Privacy Policy

Valid and effective from 29. 9. 2026.

1. Controller

The controller of personal data is BLACK MARKET s.r.o., with its registered office at Pod Táborom 15389/37B, 080 01 Prešov, Company ID (IČO) 51 983 095, Tax ID (DIČ) 2120868431, VAT ID (IČ DPH) SK2120868431, registered in the Commercial Register of the District Court Prešov, Section: Sro, Insert No. 37221/P (hereinafter "we" or the "controller"). We operate the e-shop www.zbranepresov.sk and stores in Prešov and Bratislava.

Contact for personal data protection matters: e-mail [email protected] or [email protected], or by post to the address of our registered office.

2. For what purposes and on what legal basis we process data

• Order, purchase contract, delivery and payment – first name and surname, billing and delivery address, e-mail, telephone, for purchases on behalf of a company the business name, Company ID (IČO), Tax ID (DIČ) and VAT ID (IČ DPH), order contents, delivery and payment method, selected pickup point. Legal basis: performance of a contract and pre-contractual measures (Art. 6(1)(b) of the GDPR). Without this data we cannot process the order.
• Age verification and the record book for the sale of firearms and ammunition – for category D firearms that we sell at a distance (point 5.4 of the GTC), the first name, surname, date of birth, photograph, type and number of the identity document taken from the copy of the document that the buyer sends us; for sales of firearms, ammunition and their main parts in the store, data from the documents required by law (e.g. firearms licence, purchase permit). Legal basis: compliance with a legal obligation (Art. 6(1)(c) of the GDPR) under Act No. 190/2003 Coll. on Firearms and Ammunition and Section 5 of Decree of the Ministry of the Interior of the Slovak Republic No. 555/2003 Coll. We use the copy of the document only to verify age and make the entry in the record book, and then we destroy it; on the copy you may cover all data except the first name, surname, date of birth, photograph, type and number of the document. We keep the entry in the record book for the period set by the regulations on firearms and ammunition and present it to the Police Force on request.
• Accounting and taxes – invoices and accounting documents. Legal basis: legal obligation (Art. 6(1)(c) of the GDPR, Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax).
• Complaints, withdrawal from the contract, grievances – data from the complaint or withdrawal notice, bank account number for refunds. Legal basis: legal obligation (Art. 6(1)(c) of the GDPR, the Civil Code, Act No. 108/2024 Coll. on Consumer Protection).
• Customer account – if you create one: login e-mail, password (in encrypted form), addresses and order history. Legal basis: the contract for maintaining the account (Art. 6(1)(b) of the GDPR). You can close your account at any time.
• Wholesale – data about the company and contact persons; for distance sales of firearms and ammunition, data from the firearms business licence. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c) of the GDPR).
• Newsletter and back-in-stock notifications – e-mail and, where applicable, name. Legal basis: consent (Art. 6(1)(a) of the GDPR), which you can withdraw at any time via the link in the e-mail or by e-mailing us; withdrawal does not affect the lawfulness of processing before it.
• Abandoned cart reminder – e-mail, name, cart contents (products, quantities, prices) and the time the cart was last changed. If you leave goods in your cart and do not complete the order, we will send you at most one reminder e-mail, usually after 24 hours, without a discount coupon. We will not send it if you have completed the order in the meantime or have opted out of reminders. We send reminders only to customers logged into their account, on the basis of our legitimate interest (Art. 6(1)(f) of the GDPR) in helping to complete an unfinished purchase; you may object to this at any time. We do not send reminders for purchases without registration. Every reminder contains a link "Do not send me cart reminders" – after that we will not send you any more.
• Product reviews – the name or nickname you provide and the text of the review. Legal basis: consent (Art. 6(1)(a) of the GDPR) given by publishing the review.
• Protection of forms against spam and misuse – when a form is submitted (registration, order, review, contact, complaint, newsletter, availability alerts, withdrawal from the contract, forgotten password, CV) we check the IP address, the time taken to fill in the form and whether the domain of the e-mail address exists. For most of these forms we also use the Cloudflare Turnstile service (Cloudflare, Inc., USA), which distinguishes a human from an automated bot based on technical browser data (e.g. IP address, browser type). It runs only once you start filling in the form, and the data is not used for advertising. Legal basis: legitimate interest (Art. 6(1)(f) of the GDPR) – protecting the website and customers against spam and misuse; you may object to such processing.
• Records of consents and requests – e-mail, date and time, IP address and browser type, the wording of the terms and conditions and of this information valid at the time of the order, registration or newsletter sign-up, and requests by which you exercise your rights. Legal basis: compliance with the legal obligation to demonstrate consent and the handling of requests (Art. 6(1)(c) in conjunction with Art. 5(2), Art. 7(1) and Art. 12 of the GDPR) and the legitimate interest in demonstrating the terms under which the contract was concluded (Art. 6(1)(f) of the GDPR).
• Protection of our rights and website security – data necessary to establish and defend legal claims, IP address and website access logs. Legal basis: legitimate interest (Art. 6(1)(f) of the GDPR). You may object to such processing.

We do not carry out automated decision-making or profiling with legal effects.

3. Who we share data with

We share data only to the extent necessary for the given purpose: with carriers (GLS General Logistics Systems Slovakia s.r.o.; for the transport of firearms and ammunition, a company authorised to transport them), the bank and payment service providers, providers of web hosting, e-mail and information systems (e-shop, warehouse and accounting), the provider of form protection against bots (Cloudflare), our accountant, auditor and lawyer, and public authorities where required by law (e.g. the Police Force when inspecting the record book, the Slovak Trade Inspection, the financial administration, courts). Contract processors process data only in accordance with our instructions.

We do not transfer data to countries outside the European Union and the European Economic Area, with the exception of third-party tools that run on the website only with your consent in the cookie settings, and the Cloudflare Turnstile service when forms are submitted; Cloudflare is certified under the EU-US Data Privacy Framework.

4. How long we keep data

• order and contract data: for the duration of the contract and until the limitation periods expire (usually 4 years after the end of the contract),
• accounting documents: 10 years from the end of the year to which they relate (Section 35 of Act No. 431/2002 Coll.),
• copy of an identity document: only until age has been verified and the entry made in the record book; the entry in the record book for the period set by the regulations on firearms and ammunition,
• complaints and withdrawals: until the period of liability for defects and the limitation periods expire,
• customer account: until it is closed,
• newsletter, notifications and reviews: until consent is withdrawn,
• abandoned cart reminder: cart data for at most 30 days from its last change; the e-mail on the list of declined reminders until you ask us to delete it (without it we would not be able to respect your opt-out),
• form protection: records of submission attempts for at most 1 day, records of blocked attempts (with a shortened IP address) for 30 days,
• records of consents and requests: for the duration of the consent, account or contract and then until the limitation periods expire (usually 4 years); verification links from the My personal data page are valid for 24 hours and we usually delete them within 8 days,
• website access logs: at most 12 months.

5. Your rights

You have the right of access to your data, to its rectification, erasure, restriction of processing and portability, the right to object to processing based on legitimate interest and the right to withdraw consent at any time (Art. 15 to 21 of the GDPR). Some rights cannot be exercised if we are required by law to keep the data. The easiest way to do this is on the My personal data page (you will also find the link in the website footer): after verification by e-mail you can download the data we hold about you there and request its rectification or erasure or file an objection. You can also send us a request using the contact details under point 1; we will respond within one month.

If you believe that we process data in breach of the regulations, you may file a petition to initiate proceedings with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

6. Cookies

Which cookies and similar technologies we use, for what purpose and for how long, is set out in the Cookie Policy. We run tools that are not strictly necessary only with your consent; you can change or withdraw your consent at any time via the "Cookie settings" link in the website footer.

7. Changes

We update this information on an ongoing basis. The version published on this page applies.