Privacy Policy
This policy explains how we process personal data when you visit shop.keykey.si ("the site") and when you join the Drill Vault waitlist. We process personal data in line with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Slovenian Personal Data Protection Act (ZVOP-2).
The store is not selling yet. Before it starts selling we will update this policy to cover orders, payments and invoices, and we will show the new version on this page.
- Who is responsible
- What we process and why
- Who receives the data
- Transfers outside the EU
- Cookies and tracking
- How long we keep data
- Your rights
- Right to complain
- Other information
- Changes to this policy
1. Who is responsible
Key Key, Klemen Kladnik Malačič s.p. (brand Drill Vault)
Kvedrova cesta 16, 6000 Koper, Slovenia
Registration number: 9162852000 · VAT ID: SI72400170
Email for privacy requests: info@keykey.si
We are a sole proprietorship and are not required to appoint a data protection officer. Write to the email above with any question about your data.
2. What we process and why
| Purpose | Data | Legal basis |
|---|---|---|
| Waitlist: one email when the store opens, and news about new Drill Vault books | Email address; the product and role you chose (optional); that you ticked the consent box; date and time of sign-up; which form you used | Your consent, GDPR Art. 6(1)(a) |
| Proof of consent | Date, time and content of the consent you gave | Our legal obligation to demonstrate consent, Art. 7(1) and 6(1)(c) |
| Spam protection of the form | The content of the form submission and technical data such as IP address and browser | Our legitimate interest in keeping the list free of fake sign-ups, Art. 6(1)(f) |
| Delivering the site and keeping it secure | IP address, date and time, requested page, browser and device type (server logs) | Our legitimate interest in a working and secure site, Art. 6(1)(f) |
| Answering your emails | Your email address, name if given, and what you write | Our legitimate interest in replying, Art. 6(1)(f); if you ask about a purchase, taking steps before a contract, Art. 6(1)(b) |
Giving us your email is voluntary. Without it we cannot tell you when the store opens. We do not use your data for automated decision-making or profiling, and we never sell it or give it to anyone for their own marketing.
3. Who receives the data
We use these service providers. They process data only on our instructions under a data processing agreement (GDPR Art. 28):
- Netlify, Inc., San Francisco, USA – hosts the site and stores waitlist form submissions.
- Automattic, Inc. (Akismet), USA – spam filtering of form submissions, used through Netlify.
- Email service provider – if we use one to send the launch email, we will name it here before the first email is sent.
We may also disclose data to public authorities where the law requires it.
4. Transfers outside the EU
Netlify and Automattic are based in the USA. Transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified, and otherwise on the Commission's Standard Contractual Clauses (GDPR Art. 46(2)(c)). You can ask us for a copy of the safeguards.
5. Cookies and tracking
The site does not set cookies and does not use analytics, advertising pixels or social media plugins. Fonts, images and the video are loaded from our own site, so visiting a page does not send your data to Google, Meta or other third parties. Links to TikTok, YouTube or Instagram take you to those platforms, where their own privacy policies apply.
Because we use no cookies that need consent, the site shows no cookie banner. If this changes, we will ask for your consent first.
6. How long we keep data
- Waitlist: until you unsubscribe or withdraw consent, and at the latest 24 months after you joined, unless you give new consent.
- Proof of consent: for as long as we keep your email and up to 3 years after, to be able to show that we had your consent.
- Server logs: as set by Netlify, usually a few days to weeks.
- Emails with us: up to 2 years after the matter is closed, unless the law requires longer.
7. Your rights
Under the GDPR you have the right to:
- withdraw your consent at any time, without affecting what we did before (Art. 7(3)) – use the unsubscribe link in any email or write to us;
- get access to your data and a copy of it (Art. 15);
- have wrong data corrected (Art. 16);
- have your data deleted (Art. 17);
- have processing restricted (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on our legitimate interest (Art. 21).
Send requests to info@keykey.si. We reply within one month. We may ask you to confirm that the email address is yours.
8. Right to complain
You can complain to the supervisory authority in your country, or in Slovenia to the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si. We would appreciate the chance to fix the problem first.
9. Other information
Age. The waitlist and the store are for adults. If you are under 18, please ask a parent or your coach to sign up.
Security. The site is served only over HTTPS. Access to the waitlist is limited to us.
10. Changes to this policy
We will update this policy when we change how we process data, in particular before the store starts selling. The date at the top shows the current version. If a change needs your consent, we will ask for it.