WHY NOT — Privacy Policy

Last updated: 14.10.2026

1. Who We Are

This Privacy Policy explains how the operator of why-not.co processes personal data.

Data controller: Mark Seserko
Business address: Vodovodna ulica 17, 2000 Maribor
Privacy contact: mark.seserko@why-not.co

2. Personal Data We Collect

Depending on how you interact with our Website, we may process:

• Contact details, such as your name, email address, telephone number and delivery address.

• Order information, including products purchased, order history, payment status and returns.

• Payment-related information supplied by our payment service providers. Full card details may be processed directly by the relevant provider rather than stored by us.

• Customer support messages and information you choose to provide.

• Technical and usage information, such as device information, IP address, Website interactions and cookie identifiers, where lawfully collected.

• Marketing preferences and consent records, where applicable.

We do not intentionally request unnecessary sensitive personal data.

3. Purposes and Legal Bases

We process personal data for the following purposes, as applicable:

Order fulfilment and customer service: to process orders, accept payments, arrange delivery, handle returns and respond to enquiries. The legal basis is generally performance of a contract or steps requested before entering into a contract.

Legal and accounting obligations: to comply with applicable tax, accounting, consumer protection and other legal requirements.

Fraud prevention and security: to protect our Website, transactions, customers and business against fraud, abuse and security incidents, where processing is necessary and proportionate and supported by an appropriate legal basis.

Website analytics: to understand Website performance and improve the shopping experience. Where required, analytics technologies will only be activated after valid consent.

Marketing communications: to send promotional emails where we have valid consent or another lawful basis permitted by applicable law. Where consent is required, you may withdraw it at any time.

4. Who Receives Personal Data

Depending on the transaction and services used, relevant data may be shared with:

• Shopify, which provides our e-commerce platform.

• Shopify Payments and relevant payment-processing partners.

• Shipping carriers and fulfilment providers.

• Email marketing providers, such as Shopify Email or Klaviyo, if used.

• Analytics or advertising providers, such as Google or Meta, if configured and lawfully activated.

• Professional advisers, public authorities or other recipients where necessary and legally permitted.

We do not authorise service providers to use personal data for unrelated purposes merely because they receive it from us. The applicable contracts, privacy terms and legal roles must be assessed for each provider.

5. International Data Transfers

Some service providers may process data outside the European Economic Area.

Where personal data is transferred internationally, we will apply the safeguards required by applicable law, where relevant including an adequacy decision or appropriate contractual safeguards.

Further information about applicable safeguards may be requested through info@why-not.co.

6. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal retention requirements.

Order, accounting and tax records may need to be retained for statutory periods. Customer support records, marketing preferences, analytics information and other data will be retained according to their purpose, applicable law and documented retention practices.

7. Your Rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• Request access to your personal data.

• Request correction of inaccurate data.

• Request erasure of data.

• Request restriction of processing.

• Receive certain data in a portable format.

• Object to certain processing, including direct marketing.

• Withdraw consent at any time where processing is based on consent.

• Lodge a complaint with the competent data protection supervisory authority.

To exercise your rights, contact info@why-not.co. We may need to verify your identity reasonably before responding.

Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

8. Marketing Emails

You can unsubscribe using the link included in marketing emails or contact info@why-not.co.

We may still send necessary transactional communications relating to purchases, deliveries, account security or legal obligations.

We will not treat consent to marketing as a condition of purchasing a product where the law prohibits that practice.

9. Cookies and Similar Technologies

Our Website may use essential technologies needed for functions such as checkout, security and remembering consent choices.

Analytics and advertising technologies may also be used if enabled. Where required by law, they will remain inactive until valid consent is obtained.

For further information, see our Cookie Policy and the cookie preference controls available on the Website.

10. Children's Data

Our Website is intended for people legally able to make purchases under the applicable law. We do not knowingly collect children's personal data for purposes unrelated to the operation of the Website.

If you believe a child has provided personal data inappropriately, contact info@why-not.co so that we can assess the request and take appropriate action.

11. Security

We implement reasonable technical and organisational measures appropriate to the nature of the personal data and the risks involved.

No online service can guarantee absolute security. If a personal data breach occurs, we will take the steps required by applicable law.

12. Changes to This Policy

We may update this Policy to reflect changes in our practices, services or legal obligations. The updated version will be published on the Website with a revised date.

13. Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please call +386 41 884 780 or email us at info@why-not.co or contact us at Vodovodna ulica 17, 2000 Maribor, Slovenia. For the purpose of applicable data protection laws, we are the data controller of your personal information.