PRIVACY POLICY

This Privacy Policy explains how Gamatec (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you visit our website, contact us, buy products (parts/accessories), or order services (diagnostics, repair, maintenance, network/smart home installation, on-site visits).

This Privacy Policy is intended to meet transparency requirements under the EU General Data Protection Regulation (GDPR), including the information typically required when we collect personal data from you. 

1) Who we are (Data Controller)

Controller: {LEGAL_COMPANY_NAME} (Gamatec)

Registered address: {ADDRESS}, Slovenia

Email: {EMAIL}

Phone: {PHONE}

Business ID / VAT: {REG_NO}, {VAT_NO} (if applicable)

Data Protection Officer (DPO):

• ☐ We have appointed a DPO: {DPO_NAME}, {DPO_EMAIL}

• ☐ We have not appointed a DPO (if not required)

2) Scope

This Privacy Policy applies to:

• website visits and cookie-based technologies;

• inquiries via forms, email, phone, chat, and messaging apps (if used);

• orders for goods (spare parts, accessories, devices);

• service orders (diagnostics, repair, maintenance, installation, on-site visits);

• customer accounts (if available);

• courier pickup / EU delivery operations.

It does not cover third-party websites/services you may access via links from our website.

3) Personal data we collect

We collect data you provide directly, data generated during service delivery, and limited technical data from website use.

A) Data you provide

• Identity & contact: name, email, phone, billing/shipping address

• Order details: items purchased, invoice data, payment status, communication about the order

• Service request details: device/model, symptoms, photos/videos you send, service history (if you share it)

• Account data (if used): login credentials, saved addresses, order history

• Business customers: company name, VAT, contact person, procurement details

B) Data created during service delivery (workshop/on-site)

• device identifiers (model/serial numbers), configuration details (as needed)

• diagnostic findings, repair notes, replaced parts list, test results

• on-site visit notes (location-related info necessary for service)

• network/smart home: router model, SSID names, device IDs, automation settings (only what is necessary)

• training/support records (what was configured, recommended settings)

C) Website/technical data

• IP address, browser type, device type, operating system

• pages viewed, approximate location (city/region), referral source

• cookie identifiers (if cookies are used)

4) Why we process your data (Purposes) and legal bases

We process personal data only when we have a legal basis under GDPR.

A) To provide goods and services (contract)

Purpose: order processing, service delivery, scheduling, warranty handling, returns/refunds, parts matching, courier pickup/delivery.

Legal basis: performance of a contract / steps at your request before entering into a contract.

B) To comply with legal obligations

Purpose: accounting, invoicing, tax compliance, consumer law obligations, record keeping.

Legal basis: legal obligation.

C) To communicate and support you

Purpose: responding to inquiries, status updates, technical clarifications, post-service support.

Legal basis: contract (where related) and/or legitimate interests.

D) To improve and secure our website/services (legitimate interests)

Purpose: website security, fraud prevention, service quality improvement, analytics (where appropriate), internal reporting.

Legal basis: legitimate interests (balanced against your rights).

E) Marketing (consent or legitimate interests, depending on channel)

• Email/SMS marketing (where required): only with consent, and you can withdraw anytime.

• Existing customer offers: in some cases we may send service-related offers based on legitimate interests, where permitted, with a clear opt-out each time.

F) Cookies and similar technologies

Purpose: essential site functionality, preferences, analytics, advertising (if enabled).

Legal basis: consent for non-essential cookies; essential cookies are used under legitimate interests/necessity.

5) Cookies and tracking

We may use cookies and similar technologies. Cookies can be:

• Strictly necessary (site operation, security, shopping cart)

• Preferences (language, region)

• Analytics (traffic measurement)

• Marketing (ad performance, retargeting—only if enabled)

Cookie choices: If we use a cookie banner/consent tool, you can accept/reject categories and change choices anytime via cookies.

Third-party tools (examples—edit to match your stack):

• Analytics: ☐ Google Analytics ☐ Matomo ☐ Plausible ☐ 

• Ads/remarketing: ☐ Meta Pixel ☐ Google Ads ☐ 

If you don’t use any analytics/ads, remove this section or state “We do not use marketing cookies.”

6) How we share your data (Recipients)

We do not sell your personal data. We share it only as needed:

A) Service providers (processors)

• Hosting / website platform.

• Shipping/courier partners.

• Accounting/invoicing.

• Analytics/ads providers .

These providers process data under contractual safeguards.

B) Legal/obligation disclosures

We may disclose data if required by law, court order, or to protect rights, safety, and security.

C) Business transfers

If the business is reorganized/merged/sold, data may be transferred with appropriate safeguards.

7) International transfers (outside EEA)

We primarily process data in the EU/EEA. If any provider processes data outside the EEA, we rely on:

• an adequacy decision, or

• Standard Contractual Clauses (SCCs), and additional safeguards where appropriate.

List (if applicable): {NON_EEA_PROVIDERS_AND_SAFEGUARDS}

8) How long we keep your data (Retention)

We keep personal data only as long as needed for the purposes above, then delete/anonymize it.

Typical retention (adjust to your operations):

• Order and invoice records: as required by tax/accounting law (often several years)

• Service records (diagnostics/repair notes): for warranty, safety, and support purposes (e.g., 2–5 years)

• Customer support communications: typically 12–24 months

• Marketing consent records: while consent is active + proof of consent retention

• Website logs (security): typically 30–180 days

• Cookies: per cookie settings (see cookie banner)

9) Your rights under GDPR

 

Depending on circumstances, you may have the right to:

• access your data;

• correct inaccurate data;

• delete data (where applicable);

• restrict processing;

• object to processing (especially based on legitimate interests);

• data portability (for data you provided, in a structured format);

• withdraw consent (does not affect prior lawful processing);

• lodge a complaint with a supervisory authority.

To exercise rights, contact us at {EMAIL}. We may need to verify identity before fulfilling the request.

10) Complaints (Supervisory Authority)

If you are in Slovenia, the supervisory authority is the Information Commissioner of the Republic of Slovenia. 

Address: Dunajska cesta 22, 1000 Ljubljana, Slovenia

Phone: +386 1 230 97 30

Email: gp.ip@ip-rs.si

Website: ip-rs.si

(If you are in another EU country, you can also contact your local authority.)

11) Security measures

We use reasonable technical and organizational measures to protect data, such as:

• access controls and least-privilege policies;

• secure hosting and updates;

• encryption in transit (HTTPS);

• backup and recovery procedures;

• staff confidentiality and training.

No system is 100% secure, but we work to prevent unauthorized access, loss, or misuse.

12) Data provided for services (photos/videos, configurations)

When you send photos/videos for diagnosis or we document work:

• we use them only for diagnosis, repair verification, warranty, and support;

• we limit access to relevant staff;

• we keep them only as long as needed for the stated purpose and retention rules.

For network/smart home services, we may temporarily process:

• Wi-Fi/router settings, device identifiers, automation scenarios.

  We only access what is necessary to complete the work and provide support.

13) Children’s privacy

Our services and products are intended for adults and businesses. We do not knowingly collect data from children without parental consent. If you believe a child provided data, contact us to remove it.

14) Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects on you (e.g., automated credit decisions) unless explicitly stated elsewhere.

15) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date will change accordingly. Material changes will be communicated via the website or by other appropriate means.