In order to provide the Services, we collect personal information about you from various sources, as listed below. The information we collect and use varies depending on how you interact with us. In addition to the specific uses listed below, we may also use the information we collect about you to communicate with you, provide or improve the Services, comply with applicable legal obligations, enforce the applicable Terms of Service, and to protect or defend the Services, our rights and our users or others.

The types of personal data we collect about you depend on your interaction with our website and use of our services. When we use the term "personal data", we mean data that identifies you, relates to you, describes you or can be linked to you. The following sections describe the categories and specific types of personal data we collect.

Information you provide to us directly through our Services may include:

• contact information, including your name, address, telephone number and email;
• order details, including your name, billing address, delivery address, proof of payment, email address and telephone number;
• account information, including your username, password, security questions and other information used for account security purposes;
• customer support information, including information you choose to include in communications with us, such as when sending a message through the Services.

Certain features of the Services may require you to provide us with certain information about yourself directly. You may choose not to provide this information, but doing so may prevent you from using or accessing these features. Information We Collect About Your Usage We may also automatically collect certain information about your interaction with the Services (" Usage Information "). For this we may use cookies, pixels and similar technologies (" cookies "). Usage Data may include information about how you access and use our Site and your account, including information about your device, browser, network connection, IP address, and other information about your interaction with the Services.

For complications and problems that would arise from possible improper use of the goods or if the instructions and warnings of the provider are not followed, the provider is not responsible.

Employees of the company Puffi, marketing and business services, Aljaž Skornšek sp, Vrenska gorca 16, 3255 Buče, which manages the online store www.puffy.si , are not competent to personally solve any problems regarding the use of goods.

The provider is not responsible for any occasional problems with the operation of the www.puffi.si online store, any inaccuracy of information, or any damage caused by the use of inaccurate or incomplete information.

The provider reserves the right to withdraw from the contract or realization of the order if there is a significant error in the offer. A fundamental error includes elements on the basis of which the company would not agree to conclude the contract. The mentioned errors also include obvious errors in the price, which may be the result of technical and other problems.

Communication takes place via publicly available and published channels or company contact information (e-mail, address, phone).

We may also obtain information about you from third parties, including vendors and service providers who may collect information on our behalf, for example

• companies that support our website and services, such as Shopify;
• our payment processors who collect payment information (eg bank account, credit or debit card information, billing address) to process your payment in order to fulfill your orders and provide you with the products or services you have requested in order to fulfill our contract with you.
• When you visit our website, open or click on emails we send to you, or interact with our services or advertisements, we or the third parties we work with may automatically collect certain information using web tracking technologies such as pixels , web beacons, software developer kits, third-party libraries and cookies.

Any information we obtain from third parties will be treated in accordance with this Privacy Policy. See also the section below, Third Party Sites and Links.

• Provision of products and services. We use your personal information to provide services to fulfill our contract with you, including processing your payments, fulfilling your orders, sending you notifications regarding your account, purchases, returns, exchanges or other transactions, creating, maintaining and otherwise managing your account, arranging delivery, enabling returns and exchanges, and other functions and features related to your account.
• Marketing and advertising. We may use your personal information for marketing and promotional purposes, for example, to send you marketing, advertising and promotional communications by email, text message or regular mail, and to display advertisements for products or services. This may include using your personal information to better tailor services and advertising on our website and other websites. If you are a resident of the EEA, the legal basis for these data processing activities is our legitimate interest in the sale of our products in accordance with Art. 6 (1) (f) GDPR.
• Security and fraud prevention. We use your personal information to detect, investigate or act on potential fraudulent, illegal or malicious activity. If you choose to use the Services and register an account, you are responsible for the security of your account credentials. We recommend that you do not share your username, password or other access information with anyone else. If you believe your account has been compromised, please contact us immediately. If you are a resident of the EEA, the legal basis for these data processing activities is our legitimate interest in ensuring the security of our website for you and other customers in accordance with Art. 6 (1) (f) GDPR.
• Communicating with you and improving the Services. We use your personal information to provide customer support and improve our services. It is in our legitimate interest to be able to respond to you, provide you with efficient services and maintain a business relationship with you in accordance with Art. 6 (1) (f) GDPR.

Like many other websites, we use cookies on our website. For specific information about the cookies we use in connection with the operation of our Shopify store, see https://www.shopify.com/legal/cookies . We use cookies to operate and improve our website and our services (including remembering your actions and settings), to perform analytics and better understand how users interact with the services (in our legitimate interest to manage, improve and optimize the services). We may also allow third parties and service providers to use cookies on our website to better customize services, products and advertising on our website and other websites. Most browsers automatically accept cookies by default, but you can set your browser to remove or reject cookies through your browser controls. Please note that removing or blocking cookies may negatively impact your user experience and may cause some services, including certain features and general functionality, to function incorrectly or become unavailable. In addition, blocking cookies may not completely prevent the sharing of information with third parties, such as our advertising partners.

In certain circumstances, we may disclose your personal information to third parties for contract performance purposes, lawful purposes and other reasons in accordance with this Privacy Policy. Such circumstances may take place:

• with vendors or other third parties who perform services on our behalf (eg IT management, payment processing, data analysis, customer support, cloud storage, fulfillment and shipping);
• with business and marketing partners, to provide services and advertising. Our business and marketing partners will use your information in accordance with their privacy notices;
• with your consent when you instruct us, request or otherwise consent to the disclosure of certain information to third parties, such as to ship products or through the use of social networking tools or login integrations;
• with our affiliates or otherwise within our group of companies in our legitimate interest for successful business;
• in connection with a business transaction, such as a merger or bankruptcy, to comply with any applicable legal obligations (including responding to subpoenas, search warrants and similar requests), to enforce any applicable Terms of Service, and to protect or defend the Services, our rights and our users or others.

We disclose the following categories of personal data and sensitive personal data about users for the purposes set out above. "How we collect and use your personal information" and "How we disclose personal information" : CategoryCategory of recipients

• Identifiers such as basic contact information and certain order and invoice information.
• Commercial data such as order data, shopping data and customer support data.
• Internet activity or other similar network activity, such as usage data.
• Geolocation data, such as locations determined by IP address or other technical measures.
• Vendors and third parties that perform services on our behalf (for example, ISPs, payment processors, order fulfillment partners, customer support partners, and data analytics providers).
• Business and marketing partners
• Branch offices

We do not use or disclose sensitive personal information without your consent or to make inferences about your characteristics. With your consent, we share personal information for advertising and marketing purposes as follows.

Our website may contain links to websites or other online platforms operated by third parties. If you follow links to websites that are not affiliated with or under our control, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of these websites, including the accuracy, completeness or reliability of the information found on these websites. Information that you provide on public or semi-public sites, including information that you share on third-party social networking platforms, may be viewed by other users of the Services and/or users of those third-party platforms without limitations on their use by us or third parties persons. Our inclusion of such links does not in itself imply that we endorse the content on such platforms or their owners or operators, except as disclosed on the Services.

The Services are not intended for children and we do not knowingly collect personal information about children. If you are the parent or guardian of a child who has provided us with their personal data, you can contact us using the contact details below and request their deletion. As of the effective date of this Privacy Policy, we are not aware of "sharing" or "selling" (as those terms are defined in applicable law) personal information of individuals under the age of 16.

You should be aware that no security measures are perfect or foolproof and that we cannot guarantee "perfect security". In addition, any information you send us may not be secure in transit. We recommend that you do not use unsecured channels to transmit sensitive or confidential information to us. How long we keep your personal information depends on various factors, such as whether we need it to maintain your account, provide services, comply with legal obligations, resolve disputes or enforce other applicable agreements and policies.

Depending on where you live, you may have some or all of the rights listed below in relation to your personal data. However, these rights are not absolute and may only be exercised in certain circumstances, and in certain cases we may refuse your request as permitted by law.

• Right of access/notification : You may have the right to request access to the personal data we hold about you, including details of how we use and share your data.
• Right to erasure : You may have the right to request that we delete the personal data we hold about you.
• Right to rectification : You may have the right to request that we correct inaccurate personal data we hold about you.
• Right to portability : In certain circumstances and subject to certain exceptions, you may have the right to receive a copy of the personal data we hold about you and to request that we transfer it to a third party.
• Right to Withdraw Consent to Sale or Sharing or Targeted Advertising : You may have the right to instruct us not to “sell” or “share” your personal information, or to withdraw consent to the processing of your personal information for purposes that are considered to be “ targeted advertising” as defined in applicable privacy laws. Please note that if you visit our website with your GPC Signal consent withdrawn, depending on your location, we will automatically treat this as a request to withdraw your consent to "sell" or "share" the device and browser data you use to site visit.
• Restriction of processing : You may have the right to request that we stop or restrict the processing of personal data.
• Withdrawal of consent : If we rely on consent to process your personal data, you may have the right to withdraw that consent.
• Appeal : You may have the right to appeal our decision if we refuse to consider your request. You can do this by directly responding to our rejection.
• Managing your communication preferences : We may send you promotional emails, and you can opt-out of receiving them at any time through the unsubscribe option that appears in our emails. If you opt out, we may still send you non-promotional emails, such as about your account or orders you have placed.

You can exercise any of these rights if set out on our website or by contacting us using the contact details below. We will not discriminate against you for exercising any of these rights. We may need to collect information from you to verify your identity, such as your email address or account information, before responding to your request in substance. In accordance with applicable laws, you may designate an authorized representative to file requests on your behalf to exercise your rights. Before we accept such a request from an agent, we will ask them for proof that you have authorized them to act on your behalf, and we may ask you to verify your identity directly with us. We will respond to your request in a timely manner as required by applicable law.

If you have any complaints about how we process your personal data, please write to us at the contact details below. If you are not satisfied with our response to your complaint, depending on where you live, you have the right to appeal our decision by contacting us using the contact details below or by lodging a complaint with your local data protection authority. A list of competent data protection supervisory authorities for the EEA is available here .

Please note that we may transfer, store and process your personal data outside the country in which you live. Your personal data is also processed by employees and third-party service providers and partners in these countries. If we transfer your personal data out of Europe, we will rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses or equivalent contracts issued by the relevant UK competent authority, unless the data is transferred to a country where has been found to provide an adequate level of protection.

If you have any questions about our privacy practices or this privacy policy, or if you wish to exercise any of the rights available to you, please call or email us at info@puffy.si or contact us at PUFFI, Vrenska gorca 16, 3255 Buče. In accordance with applicable data protection laws and unless expressly stated otherwise, we are the controller of your personal data.