Privacy Policy

Who is responsible

BIONIX trgovina na debelo s sadjem in zelenjavo d.o.o., Levstikova cesta 7, 3320 Velenje, Slovenia, is the data controller for personal data collected through this site.

We have not appointed a Data Protection Officer, as we are not required to. Privacy questions are handled directly by the contacts below.

For any question about your data, write to ciao@artisanglutenfree.com.

What we collect, and why

Apart from analytics, which you control, we collect only what you type into a form. We do not build advertising profiles or buy contact data from third parties.

B2B enquiry form. First and last name, company, email address, telephone number, country, business type and your message. We use this to answer your enquiry and, if it leads somewhere, to discuss supply. The legal basis is Article 6(1)(b) GDPR, covering steps taken at your request before entering a contract, together with our legitimate interest in responding to business enquiries under Article 6(1)(f).

Product update signup. Name, email address and, optionally, company. We use this to send product news and launch notifications. The legal basis is your consent under Article 6(1)(a). You can withdraw it at any time using the unsubscribe link in any message, or by writing to us.

Analytics, if you agree to it. If you accept analytics in the cookie banner, Google Analytics collects pages viewed, approximate location derived from a truncated IP address, device and browser type, and how you arrived. The legal basis is your consent under Article 6(1)(a) GDPR, and you may withdraw it at any time through Cookie settings at the foot of any page. If you decline, no Google script is loaded and no analytics data is collected.

We do not collect special categories of personal data, and the site is not directed at children.

Who else processes your data

We use three service providers, each acting as a processor under a data processing agreement:

Netlify hosts the website and processes server logs, including IP addresses, for security and delivery.

Supabase stores enquiries and signups in a hosted database.

Klaviyo sends product update emails to people who have signed up. Klaviyo is based in the United States; transfers rely on the European Commission's Standard Contractual Clauses.

Google Analytics, operated by Google Ireland Limited, measures site usage, but only for visitors who have accepted analytics. Processing also takes place in the United States, relying on Standard Contractual Clauses and Google's certification under the EU–US Data Privacy Framework.

We do not sell your data, and we do not share it with anyone else unless we are legally required to.

How long we keep it

Enquiries are kept for up to three years from our last contact with you, so that we can pick up a conversation where it left off and meet our commercial record-keeping obligations. If an enquiry leads to a supply relationship, the records are kept for as long as that relationship lasts plus any statutory retention period.

Product update signups are kept until you unsubscribe. If you unsubscribe, we keep a minimal record of that fact so that we do not email you again by mistake.

Analytics data is retained by Google for 14 months from a visitor's last activity, after which it is deleted automatically.

Your rights

Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to another provider in a portable format. Where we rely on legitimate interest, you may object to that processing. Where we rely on consent, you may withdraw it at any time, which does not affect anything done before you withdrew it.

Write to ciao@artisanglutenfree.com and we will respond within one month.

If you are not satisfied with our response, you may complain to Informacijski pooblaščenec Republike Slovenije, Dunajska cesta 22, 1000 Ljubljana, Slovenia (https://www.ip-rs.si), or to the supervisory authority where you live or work.

Security

The site is served over HTTPS. Enquiry and signup records are held in a database with row-level access rules that prevent them from being read through the public website. They are only accessible to us. Access is limited to people who need it.

Changes

We will update this policy when the site changes. This version is dated 2026-09-20.