Privacy policy
Last updated: 4 November 2026
This policy explains how we handle your personal information when you visit PurePeak, place an order, contact us or subscribe to our news. Our store runs on Shopify. Optional analytics and marketing are separate from the information we need to deliver your order.
1. Who is responsible for your information
PEAKCARBON, proizvodnja in trgovina, d.o.o. (PEAKCARBON d.o.o.), trading as PurePeak, is the controller of the customer information we use to run our business.
Uriskova ulica 353320 Velenje, Slovenia
Email: info@pure-peak.com
Telephone: +386 31 300 787
You can contact us using these details about your information or privacy rights. Some providers also act as controllers for their own services, as explained below.
2. Information we collect and where it comes from
- Orders and delivery: your name, email, telephone number, billing and delivery addresses, products and quantities, prices, discounts, taxes, delivery instructions and order history. For a business purchase, we may also need your company name and VAT number.
- Payments and invoices: payment method, payment status, transaction references, invoices and refund records. Payment providers handle card and wallet credentials. We do not ask you to email us card numbers or security codes.
- Questions, returns and warranty requests: your messages, relevant order details and any information or photographs you choose to send us.
- Subscriptions and referrals: your email, subscription choices and related records; an affiliate link or code, referral identifiers and the order information needed to calculate a commission.
- Website activity: IP-related and device information, browser type, pages and links used, referral sources, campaign identifiers, clicks, scrolling and shopping events. Optional collection depends on your privacy choices and the service concerned.
We receive information directly from you, from your browser and from the services we use, such as Shopify, payment providers, delivery services and referral tools. Our previous store and email service may hold records of earlier orders or subscriptions. A migration does not turn an unsubscribed contact into a subscriber.
3. Why we use information
| Purpose | Legal basis for our processing |
|---|---|
| Take your order, arrange payment and delivery, and handle requested returns or support. | Steps you request before a purchase and performance of our contract, GDPR Article 6(1)(b). |
| Issue and keep invoices, handle tax requirements and respond to binding legal requests. | Applicable legal obligations, Article 6(1)(c). |
| Send optional newsletters; use non-essential analytics, advertising and referral tracking. | Your consent, Article 6(1)(a), and the applicable rules on electronic marketing and tracking. |
| Protect the store, investigate fraud, manage ordinary business correspondence and establish or defend claims. | Our legitimate interests in security, business administration and protecting legal rights, Article 6(1)(f), where these do not override your rights. |
We also use an affiliate code you apply and the necessary order records to verify referrals and settle commissions. Our legitimate interest is administering our referral partnerships and preventing incorrect commission claims, subject to your rights. This is separate from optional browser tracking.
Necessary order information is required to complete and deliver your purchase. Optional tracking and a newsletter subscription are not conditions of purchase. The delivery telephone number is used for delivery arrangements, including contact by the carrier.
4. Shopify and payment services
Shopify hosts our store and supports checkout, order records, customer accounts where used, security and payment services. It processes information to provide these services to us.
We also have Shopify Network Intelligence enabled. Shopify uses information from interactions with our store, other merchants and Shopify to provide enhanced services, including personalization, security and advertising features. For this processing, Shopify is responsible for its own use of the information. Other merchants do not receive access to our customer records through this feature.
Read the Shopify Consumer Privacy Policy. You can exercise rights relating to Shopify's own processing through its Privacy Portal. Our data-sharing opt-out page provides additional choices where applicable.
The payment service you choose receives the information needed to process the payment and perform its security checks. Available options can include Shopify Payments, Shop Pay, PayPal, supported wallets and Klarna, depending on your location and device. For a bank transfer, our bank processes the transfer details. These providers may have their own legal obligations and privacy notices, shown in their services or during checkout.
Payment providers may use automated fraud checks. If you choose a credit or pay-later method, the provider may also make eligibility decisions under its own terms. Contact the provider about those decisions, and contact us about any issue with your PurePeak order.
5. Delivery, invoices and business support
We share the delivery name, address, telephone number and relevant shipment details with FedEx or another carrier used for your delivery. Customs authorities and delivery partners may require order, value and recipient information for an international shipment. FedEx acts as a controller for its own delivery operations, as described in its Global Privacy Notice.
We use e-racuni.com, supplied by E-RAČUNI d.o.o., for invoicing and accounting records. Our accounting advisers and authorized support providers may access the records needed for their work. See the provider's privacy and data-processing information.
We may disclose relevant information to authorities when legally required and to professional advisers when needed to handle a claim or business obligation.
6. Analytics and advertising
Google Analytics helps us understand visits and shopping activity. Depending on your permissions, Google receives device and browser identifiers, pages visited, referral information and shopping events. These identifiers are not the same as anonymous information.
When Google Ads conversion measurement is enabled, it helps connect an ad interaction with an action in our store. Enhanced conversions can use customer-provided details, such as email, name, telephone or address, to improve matching. Relevant identifiers are hashed; hashing does not make the data anonymous, and some location fields may be sent without hashing. Read how Google uses information from partner sites and the Google Privacy Policy.
Meta's Facebook and Instagram integration uses the Meta Pixel and Conversions API with advanced matching. It can send page and shopping events, browser or click identifiers, order details and matching information such as name, email, telephone and location. Meta can associate information with its own accounts to measure and improve advertising. Some events are sent from Shopify's servers rather than your browser. Server-side delivery does not remove the need for the relevant privacy permissions. See Meta's Privacy Policy.
Advertising services can use activity to infer interests and personalize advertising. You can change your store choices through Cookie preferences in the footer and manage additional choices in your Google or Meta account.
7. Microsoft Clarity
When enabled and with the relevant privacy permissions, Microsoft Clarity heatmaps and session replays help us understand how people navigate the store and identify usability problems. It can process page URLs and layout, clicks, scrolling, browser and device information, IP-related information and identifiers.
Our Clarity project is configured to use Strict masking for page text. Masking is a safeguard; it does not make all usage information anonymous. Microsoft acts as an independent controller for its processing, which can include improving its services and creating advertising profiles. Its terms also allow use of non-personal data for research and development, including AI.
Microsoft states that normal playback data is retained for 30 days; heatmap/click data and labelled or favourited sessions can remain for nine months. Read the Microsoft Privacy Statement and Clarity retention information.
8. Affiliate referrals
We use GoAffPro to manage referral links, assigned discount codes and commissions. An applied affiliate code can identify a referral separately from a stored tracking cookie. Our referral-link attribution window is 30 days; this is not the retention period for all order or commission records.
Referral information can include an affiliate identifier, referral activity and the order details needed to verify a commission. In the current partner portal configuration, customer contact and shipping details are hidden from affiliates. Affiliates can view the referral and commission information made available for their partnership.
GoAffPro is provided by ARV TECH, based in Sirsa, Haryana, India. For the affiliate and referral processing carried out on our instructions, ARV TECH acts as our processor under a Data Processing Agreement. The agreement incorporates the European Commission's Standard Contractual Clauses, Module Two (controller to processor), for transfers from the EEA to India. You can contact info@pure-peak.com for information about these safeguards and to request a copy, with confidential information redacted where necessary.
GoAffPro's notices describe processing outside the EEA, including India-based operations and hosting locations in Germany, the United States and Singapore. Its own controller activities are described in its portal privacy notice and merchant privacy policy.
9. Email and subscriptions
We use your contact details to answer questions and send order or service messages. These messages are separate from optional product news and offers. Our business correspondence uses Google/Gmail together with domain-email infrastructure operated by NEOSERV (Avant.Si d.o.o.). These services can process message content, contacts and technical delivery information.
If you subscribe to our news, we use your email and subscription preferences for that purpose. You can unsubscribe using the link in a marketing email or by contacting info@pure-peak.com. Buying a shovel does not by itself subscribe you. Unsubscribing from marketing does not prevent essential messages about an order.
Our existing newsletter list is held in Brevo during the transition to a new system. Subscription records, earlier campaign activity and suppression records may remain there until the migration and agreed deletion process are complete. See Brevo's Privacy Policy.
10. Cookies and similar technologies
Cookies are small files stored in your browser. Related tools can use local storage, pixels, identifiers and server-side events. Not all tracking depends on a cookie.
| Category | Purpose |
|---|---|
| Required | Operate the store, remember your cart and privacy choices, protect checkout and provide the service you request. |
| Personalization | Remember optional preferences or provide optional personalized features where enabled. |
| Analytics | Understand visits and shopping activity and improve the site through services such as Shopify analytics and Google Analytics. |
| Marketing | Measure advertising, support relevant ads and attribute affiliate referrals through the configured services. |
Some tools require more than one permission. The current Clarity integration declares both analytics and marketing permissions; choosing analytics alone does not authorize every tool described in this policy.
Use the banner to Accept all, Reject optional or Manage preferences. You can reopen Cookie preferences in the footer at any time and save a different selection. Refusing optional purposes does not prevent a purchase. Withdrawal does not undo earlier lawful processing.
Changing your choices does not necessarily remove cookies already stored in your browser. Your browser also lets you remove or block stored cookies. Blocking required cookies can affect the cart or checkout. Deleting cookies can remove the saved record of your choices, so you may be asked again.
Cookie lifetimes and server-side record retention are different. Shopify publishes its current cookie list and durations; Google and Microsoft provide Google Analytics cookie information and Clarity cookie information.
11. International processing
Shopify currently reports EU hosting for our store's customer data. This does not mean that all processing stays in the EEA. Providers, their support teams and subprocessors may process data in other countries, including the United States. Some services described above have additional international operations.
Transfers requiring protection under GDPR must use an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses and any necessary additional measures. Contact us for information about the arrangements relevant to your data and how to obtain a copy of applicable safeguards.
12. How long we keep information
We keep information for the purposes and periods below. Our retention rules include the review points described here; they are not automatic deletion deadlines. Legal obligations and unresolved matters can require some records to remain.
- Invoices: generally ten years after the end of the calendar year to which they relate, as required for Slovenian VAT records.
- Order, delivery, return and warranty records: while needed to complete the transaction, address the applicable return or warranty obligations and handle associated legal claims. Where information forms part of a required accounting record, the legal retention rule applies to that record.
- Ordinary correspondence: our review point is 24 months after an enquiry is closed, to identify information no longer needed. Records required for an order, an unresolved issue, a legal obligation or a specific claim are handled under the relevant rule instead.
- Abandoned checkouts: our review point for unnecessary contact information is 90 days after abandonment. A checkout that becomes an order follows the order and accounting rules. Starting checkout does not by itself subscribe you to marketing.
- Newsletter records: while you remain subscribed, with a review point for inactive marketing contacts after 24 months. After an unsubscribe, we keep only the limited suppression and consent evidence needed to respect your choice and demonstrate lawful processing, unless another legal basis requires a record to remain.
- Affiliate records: while required to administer the relationship, settle commissions and handle claims; accounting records follow the applicable legal period.
- Google Analytics: the configured retention for user-level and event-level data is up to 14 months. The user-data expiry can reset when there is new activity. These settings do not apply to most standard aggregated reports.
- Clarity: the provider periods described in section 7. Other advertising records follow the configured service retention and applicable deletion rules.
We may retain relevant information longer for a specific legal requirement or an ongoing claim, with access limited to that purpose. A cookie's expiry does not itself delete an invoice or an already-collected service record.
13. Your rights and choices
Subject to the applicable rules, you can ask for access, correction, deletion, restriction or portability of your information. You can object to processing based on legitimate interests and to direct marketing, and withdraw consent where processing relies on it.
Email info@pure-peak.com to exercise your rights. We may request proportionate information to verify your identity. We normally respond within one month; if the law allows an extension, we will explain it within that period. Some records must remain for legal obligations or claims. We will not discriminate against you for exercising applicable privacy rights.
You can complain to Slovenia's Information Commissioner, or another competent supervisory authority. You do not have to contact us before making a complaint.
Depending on your location, advertising disclosures can count as a sale, sharing or targeted advertising under local privacy law. Use our data-sharing opt-out page and the Shopify Privacy Portal where applicable. Shopify's supported Global Privacy Control handling may also apply. Browser opt-out signals and email unsubscribes are separate choices.
14. Other websites, security and updates
Following an external review, social-media or payment link takes you to a service with its own privacy information. Please avoid sending unnecessary sensitive details in support messages.
We use access controls and the security features of our business systems to protect information. No system offers an absolute security guarantee. Our store is not directed at children; contact us if you believe a child has provided information that should be removed.
We will update this policy when our actual services or practices change and provide any further notice or consent request required by law. A changed policy is not, by itself, your consent to a new optional purpose.