PRIVACY NOTICE – [[STUDIO_BRAND]]

1. Controller and scope

Provisional controller: BARF SHOP s.r.o., Okružná 1215/144, 900 26 Slovenský Grob, Slovakia, company number 53 231 937.

Privacy contact: info@myknifestudio.com, postal address [[ADDRESS]]. Data protection officer, if appointed: [[DPO_OR_REMOVE_AFTER_VERIFICATION]]. Service website: [[DOMAIN]].

This notice concerns Studio, its presentation, accounts, support and subscriptions. It does not create shared marketing permission for the controller's other brands or projects.

2. Data and sources

You provide information when registering, ordering, choosing preferences or contacting us. Technical data arises during use. The payment provider may return payment results, transaction identifiers and information needed to reconcile payments, renewals or disputes.

Account data includes email, an internal identifier, verification and login information, and relevant event dates. If passwords are used, they must not be recorded in readable form.

Order data includes the plan, price, currency, tax treatment, billing information, payment status, renewal date and records of terms acceptance and any request for early service commencement.

Support data includes contact details, messages and attachments you choose to send.

Security records may include IP address, time, browser type, login and error events to the extent needed. Exact scope: [[LOG_DATA_SCOPE]].

Preferences include marketing and cookie choices, the notice version, time and method of giving or withdrawing consent.

[[PAYMENT_DATA: Verify the real integration. The proposed model leaves full card numbers and security codes with the payment provider; Studio receives necessary references/tokens and possibly masked details. Do not present this proposal as a verified implementation.]]

3. Designs, photographs and local storage

In the current local mode, the editor saves designs and boards in your device's browser. Registering does not itself upload them to our server or back them up to the cloud. Reference photos, project names and logos can contain personal information; include only what is needed.

If you send a project or screenshot to support, we process it to address your request. We do not publish private designs or provide them for AI model training without separate permission. Local storage does not mean that visiting the website produces no server or security logs.

Before introducing cloud storage, we will explain the transferred data, providers, purposes, access and deletion. If business customers store other people's personal data, controller/processor responsibilities require a separate assessment. This notice is not itself a data processing agreement.

4. Purposes and legal grounds

• Personal account, trial, subscription and contract-related support: performing a contract with you or taking steps you request before it, GDPR Article 6(1)(b).

• Business representatives' contact details: our legitimate interest in communicating and performing the contract with their organisation, Article 6(1)(f). The representative is not automatically a party to that contract.

• Accounting, invoicing, tax and other legal duties: Article 6(1)(c).

• Proportionate account protection, fraud prevention, technical security and legal claims: Article 6(1)(f). The interests are secure operation and protecting legitimate claims, subject to necessity and balancing.

• Studio marketing emails, offers, news and incomplete-purchase reminders in the proposed flow: optional consent, Article 6(1)(a), together with electronic communications rules.

• Optional analytics and advertising tools: consent appropriate to the specific implementation. Access to or storage of device information is also assessed under Slovak electronic communications law.

An email address is needed for an account; required billing details are needed for a purchase. Marketing and optional tracking are not conditions of an account or trial. Contract-essential processing does not require a blanket mandatory “GDPR consent”.

5. Emails and measurement

Verification, security notices, receipts and neutral service notices use the appropriate contractual or legal basis. Giving an offer an operational title does not make it a service message.

You may decline marketing at registration or withdraw it through the email unsubscribe link, [[COMMUNICATION_SETTINGS]] or our contact address. Withdrawal does not affect prior lawful processing or your paid service. Relevant queued marketing reminders also stop.

Newsletter consent does not automatically cover advertising cookies, email-open tracking or uploading your address to Meta or Google advertising audiences. Those activities need specific information and a suitable legal basis. They are not activated by this draft.

Using trial or incomplete-purchase status to tailor consented marketing is marketing processing; it is not presented as essential invoicing.

6. Recipients and international transfers

Access is limited to authorised staff and necessary service providers:

• hosting/infrastructure: [[LEGAL_ENTITY, COUNTRY, ROLE]];

• external authentication, if any: [[PROVIDER_OR_NONE]];

• transactional and marketing email: [[PROVIDERS_AND_ROLES]];

• payments: [[PROVIDER_AND_ROLE]];

• accounting/legal assistance: [[PROVIDERS_OR_CATEGORIES]];

• optional analytics/advertising: [[ONLY_TOOLS_ACTUALLY_USED]].

Processors operate under appropriate agreements. Payment institutions and some professional advisers may act as independent controllers for their own legal purposes. We may disclose data to authorities where law requires it. We do not sell the contact database to other brands.

Transfers outside the EEA: [[COUNTRIES, RECIPIENTS, LEGAL_MECHANISM_AND_HOW_TO_OBTAIN_SAFEGUARDS]]. European hosting alone does not exclude overseas support access. Do not claim all processing remains in the EU without checking the vendors.

7. Retention

Account and settings: while the account exists; post-closure deletion and inactivity rules: [[ACCOUNT_RETENTION_AND_INACTIVITY]].

Unverified registration: [[UNVERIFIED_REGISTRATION_RETENTION]]. Technical/security logs: [[LOG_RETENTION]], with longer retention only where justified for a specific incident.

Support and non-accounting contract records: [[SUPPORT_AND_CLAIMS_RETENTION]], based on their purpose and applicable claim periods.

Accounting/tax records: for the statutory period; Slovak accounting records are generally retained for ten years following the year to which they relate. Specific documents and international tax records require the applicable regime.

Marketing use: until withdrawal or earlier expiry of the purpose; inactive contact policy: [[MARKETING_INACTIVITY_PERIOD]]. Consent and withdrawal evidence is archived separately for legal compliance, including at least four years after withdrawal where Slovak Electronic Communications Act section 116(5)–(6) applies. That archive is not used for further marketing.

A minimal suppression record is kept as necessary to honour your choice. Server backup cycle: [[BACKUP_CYCLE]]. Deletion requests must be reapplied if a backup is restored.

Local designs do not have an automatically guaranteed server retention period; you and your browser control their availability. Closing an account does not necessarily erase files on your device.

8. Your rights

Subject to applicable conditions, you may request access, rectification, erasure, restriction and portability. You may object to legitimate-interest processing and at any time to direct marketing; data will no longer be used for that marketing purpose. You may withdraw consent at any time.

Contact info@myknifestudio.com. We verify identity proportionately, rather than automatically requiring an identity-document copy. We normally respond within one month. If the law permits an extension because of complexity or request volume, we explain it within that period. Erasure does not remove records we must retain by law or legitimately need for legal claims.

You may complain to a competent supervisory authority, particularly where you live, work or believe an infringement occurred. The Slovak authority is the Office for Personal Data Protection, Galvaniho 7/B, 821 04 Bratislava; procedure: https://www.dataprotection.gov.sk/sk/urad/konanie-ochrane-osobnych-udajov/ .

Customers outside the EEA retain additional rights under applicable local law; market-specific notices must be added for the countries actually served.

9. Automated decisions, security and changes

[[VERIFY_BEFORE_PUBLICATION: The proposed operation does not use solely automated decisions producing legal or similarly significant effects. Security restrictions can receive human review. If relevant profiling is deployed, explain its logic, significance and consequences.]]

We use appropriate technical and organisational measures for the actual operation. We make no unverified certification claims or absolute security guarantees. We explain material new purposes or data collection before introducing them and obtain fresh consent where required.