Privacy protection

Information obligation of the controller pursuant to Article 13 GDPR for customers and visitors of the Top4Mobile online store.

1. Introductory information

This document explains how we process the personal data of customers and visitors of the Top4Mobile online store. It applies in particular to the use of the e-shop, placing an order, registering a customer account, payment, delivery, complaints, returns, communication with customer support, sending newsletters, the use of cookies, and traffic or advertising measurement.

These principles apply to the Top4Mobile online store and its language or domain versions operated by Shield-Sk s. r. o. Cookies are also covered on a separate page dedicated to cookies.

2. Personal data controller

The controller of personal data is:

Shield-Sk s. r. o.

Registered office: Ulica Rudolfa Mocka 3750/2A, 841 04 Bratislava, Slovak Republic

Company ID: 46701494

Tax ID: 2023549671

VAT ID: SK2023549671

E-mail for questions regarding personal data protection: info@top4mobile.eu

Hereinafter referred to as the “controller”, “we”, “us” or “our”.

3. What personal data we process

We process only personal data that is necessary for a specific purpose. Depending on the situation, this may include in particular the following data:

first name and surname,
billing and delivery address,
e-mail address,
telephone number,
order details and details of purchased goods,
data necessary for receiving, matching or refunding a payment,
data necessary for handling a complaint, return of goods or withdrawal from the contract,
data from communication with customer support,
customer account data, if you create one,
technical data about the use of the website, such as IP address, cookies, device identifiers, browser type and data on behaviour on the website,
data necessary for sending newsletters and marketing communication.

We do not request any data from you that is not necessary for processing an order, providing a service or fulfilling a legal obligation.

4. Order processing and delivery of goods

We process your personal data so that we can accept and process your order, confirm its receipt, prepare the goods, issue documents, deliver the shipment and communicate with you about the status of the order.

Legal basis: performance of a contract or taking steps prior to entering into a contract pursuant to Article 6(1)(b) GDPR.

Processed data: in particular first name, surname, billing and delivery address, e-mail, telephone number, order details and data necessary for delivery.

Retention period: during order processing and subsequently for the period necessary to protect legal claims. Accounting documents are generally retained for 10 years in accordance with the law.

5. Payments

When making a payment, we process data necessary for receiving, verifying, matching or refunding the payment. In the case of online payments, data may also be processed by the payment service provider.

Legal basis: performance of a contract pursuant to Article 6(1)(b) GDPR and compliance with legal obligations pursuant to Article 6(1)(c) GDPR.

Recipients: GoPay, Stripe, PayPal, banks, accounting providers and authorised persons of the controller.

Retention period: generally 10 years in accordance with accounting and tax regulations.

6. Transport and delivery of the shipment

In order to deliver the ordered goods to you, we provide the necessary data to the selected carrier or pick-up point. This includes in particular first name, surname, delivery address, telephone number, e-mail and shipment details.

Legal basis: performance of a contract pursuant to Article 6(1)(b) GDPR.

Recipients: carriers and logistics partners, for example Packeta, GLS, DPD, Slovenská pošta or other carriers depending on the selected country and delivery method.

Retention period: during order processing and subsequently for the period necessary to handle any delivery-related complaints, delivery issues or legal claims.

7. Customer account

If you create a customer account, we process data necessary for maintaining the account, logging in, displaying order history and making shopping easier.

Legal basis: performance of a contract pursuant to Article 6(1)(b) GDPR, or legitimate interest pursuant to Article 6(1)(f) GDPR consisting in providing customer convenience and account administration.

Retention period: for the duration of the customer account. You may cancel your account at any time. This does not affect the retention of data that we must retain due to legal obligations or the protection of legal claims.

8. Complaints, returns and withdrawal from the contract

We also process your data when handling complaints, returns of goods, withdrawal from the contract, exchange of goods or other customer requests.

We process in particular identification and contact data, order details, data about the goods, description of the defect or request and, where applicable, the bank account number for refunding the payment.

Legal basis: performance of a contract pursuant to Article 6(1)(b) GDPR, compliance with a legal obligation pursuant to Article 6(1)(c) GDPR and legitimate interest pursuant to Article 6(1)(f) GDPR in the protection of legal claims.

Retention period: generally 4 years from the handling of the complaint or request, or longer if necessary for the protection of legal claims.

9. Accounting and tax agenda

We process personal data stated on invoices, tax documents and accounting records for the purposes of maintaining accounting records, fulfilling tax obligations and archiving accounting documents.

Legal basis: compliance with a legal obligation pursuant to Article 6(1)(c) GDPR, in particular under the Accounting Act and tax regulations.

Recipients: accountants, tax advisers, auditors, public authorities and authorised persons of the controller.

Retention period: generally 10 years following the year to which the accounting documents relate.

10. Customer support and communication

If you contact us by e-mail, telephone, contact form, chat or any other means, we process data necessary for handling your request.

Legal basis: performance of a contract or pre-contractual communication pursuant to Article 6(1)(b) GDPR, or legitimate interest pursuant to Article 6(1)(f) GDPR consisting in providing customer support and keeping records of communication.

Retention period: during the handling of the request and subsequently for a reasonable period for the protection of legal claims. We generally retain ordinary customer communication for no longer than 3 years.

Recipients: euro.support as the provider of customer support and the ticketing system, or authorised persons of the controller.

11. Newsletter and marketing communication

If you subscribe to the newsletter, we process your e-mail address for sending news, discounts, promotions and marketing offers.

If you have purchased from us, we may send you similar commercial offers relating to our products, provided that you have not refused such sending and the law allows it.

Legal basis: consent pursuant to Article 6(1)(a) GDPR, or legitimate interest pursuant to Article 6(1)(f) GDPR when sending similar offers to existing customers.

Retention period: until consent is withdrawn or until you unsubscribe from the newsletter.

Unsubscribing: you can unsubscribe from the newsletter at any time by clicking the unsubscribe link in the e-mail or by contacting us at info@top4mobile.eu.

12. Ratings, reviews and customer satisfaction

After a purchase, we may ask you to rate the purchase, products or your satisfaction with our services. For this purpose, we may provide your e-mail address to the review service provider euro.reviews so that a review request can be sent to you.

Legal basis: legitimate interest pursuant to Article 6(1)(f) GDPR consisting in obtaining feedback and improving our services, or consent if required by the specific service.

Recipients: euro.reviews, within the scope of the e-mail address necessary for sending the review request.

Retention period: for the period necessary to send and evaluate the feedback, or in accordance with the rules of the review service.

13. Cookies, analytics and online advertising

We use cookies and similar technologies on our website. Necessary cookies are required for the functioning of the website, shopping cart, order process and security of the e-shop. Other cookies are used only according to your settings in the cookie bar.

For analytics and online advertising, we may use in particular Google Analytics, Google Ads and Meta Ads. These tools help us measure traffic, evaluate advertising performance, improve the website and display more relevant advertising.

Legal basis: necessary cookies are processed on the basis of legitimate interest and the technical necessity of operating the website. Analytical, advertising and personalisation cookies are used on the basis of your consent pursuant to Article 6(1)(a) GDPR.

You can change or withdraw your consent to cookies at any time through the cookie settings on our website.

Detailed information about specific cookies, their purpose, retention period and providers can be found on the separate Cookies page.

14. Website security and protection against misuse

We process technical data necessary for securing the website, preventing fraud, protecting against attacks, resolving technical incidents and ensuring the proper functioning of the e-shop.

Legal basis: legitimate interest pursuant to Article 6(1)(f) GDPR consisting in protecting the website, data, services and customers.

Retention period: technical logs are retained for the necessary period, generally from several days to several months, unless longer retention is necessary due to a security incident or legal claim.

15. Legal agenda and protection of legal claims

We may also process your personal data if this is necessary to prove, exercise or defend our legal claims, for example in disputes, debt recovery, insurance claims, inspections or communication with public authorities.

Legal basis: legitimate interest pursuant to Article 6(1)(f) GDPR.

Retention period: for the duration of the dispute or proceedings and subsequently until the expiry of the relevant limitation or archiving periods.

Recipients: legal advisers, attorneys, persons authorised to recover debts, insurance companies, courts, public authorities and authorised persons of the controller.

16. Handling data subject rights

If you exercise your rights under the GDPR, we process your data necessary for receiving, assessing and handling your request.

Legal basis: compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.

Retention period: generally 5 years from the handling of the request.

Recipients: authorised persons of the controller, legal advisers and, where necessary, the Office for Personal Data Protection of the Slovak Republic.

17. To whom we may provide personal data

We provide your personal data only to the extent necessary to fulfil a specific purpose. Recipients of personal data may include in particular:

carriers and pick-up points,
payment systems GoPay, Stripe and PayPal,
banks,
accountants, tax advisers and auditors,
providers of IT services, hosting, cloud services and technical support,
providers of e-mail and communication services,
providers of customer support and ticketing systems, in particular euro.support,
Google Analytics, Google Ads and Meta Ads, if you have granted the relevant consent to cookies or marketing processing,
euro.reviews within the scope of the e-mail address for sending a review request,
legal advisers, attorneys and persons authorised to recover debts,
public authorities, if such an obligation is imposed on us by law.

We have concluded contracts or have another legal basis ensuring the protection of personal data with persons who process personal data for us as processors.

18. Transfer of personal data outside the EU/EEA

Some of our technical, analytical or marketing partners may process personal data outside the European Union or the European Economic Area, especially in the case of global service providers such as Google or Meta.

If personal data is transferred outside the EU/EEA, we ensure that the transfer is carried out in accordance with the GDPR, in particular on the basis of an adequacy decision, standard contractual clauses or other appropriate safeguards under the GDPR.

19. How long we retain personal data

We retain personal data only for the period necessary to fulfil the purpose for which it was obtained, or for the period required by law.

Indicative retention periods:

orders and related communication: during order processing and subsequently for the period necessary to protect legal claims,
accounting and tax documents: generally 10 years,
customer account: for the duration of the account,
complaints and returns of goods: generally 4 years from handling,
newsletter: until unsubscribing or withdrawal of consent,
requests of data subjects under the GDPR: generally 5 years from handling,
technical and security logs: for the necessary period, generally from several days to several months,
legal agenda: for the duration of the dispute or until the expiry of the relevant limitation periods.

After the expiry of the relevant period, we delete or anonymise personal data if we no longer need it for another lawful purpose.

20. Automated decision-making and profiling

When processing personal data, we do not carry out automated individual decision-making that would have legal effects or a similarly significant impact on the customer.

On the website, we may use analytical and advertising tools that help measure traffic, evaluate advertising performance or display more relevant ads. Such processing is carried out only in accordance with cookie settings and granted consents.

21. How we protect personal data

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal data is granted only to authorised persons who need it to perform their work or contractual duties. Personal data is processed in information systems that we protect with appropriate security measures. We back up data to the extent necessary to ensure system availability and recovery.

22. Your rights

As a data subject, you have the following rights under the GDPR:

the right of access to personal data,
the right to rectification of inaccurate or incomplete data,
the right to erasure of personal data,
the right to restriction of processing,
the right to data portability,
the right to object to processing based on legitimate interest,
the right to withdraw consent, if the processing is based on consent,
the right to lodge a complaint with a supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

You may exercise your rights by e-mail at info@top4mobile.eu or in writing to the registered office address of the controller.

When handling your request, we may ask you to verify your identity if this is necessary to protect your data.

23. Right to lodge a complaint

If you believe that we process your personal data unlawfully or incorrectly, you may contact the supervisory authority:

Office for Personal Data Protection of the Slovak Republic

Galvaniho Business Centrum II

Galvaniho 7/B

821 04 Bratislava

Slovak Republic

E-mail: statny.dozor@pdp.gov.sk

24. Provision of personal data

Providing personal data is in some cases necessary for entering into or performing a contract, for example when placing an order, delivering goods or handling a complaint.

If you do not provide us with the necessary data, we may not be able to process the order, deliver the goods, provide customer support or fulfil legal obligations.

In the case of processing based on consent, the provision of data is voluntary and you may withdraw your consent at any time.

25. Changes to the Privacy Policy

We may update this Privacy Policy on an ongoing basis, in particular due to changes in legislation, the services used or the operation of our online store.

The current version is always published on our website.

Effective from: 16 June 2026