Privacy Policy

1. Who We Are

This website is operated by Forged — Iron & Fire, registered at Blejska Dobrava 62, 4273 Blejska Dobrava, Slovenia. We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and Slovenian data protection law.

2. What Data We Collect

We collect the following personal data when you interact with our website:

• When you place an order: Name, email address, phone number, billing address, shipping address, payment information (processed securely by our payment provider — we do not store card details).
• When you create an account: Name, email address, password (encrypted).
• When you contact us: Name, email address, and the content of your message.
• When you subscribe to our newsletter: Email address.
• Automatically: IP address, browser type, device information, pages visited, and cookies (see Section 4).

3. How We Use Your Data

We use your personal data for the following purposes:

• To process and fulfil your orders
• To communicate with you about your order status
• To respond to your inquiries and support requests
• To send you marketing communications (only with your explicit consent)
• To improve our website and services
• To comply with legal obligations (tax records, fraud prevention)

Legal basis: We process your data based on contractual necessity (orders), legitimate interest (website improvement), consent (marketing), and legal obligation (tax/accounting).

4. Cookies

Our website uses cookies to function properly. We use:

• Essential cookies: Required for the website to work (cart, login sessions, security). These cannot be disabled.
• Analytics cookies: Help us understand how visitors use our site (Google Analytics). These are only set with your consent.
• Functional cookies: Remember your preferences (language, currency). Optional.

You can manage your cookie preferences at any time through the cookie settings banner on our website.

5. Third Parties

We share your data only with trusted third parties necessary to provide our services:

• Payment processors: Stripe, PayPal — to process payments securely
• Shipping providers: To deliver your orders
• Email services: To send order confirmations and newsletters
• Analytics: Google Analytics (anonymised data only)
• Hosting: Our website hosting provider stores data on EU-based servers

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of all personal data we hold about you
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your data (“right to be forgotten”)
• Right to restrict processing: Limit how we use your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing based on legitimate interest or for marketing
• Right to withdraw consent: Withdraw consent at any time for consent-based processing

To exercise any of these rights, contact us at info@kovacija.si. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (ip-rs.si).

7. Data Retention

We retain your personal data for the following periods:

• Order data: 10 years (legal requirement for tax/accounting records in Slovenia)
• Account data: Until you delete your account
• Marketing data: Until you unsubscribe
• Inquiry data: 2 years after last communication
• Analytics data: 26 months (Google Analytics default)

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including SSL encryption, secure payment processing, access controls, and regular security reviews.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Continued use of our website after changes constitutes acceptance of the revised policy.