Controller and scope
The controller of personal data processed through this store is ST. DOMINIC & CO., poslovne storitve, d.o.o., trading as St. Dominic Press, Sagadinova ulica 15 A, 2250 Ptuj, Slovenia. Contact: info@stdominicpress.com.
This notice describes the current storefront. It has guest checkout only and does not operate customer accounts, store passwords, an ownership registry, certificates of authenticity, or provenance profiles.
Browsing and necessary technologies
Cloudflare delivers and protects the website. It may process IP address, request time, requested URL, browser and device information, security signals, and similar network metadata needed to provide the site, prevent abuse, and diagnose failures. We process this information for our legitimate interests in operating a reliable and secure website.
The cart and language preference are stored in your browser’s local storage. Cart data consists of product identifiers and quantities and remains on your device unless you clear it or submit the selected items for checkout. The storefront does not set advertising or cross-site tracking cookies. Confirming your subscription or unsubscribing uses short-lived strictly necessary cookies that expire within minutes and are never used for tracking. Stripe and security providers, including Turnstile, may use necessary technologies on services they operate. If we enable optional analytics or similar tracking that requires consent, we will request it before using that technology.
Orders, payments, and delivery
When you start checkout, our Cloudflare Worker validates product identifiers and quantities and asks Stripe to create a hosted Checkout Session. Stripe directly collects the name, email address, billing and delivery address, payment details, and authentication information needed to process the order. We do not receive or store complete payment-card or bank-account numbers.
Stripe sends signed payment events to the store. We keep limited operational records in Cloudflare D1: Stripe event and Checkout Session identifiers, payment status, order type, customer email where supplied, total, currency, invoice identifier, locale, timestamps, and retry records. Private R2 backups contain copies of those D1 records. Stripe remains the primary record for payment, invoice, refund, and full order information.
We use order information to perform the contract, arrange delivery, communicate about the order, prevent duplicate fulfilment, handle returns and disputes, keep required accounting records, and prevent fraud. The legal bases are performance of a contract, compliance with legal obligations, and our legitimate interests in secure and reliable operations. We share the name, delivery address, and necessary contact or order information with the selected carrier to deliver the parcel.
Mailing list
If you subscribe, we process your email address, selected or inferred country, browser languages, locale, signup source, consent and confirmation timestamps, unsubscribe state, and limited campaign tags. Subscription uses double opt-in. As a thank-you gift, confirmed subscribers receive Adam & Eve as a free reading PDF by email. The legal basis is consent, which you may withdraw at any time using an unsubscribe link or by contacting us.
Cloudflare D1 holds the consent record and Cloudflare Email Service sends confirmation and transactional emails. Unconfirmed subscriptions are deleted after 30 days. When you unsubscribe, we mark the subscription as unsubscribed and retain the record as needed to honour that choice, demonstrate consent, prevent further marketing, or meet legal obligations. You may request deletion, subject to those obligations.
Communications, diagnostics, and required information
If you contact us, we process your message, contact details, attachments, and related order reference to answer and maintain a support record. The legal basis is our legitimate interest in responding to requests and, where relevant, performing the contract or meeting legal obligations.
Sentry may receive technical error and performance information, such as browser, device, request, and diagnostic data, to help us diagnose failures. We rely on our legitimate interest in secure and reliable operation. Our application is designed not to deliberately send payment-card data, plaintext tokens, complete webhook bodies, or subscriber lists to application logs.
Checkout and delivery details are required to take payment and supply an order; without them, we cannot complete the purchase. Newsletter registration is optional and is not required to buy a book. Contact information is needed if you ask us to reply.
Providers and international transfers
We currently use Cloudflare for hosting, D1, R2, security, Turnstile, email delivery, and request handling; Stripe for hosted checkout, payment processing, fraud prevention, invoices, and refunds; Sentry for error and performance monitoring; and the selected carrier for delivery. Depending on the service and processing, a provider may act as our processor or as an independent controller under its own terms.
Some provider processing may occur outside the European Economic Area. Where a transfer requires a safeguard, we rely on an adequacy decision, the European Commission’s standard contractual clauses, or another lawful transfer mechanism. To ask which safeguard applies to your data or to request a copy where available, contact info@stdominicpress.com.
Retention
We keep personal data only for as long as necessary for the stated purpose:
- order, invoice, refund, and accounting records for the period required by tax and accounting law;
- support and dispute records while needed to handle the request and establish, exercise, or defend legal claims;
- payment-event, fulfilment, and retry records while needed for reconciliation, fraud prevention, support, and legal claims;
- mailing-list data as described above;
- backup copies until their restricted retention cycle expires; and
- security and diagnostic logs for the retention periods configured with the relevant provider.
When the retention period ends, data is deleted or anonymised unless a legal obligation or lawful claim requires continued storage.
Your rights and automated decisions
Subject to the GDPR and applicable law, you may request access, correction, deletion, restriction, or portability of your data; object to processing based on legitimate interests; and withdraw consent without affecting earlier lawful processing. We may need to verify your identity and may retain information where law or an overriding legal ground requires it.
We do not use your personal data to make our own solely automated decisions that produce legal or similarly significant effects. Stripe may use automated fraud-prevention and authentication checks as part of payment processing; those checks can affect whether a payment proceeds and are subject to Stripe’s applicable terms and privacy information.
Send requests to info@stdominicpress.com. You may also lodge a complaint with the Information Commissioner of the Republic of Slovenia or the competent supervisory authority where you live.
Security and changes
We use technical and organisational measures appropriate to the risk, including access management, encryption in transit, restricted service credentials, webhook signature verification, rate limiting, backups, and monitoring.
We may update this notice when the store, providers, retention practices, or law changes. The current version is published on this page.