Last updated: 23.06.2026
JELLA, spol. s r.o. (hereinafter the "controller") processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter "GDPR") and Act No. 18/2018 Coll. on the protection of personal data, as amended.
1. Identification of the controller
| Business name | JELLA, spol. s r.o. |
| Registered office | Námestie republiky 8, 940 65 Nové Zámky |
| Company ID (IČO) | 36540749 |
| Phone | +421 905 560 430 |
| info@rockbike.sk | |
| Contact for personal data protection | info@rockbike.sk |
The controller is not obliged to appoint a data protection officer (DPO) under Article 37 GDPR, as it does not process personal data on a large scale or special categories of data. If you have any questions about personal data protection, contact us at info@rockbike.sk.
2. Purposes and legal bases of processing
| Purpose of processing | Legal basis | Categories of data | Retention period |
|---|---|---|---|
| Handling orders and performing the purchase contract | Art. 6(1)(b) GDPR — performance of a contract | Name, surname, address, e-mail, phone, order details | 5 years from the last order (legal obligation — accounting records) |
| Issuing and keeping accounting documents | Art. 6(1)(c) GDPR — legal obligation (Accounting Act, VAT Act) | Billing details (name, address, company ID/tax ID) | 10 years (Act No. 431/2002 Coll. on accounting) |
| Handling complaints / withdrawal from the contract | Art. 6(1)(c) GDPR — legal obligation (Act No. 108/2024 Coll.) | Name, surname, address, e-mail, order details, description of the defect | 5 years from handling the complaint |
| Delivery of goods | Art. 6(1)(b) GDPR — performance of a contract | Name, surname, delivery address, phone | For the duration of delivery + 1 year |
| Marketing communication (newsletter) | Art. 6(1)(a) GDPR — consent | Name, e-mail | Until consent is withdrawn |
| Analytics and service improvement | Art. 6(1)(a) GDPR — consent (given via the cookie bar) | Anonymised/pseudonymised browsing data (cookies, IP address) | According to the lifetime of the individual cookies (see section 7) |
| Remarketing and personalised advertising | Art. 6(1)(a) GDPR — consent (given via the cookie bar) | Cookie identifiers, browsing data, interests | According to the lifetime of the cookies (see section 7) |
3. Recipients of personal data (processors)
Your personal data may be provided to the following third parties — processors who process it on behalf of the controller under a data processing agreement:
| Processor | Purpose | Registered office |
|---|---|---|
| WebSupport, s.r.o. | Web hosting, server infrastructure | Slovak Republic |
| Google Ireland Limited | Google Analytics, Google Ads, Google Tag Manager | Ireland (EU) / USA* |
| Meta Platforms Ireland Limited | Facebook Pixel, Instagram, remarketing | Ireland (EU) / USA* |
| UPS / Slovak Parcel Service (SPS) | Parcel delivery | Slovak Republic / EU |
| Slovenská pošta, a.s. | Parcel delivery | Slovak Republic |
| VÚB, a.s. / payment gateway | Processing online payments | Slovak Republic |
* Transfer to the USA — see section 4.
Your data may also be disclosed to public authorities (tax office, courts, SOI) on the basis of a legal obligation.
4. Transfer of personal data to third countries
Some of our processors (Google, Meta) transfer personal data to the USA. These transfers are safeguarded on the basis of:
- The European Commission's adequacy decision — the EU-U.S. Data Privacy Framework (DPF), adopted on 10 July 2023. Both Google LLC and Meta Platforms, Inc. are certified under the DPF.
- Standard contractual clauses (SCCs) approved by the European Commission as a supplementary mechanism.
Data is transferred only to the extent necessary to provide the relevant services (analytics, remarketing) and only if you have given consent via the cookie bar.
5. Profiling and automated decision-making
5.1. Our site uses remarketing and behavioural advertising tools (Facebook Pixel, Google Ads remarketing). These tools create a profile of your interests based on your activity on the site (products viewed, added to cart) in order to show relevant ads on other websites and social networks.
5.2. This profiling takes place only with your consent (given via the cookie bar in the "Marketing cookies" category). You can withdraw your consent at any time by changing your cookie settings.
5.3. On our site there is no automated decision-making with legal effects under Article 22 GDPR. No decision about you is made solely by automated means without human involvement.
6. Rights of data subjects
As a data subject, you have the following rights under the GDPR:
| Right | Description | GDPR article |
|---|---|---|
| Right of access | You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access it. | Art. 15 |
| Right to rectification | You have the right to have inaccurate personal data corrected. | Art. 16 |
| Right to erasure | You have the right to request erasure of data if it is no longer necessary for the purpose for which it was collected. | Art. 17 |
| Right to restriction of processing | You have the right to request restriction of processing, e.g. if you contest the accuracy of the data. | Art. 18 |
| Right to data portability | You have the right to receive your data in a structured, commonly used and machine-readable format. | Art. 20 |
| Right to object | You have the right to object to processing based on legitimate interest, including profiling. | Art. 21 |
| Right to withdraw consent | Where processing is based on consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. | Art. 7(3) |
| Right to lodge a complaint | You have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic. | Art. 77 |
You can submit a request to exercise your rights by e-mail to info@rockbike.sk or by post to the controller's registered office. We will respond to your request within 30 days.
Supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava 27
Tel.: +421 2 3231 3214 | Web: dataprotection.gov.sk
7. Cookies
Our site uses cookies — small text files stored in your browser. Cookies help us keep the site working, analyse traffic and show relevant ads.
7.1. Cookie categories
| Category | Legal basis | Examples | Purpose | Storage period |
|---|---|---|---|---|
| Essential | Legitimate interest (Art. 6(1)(f) GDPR) | woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*, wordpress_logged_in_*, PHPSESSID | Running the online shop, shopping cart, login, security | Session – 2 years |
| Analytics | Consent (Art. 6(1)(a) GDPR) | _ga, _ga_*, _gid (Google Analytics 4) | Traffic measurement, user behaviour, site improvement | _ga: 2 years, _gid: 24 hours |
| Marketing | Consent (Art. 6(1)(a) GDPR) | _fbp, _fbc (Meta/Facebook Pixel), _gcl_au, _gcl_aw (Google Ads), IDE, NID (Google DoubleClick) | Remarketing, personalised advertising, conversion measurement | 90 days – 2 years |
7.2. Managing cookie consent
On your first visit to the site you will see a cookie bar, where you can:
- Accept all cookies — consent to all categories
- Reject optional cookies — only essential cookies are activated
- Set preferences — choose specific cookie categories
You can change your consent at any time by clicking the "Cookie settings" icon in the site footer.
Our cookie bar uses Google Consent Mode v2, which ensures that marketing and analytics cookies are only activated after consent is given. For visitors from the EU the default setting for all optional categories is "denied".
7.3. Blocking cookies in your browser
You can also manage or block cookies directly in your browser settings. Please note that blocking essential cookies may limit the functionality of the online shop (e.g. the shopping cart will not work).
8. Security of personal data
The controller has adopted appropriate technical and organisational measures to protect personal data, in particular:
- Encrypted communication (HTTPS/TLS) across the whole site
- A secure server environment (WebSupport, s.r.o.) with regular backups
- Access to personal data limited to authorised employees only
- Regular software updates (WordPress, WooCommerce, plugins)
9. Final provisions
9.1. This privacy policy is valid from 23.06.2026 and replaces the previous version.
9.2. The controller reserves the right to update this policy. We will inform you of significant changes by a notice on the online shop website.
9.3. This policy applies exclusively to the processing of personal data through the website www.rockbike.sk. We are not responsible for data processing on third-party websites (Facebook, Instagram, Google) — please refer to their own privacy policies.
Nové Zámky, 23 June 2026
JELLA, spol. s r.o.