Privacy Policy

Stone Roots Olive Oil Club

Version 1.1 · Date: 1 August 2026

1. Introduction

BLOODY ROOTS d.o.o. (hereinafter: we, us, or Company) is committed to protecting the personal data of individuals who interact with our website and web shop. This Privacy Policy explains what personal data we collect, on what legal basis, for what purposes, how long we retain it, to whom we disclose it, and what rights data subjects have under the General Data Protection Regulation (EU) 2016/679 (hereinafter: GDPR) and applicable Slovenian law.

This Privacy Policy applies to all personal data processing activities carried out by the Company as a data controller in connection with: (i) the operation of our website and web shop; (ii) direct marketing communications, including our newsletter and our WhatsApp channel; and (iii) communication with individuals who contact us.

Please read this Privacy Policy carefully. By using our website or web shop, subscribing to our newsletter, joining our WhatsApp channel, or otherwise interacting with us, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

Data Controller is BLOODY ROOTS d.o.o., Podbreznik 15, 8000 Novo mesto, Slovenia, registration number: 7331231000, email: hello@stoneroots.club, telephone: +386 51 874 447.

We are not required to appoint a data protection officer under Article 37 GDPR and we have not appointed one. For any questions regarding this Privacy Policy or the exercise of your data protection rights, please contact us at the email address set out above.

3. Categories of Data Subjects and Personal Data Collected

We process personal data of the following categories of data subjects.

3.1. Newsletter and informational subscribers

Persons who voluntarily submit their email address to receive newsletters or informational communications about our offerings. We collect:

• email address;

• name, if voluntarily provided;

• date and time of subscription and confirmation of consent;

• signup source and selected website language;

• records of the delivery, opening of and clicks within our messages.

3.2. Subscribers to our WhatsApp channel and messaging list

Persons who submit their telephone number in order to receive notifications about new drops, or who join our WhatsApp channel. We collect:

• telephone number;

• name or WhatsApp profile name, where displayed to us;

• date and time of subscription and confirmation of consent;

• the content of messages you send us through this channel.

Telephone numbers submitted through our website are stored in our email and messaging platform. Messages are sent from our WhatsApp Business profile. The WhatsApp service is provided by Meta Platforms Ireland Limited, which processes data relating to your use of WhatsApp as an independent controller under its own terms and privacy policy, over which we have no control. In a WhatsApp channel, members do not see one another's telephone numbers; the number of the channel operator is visible, and Meta processes the numbers of all participants.

3.3. Web shop customers

Persons who place orders through our web shop. We collect:

• first name and last name;

• email address;

• delivery and billing address;

• telephone number;

• payment data, processed directly by our payment service provider, as we do not store full payment card details;

• IP address and technical data generated during the use of our web shop;

• order history and transaction records, including invoices, returns, withdrawals and complaints.

3.4. Persons who contact us

Persons who write to us by email, call us, or contact us through our social media profiles. We collect the contact details you use, the content of your message and any data you provide in it, and our reply.

3.5. Persons whose reviews or contributions we publish

Where you send us a review, a photograph or another contribution and we publish it, we process your first name or the name under which you asked to appear, the content of the contribution, and the fact of your purchase where we verify it. Publication is based on your consent and you may ask us to remove it at any time.

We do not process special categories of personal data under Article 9 GDPR, and we ask you not to send us such data.

4. Purposes of Processing and Legal Bases

We process personal data only where we have a valid legal basis.

We process data to send newsletters and informational communications to subscribers who have signed up via our website, and to send notifications about drops to subscribers of our WhatsApp channel and messaging list, based on consent obtained at the time of sign-up via a clear affirmative action (Article 6(1)(a) GDPR). You may withdraw consent at any time.

We may send marketing communications to existing customers regarding our own similar products and services based on our legitimate interest in marketing our offerings to persons who have already purchased from us (Article 6(1)(f) GDPR). You may object at any time.

We process data to execute and manage contracts for the purchase of products through the web shop, including delivery, payment, invoicing, returns, withdrawals and complaints, where processing is necessary for the performance of a contract to which you are a party (Article 6(1)(b) GDPR).

We process data to provide pre-contractual information and to respond to enquiries where processing is necessary to respond to your requests prior to entering into a contract (Article 6(1)(b) GDPR), or, where no contract is contemplated, on the basis of our legitimate interest in communicating with people who contact us (Article 6(1)(f) GDPR).

We process data to comply with legal obligations, including accounting, tax, food safety and consumer protection law, where Slovenian and EU law require us to retain certain records for specified periods (Article 6(1)(c) GDPR).

We process technical data to ensure the security and proper functioning of our website and web shop, to prevent fraud and abuse, and to establish, exercise or defend legal claims, based on our legitimate interest in maintaining the security, integrity and performance of our systems and in protecting our rights (Article 6(1)(f) GDPR).

We publish reviews and contributions on the basis of your consent (Article 6(1)(a) GDPR).

Cookies and similar technologies that are not strictly necessary are used on the basis of your consent, as described in Section 5 below.

Where we rely on legitimate interests as our legal basis, we have carried out a balancing test to ensure that our interests are not overridden by the interests, fundamental rights or freedoms of data subjects. You may request further information about that assessment.

Is the provision of data mandatory? Providing your delivery and contact details is a contractual requirement and is necessary in order for us to conclude and perform a purchase contract. If you do not provide them, we cannot process your order. Providing your email address or telephone number for our newsletter or WhatsApp channel is voluntary, and the only consequence of not providing it is that you will not receive those communications.

5. Cookies and Similar Technologies

Our website and web shop use cookies and similar technologies. Strictly necessary cookies, which keep the cart, the session and the checkout working and protect the site against abuse, are used on the basis of our legitimate interest and the performance of the contract. Analytics, preference and marketing cookies are used only on the basis of your consent, which you give through the cookie banner and can withdraw at any time.

A full list of the cookies used, their purposes and their durations, together with instructions on how to change your choices, is set out in our Cookie Policy: https://stoneroots.club/cookies/

6. Retention Periods

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply.

Newsletter and WhatsApp subscriber data (consent-based). Until withdrawal of consent, plus a short period of up to 30 days for technical deletion. Records of consent are retained for up to 3 years from the date of consent as evidence of lawful processing.

Web shop order data and customer account data. Up to 10 years from the date of the transaction, in accordance with Slovenian accounting and tax law requirements.

Payment transaction records. Up to 10 years from the date of transaction, as required by applicable financial and tax law.

Returns, withdrawals and complaints. Up to 5 years from the closure of the matter, in line with the general limitation period for claims.

Correspondence and enquiries not leading to a contract. Up to 1 year from the enquiry, unless converted into a contract relationship.

Technical data and logs, including IP addresses and access logs. Up to 12 months from collection, unless retention for a longer period is required for security investigations or legal proceedings.

Published reviews and contributions. Until you withdraw consent or ask us to remove the contribution.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized.

7. Recipients and Processors

We may share personal data with the following recipients, who act as our data processors or, in certain cases, as independent controllers. Processors act on our instructions under data processing agreements concluded in accordance with Article 28 GDPR.

We do not sell personal data and we do not disclose it to third parties for their own marketing purposes.

8. International Transfers

Some of our processors are established outside the European Economic Area (EEA) or use sub-processors or infrastructure located outside the EEA, in particular in the United States and Canada. This applies, among others, to Shopify, Cloudflare, Meta and Google.

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards under Chapter V GDPR are in place, namely:

• an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified under it; or

• Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR, supplemented where necessary by additional technical and organisational measures identified in a transfer impact assessment.

You may request a copy of the safeguards applied by writing to hello@stoneroots.club.

Where you choose to communicate with us through WhatsApp, Instagram or another platform operated by a third party, the data you share there is also processed under that platform's own terms and transfer mechanisms, over which we have no control.

9. Information Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. These include encrypted transmission (TLS) across our website and web shop, access controls and strong authentication for the systems we use, restriction of access to those who need it, and contractual security obligations on our processors.

Full payment card details are never stored on our systems and are handled directly by our payment service provider on certified infrastructure.

No transmission over the internet can be guaranteed to be completely secure. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you and the supervisory authority in accordance with Articles 33 and 34 GDPR.

10. Rights of Data Subjects

Under the GDPR, data subjects have the following rights in relation to their personal data processed by us. These rights are subject to certain conditions and limitations as provided for under applicable law.

Right of access. You have the right to obtain confirmation as to whether we process personal data concerning you and, if so, to receive a copy of that data and related information.

Right to rectification. You have the right to request correction of inaccurate personal data and completion of incomplete personal data concerning you.

Right to erasure (right to be forgotten). You have the right to request deletion of your personal data where, among other grounds, the data is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing.

Right to restriction of processing. You have the right to request that we restrict processing of your personal data in certain circumstances, for example while accuracy is contested or where processing is unlawful but you oppose erasure.

Right to data portability. Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to object. You have the right to object at any time to processing based on legitimate interests, including profiling. You also have an unconditional right to object to direct marketing. We will cease processing unless we can demonstrate compelling legitimate grounds.

Right to withdraw consent. Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To unsubscribe from our newsletter, use the unsubscribe link in any email or contact us directly. To leave our WhatsApp channel, use the leave option in the application or write to us.

Right not to be subject to automated decision-making. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you. We do not carry out such processing.

Right to lodge a complaint with a supervisory authority. You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for the Company is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si. We encourage you to contact us first before lodging a complaint with the supervisory authority, as we will endeavour to resolve any concerns directly.

To exercise any of the above rights, please contact us at the contact details provided above. We will respond to your request within one month of receipt, which may be extended by a further two months where necessary given the complexity or number of requests. We may need to verify your identity before processing your request.

11. Processing of Children's Personal Data

Our website and services are not intentionally directed at children under the age of 15. Where processing is based on consent, we require data subjects to be at least 15 years of age. Persons under 15 years of age may only consent to processing with the authorization of their parent or legal guardian.

We do not knowingly collect personal data from children under 15 without verifiable parental consent. If you are a parent or guardian and believe that your child has provided personal data to us without your consent, please contact us at the email address above so that we may take appropriate action.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law, or regulatory guidance. The current version of the Privacy Policy is always available on our website.

Where changes are material, we will notify data subjects by appropriate means, for example by email or by prominent notice on our website, prior to the changes taking effect. The date of the most recent revision is indicated at the top of this document.

BLOODY ROOTS d.o.o.

Podbreznik 15, 8000 Novo mesto, Slovenia

Registration number 7331231000 · VAT SI91306094

hello@stoneroots.club · +386 51 874 447

Version 1.1, 1 August 2026