← fonsena

Privacy Policy

Effective from October 17, 2026

This Privacy Policy explains what personal data we process in connection with the website fonsena.com (the "Site"), for what purpose, on what legal basis, and what rights you have. We take privacy seriously and have designed the Site to process as little data as possible.

1. Who we are (the controller)

2. What data we process

You do not need a visitor account, and we do not ask you to enter or record the content of your wish. This does not mean that payments or visits leave no records. We process:

• Payment data. Payments are handled by our payment provider, Stripe. You enter your card details directly on Stripe's secure page; those details never reach us and we do not store them. Our application stores order and payment-session identifiers, payment status, amount, currency, timestamps, and the applicable version of the Terms. Older checkout records may also contain the immediate-delivery consent recorded under an earlier version. New checkouts under version 2026-10-17 do not record that consent. Stripe may process contact and billing information you provide and make transaction information available to us for payment support, refunds and accounting.
• Server technical data. Our hosting server may automatically record, in its operational logs, your IP address, the date and time of access, and basic technical information about your browser. This data is used to keep the Site secure and functioning.
• Security counters. To limit automated requests and login attempts, we derive a keyed, pseudonymous identifier from an IP address or login identifier and store it with a request count and expiry time. These are security records, not marketing profiles. Pseudonymous records are not necessarily anonymous.
• Delivery records. We record the number of coin interactions granted and completed, timestamps, and any promo code used. A private access token or a Stripe session identifier lets us restore an unfinished experience. Payment-linked records can be connected to a transaction and are not described as anonymous.
• Site usage counts. We count loads of the home and wish pages and completed coin interactions by day. Page counting does not use analytics cookies, browser storage, cross-site identifiers or visitor profiles. A random identifier for a single page load prevents duplicate counting; it is not linked to your payment or wish. We do not include the page's query string, private receipt link or referring website in these analytics records. Page counts do not represent unique people.
• Support correspondence. If you contact us, we process the information you choose to send so that we can answer your request.

3. Purpose and legal basis

• Processing payment and providing the service — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Security and operation of the Site (technical logs and security counters) — legal basis: our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR).
• Understanding service usage. We use aggregate page and coin-interaction counts to assess and improve the service. These totals contain no visitor identifier. The accompanying technical request handling follows the security and operation purpose above.
• Accounting and tax records — legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

4. Service providers and recipients

To operate the Site we rely on trusted providers who process data for us as processors or as independent controllers:

• Stripe (payment processing). Stripe processes payment data under its own terms and privacy policy. See stripe.com/privacy.
• Hosting provider webhouse.sk, which operates the server the Site runs on.

5. International data transfers

Because the service is available worldwide and payments are handled by Stripe, data may be transferred to countries outside the European Economic Area (for example, the United States). Such transfers take place under appropriate safeguards required by the GDPR, in particular the Standard Contractual Clauses approved by the European Commission. Details of Stripe's transfer safeguards are set out in its privacy policy.

6. How long we keep data

• Application security counters expire after their short request-limiting window (at most one hour). Expired counters are removed by request-time cleanup and an hourly scheduled cleanup. Hosting logs have a separate retention period set by the hosting provider; contact us for details of the current hosting configuration.
• Payment records and related accounting documents — for the period required by Slovak tax and accounting law (generally 10 years).
• Order and delivery records, including any historical consent records, are retained to provide or restore the experience, prevent duplicate use, handle complaints and meet applicable record-keeping obligations. They are not treated as indefinitely retainable anonymous statistics. Contact us about deletion of records no longer needed for those purposes.
• Support correspondence is retained for handling the request and any related dispute or legal obligation.
• Random page-load identifiers expire after 24 hours and are removed by bounded request-time and scheduled cleanup. Daily totals are retained without page-load identifiers; they do not contain individual visitor histories.

7. Cookies

The visitor-facing part of the Site does not use tracking or marketing cookies. A temporary checkout-attempt identifier is kept in your browser's session storage to prevent duplicate checkout creation when you retry. The administration area uses a necessary login session cookie. Stripe's payment page may use its own cookies that are strictly necessary to process the payment and prevent fraud; these are governed by Stripe's terms.

8. Your rights

To the extent we process your personal data, under the GDPR you have the right to:

• access your data and information about how it is processed,
• rectification of inaccurate data,
• erasure ("right to be forgotten") and restriction of processing,
• object to processing based on legitimate interest,
• data portability,
• lodge a complaint with a supervisory authority.

You can exercise your rights via the contact e-mail above. The supervisory authority in Slovakia is the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk). If you are located elsewhere, you may also have the right to contact your local data protection authority.

9. Changes to this Policy

We may update this Policy from time to time. The current version is always available on this page, with its effective date shown.