Privacy Policy
Last updated: 1 September 2026
This Privacy Policy explains how Spletna trgovina, Aleksandr Lepeshkin s.p., trading under the name Nebrito, collects, uses, stores and shares personal data when you visit our websites, create an account, place an order, subscribe to marketing communications, contact us, submit a review, or visit our physical store.
This Privacy Policy applies to:
- nebrito.si
- nebrito.com
- the Nebrito physical store, showroom, warehouse and collection point at Čevljarska ulica 8, 6000 Koper, Slovenia, where applicable.
Our use of cookies and similar technologies is described separately in our Cookie Policy.
1. Who is responsible for your personal data?
The data controller is:
Spletna trgovina, Aleksandr Lepeshkin s.p.
Trading name: Nebrito
Čevljarska ulica 8
6000 Koper
Slovenia
Registration number: 8687188000
VAT number: SI21179379
Email: [email protected]
We are established in Slovenia and process personal data primarily in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Slovenian Personal Data Protection Act (ZVOP-2), and other applicable EU and Slovenian legislation.
2. Personal data we collect
Depending on how you use Nebrito, we may collect the following categories of personal data.
Account information
When you register or when an account is automatically created during checkout, we may process:
- first name;
- email address;
- account password or authentication credentials;
- account settings;
- account and login-related technical information.
An account is created for every customer who completes an order, including customers who were not previously registered.
Order and delivery information
When you place an order, we may process:
- first and last name;
- email address;
- telephone number;
- country;
- city;
- postal code;
- billing address;
- delivery address;
- products ordered;
- order value;
- delivery method;
- payment method;
- order status;
- delivery and tracking information;
- information contained in any comments you voluntarily add to an order.
For business customers, we may additionally process:
- company name;
- VAT number;
- other invoicing information required for the transaction.
Please do not include sensitive personal information in the free-text order comment unless it is genuinely necessary for us to process your order.
Payment information
Online payments are processed through Stripe, including payment methods made available through Stripe, such as card payments and PayPal where available.
Payment card details are entered directly into Stripe's payment interface. Nebrito does not receive or store full payment card numbers, card security codes or equivalent payment credentials.
We may nevertheless receive and store information associated with the payment, such as:
- payment status;
- transaction identifier;
- payment method;
- amount;
- date and time of payment;
- limited payment-related information made available by Stripe;
- information necessary for refunds, disputes and fraud prevention.
Stripe may process personal data in its own capacity as a processor, controller or joint controller depending on the particular payment service.
Communications
When you contact us, we may process:
- your name;
- email address;
- telephone number, where provided;
- order number;
- the content of your correspondence;
- attachments or other information you choose to provide.
Marketing information
If you subscribe to our marketing communications, we may process:
- email address;
- name, where available;
- subscription status;
- date and source of subscription;
- confirmation of subscription;
- marketing preferences;
- information about marketing emails sent to you;
- interaction with such emails, such as delivery, opening or link interaction data;
- information used for relevant marketing segmentation.
Our email marketing platform is Klaviyo.
We use a confirmation email process for marketing subscriptions. Marketing subscription is voluntary.
Marketing communications may include:
- news;
- new product announcements;
- promotional offers;
- product recommendations;
- abandoned-cart reminders.
We do not use SMS marketing.
Website and technical information
When you use our websites, we may process technical information such as:
- IP address;
- browser and device information;
- operating system;
- date and time of access;
- pages visited;
- referring page;
- website activity;
- technical logs;
- cookie or similar identifiers where permitted;
- consent preferences and records.
For analytics and advertising, we use services including:
- Google Tag Manager;
- Google Analytics 4;
- Google Ads, including remarketing;
- Meta Pixel and Meta Ads.
Non-essential analytics and advertising technologies are subject to the consent choices described in our Cookie Policy and cookie consent interface.
We may also process limited technical information necessary to record, communicate and enforce your privacy and cookie preferences.
CRM information
We use HubSpot as a customer relationship management system.
Information stored in our CRM may include customer contact details, order-related information, correspondence, customer service history and information necessary to manage our relationship with customers and business contacts.
Reviews
Registered customers may submit reviews of products and reviews of the Nebrito store.
We may associate a review internally with the customer's account and order number in order to verify that the review originates from a genuine customer.
When a review is published on the Nebrito website, we may display:
- review text;
- customer's first name or displayed user name;
- city;
- date of the relevant order;
- rating;
- date of publication.
The customer's order number and other order details are not published.
If you submit a review through Google Maps or Google Business Profile, Google processes the information under its own terms and privacy rules. Nebrito may access and respond to reviews made publicly available through those services.
3. Why we use personal data and our legal bases
We process personal data only where we have an appropriate legal basis.
Creating and managing your account
We process account information in order to provide the customer account, authenticate users and provide access to order history and related services.
Legal basis: performance of a contract or steps taken at your request before entering into a contract.
We may additionally process security information to protect accounts and prevent misuse.
Legal basis: our legitimate interest in maintaining the security and integrity of our services.
Processing and delivering orders
We process customer, address, order and contact information to:
- accept and manage orders;
- collect payment;
- prepare products for shipment or collection;
- arrange delivery;
- communicate order status;
- process returns, refunds and complaints;
- provide customer support.
Legal basis: performance of a contract.
Accounting, invoicing and taxation
We process and retain transaction and invoicing information where necessary to:
- issue invoices;
- maintain accounting records;
- fulfil VAT and tax obligations;
- fiscally confirm invoices where required;
- comply with requests from competent public authorities.
We use the Slovenian MetaKocka service for inventory, accounting-related order processing and invoicing. Where applicable, invoice information is transmitted to the Financial Administration of the Republic of Slovenia (FURS).
We also use an external Slovenian accounting service provider.
Legal basis: compliance with legal obligations.
Service communications
We send transactional and service-related emails such as:
- account registration confirmations;
- password reset messages;
- order confirmations;
- payment information;
- shipping and order status updates;
- information concerning returns, refunds or customer support.
These communications are necessary for the operation of your account or performance of your order and do not require a marketing subscription.
Service email is provided using Google Workspace / Google SMTP infrastructure.
Legal basis: performance of a contract and, where appropriate, our legitimate interest in providing customer service and maintaining the operation and security of the website.
Marketing communications
Where you have subscribed to marketing communications, we may send newsletters, promotional offers, product information and abandoned-cart reminders.
Legal basis: your consent.
You may withdraw your consent at any time by using the unsubscribe link included in marketing emails or by contacting us at [email protected].
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Analytics
Where you have given the required consent, we use analytics tools to understand how visitors use our websites, measure website performance and improve our services.
This includes Google Analytics 4, implemented through Google Tag Manager.
Legal basis: your consent.
Advertising and remarketing
Where you have given the required consent, we may use Google Ads, Meta Ads and related technologies to:
- measure advertising performance;
- build advertising audiences;
- show relevant advertising;
- conduct remarketing campaigns;
- understand whether advertising resulted in visits or purchases.
Legal basis: your consent.
Further information about cookies, advertising identifiers and consent choices is provided in our Cookie Policy.
Customer relationship management
We may use HubSpot to organise customer communications, customer service, sales-related correspondence and our relationship with business customers.
Legal basis: performance of a contract and our legitimate interests in efficiently organising customer service and business relationships.
HubSpot data will not be used to send marketing communications to you unless an appropriate legal basis for such marketing exists.
Reviews
When you voluntarily submit a review for publication, we process the review and the information that you choose to make public.
Legal basis: your consent and your request to publish the review.
We may connect the review internally to your customer account and order information in order to verify that it originates from a genuine customer and to prevent misleading or fraudulent reviews.
Legal basis: our legitimate interest in maintaining the reliability and authenticity of customer reviews.
Website security, fraud prevention and legal claims
We may process technical, transaction and account information where necessary to:
- secure our websites and infrastructure;
- detect fraud or misuse;
- investigate security incidents;
- establish, exercise or defend legal claims;
- respond to lawful requests from authorities.
Legal basis: our legitimate interests and, where applicable, compliance with legal obligations.
Recording consent
We may retain records showing your consent choices, including marketing consent and cookie/privacy preferences, as well as subsequent withdrawals or changes.
Legal basis: compliance with our legal obligations and our legitimate interest in demonstrating compliance with applicable data protection rules.
4. Delivery companies
To deliver your order, we provide the information necessary for delivery to the selected carrier.
Our carriers may include:
- Pošta Slovenije;
- GLS;
- DPD;
- their local delivery partners;
- national postal operators and other delivery partners in the destination country.
The information transferred normally includes your name, delivery address, telephone number, email address where necessary, shipment information and other information required to deliver and track the parcel.
For international shipments, carriers may transfer shipment information to their partners or postal operators in the destination country.
Where you request delivery to a country outside the EEA, transferring the necessary delivery information to that country may be necessary for performance of our contract with you.
5. Who receives your personal data?
Depending on the service concerned, personal data may be disclosed to:
- payment service providers, including Stripe and payment methods available through Stripe;
- delivery and postal service providers;
- hosting and IT infrastructure providers;
- Google Workspace and email infrastructure providers;
- Klaviyo;
- HubSpot;
- MetaKocka;
- our external accountant;
- Google, in connection with analytics, advertising and related services;
- Meta, in connection with advertising and related services;
- service providers assisting us with website operation, maintenance or security;
- FURS and other public authorities where required by law;
- courts, law enforcement authorities or professional advisers where necessary for legal claims or compliance with law.
Some providers act as processors on our behalf, while others may act as independent controllers or joint controllers for particular processing activities.
Our website infrastructure is hosted within the European Economic Area (EEA). Our current hosting provider is Hetzner. We may change server locations within the EEA without changing the fundamental protections applicable to your personal data.
6. International transfers of personal data
Some of the service providers we use are international organisations and may process personal data outside Slovenia or outside the EEA.
Where personal data is transferred outside the EEA, we use or rely on an appropriate transfer mechanism where required, which may include:
- a European Commission adequacy decision;
- the EU-U.S. Data Privacy Framework for eligible certified recipients;
- Standard Contractual Clauses approved by the European Commission;
- other safeguards permitted under GDPR.
Certain international transfers may also be necessary to perform a contract with you. For example, if you order delivery to a country outside the EEA, necessary delivery information must be transferred to postal or courier operators serving that country.
You may contact us at [email protected] for additional information concerning applicable safeguards.
7. How long we keep personal data
We do not intend to keep personal data for longer than reasonably necessary for the purpose for which it was collected, subject to legal retention requirements.
As a general policy, we apply the following retention periods.
Customer accounts
Account and profile information is normally retained while your account remains active.
Accounts that have been inactive for an extended period may be deleted or anonymised. As a general rule, we may remove accounts after approximately 5 years of inactivity, provided that no legal, contractual or accounting reason requires related information to be retained.
Deleting an account does not require us to delete invoices, transaction records or other information that we are legally required to retain.
Orders and contractual records
General order and customer-service records may be retained for up to 5 years after completion of the relevant transaction, where necessary for complaints, warranty matters, disputes or legal claims.
Information subject to longer statutory accounting or tax retention periods is retained for the required period.
Invoices, accounting and tax records
Invoices and related accounting information are generally retained for at least 10 years after the end of the year to which the relevant documents relate, or longer where required by applicable law.
Payment information
Nebrito does not retain full payment-card details.
Payment confirmations, transaction identifiers and accounting information may be retained together with the relevant order and accounting records for the applicable statutory period.
Customer correspondence
General customer-service correspondence may normally be retained for up to 3 years after the relevant matter has been resolved, unless it forms part of order, accounting or legal-claim documentation that must be retained longer.
Marketing subscriptions
Marketing profile and subscription information is retained until you unsubscribe or otherwise withdraw consent.
After withdrawal, we may retain a minimal record of the withdrawal or suppression status where necessary to ensure that we do not send further marketing messages and to demonstrate compliance with your request.
Abandoned carts
Information used specifically to operate an abandoned-cart reminder may normally be used for the active reminder process for up to 30 days.
If you are also a marketing subscriber or customer, other information associated with your customer or marketing profile may be retained according to the applicable retention period described in this Policy.
Consent records
Records necessary to demonstrate privacy, cookie or marketing consent and withdrawal may normally be retained for up to 5 years after the relevant consent ceases to be used, unless a longer period is necessary in connection with a dispute or legal obligation.
Reviews
Published reviews may be retained for as long as they remain published.
If you ask us to remove a review, we will normally remove its public version and delete or anonymise associated information unless retention is necessary for the establishment, exercise or defence of legal claims.
Website security logs
Technical and security logs are generally retained for up to 12 months, unless they need to be retained longer for investigation of a security incident, fraud or legal claim.
Analytics and advertising information
Analytics and advertising information is retained according to our configured retention settings, your consent choices and the applicable provider's retention mechanisms.
Where configurable, we aim to use reasonable and proportionate retention periods and to avoid retaining identifiable analytics information indefinitely.
More information is provided in our Cookie Policy.
8. Video surveillance at our physical store
Video surveillance is used at the Nebrito premises at:
Čevljarska ulica 8, 6000 Koper, Slovenia
The purpose of video surveillance is to protect people and property, prevent and investigate security incidents, and control access to the premises where necessary.
Video surveillance is not used for marketing, customer profiling or analysing shopping behaviour.
CCTV recordings are stored locally on equipment located at the store and are not routinely transferred to cloud storage.
Access to recordings is restricted to persons authorised to access them and recordings may be viewed or disclosed only where necessary for the purposes for which the surveillance was lawfully established, including investigation of an incident, protection of legal rights or cooperation with competent authorities.
CCTV recordings are normally retained for no more than 30 days.
Where a recording is required to investigate a specific incident or for legal proceedings, the relevant recording may be retained for longer for that purpose, but not beyond the maximum period permitted by applicable law.
Appropriate notice of video surveillance is displayed at the monitored premises.
Questions or requests relating to video surveillance may be sent to [email protected].
9. Cookies and similar technologies
Our websites use cookies and similar technologies.
Some technologies are necessary for website functionality, account management, shopping-cart operation, security and remembering privacy choices.
Analytics, advertising, remarketing and other non-essential technologies are controlled through our cookie consent system.
You can change or withdraw your choices using the cookie settings available on the website.
For detailed information about categories of cookies, providers, purposes, storage periods and how to manage your preferences, please see our Cookie Policy.
10. Is providing personal data mandatory?
Some information is necessary for us to provide our services.
For example, we cannot normally process and deliver an order without information such as:
- your name;
- delivery address;
- email address;
- telephone number where required for delivery;
- payment information processed through the payment provider.
Where information is required for a contract or by law, failure to provide it may prevent us from completing your order or providing the requested service.
Providing personal data for marketing purposes is voluntary and is not a condition of purchasing products from Nebrito.
The order comment field and similar free-text fields are optional.
11. Automated decision-making and profiling
Nebrito does not make decisions based solely on automated processing that produce legal effects or similarly significant effects for customers within the meaning of Article 22 GDPR.
Our analytics and advertising providers may perform audience creation, measurement or profiling where you have provided the required consent.
Payment providers such as Stripe may also use automated fraud-prevention and risk-management systems under their own legal obligations and privacy terms.
12. Your rights
Subject to the conditions and limitations provided by applicable data protection law, you may have the right to:
- obtain confirmation as to whether we process your personal data;
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive certain personal data in a structured, commonly used and machine-readable format and request data portability;
- withdraw consent at any time where processing is based on consent;
- object at any time to the use of your personal data for direct marketing;
- lodge a complaint with a competent data protection supervisory authority.
Withdrawal of consent applies to future processing and does not make previous processing based on valid consent unlawful.
The right to deletion is not absolute. For example, we may continue to retain personal data where necessary to comply with tax and accounting legislation or to establish, exercise or defend legal claims.
13. How to exercise your rights
To exercise a data protection right or ask a privacy-related question, contact:
or write to:
Spletna trgovina, Aleksandr Lepeshkin s.p.
Čevljarska ulica 8
6000 Koper
Slovenia
We may ask for information reasonably necessary to confirm your identity before fulfilling a request.
We will respond within the time limits required by applicable data protection law.
14. Right to complain to a supervisory authority
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent supervisory authority.
Our lead supervisory authority in Slovenia is:
Information Commissioner of the Republic of Slovenia
Dunajska cesta 22
SI-1000 Ljubljana
Slovenia
Email: [email protected]
You may also have the right to complain to the supervisory authority in the EU or EEA country where you live, work or where an alleged infringement occurred.
15. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures may include access restrictions, account authentication, encrypted network communication, system monitoring, backups and other security controls appropriate to the nature of the information and risks involved.
No internet-based system can be guaranteed to be completely secure.
16. Children
Nebrito products and services are not specifically directed at children.
We do not intentionally operate services designed to collect personal data from children for behavioural advertising or similar purposes.
If we become aware that personal data concerning a child has been collected in circumstances where additional parental or guardian authorisation is legally required, we will take appropriate steps.
17. Changes to this Privacy Policy
We may update this Privacy Policy when our services, service providers, processing activities or applicable legal requirements change.
The current version will always be published on our websites together with the date of the latest update.
Where a change materially affects processing based on your consent, we will request new consent where required by law.
Minor changes, clarifications or changes that do not affect the nature or legal basis of processing do not require renewed consent.