman.sk. After unsubscribing, the address is removed from the list.

Website operation and security

The forms on the website are protected against automated abuse by limiting the number of submissions from one IP address. For this purpose, the IP address is stored only as an unreadable fingerprint together with a submission counter and is automatically deleted after five minutes. It is not linked to the content of a message or to an order.

In addition, the hosting provider keeps standard web server operating logs, which contain the IP address, the time of access and the address of the requested page. They serve to ensure the operation and security of the server. The server is operated by Websupport s. r. o. According to Websupport’s documentation, these logs are available for the last 14 days.

The forms on the website (the contact form, the newsletter subscription, product reviews, login, registration and password reset) are additionally protected by the Cloudflare Turnstile service of Cloudflare, Inc., which has its registered office in the USA. The service is loaded only when a form is being used, not during normal browsing of the website. The administration login page loads it as soon as the page is displayed. To tell a human from an automated program, it processes the IP address, browser data (User-Agent, TLS fingerprint) and other technical signals of the device. It does not see the content of the form. For the verification, Cloudflare acts as a processor; however, it also uses the technical signals as an independent controller to improve the detection of automated programs. Details are set out in Cloudflare’s Turnstile Privacy Addendum. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, so the transfer of data to the USA relies on the European Commission’s adequacy decision under Article 45 GDPR. Should the certification cease to be valid, Cloudflare will, under its contractual terms, rely on standard contractual clauses under Article 46 GDPR, which it also uses for transfers to other countries outside the EU and the EEA.

The legal basis is the controller’s legitimate interest in the secure and functional operation of the website under Article 6(1)(f) GDPR.

Website traffic measurement (Google Analytics)

If a visitor allows analytics cookies in the cookie settings, the website loads the Google Analytics 4 tool for measuring traffic, through the Google Tag Manager service, which starts only after consent to analytics or marketing cookies has been given. Without this consent, neither Google Tag Manager nor Google Analytics is loaded. Visits by logged-in e-shop administrators are not measured.

Google Analytics records how the website is used: the pages viewed, where the visitor came from (for example from a search engine, from a link on another website or from a campaign), page scrolling, clicks on website elements and on links leading off the website, terms entered into the website search, starting and submitting a form (without its content) and file downloads. It also records the page type, the page language, the currency in which prices are shown and whether the visitor is logged in to a customer account. It attaches technical data about the device and browser to the visit (device type, operating system, browser, language and screen resolution) and the approximate location (country, region, city) determined from the IP address. According to Google, it does not store the IP addresses of visitors from the European Union and discards them after determining the location. The browser is recognized by a random identifier stored in the _ga and _ga_* cookies.

Purchases in the e-shop are also measured: the product lists and individual products viewed, selecting a product from a list, adding to and removing from the cart, opening the cart, the individual checkout steps including the chosen shipping and payment method, and the completed purchase with the order number, its value, tax, shipping cost, currency, the discount code used and the items purchased. Logging in to an account, registration, sending the contact form and subscribing to the newsletter are also measured, always only the fact that they happened, not the data entered.

If the customer is logged in to a customer account, the website also passes a pseudonymous identifier to Google Analytics. The website calculates it from the account number using a one-way function with a secret key, so Google cannot work out the account number or the customer's identity from it; only the controller can link it to the account. The identifier is used so that visits by the same customer from several devices are evaluated together. No name, email address, phone number or address is sent to Google Analytics. If a link from a newsletter email contains the recipient's email address in the ecmid parameter (see below), this address is removed from the page address before it is sent to Google Analytics.

Google Analytics and Google Tag Manager are provided by Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland, which processes the data from Google Analytics on behalf of the controller as its processor under the Google Ads Data Processing Terms. According to Google, Google Tag Manager does not collect visitor data; the exceptions are aggregated diagnostic data without IP addresses and standard server request logs, which Google deletes within 14 days. How Google handles data from websites that use its services is described on Google's page.

The purpose is to find out how visitors use the website, which pages and products interest them and how purchases go, and to improve the website and the offer accordingly. The legal basis is consent under Article 6(1)(a) GDPR and, for storing cookies, also Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications. Consent can be withdrawn at any time through “Cookie settings” in the website footer. The website then deletes the Google Analytics cookies from its domain and does not start Google Analytics on the next page load.

Session recordings and heatmaps (Microsoft Clarity)

If a visitor allows analytics cookies in the cookie settings, the website also loads the Microsoft Clarity tool through Google Tag Manager. Without this consent, Microsoft Clarity is not loaded. Visits by logged-in e-shop administrators are not recorded, and Microsoft Clarity does not run on the order confirmation page or on the order payment page.

Microsoft Clarity records how a visitor uses the page: the pages viewed, clicks, mouse movement, page scrolling and window resizing, as well as how the displayed page looks. From these data it creates recordings of the course of a visit, which the controller can play back, and aggregated heatmaps of where visitors click and how far they scroll a page. Clarity masks the content of form fields and drop-down lists and the numbers and email addresses shown on the page already in the browser, so they are not sent to Clarity. Other parts of the page that contain personal data, for example addresses in the customer account, are masked as well. Payment card details are entered into fields that Stripe inserts into the page and do not reach Clarity. Technical data about the device and browser (device type, operating system and browser) and the approximate location determined from the IP address are attached to the visit. The browser is recognized by a pseudonymous identifier stored in the _clck and _clsk cookies; with its own cookie on the clarity.ms domain, Clarity may also recognize the browser on other websites that use Clarity.

Microsoft Clarity is provided by Microsoft Ireland Operations Limited, with its registered office at One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Under the Microsoft Clarity Terms of Use, Microsoft is not the controller's processor: the controller and Microsoft are each independent controllers of these data and each is responsible for them on its own. Microsoft also obtains the data from Clarity to provide its Microsoft Advertising service and, in accordance with its privacy statement, may use them for its own purposes, for example to provide and improve its products and services and to create user profiles for purposes that include advertising. The website gives Microsoft Clarity consent to store advertising-related data only if the visitor also allows marketing cookies. How Microsoft handles the data and how rights can be exercised with it are described in the Microsoft Privacy Statement.

The purpose is to find out how visitors use the website and where they run into difficulties while browsing and shopping, for example elements that do not work or unclear steps, and to improve the website accordingly. The legal basis is consent under Article 6(1)(a) GDPR and, for storing cookies, also Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications. Consent can be withdrawn at any time through “Cookie settings” in the website footer. The website then deletes the Microsoft Clarity cookies from its domain and does not start Microsoft Clarity on the next page load. The list of cookies and how long they last are given on the Cookie policy page.

Visit tracking for the newsletter (Ecomail)

If a visitor allows marketing cookies in the cookie settings, the website also loads the Ecomail tracking code through Google Tag Manager. It records the website pages viewed together with basic technical data about the browser (for example the language and screen resolution) and stores a random identifier in the browser (the _sp_id and _sp_ses cookies and entries in the browser's local storage). Links in emails sent through Ecomail may contain the ecmid parameter with the recipient's email address. When the recipient comes to the website through such a link and has marketing cookies allowed, Ecomail links their browser to their contact and stores the pages they view under it, including on later visits.

The purpose is to evaluate what newsletter recipients are interested in on the website and to tailor the content of the newsletter to them accordingly. The legal basis is consent under Article 6(1)(a) GDPR and, for storing cookies, also Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications; without it, the tracking code is not loaded. Consent can be withdrawn at any time through “Cookie settings” in the website footer; from the next page load, the tracking code no longer starts. Ecomail processes these data on behalf of the controller as its processor. The list of cookies and how long they last are given on the Cookie policy page.

Unfinished purchase reminder

When you enter your email address at checkout and do not finish the purchase, we send you at most two reminders with the contents of your cart: the first about 3 hours and the second about 48 hours after your last activity at checkout. A line under the email field at checkout tells you this as well. No reminder is sent if an order was placed with that address in the last 7 days. We store the email address, the contents of the cart (products, variants, quantities and the discount codes used), the language and currency of the page and the times of the activity and of the reminders sent.

The link in a reminder is valid for 7 days. Opening it restores the cart in the browser that opened the link and keeps it in the e-shop session (the cart cookie, at most 2 days); the email address is not filled in at checkout.

The legal basis is the controller’s legitimate interest in reminding you of an unfinished purchase under Article 6(1)(f) GDPR. You can object to this processing at any time through the link “Unsubscribe from similar e-mails” in every reminder or by email to info@byroman.sk. We keep an unsubscribed address only as a one-way fingerprint, so that no further reminders reach you, not even at its variants (for example with a part after the “+” sign).

We send the reminders from the controller’s mail server at Websupport s. r. o.; the data are not provided to any other recipient.

How long the data are kept

PurposeDataRetention period
Contact formname, email, text of the messageat most 90 days from sending, after which the record is deleted automatically
Order, performance of the contractorder and delivery datafor the duration of the contract and for the statutory period of liability for defects
Invoices and accounting documentsbilling data10 years under Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax
Newsletter subscriptionemail, date, record of consent, IP addressuntil consent is withdrawn
Unfinished purchase reminderemail address, cart contents, language and currency, activity times30 days from the last activity at checkout; the fingerprint of an unsubscribed address without a time limit
Form protectionIP address fingerprint5 minutes
Website traffic measurement (Google Analytics)pseudonymous identifiers, pages viewed and events on the website including purchases, device data and approximate locationevent data 14 months, data linked to the identifier 14 months from the last visit, after which Google deletes them automatically (aggregated statistics without identifiers remain)
Session recordings and heatmaps (Microsoft Clarity)pseudonymous identifier, records of movement on the page (clicks, mouse movement, scrolling), device data and approximate locationin the Clarity service: session recordings 30 days; a randomly selected sample of recordings, recordings marked by the controller, heatmaps and aggregated click data at most 9 months, after which Microsoft deletes them, including from backups; how long Microsoft keeps the data it uses for its own purposes is set out in its privacy statement; identifier in the browser (the _clck cookie) at most 1 year
Visit tracking for the newsletter (Ecomail)random browser identifier, pages viewed, when arriving from an email, linking to the contactrecords linked to the contact at most for as long as the contact is kept in the Ecomail service (on a request for erasure, the controller deletes it permanently); identifier in the browser at most 2 years

We keep messages from the contact form on the website for 90 days from sending, then delete them automatically. If consent is withdrawn earlier, the data processed on the basis of that consent are erased without undue delay. This does not apply to data that the controller must keep by law, for example the data on an invoice.

Who the data are made available to

The data are not sold. They are not provided to third parties for their own marketing purposes, with the exception of Microsoft, which as an independent controller may also use the data from the Microsoft Clarity service for its own purposes, including advertising (see above). They are made available only to those who are needed to handle an order, to send the newsletter, to measure traffic and analyse the use of the website or to operate the website, and only to the extent necessary for the purpose concerned:

  • the web hosting provider that operates the server with the website’s database: Websupport s. r. o., with its registered office at Karadžičova 7608/12, 821 08 Bratislava, Company ID (IČO): 36421928
  • the email service provider through which emails from the website are sent: Websupport s. r. o., with its registered office at Karadžičova 7608/12, 821 08 Bratislava, Company ID (IČO): 36421928
  • the carrier that delivers the order: Packeta Slovakia s. r. o., with its registered office at Vajnorská 100/B, 831 04 Bratislava, Company ID (IČO): 48136999
  • the person or company keeping the accounts and the provider of the system in which invoices and credit notes for orders are issued (the customer's name and address, the items ordered, the payment): BILVAO s. r. o., with its registered office at Janka Jesenského 564/9, 957 01 Bánovce nad Bebravou, Company ID (IČO): 53399978
  • the payment service provider that processes card payments (including through Apple Pay and Google Pay): Stripe Payments Europe, Limited, with its registered office at One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, registration number 513174
  • the provider of the service for sending the newsletter and tracking website visits (tracking only with consent to marketing cookies): ECOMAIL.CZ, s.r.o., with its registered office at Na příkopě 388/1, Staré Město, 110 00 Praha 1, Czech Republic, Company ID (IČO): 02762943
  • the provider of the Google Analytics (traffic measurement) and Google Tag Manager (loading of measurement codes) services, only with consent to analytics or marketing cookies: Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland, registration number 368047
  • the provider of the Microsoft Clarity service (session recordings and heatmaps), only with consent to analytics cookies, which processes the data as an independent controller: Microsoft Ireland Operations Limited, with its registered office at One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
  • public authorities, where the controller is required to do so by law

A data processing agreement under Article 28 GDPR has been concluded with each of the recipients listed above that processes data on behalf of the controller.

What the website does not use

Apart from the tools described above (Google Tag Manager, Google Analytics, Microsoft Clarity and the Ecomail tracking code), which are loaded only with the visitor's consent, the website does not use any other third-party analytics or tracking tools. Meta Pixel and other advertising tools are not deployed on it. No social media widgets or third-party players are embedded in it.

Fonts are stored on the website's own server and are not loaded from Google Fonts. Until the visitor allows analytics or marketing cookies, loading a page therefore does not trigger a request to a third-party server, and the visitor's IP address does not reach anyone else while browsing the website. Once such consent is given, the browser also connects to Google's servers (Google Tag Manager, Google Analytics), with analytics cookies to Microsoft's servers (Microsoft Clarity) and, with marketing cookies, to the servers of the Amazon CloudFront network, through which Ecomail provides its tracking code.

Transfers outside the European Union

The data are processed mainly within the European Union. The website and the e-shop’s mailboxes are stored on servers of Websupport s. r. o. in the Perpetuus data centre in Bratislava, and backups in another data centre in Bratislava. Under its terms and conditions, Websupport processes personal data in EU and EEA countries and may transfer them to third countries only where there is an adequate level of protection or appropriate safeguards.

Stripe Payments Europe, Limited may transfer payment data to its parent company Stripe, LLC, which has its registered office in the USA. Stripe, LLC is certified under the EU-U.S. Data Privacy Framework, so this transfer relies on the European Commission’s adequacy decision under Article 45 GDPR.

Ecomail stores the data in the European Union. Some of its subcontractors may transfer them to the USA on the basis of the EU-U.S. Data Privacy Framework or of standard contractual clauses under Article 46 GDPR.

Data from Google Analytics and Google Tag Manager may also be processed by Google outside the European Union, in particular in the USA through Google LLC. Google LLC is certified under the EU-U.S. Data Privacy Framework, so this transfer relies on the European Commission's adequacy decision under Article 45 GDPR. For transfers not covered by this framework, or if the certification ceased to be valid, Google relies on standard contractual clauses under Article 46 GDPR according to its terms and conditions.

Data from the Microsoft Clarity service are stored in the Microsoft Azure cloud service, and Microsoft Ireland Operations Limited may transfer them to its affiliate Microsoft Corporation, which has its registered office in the USA. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework, so this transfer relies on the European Commission's adequacy decision under Article 45 GDPR. According to Microsoft, transfers between these companies are also covered by standard contractual clauses under Article 46 GDPR.

Cookies and local storage

The website uses cookies and the browser’s local storage. They are mainly necessary cookies that make the cart, ordering and login work. The full list, with the purpose and duration of each entry, is on the Cookie policy page.

Analytics and marketing cookies, for example the cookies of Google Analytics, of Microsoft Clarity and of the Ecomail tracking code, are stored only with the visitor's consent. Consent is given in the bar that the website shows on the first visit and can be changed or withdrawn at any time through “Cookie settings” in the website footer.

Cookies can be blocked or deleted in the browser settings. However, if necessary cookies are blocked, the cart and ordering stop working.

Rights of the data subject

Under the GDPR, every person whose data are processed has the following rights:

  • the right of access to the data and to a copy of the data processed (Article 15)
  • the right to rectification of inaccurate or incomplete data (Article 16)
  • the right to erasure of the data if they are no longer needed or consent has been withdrawn (Article 17)
  • the right to restriction of processing (Article 18)
  • the right to portability of the data in a machine-readable format (Article 20)
  • the right to object to processing based on legitimate interest (Article 21)
  • the right to withdraw consent at any time without affecting the lawfulness of processing before its withdrawal (Article 7(3))
  • the right to lodge a complaint with a supervisory authority (Article 77)

It is enough to send the request by email to info@byroman.sk. The controller will handle it within one month of receiving it at the latest. If the request is complex or there are several requests, the period may be extended by a further two months, of which the requester will be informed.

Both a request for a copy of the data and a request for erasure cover all data that this website stores, that is, messages from the contact form as well as the newsletter subscription. If it is not clear who is making the request, the controller may ask for additional verification of identity.

The processing involves no automated decision-making under Article 22 GDPR that would produce legal effects concerning the data subject or similarly significantly affect them. Tailoring the newsletter content to the pages viewed on the website (Ecomail, only with consent to marketing cookies) is profiling that has no such effects.

Supervisory authority

Anyone who believes that their data are being processed in breach of the law may lodge a complaint with the supervisory authority:

Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
Hraničná 12
820 07 Bratislava 27
website: dataprotection.gov.sk

Changes to this policy

This policy may change if the way data are processed or the law changes. The current version is always available on this page.

This version is effective from 4 November 2026.