Privacy Policy

1Who we are and what this policy covers

1. The controller of personal data is NGP Tobacco Online s. r. o., with its registered office at Mikovíniho 19, 917 02 Trnava, Slovak Republic, Company ID (IČO): 54 679 800, registered in the Commercial Register of the Trnava District Court, Section: Sro, Insert No. 51866/T, e-mail: info@killaxpablo.com, telephone: +421 2 3333 1066 (the “Controller”, “we”).
2. This policy explains how we process the personal data of visitors to and customers of the online shop at www.killaxpablo.com (the “Website”), in particular in connection with the purchase of goods including merchandise, the operation of customer accounts, delivery, the handling of complaints and withdrawals from contract, marketing communications and the use of cookies.
3. This policy sits alongside the General Terms and Conditions, the Returns and Complaints document and the Delivery Terms published on the Website. Those documents govern the contractual relationship; this policy governs the processing of personal data.
4. Processing is governed by Regulation (EU) 2016/679 (GDPR), Act No. 18/2018 Coll. on the Protection of Personal Data and, as regards cookies, Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications.

2What data we process

1. Depending on how you use the Website, we process:
   • (a) identification and contact data: first name, surname, e-mail address, telephone number, billing and delivery address;
   • (b) customer account data: login name, password in encrypted form, account settings, order history;
   • (c) order and payment data: contents of the order, price, payment method, transaction identifier (we do not process payment card numbers; payments are handled by the payment service provider);
   • (d) for merchandise: the size and variant selected and, for goods made to your specification, the personalisation text or motif you supplied;
   • (e) delivery data: delivery address, telephone number, communications with the carrier;
   • (f) data concerning complaints, withdrawal from contract and other communications with us, including any photographs you send us with a complaint;
   • (g) technical data: IP address, device and browser type and settings, date and time of access, log records;
   • (h) data from age verification on entering the Website; on handover of the consignment the carrier verifies age by inspecting an identity document — we neither make nor keep a copy of that document;
   • (i) data obtained through cookies and similar technologies under Article 5 of this policy.

3Why we process data and on what legal basis

1. Conclusion and performance of the purchase contract, order processing, payment and delivery – Article 6(1)(b) GDPR (performance of a contract and pre-contractual steps).
2. Production of goods to your specification for personalised merchandise – Article 6(1)(b) GDPR.
3. Creation and operation of a customer account – Article 6(1)(b) GDPR.
4. Handling of complaints and withdrawals from contract – Article 6(1)(c) GDPR (compliance with a legal obligation), in the alternative Article 6(1)(b) GDPR.
5. Compliance with legal obligations, in particular accounting, tax and archiving obligations – Article 6(1)(c) GDPR.
6. Compliance with the obligations of a food business operator, in particular traceability, withdrawal or recall of food from the market and informing customers under Articles 18 and 19 of Regulation (EC) No 178/2002 and Act No. 152/1995 Coll. on Food – Article 6(1)(c) GDPR.
7. Verification of the customer’s age on entering the Website, when ordering and on handover of the consignment – Article 6(1)(f) GDPR (legitimate interest in protecting minors and observing the age restriction set by the Controller).
8. Security of the Website and the prevention and detection of fraud and misuse – Article 6(1)(f) GDPR.
9. Sending commercial communications about our own similar products to existing customers – Article 6(1)(f) GDPR; you may object at any time and unsubscribe using the link in every message. At checkout this is the box “Email me with news and offers”, which is ticked in advance: untick it if you do not want these messages. We add your e-mail address only once your order has been paid.
10. Newsletters and marketing communications beyond the preceding point – Article 6(1)(a) GDPR (consent). Consent is voluntary, is not a condition of purchase and may be withdrawn at any time.
11. Establishing, exercising and defending legal claims – Article 6(1)(f) GDPR.
12. Cookies that are not strictly necessary for the operation of the Website – consent under Section 109(8) of Act No. 452/2021 Coll. in conjunction with Article 6(1)(a) GDPR.
13. Providing the data marked as mandatory is necessary in order to conclude and perform the contract; without it we cannot process an order. Provision of other data is voluntary.

4Who we share data with

1. Recipients may include: hosting and IT service providers, the operator of the e-shop platform, payment service providers, postal undertakings and courier companies, the production or fulfilment partner for merchandise including goods made to your specification, e-mail distribution tool providers, marketing agencies, analytics and advertising tool providers, accountants, auditors and lawyers, and public authorities to the extent of statutory obligations, in particular the Slovak Trade Inspection and the official food control authorities.
2. We have concluded agreements with processors under Article 28 GDPR. We do not sell personal data.
3. Transfers to a third country outside the European Economic Area take place only where necessary, on the basis of a European Commission adequacy decision, subject to appropriate safeguards under Article 46 GDPR (in particular standard contractual clauses), or under Article 49 GDPR. We will provide information about the safeguards used on request.

5Cookies and similar technologies

1. Cookies are small files stored on your device. Strictly necessary cookies, without which the Website cannot function, are used under Section 109(8) of Act No. 452/2021 Coll. without consent. All other cookies – functional, analytics and marketing – are used only on the basis of your consent given through the cookie banner.
2. Consent is voluntary, individual categories may be accepted or refused separately, and consent may be withdrawn at any time in the cookie settings on the Website or in your browser settings. Refusing optional cookies does not affect your ability to shop.
3. Overview of the cookies used:

Strictly necessary cookies

Analytics cookies – only with your consent

Microsoft Clarity shows us how the Website is used – clicks, scrolling and mouse movement, as heatmaps and recordings of visits – so we can see where visitors get stuck. Text in the checkout, the shopping cart, your account and order details is masked and is not recorded. Card details are entered in the payment provider’s secure fields and are never recorded.

Functional and marketing cookies are not used at present. You can change your choice at any time: Cookie settings

6How long we keep data

1. Order data and accounting documents – 10 years from the end of the accounting period in which the order was completed.
2. Customer account data – for the duration of the account and 1 year after its closure.
3. Complaints and withdrawals from contract – 4 years from the conclusion of the matter.
4. Data required for food traceability under Article 18 of Regulation (EC) No 178/2002 – for the period laid down by food law, as a rule until the date of minimum durability and 6 months thereafter.
5. Materials for personalised merchandise (personalisation text or motif) – 2 years from delivery of the goods.
6. Technical and log records – 6 months.
7. Data processed on the basis of consent (newsletter, cookies) – until consent is withdrawn; for cookies, no longer than the periods stated in the table in Article 5.
8. E-mail address for commercial communications to existing customers – until you object or unsubscribe.
9. Data needed to establish and defend legal claims – until the expiry of the applicable limitation periods.

7Your rights

1. You have the right of access (Article 15 GDPR), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20), to object to processing based on legitimate interest including direct marketing (Article 21), and to withdraw consent at any time (Article 7(3)) without affecting the lawfulness of prior processing.
2. You may exercise these rights at info@killaxpablo.com or in writing at the Controller’s registered office. We will respond without undue delay and at the latest within one month.
3. You also have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk, or with the supervisory authority in your country of habitual residence, and the right to an effective judicial remedy.

8Further information

1. No automated individual decision-making or profiling within the meaning of Article 22 GDPR takes place in the processing covered by this policy.
2. Neither the Website nor the products offered are intended for persons under 18 years of age, and we do not knowingly process the personal data of such persons. If we discover that we have obtained such data, we will erase it without undue delay.
3. We have implemented appropriate technical and organisational measures to protect data, in particular encryption in transit, access controls, training of authorised persons and back-ups.
4. We make this policy available in every language in which the online shop is made available for ordering. If the language versions differ, the data subject may rely on the version in the language in which they became acquainted with the policy.
5. We may update this policy. The current version is always available on the Website; we will inform you of material changes by appropriate means. This policy is effective from 13 October 2026.