Privacy policy

Last updated: 27.9.2026

Protecting your personal data is important to us. This policy explains what personal data we process, for what purposes, on what legal basis, to whom we disclose it and what rights you have in relation to its processing. This policy applies to the online store duos.sk (hereinafter the “e-shop”).

1. Data Controller

The controller that processes your personal data is:

Company name: DUOS online, s. r. o.

  • Registered office: Dunajská 2285/3, 811 08 Bratislava – Staré Mesto borough, Slovak Republic
  • Company ID No.: 52 689 301
  • Registered in the Commercial Register of the Bratislava III Municipal Court, Section Sro, Entry No. 141033/B.
  • Email: info@duos.sk
  • Telephone: +421 905 753 146

If you have any questions about the processing of personal data, you can contact us using the contact details above.

2. What Personal Data We Process

Data category

Examples

Identification and contact details

first name, surname, email address, telephone number, billing and delivery address

Order data

order history, shopping cart contents, payment and delivery method, complaints

Website usage data

IP address, device and browser type, pages visited, time spent on the website, traffic source

Marketing and email data

newsletter consent, history of email opens/clicks, contact segmentation and scoring (Brevo)

Data from advertising platforms

advertising-related identifiers and interactions (Meta Ads, Google Ads) for conversion tracking and remarketing

Customer support communications

content of emails, messages or chats when handling enquiries and complaints

Eyesight / glasses prescription data

data included in your glasses prescription or data you provide to us for this purpose, particularly dioptre, cylinder and axis values, and other data needed to manufacture the product ordered

3. Purposes and Legal Bases of Processing

Purpose of processing

Legal basis (GDPR)

Order processing, delivery of goods, invoicing

Performance of a contract (Article 6(1)(b))

Bookkeeping and compliance with statutory obligations

Compliance with a legal obligation (Article 6(1)(c))

Handling complaints and customer requests

Performance of a contract / legitimate interests (Article 6(1)(b) and (f))

Website traffic analytics (Google Analytics, Shopify analytics)

Consent (Article 6(1)(a))

Advertising and remarketing (Meta Ads, Google Ads, Google Tag Manager)

Consent (Article 6(1)(a))

Sending newsletters and email automation (Brevo)

Consent or, for existing customers, legitimate interests (Article 6(1)(a) and (f))

Fraud prevention and website security

Legitimate interests (Article 6(1)(f))

Processing eyesight data to manufacture the product ordered

Performance of a contract (Article 6(1)(b)) and consent under Article 9(2)(a)

We process personal data only to the extent necessary to achieve the purposes set out above. Where processing is based on consent, you have the right to withdraw that consent at any time, for example through the unsubscribe link in an email or through the cookie settings on the website.

4. Recipients and Processors

To operate the e-shop, we use the following platforms and partners, which process personal data on our behalf or as independent controllers:

Partner / platform

Purpose of processing

Shopify Inc.

E-shop operation, order and payment processing, and hosting

Google Analytics (Google Ireland Ltd.)

Analysis of website traffic and user behaviour

Google Tag Manager (Google Ireland Ltd.)

Management of marketing and analytics scripts (tags)

Google Ads (Google Ireland Ltd.)

Advertising, conversion tracking, remarketing

Meta Platforms Ireland Ltd. (Meta Ads / Pixel)

Advertising on Facebook and Instagram, remarketing, conversion tracking

Brevo (Sendinblue SAS)

Email marketing, newsletters, automation and contact scoring

Payment gateways (e.g. Shopify Payments and potentially others)

Processing payments for orders

Delivery and courier companies

Delivery of ordered goods

Accounting/invoicing company (where relevant)

Bookkeeping and invoicing

We have entered into personal data processing agreements with entities processing data on our behalf (processors) in accordance with Article 28 GDPR.

5. Transfers of Personal Data to Third Countries

Some of the partners listed above (particularly Google and Meta) may also process data outside the European Economic Area (e.g. in the USA). Such transfers are safeguarded by Standard Contractual Clauses approved by the European Commission or another appropriate mechanism under Article 46 GDPR. A copy of the relevant safeguards can be made available upon request.

6. Data Retention Periods

Data type

Retention period

Order and billing data

10 years (statutory retention period for accounting records)

Customer account

for as long as the account exists or until a request for erasure is made

Newsletter consent and marketing data

until consent is withdrawn or for a maximum of 3 years from the last interaction

Cookies and analytics data

according to the expiry period of each cookie – see the Cookie Policy

Customer support communications

3 years after the request has been resolved

7. Your Rights

In relation to the processing of personal data, you have, in particular, the following rights:

  • the right of access to personal data (Article 15 GDPR),
  • the right to rectification of inaccurate data (Article 16 GDPR),
  • the right to erasure (“right to be forgotten”) (Article 17 GDPR),
  • the right to restriction of processing (Article 18 GDPR),
  • the right to data portability (Article 20 GDPR),
  • the right to object to processing, particularly for direct marketing purposes (Article 21 GDPR),
  • the right to withdraw consent to processing at any time where processing is based on consent,
  • the right to lodge a complaint with a supervisory authority.

You may exercise your rights in writing or by email using the contact details provided in Section 1. We will respond to your request without undue delay and no later than one month after receiving it. Where necessary, we may extend this period by a further two months, taking into account the complexity and number of requests. We will inform you of any such extension and the reasons for it within one month of receiving your request.

8. Supervisory Authority

If you believe that the processing of your personal data infringes the GDPR or applicable legislation, you have the right to lodge a complaint with:

9. Cookies

Detailed information about the cookies we use on the website (including Google Analytics, Google Ads, Meta Ads and Brevo) can be found in the separate Cookie Policy at https://duos-9925.myshopify.com/pages/zasady-pouzivania-suborov-cookie. You can change your consent to optional cookies at any time through the cookie settings on the website.

10. Automated Decision-Making and Profiling

As part of email marketing (Brevo) and advertising platforms (Meta Ads, Google Ads), profiling may take place based on your behaviour on the website and your interactions with emails (e.g. segmentation, scoring and displaying personalised advertisements). This profiling has no legal effects and does not give rise to any legal consequences for you; it is used solely to improve our offering and marketing communications. You may object to this profiling at any time.

11. Data Security

We have adopted appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or misuse, including encrypted communications (HTTPS/SSL) and restricting access to data to authorised persons only.

12. Changes to this Policy

We may update this Privacy Policy from time to time, for example in connection with changes in legislation or in the tools and services used. The current version is always available on this page together with the date of the last update.

13. Contact

If you have any questions, please contact us at info@duos.sk or DUOS online s. r. o., Dunajská 2285/3, 811 08 Bratislava – Staré Mesto borough, Slovak Republic.