Privacy Policy

1. Data Controller

The data controller is deFox. For matters concerning personal data protection, please contact:

2. Purpose of Data Processing

Personal data is processed for:

  • Order fulfillment and service provision
  • User account management
  • Sending subscription expiration notifications
  • Handling inquiries and complaints
  • Fulfilling legal obligations (e.g., accounting)

3. Legal Basis

The legal basis for data processing is:

  • Contract performance (Art. 6(1)(b) GDPR)
  • Legitimate interest of the controller (Art. 6(1)(f) GDPR)
  • Legal obligation (Art. 6(1)(c) GDPR)

4. Data Recipients

Data may be shared with:

  • Payment operators (PayU, Stripe)
  • Hosting service providers
  • Google Ireland Limited (Google Analytics 4) - only after consent to analytics cookies
  • Meta Platforms Ireland Limited (Meta Pixel) - only after consent to marketing cookies
  • Public authorities, if required by law

Google and Meta may process data outside the European Economic Area (including the USA). Both companies participate in the EU-U.S. Data Privacy Framework, which provides a legal basis for such transfers.

5. Retention Period

Data is stored for:

  • Account data - until account deletion
  • Transaction data - as required by law (5 years)
  • Contact form data - up to 2 years from last contact

6. User Rights

Users have the right to:

  • Access their data
  • Rectify data
  • Erase data ("right to be forgotten")
  • Restrict processing
  • Data portability
  • Object to processing
  • Lodge a complaint with a supervisory authority

7. Cookies

The website uses cookies grouped into the following categories:

  • Necessary (always active, no consent required) - maintaining user sessions, remembering language preferences, shopping cart functionality, and form security (CSRF)
  • Analytics (Google Analytics 4, requires consent) - visit statistics and user behavior that help us improve the site
  • Marketing (Meta Pixel, requires consent) - measuring ad performance and tailoring ad content on Facebook/Instagram

Analytics and marketing cookies are only loaded after consent is given in the cookie banner, in accordance with Art. 6(1)(a) GDPR. Consent can be withdrawn or changed at any time via "Cookie Settings" in the site footer - withdrawing consent is as easy as giving it.

Users can also manage cookies through browser settings, including blocking or deleting cookies already stored.

8. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or destruction.

9. Contact

For data protection matters: