Privacy policy

Privacy Policy

Effective date: November 6, 2026

Slovenská verzia: obchodné podmienky v slovenčine

This policy explains what personal data we collect when you visit entomoboxes.com or buy from us, why we need it, who helps us process it and what your rights are. We try to keep it short and clear. If anything is unclear, just write to us.

1. Who is responsible for your data

The controller of your personal data is:

Nymphalis s. r. o.
Ulica Veterná 8508/45, 917 01 Trnava, Slovakia
Company ID (IČO): 56 689 331, VAT ID (IČ DPH): SK2122390292
Registered in the Commercial Register of the District Court Trnava, Section Sro, Insert No. 58314/T
Email: info@entomoboxes.com
Phone: +421 947 950 865

We have not appointed a data protection officer, because the law does not require it for a business our size. The person in charge of the protection of personal information is Kristián Grell, Managing Director, reachable at info@entomoboxes.com.

2. What data we collect

  • Order data: name, email, phone number, delivery and billing address, ordered products, prices, order history, and for parcels outside the EU the details needed for the customs declaration.
  • Payment data: payments are handled by our payment providers. We only see the payment status, the payment method and, for cards, the card type and last four digits. We never see your full card number.
  • Customer account (if you create one): email, saved addresses, order history and login codes.
  • Messages: what you write to us by email, through the contact form or in the chat on our website, and what you submit through our online withdrawal form.
  • Newsletter: your email address, when and how you signed up, and whether you open our emails and click links in them.
  • Reviews: your name as you choose to show it, rating, text and photos, and whether the review is linked to an order, including reviews you published on our Etsy shop.
  • Technical and usage data: IP address, browser and device type, language, pages visited, and cookie or device identifiers. Analytics and advertising data, including session recordings, is only collected as described in section 7.

3. What we use your data for and why

  • Processing and delivering your order, including payment, shipping, customs, order and shipping emails, withdrawals, returns, complaints and warranty claims. Legal basis: performance of a contract (Article 6(1)(b) GDPR) and, for handling withdrawals and complaints, our legal obligations under consumer law (Article 6(1)(c) GDPR).
  • Customer account and customer support, including the chat. Legal basis: performance of a contract or steps before a contract at your request (Article 6(1)(b) GDPR).
  • Invoices, accounting and taxes. Legal basis: legal obligation (Article 6(1)(c) GDPR) under the Slovak Accounting Act (No. 431/2002 Coll.) and VAT Act (No. 222/2004 Coll.).
  • Preventing fraud and keeping the site secure, for example checking suspicious orders and blocking bots on forms. Legal basis: our legitimate interest in protecting our shop and customers from fraud and abuse (Article 6(1)(f) GDPR).
  • Defending or exercising legal claims. Legal basis: our legitimate interest in being able to prove what happened with an order (Article 6(1)(f) GDPR).
  • Newsletter. We send our newsletter (news, new products, discounts, free guides) if you sign up. Legal basis: your consent (Article 6(1)(a) GDPR). Every email has an unsubscribe link.
  • Review request. After your order is delivered, we send you one email asking how you like it and whether you would leave a review. Legal basis: our legitimate interest in feedback on our products (Article 6(1)(f) GDPR) and § 116(15) of Act No. 452/2021 Coll. Each of these emails has an unsubscribe link, and you can also tell us at any time at info@entomoboxes.com.
  • Showing reviews you decided to publish. Legal basis: your consent when you submit the review (Article 6(1)(a) GDPR). Some reviews were imported from our Etsy shop, where the buyer published them. We show them with the name as shown on Etsy, based on our legitimate interest in showing customer feedback (Article 6(1)(f) GDPR). If you want your imported review removed, just write to us. Loading the review widget on our pages so reviews can be shown is based on our legitimate interest in showing customer feedback (Article 6(1)(f) GDPR).
  • Analytics and session recordings, to understand how the shop is used and fix what doesn't work. Legal basis: your consent via the cookie banner (Article 6(1)(a) GDPR and § 109(8) of Act No. 452/2021 Coll.). Where no consent is asked (outside the EEA, the UK and Switzerland), the legal basis is our legitimate interest in understanding and improving our shop (Article 6(1)(f) GDPR), and you can object at any time in "Cookie settings".
  • Advertising and measuring our ads on Google, Meta (Facebook, Instagram) and Pinterest. Legal basis: your consent via the cookie banner (Article 6(1)(a) GDPR and § 109(8) of Act No. 452/2021 Coll.). Where no consent is asked (outside the EEA, the UK and Switzerland), the legal basis is our legitimate interest in promoting our shop (Article 6(1)(f) GDPR), and you can object at any time in "Cookie settings".

4. Do you have to give us your data?

To place an order we need your name, email, delivery address and payment details. Without them we can't accept or ship your order. Some of this data we are required to keep by Slovak accounting and tax law. For shipments outside the EU we also need your phone number and the customs details, otherwise the carrier or customs may refuse the parcel. Everything else, like the newsletter, a review or accepting cookies, is voluntary and you can use the shop without it.

5. Who we share your data with

We never sell your personal data for money. We share it only with providers we need to run the shop, and only as much as they need. Most of them process data only on our behalf and under a data processing agreement. If you accept marketing cookies, advertising partners receive information about your visit (see below). Some U.S. state laws call this "selling" or "sharing", see section 14.

  • Shopify (Shopify International Limited, Ireland): store hosting, checkout, customer accounts, order and newsletter emails (Shopify Messaging), forms (Shopify Forms), the chat (Shopify Inbox) and the cookie banner. See also section 6.
  • Payments: card payments, Apple Pay and Google Pay through Shopify Payments, processed by Stripe; Shop Pay if you choose it (see section 6); and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) if you choose the PayPal button. PayPal, Stripe and your bank or card issuer are independent controllers for the payment itself.
  • Shipping: Spring GDS and its delivery partners (for example PostNL, Correos and national postal operators), Packeta and DPD, depending on the destination and the shipping option. For orders to the United States also Zonos (calculation and collection of import duties and taxes at checkout). For parcels outside the EU also the customs authorities of the destination country.
  • Invoicing and accounting: SuperFaktúra (invoices) and our external accountant.
  • Online withdrawal form, review requests and our review form: Cloudflare (hosting the forms and storing submissions and review photos) and Resend (sending the confirmation and review emails).
  • Reviews: Judge.me Ltd (United Kingdom) collects and displays reviews. Its review widgets load on our pages so reviews can be shown.
  • Bot protection: hCaptcha (Intuition Machines, Inc., USA) on our signup and contact forms.
  • Analytics, with your consent where required (see section 7): Google Analytics (Google Ireland Ltd), Shopify analytics, Judge.me review statistics and PostHog (servers in Frankfurt, Germany).
  • Advertising, with your consent where required (see section 7): Google Ads and Google Merchant Center (Google Ireland Ltd), Pinterest (Pinterest Europe Ltd.) and Meta (see below). These companies also use the data for their own purposes, as described in their privacy policies.
  • Meta (Facebook and Instagram), with your consent where required (see section 7): the Meta pixel tells Meta Platforms Ireland Ltd. which pages you view and what you buy, so we can measure our ads and show them to the right people. For collecting and sending this data, we and Meta are joint controllers under Article 26 GDPR. Meta takes responsibility for handling your rights for the data it then processes; you can contact either of us. See the Meta Controller Addendum and the Meta Privacy Policy.
  • Authorities, for example tax authorities, customs or courts, if the law requires it.

6. Shopify

Our store is hosted by Shopify. Shopify processes your data on our behalf to run the store. Shopify also processes some data as its own, independent controller. This covers Shop Pay and the Shop app (if you choose to use them) and Shopify's own services that are based on your interactions with our store, other Shopify merchants and Shopify, for example fraud prevention and, where you have allowed it, more relevant ads and recommendations across Shopify ("Shopify Network Intelligence"). This means data about your visit to our store may be combined with data from your interactions with other Shopify stores. Your data may be shared with Shopify and third parties that may be located in other countries, including Canada and the United States.

For visitors from the EEA, the UK and Switzerland, ads based on your activity are only shown if you accept marketing cookies, and you can withdraw that at any time via "Cookie settings" in the footer. Visitors in the United States can opt out on our Your Privacy Choices page.

You can read how Shopify handles your data in the Shopify Consumer Privacy Policy and exercise your rights toward Shopify on the Shopify privacy portal.

7. Cookies and similar technologies

Cookies are small files your browser stores. We also use similar technologies like pixels and local storage. If you visit from the EEA, the United Kingdom or Switzerland, a banner asks what you allow, and only required cookies are used until you decide. In other countries, analytics and marketing cookies may be on by default; you can switch them off at any time in "Cookie settings" at the bottom of every page, and in the United States also on our Your Privacy Choices page. Wherever you are, you can change your choice at any time in "Cookie settings".

  • Required (always on, no consent needed because the shop can't work without them): cart, checkout, login, language and country, security, and saving your cookie choice. Examples: _shopify_essential, _shopify_cmp, localization, cart (Shopify, up to 1 year), _shop_app_essential (Shop Pay, 1 year).
  • Personalization (with consent): remembers things like recently viewed products for your next visit (Shopify).
  • Analytics (with consent): helps us see how visitors use the shop. Google Analytics (_ga, _ga_*, up to 400 days), Shopify analytics (_shopify_analytics, 1 year) and PostHog (ph_*_posthog cookie and local storage, 1 year).
  • Session recordings (part of Analytics): if you accept analytics cookies, PostHog records how you use our pages, for example clicks, scrolling and which pages you open, so we can see where the shop is confusing or broken. Everything you type into form fields is masked and never recorded. Recordings are linked to a random visitor ID. Input fields are masked, but recordings can show other text displayed on the page.
  • Marketing (with consent): measures our ads and shows them to people who might like our products, also on other websites. Meta pixel (_fbp, 90 days), Pinterest tag (_pin_unauth, _pinterest_ct_ua, 1 year), Google Ads and Merchant Center, Shopify (_shopify_marketing, 1 year).

We use Google Consent Mode: Google tags only run after you accept analytics or marketing cookies. Shopify's full list of cookies is on the Shopify cookie page. Our emails may contain a small image that tells us whether you opened them and which links you clicked.

8. Transfers outside the EU

Most of our providers store data in the EU. Some of them, or their sub-processors, are located in or can access data from other countries:

  • Canada (Shopify's parent company): covered by an adequacy decision of the European Commission.
  • United Kingdom (Judge.me): covered by an adequacy decision of the European Commission.
  • United States (Google, Meta, Pinterest, Cloudflare, Resend, hCaptcha, Stripe, Zonos and sub-processors of Shopify and PostHog): these companies are either certified under the EU-U.S. Data Privacy Framework (covered by the European Commission's adequacy decision of July 10, 2023) or use the European Commission's Standard Contractual Clauses. Shopify uses its Binding Corporate Rules and Standard Contractual Clauses.
  • Destination country of your parcel: if you order from outside the EU, we have to give your name, address, phone number and the contents and value of the parcel to the carrier and the customs authorities of your country. This transfer is necessary to deliver your order (Article 49(1)(b) GDPR).

If you want a copy of the safeguards, just write to info@entomoboxes.com.

9. How long we keep your data

  • Invoices and accounting records: 10 years after the end of the year they relate to (Slovak Accounting Act § 35 and VAT Act § 76).
  • Other order data and related emails, including withdrawals and complaints: until the end of the legal guarantee period (24 months after delivery, or longer if a complaint is pending or the period was extended after a repair) plus 3 years, the general limitation period under the Slovak Civil Code. In total about 5 years after delivery.
  • Customer account: until you delete it or ask us to. Order data inside it is then kept as above.
  • Chat and support messages: 3 years after the last message, unless they relate to an order (then as order data).
  • Newsletter: until you unsubscribe. The record of your consent and of your unsubscribe is kept for 4 years after that, because the law requires us to be able to prove it (§ 116(5) and (6) of Act No. 452/2021 Coll.).
  • Review request: one email per order. If you unsubscribed, we keep your email on a do-not-send list so we don't contact you again.
  • Reviews: as long as the review is published, or until you ask us to remove it.
  • Analytics: Google Analytics data is kept for no longer than 14 months, PostHog event data for no longer than 12 months and PostHog session recordings for no longer than 30 days.
  • Cookies: for the times listed in section 7, or until you delete them in your browser.

After that, we delete or anonymize the data.

10. Your rights

Wherever you live, you have these rights toward us (under the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and similar laws):

  • Access: get a copy of the data we hold about you.
  • Rectification: have wrong data corrected.
  • Erasure: have your data deleted, unless the law requires us to keep it.
  • Restriction: ask us to limit how we use your data, for example while we check a complaint about its accuracy.
  • Data portability: get the data you gave us in a structured, machine-readable format.
  • Withdraw consent: where we rely on your consent (newsletter, reviews, analytics and marketing cookies), you can withdraw it at any time, as easily as you gave it: use the unsubscribe link in any email, or open "Cookie settings" in the footer. Withdrawing does not affect processing that happened before.
  • Complaint: if you think we handle your data unlawfully, you can complain to the Slovak data protection authority: Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho 7/B, 821 04 Bratislava, Slovakia, dataprotection.gov.sk. You can also complain to the authority in the EU country where you live or work. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk), in Switzerland the Federal Data Protection and Information Commissioner, FDPIC (edoeb.admin.ch). Customers in the UK can also contact us directly at info@entomoboxes.com with any question about their data. We'd appreciate the chance to fix things first, so feel free to write to us.

Your right to object: you can object at any time, for reasons related to your situation, to processing based on our legitimate interest (fraud prevention, security, legal claims, review requests, showing the review widget). You can object to the use of your data for direct marketing, including the newsletter and review requests, at any time without giving a reason, and we will then stop.

To use any of these rights, write to info@entomoboxes.com. It's free. We reply within one month. If we can't be sure it's you, we may ask you to confirm from the email address you used for your order.

11. Automated decisions and profiling

We don't make decisions about you that are based only on automated processing and that have legal or similarly significant effects. Shopify and our payment providers automatically check payments and orders for signs of fraud. A payment provider may decline a payment it considers high-risk; that is its own decision as an independent controller, and you can contact it or us about it. If Shopify flags an order, a person looks at it before we decide anything. If you accept marketing cookies, Google, Meta and Pinterest may build an interest profile to show you more relevant ads. You can say no to this in "Cookie settings".

12. Children

Our shop is meant for adults. We don't knowingly collect data from children under 16. If you are younger, please only order or sign up for the newsletter with the consent of a parent or guardian, or ask them to do it for you. If you think a child has given us their data, write to us and we'll delete it.

13. Data security

We use the security measures of Shopify and our other providers, like encrypted connections (HTTPS), and only people who need it can access your data. No method of sending data over the internet is 100% secure, but we do our best and we'll tell you if something goes wrong where the law requires it.

14. For visitors in the United States

We collect the categories of information described in section 2 (identifiers like name, email and address, order history, and internet activity on our site) and share them with the categories of recipients in section 5 (our service providers, payment providers, carriers, and, if you allow it, advertising partners).

Unless you opt out, advertising partners such as Meta, Google and Pinterest, and Shopify (see section 6), may collect information about your activity on our site and on other websites over time. Under some U.S. state laws this may count as "selling" or "sharing" personal information, or "targeted advertising". You can opt out at any time on our Your Privacy Choices page. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out for that browser where your state's law recognizes it. Our site does not respond to "Do Not Track" browser signals, because there is no common standard for them, but GPC works.

You can ask us to access, correct or delete your information by writing to info@entomoboxes.com. We won't treat you differently for using these rights.

15. Changes to this policy

We update this policy when our shop or the law changes. The current version is always on this page, with the date at the top. If we make an important change that affects how we use your data, we'll also let you know by email or with a notice on the site.