Routie
SK SlovenčinaDesign a print

Privacy

This policy explains how Denva s. r. o. processes the personal data of customers and visitors of the Routie online shop under Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on personal data protection.

1. Controller

  • Denva s. r. o., Ekoosada 3194/235, 925 22 Veľké Úľany, Slovakia

  • Company ID (IČO): 55376681, Tax ID (DIČ): 2121975273, VAT ID (IČ DPH): SK2121975273

  • Registered in the Commercial Register of the District Court Trnava, section Sro, insert No. 53995/T

  • Email: info@routie.sk, phone: +421 902 074 830

Please write to info@routie.sk about anything concerning personal data. We have not appointed a data protection officer, as the law does not require us to.

2. What we process, why and on what basis

Orders and their fulfilment. Name, email, phone if you give it, billing and delivery address, for a company its name, Company ID, Tax ID and VAT ID, the order contents, and payment and delivery details. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Your print design. The route you upload (a GPX, TCX or KML file) and the texts you write on the print. A route recording can reveal places where you move, for example a start near your home, so please upload only the route you want on the print. Legal basis: performance of a contract and steps before entering into it (Article 6(1)(b) GDPR).

Invoices, accounting and tax. The details on tax documents. Legal basis: legal obligation (Article 6(1)(c) GDPR) under Slovak Act No. 431/2002 Coll. on accounting and Act No. 222/2004 Coll. on value added tax.

Complaints and withdrawal from the contract. The details from the form, photos of the defect and our correspondence. Legal basis: legal obligation (Article 6(1)(c) GDPR) under the Slovak Civil Code and Act No. 108/2024 Coll. on consumer protection.

Customer account. If you create an account: your email, your password in unreadable form, saved addresses and order history. Legal basis: performance of the contract for the account (Article 6(1)(b) GDPR). You can ask us by email to close the account at any time.

Gift voucher. The recipient’s name and email and the gift message, if you enter them, so we can send the voucher. Legal basis: performance of the contract with the buyer (Article 6(1)(b) GDPR).

Newsletter. Your email, only with your consent, which you confirm through a link in an email. Once you confirm, we send you a single-use discount code. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw consent at any time through the link in every email; withdrawal does not affect processing before it.

Review request. After your order is delivered, we may send you one email asking you to rate your purchase. Legal basis: our legitimate interest in customer feedback (Article 6(1)(f) GDPR). You can decline it at checkout or later at any time by email.

Questions and enquiries. The details you send us by email or through a form. Legal basis: steps before entering into a contract, or our legitimate interest in answering you (Article 6(1)(b) and (f) GDPR).

Security and operation of the website. Technical records (IP address, time, error reports). Legal basis: our legitimate interest in a secure, working shop and in preventing fraud (Article 6(1)(f) GDPR).

Measuring visits and advertising. Only with your consent in the cookie bar, we measure visits to the shop (Google Analytics 4) and the effectiveness of ads, and show ads to website visitors (Google Ads, Meta Pixel). In doing so we process identifiers from cookies, your IP address, technical browser and device data, the pages viewed, the traffic source and shop events: product and product list views, adding to and removing from the basket, checkout steps, completed purchases (order number, products and amounts, never your name, email, phone or address) and newsletter signups without the email address. Legal basis: consent (Article 6(1)(a) GDPR) and, for storing data on your device, consent under Section 109(8) of Slovak Act No. 452/2021 Coll. You can change or withdraw consent at any time through the Cookie settings link in the footer; withdrawal does not affect processing before it.

Checkout events sent by our server. The checkout and order pages load no measurement or advertising tool, so that no third-party script runs where you enter your address and pay. Our server therefore sends the checkout steps and the completed purchase itself, and only within the scope of your consent: with consent to analytics cookies to Google Analytics 4 (Measurement Protocol), with the identifiers from the _ga and _ga_<container-id> cookies or, if there is no _ga cookie yet, an identifier derived from your basket; with consent to marketing cookies to Meta (Conversions API), with the identifiers from the _fbp and _fbc cookies, your IP address and your browser’s user agent. Each event carries the products, the amount and the currency, and a purchase also the order number, never your name, email, phone or address. The server sends a purchase only once the order is paid. Without consent it sends and stores nothing; it keeps the identifiers only until the event is sent and deletes those of an event that is never sent after 35 days at the latest. Legal basis: consent (Article 6(1)(a) GDPR).

Cookie consent record. For every choice in the cookie bar, a refusal included: the consent ID, the time, the chosen categories, the consent version, the page and language, a keyed hash (HMAC) of the IP address, never the IP address itself, and the browser’s user agent. Legal basis: the legal obligation to be able to demonstrate consent (Article 7(1) in conjunction with Article 6(1)(c) GDPR).

Establishing and defending legal claims. Details from orders and correspondence. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Providing the details needed for an order is a contractual requirement; without them we cannot fulfil the order. We do not carry out automated decision-making or profiling with legal effects.

3. Who we share data with

We share data only to the extent the recipient needs, and we have a contract under Article 28 GDPR with every processor.

  • Stripe (card, Apple Pay and Google Pay payments, including fraud risk assessment). You enter your card details directly into Stripe’s form; we never see them.

  • Packeta (delivery to a pickup point or box, or by courier): name, phone, email and delivery address. Where Packeta hands the parcel to a partner carrier in the delivery country, it passes these details to that carrier: InPost (Poland), Foxpost and Express One (Hungary), DPD (Poland and Austria), Hermes (Germany), Poșta Română (Romania), Pošta Slovenije (Slovenia), BOX NOW (Croatia, Bulgaria and Cyprus), Overseas Express (Croatia), Sameday (Bulgaria), ELTA (Greece), Poste Italiane (Italy), Mondial Relay and Colis Privé (France), MRW (Spain and Portugal), bpost (Belgium), PostNL (Belgium and the Netherlands), DHL (the Netherlands), POST Luxembourg (Luxembourg), Fastway (Ireland), PostNord (Denmark and Sweden), Matkahuolto (Finland), Venipak (Estonia, Latvia and Lithuania) or Omniva (Estonia).

  • Mailjet SAS (Sinch group), 43 rue de Dunkerque, 75010 Paris, France, through which we send order emails, invoices, account emails and the newsletter: the recipient’s email address and name and the content of the email, attachments included (for example order details, the invoice, a preview of the print). It stores the data in Google Cloud data centres in Frankfurt (Germany) and Saint-Ghislain (Belgium). For spam and fraud prevention and the security of its network, Sinch acts as an independent controller.

  • Hetzner Online GmbH, Germany (servers and file storage in the EU).

  • Cloudflare (delivery and protection of the website and of our map server tiles.routie.sk, from which your browser loads the configurator’s map tiles, relief and label fonts).

  • Sentry (recording technical errors, EU data centre).

  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Tag Manager, Google Analytics 4 and Google Ads), only with your consent in the cookie bar: the visit data and shop events described in section 2.

  • Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (Meta Pixel and Conversions API), only with your consent to marketing cookies: the visit data and checkout events described in section 2. For collecting this data on our website and transmitting it to Meta, we and Meta are joint controllers (Article 26 GDPR, the Meta Controller Addendum); Meta alone is responsible for any processing after the transmission. You can exercise your rights regarding the joint processing with us or directly with Meta; we forward any request we receive to Meta without undue delay.

  • An external accounting firm and, where the law requires it, public authorities.

4. Transfers outside the EU

Some providers (Stripe, Cloudflare, Sentry, Google and Meta) belong to groups based in the USA. Where data leaves the European Economic Area, this happens on the basis of the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses under Article 46 GDPR. Google LLC and Meta Platforms, Inc., to which Google and Meta may transfer measurement and advertising data, are certified under the EU-U.S. Data Privacy Framework. Mailjet keeps the data in the EU only; its support teams and tools outside the EU (for example Mailgun Technologies, Inc. in the USA) work with data only when we share it with them in a support request, and such a transfer then relies on the EU-U.S. Data Privacy Framework or standard contractual clauses.

5. How long we keep data

  • Orders and tax documents: 10 years from the end of the year they relate to (Accounting Act).

  • Complaints and withdrawals: 5 years after they are settled, for possible claims.

  • Print design and uploaded route: for an ordered print, together with the order, so we can handle a complaint; a design that was not ordered is deleted 90 days after it was last changed.

  • Basket: 30 days after the last change.

  • Customer account: until you ask us to close it; the details the law requires us to keep stay with the orders.

  • Newsletter: until you withdraw consent.

  • Cookie consent record: 3 years.

  • Identifiers in a checkout event our server sends: until the event is sent, 35 days at most.

  • Log of sent emails and technical records: 90 days.

6. Your rights

You have the right of access to your data (Article 15 GDPR), to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on legitimate interest (Article 21). You can withdraw consent at any time. Please send your request by email; we handle it without undue delay and within one month at the latest.

If you believe we process your data in breach of the law, you can lodge a complaint with the supervisory authority under Article 77 GDPR:

  • Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho 7/B, 821 04 Bratislava, Slovakia, dataprotection.gov.sk.

7. Cookies

We explain which cookies the shop uses and how to set them on the Cookies page.

8. Security

The website uses an encrypted connection (HTTPS), only authorised persons have access to the data, and we back it up regularly.

9. Changes

We update this policy when the way we process data changes. The version published on this page applies. Effective from 30/10/2026.