PRIVACY POLICY
1 Data Controller
The controller of personal data within the meaning of Art. 4(7) GDPR is: Business name: Liliia Viernikova — VICEpc Registered address: Bajkalská 14083/2C, 831 04 Bratislava — Nové Mesto district Company ID (IČO): 57312761 | Tax ID (DIČ): 3122365631 VAT ID: SK3122365631 — registration under § 7a of Act No. 222/2004 Coll. on VAT. The Controller is not a VAT payer; prices shown are final. Email: vicepc.slovensko@gmail.com Phone: +421 914 448 800 (hereinafter the "Controller") The Controller is not required to appoint a Data Protection Officer under Art. 37 GDPR. For all data protection matters, please contact us at the email address above.
2 What data we collect and why
We only collect personal data that is necessary for a specific purpose. We never sell your data to third parties for commercial purposes.
2.1 Order fulfillment
Legal basis: performance of a contract (Art. 6(1)(b) GDPR). We process name, address, email, phone number and order content solely to fulfill and deliver your order. Providing this data is a contractual requirement necessary to conclude and perform the purchase contract. Without it we cannot accept your order or deliver the goods.
2.2 Accounting and invoicing
Legal basis: legal obligation (Art. 6(1)(c) GDPR). Invoicing data is archived in accordance with Act No. 431/2002 Coll. on Accounting (§ 35) and Act No. 222/2004 Coll. on VAT (§ 76).
2.3 Order status tracking
Legal basis: performance of a contract (Art. 6(1)(b) GDPR). On the "Track Your Order" page at vicepc.sk, we display the status of the order, its content, and the estimated delivery date. This is an in-house feature of our website; we do not use third-party services for this purpose. The buyer's personal data (name, phone number, email address, physical address) are masked on this page—we display only the data strictly necessary for you to recognize your order.
2.4 Web analytics
Legal basis: your consent (Art. 6(1)(a) GDPR in conjunction with § 109(8) of Act No. 452/2021 Coll. on Electronic Communications). We use Google Analytics 4 to measure site traffic and behavior. Analytics cookies are activated only after you give consent.
2.5 Advertising campaigns
Legal basis: your consent (Art. 6(1)(a) GDPR in conjunction with § 109(8) of Act No. 452/2021 Coll.). We plan to use Google Ads for advertising in the future. Marketing cookies are activated only after you give consent.
2.6 Protection of legal claims
Legal basis: legitimate interest (Art. 6(1)(f) GDPR). We keep photo documentation of the assembly and testing of each PC as evidence of the condition of the goods at the time of shipment. Our legitimate interest is to demonstrate the flawless condition of the goods when handed over to the carrier and to defend against unfounded claims. You have the right to object to this processing at any time (see section 6).
2.7 Waitlist — interest in the PC rental service
Legal basis: your consent (Art. 6(1)(a) GDPR in conjunction with § 116 of Act No. 452/2021 Coll. on Electronic Communications). If you express interest in the upcoming PC rental service via the website form, we process your email address solely to notify you when the service launches. You give consent by checking the checkbox when submitting the form. You may withdraw consent at any time by emailing vicepc.slovensko@gmail.com, upon which we will promptly remove your address from the list. Your email address will not be used for any other marketing purpose and will not be shared with third parties other than the email service provider listed in section 4.
2.8 Non-binding enquiry — VICE X service
Legal basis: steps taken prior to entering into a contract at the request of the data subject (Art. 6(1)(b) GDPR). If you submit the VICE X form, we process your name, phone number, email address and information about your build requirements. We use this data solely to contact you by phone or email and prepare an individual quote. This is not marketing outreach — we contact you only in response to the enquiry you submitted. If no contract is concluded, we delete the data no later than 12 months after the last communication.
3 Cookies
Cookies are small text files stored on your device when you visit the website. Their use is governed by § 109 of Act No. 452/2021 Coll. on Electronic Communications. Some are necessary for the site to function, others are activated only with your prior consent.
3.1 Necessary (technical) cookies
Ensure basic website functionality — shopping cart, user session, site security and payment security. These cookies cannot be disabled, as they are essential for the operation of the online store, and under § 109(8) of Act No. 452/2021 Coll. no consent is required for them. Providers: vicepc.sk (own technical cookies), Cloudflare, Inc. (security cookies), Stripe Payments Europe, Limited (on the payment page only — Stripe scripts do not load on other pages of the site).
3.2 Analytics cookies
Help us measure traffic and improve the website based on how users interact with it. Activated only after you give consent. Provider: Google Analytics 4 (Google Ireland Ltd.).
3.3 Marketing cookies
Enable relevant advertising on other platforms based on your interests. Activated only after you give consent. Provider: Google Ads (planned). If further tools are added (e.g. Meta Pixel, TikTok Pixel), this policy will be updated before they are activated.
3.4 Managing consent
You give consent to analytics and marketing cookies via the cookie banner on your first visit to the site. You can withdraw or change your consent at any time by clicking "Cookie" banner. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before the withdrawal.
4 Data recipients and transfers outside the EU
Only contractual partners necessary for the operation of the online store have access to your personal data. Stripe Payments Europe, Limited (Ireland) — payment processing. The Controller does not see or store card numbers. Transfers to the USA (Stripe, Inc.) are covered by the EU-U.S. Data Privacy Framework and, additionally, Standard Contractual Clauses. Cloudflare, Inc. (USA) — CDN, DNS and website attack protection provider. Processes IP addresses and technical request data. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — ensuring the availability and security of the website. Transfers to the USA are covered by EU-U.S. Data Privacy Framework certification and Standard Contractual Clauses under the provider's terms. Server infrastructure provider — provides the server hosting the website and order database. The servers are located in the Netherlands (European Union). The server is administered exclusively by the Controller via cryptographic key-protected access; the provider has no routine access to the contents of the order database. Database backups are created and stored exclusively by the Controller. We will identify the specific provider to a data subject upon request. Resend, Inc. (USA) — sending transactional emails (order confirmation, status updates) and the informational email for PC rental waitlist subscribers. Processes the recipient's email address. Transfers to the USA are covered by Standard Contractual Clauses (SCCs). Google Ireland Ltd. — Google Analytics 4 and Google Ads, solely with consent. Transfers to the USA are covered by the EU-U.S. Data Privacy Framework and, additionally, Standard Contractual Clauses. Courier companies (e.g. DPD) — delivery of goods. The Controller shares the buyer's name, address and phone number solely for the purpose of delivering the shipment. We do not transfer personal data to any third countries other than those listed above. A copy of the safeguards for transfers outside the EU (e.g. Standard Contractual Clauses) will be provided on request at vicepc.slovensko@gmail.com. We do not use social media plugins, embedded content or third-party tracking pixels on our website. Links to our social media profiles are ordinary hyperlinks and clicking them takes you off our site. If additional processors are engaged, this policy will be updated before they are activated.
5 Data retention periods
Accounting documents and invoices: 5 to 10 years depending on document type (Act No. 431/2002 Coll., § 35; Act No. 222/2004 Coll., § 76). Order and warranty data: for the duration of the warranty period and the statute of limitations, a maximum of 5 years from delivery of the goods. Assembly photo documentation: for the duration of the warranty period + 1 year. VICE X non-binding enquiry: up to 12 months from the last communication if no contract is concluded. Analytics cookies (GA4): a maximum of 14 months, counted from the user's last activity (GA4 setting). Marketing cookies: for the duration of consent, a maximum of 12 months. Waitlist (interest in PC rental): until the service launches and the informational email is sent, but no later than 24 months from sign-up, unless you withdraw consent earlier. Database backups: backups are regularly overwritten with a newer version and older backups are removed. Data deleted at your request therefore also disappears from backups within the next backup cycle.
6 Your rights
As a data subject, you have the following rights under the GDPR: Right of access — you may request a copy of the personal data we process about you. Right to rectification — if your data is inaccurate or incomplete, you have the right to request correction. Right to erasure ("right to be forgotten") — under the conditions set out in the GDPR, you may request deletion of your data. Right to restriction of processing — in certain cases you may request that processing of your data be suspended. Right to data portability — you may request that your data be provided in a structured, commonly used and machine-readable format. Right to withdraw consent — you may withdraw consent to analytics and marketing cookies, and to the waitlist, at any time. Right to object (Art. 21 GDPR) You have the right to object at any time to processing of your personal data carried out on the basis of legitimate interest — in our case, the assembly photo documentation (section 2.6) and website security via Cloudflare (section 4). If you object, we will stop processing that data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds relating to the establishment, exercise or defence of legal claims. Objections should be sent by email to vicepc.slovensko@gmail.com. Right to lodge a complaint — if you believe that the processing of your data infringes the GDPR, you may lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Galvaniho 7/B, Bratislava, web: www.dataprotection.gov.sk, email: statny.dozor@pdp.gov.sk You may also lodge a complaint with the supervisory authority in the Member State of your habitual residence or place of work. Requests to exercise these rights should be sent by email to: vicepc.slovensko@gmail.com. We will respond without undue delay and in any event within one month of receipt. In justified cases we may extend this period by a further two months, and we will inform you of the extension and its reasons.
7 Security
All communication on the website takes place over an encrypted HTTPS (SSL/TLS) connection. The Controller does not see, process or store payment card numbers — this data is processed exclusively by the Stripe payment gateway, which is certified to PCI DSS Level 1. The server hosting the order database is administered exclusively by the Controller via cryptographic key-protected access. Only persons who need it to perform their duties have access to personal data. Access to the "Track Your Order" page is protected by a unique order identifier of sufficient length and randomness, preventing it from being guessed or systematically derived. The identifier is disclosed exclusively to the buyer. The page is excluded from search engine indexing (noindex, nofollow), and displayed personal data is masked in compliance with the data minimization principle. Database backups are created and stored exclusively by the Controller outside the production server.
8 Automated decision-making and profiling
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place when processing your personal data. The build selection tool (PC Selector) on our website functions solely as an informational aid, does not create a user profile, and we do not store its results in connection with your person.
9 Age restriction
The vicepc.sk online store's services are intended exclusively for persons over 18 years of age. We do not knowingly process personal data of persons under 18. If we learn that we have inadvertently collected such data, we will delete it without delay.
10 Final provisions
This Privacy Policy, version 2.0, is effective as of 27 August 2026 and replaces the previous version. The Controller reserves the right to update this policy, in particular in the event of legislative changes, technical modifications to the website, or the introduction of new data-processing tools (e.g. Meta Pixel, TikTok Pixel). Users will be informed of changes by publication of a new version on this page stating the effective date. Matters not governed by this policy are subject to GDPR (EU) 2016/679, Act No. 18/2018 Coll. on the Protection of Personal Data and Act No. 452/2021 Coll. on Electronic Communications.