Privacy notice
ochrana-udajov@2026-11-11 · In force from 11 November 2026
This page sets out what data we process about you, on what legal basis, how long we keep it, and what rights you have.
Controller
The controller is CRE-O s.r.o., Nábrežná 1/22, 038 61 Vrútky, SK, company number 47601604.
For data protection matters write to support@maxino.org.
What we process and why
- Order and supply of content
- E-mail, name, country and details of the titles ordered. Legal basis: performance of the contract, Art. 6(1)(b) GDPR. Without these we cannot fulfil the order.
- Invoicing and accounting
- Billing and payment details. Legal basis: legal obligation, Art. 6(1)(c) GDPR and accounting legislation.
- Determining the tax rate
- Country of consumption and the evidence of it. Legal basis: legal obligation under the VAT rules for electronically supplied services.
- Security and abuse prevention
- Technical access records. Legal basis: legitimate interest, Art. 6(1)(f) GDPR — protecting content against unauthorised download.
- Proof of delivery (defence in a dispute)
- Your IP address at the moment you consent to delivery starting before the withdrawal period ends, and when content is issued for download. Purpose: to prove, in a payment dispute or a withdrawal claim, that the content was delivered. Legal basis: legitimate interest, Art. 6(1)(f) GDPR (establishment, exercise and defence of legal claims). We automatically delete the raw IP address after 90 days.
- Device you download from (type and model)
- The device type and model (for example iPhone or an Android phone model), operating system and browser that our server receives in the request header when you download a title from your library. Purpose: to show you in the library which device you downloaded a title on, so you can find it later. We do not read them with a script and we do not find out where the file was saved. Legal basis: legitimate interest, Art. 6(1)(f) GDPR (clarity of the service). We keep them while the device is in use; a device unused for 24 months is deleted automatically. You can also remove a device from your library yourself.
- Tips in order messages
- The e-mail address given at checkout. In order messages we may offer you similar books, a gift or our referral programme. Legal basis: legitimate interest, Art. 6(1)(f) GDPR, and the statutory exception for existing customers. You can object to this use at any time via the link in the footer of the message or by writing to our support; invoices and order notices will still reach you.
- Birthday gift (optional)
- Date of birth, if you provide it. Purpose: to send you a birthday gift. Legal basis: consent, Art. 6(1)(a) GDPR. Providing it is voluntary and you can withdraw consent at any time by writing to our support.
- News by e-mail
- E-mail address. Legal basis: consent, Art. 6(1)(a) GDPR. Consent is voluntary, never pre-ticked, and can be withdrawn at any time without affecting your orders.
- Advertising measurement and targeting (Meta)
- Only if you allow advertising measurement in the banner. Data about your steps on the site (viewing a title, adding to cart, checkout, search), the identifiers of the Meta Pixel cookies and, for a purchase, the amount, currency, titles, country and a hashed (one-way encoded) e-mail, phone number, name, city, postcode and internal customer number, as well as the IP address and browser identification (user-agent) from the time of purchase. Purpose: to target and evaluate our advertising. Conversions may be evaluated on our server and also directly on your device in the browser (according to Meta, without sharing identifying information about you); in both cases only after you consent to advertising measurement. Legal basis: consent, Art. 6(1)(a) GDPR and the ePrivacy rules on cookies. Consent is voluntary, never pre-ticked, declining is as easy as allowing, you can change it in the banner at any time, and your order does not depend on it. Without consent we do not send this data to Meta.
- How you heard about us
- A voluntary answer after purchase and anonymous aggregate visit counts per campaign without cookies and without IP addresses. Legal basis: legitimate interest in evaluating marketing, Art. 6(1)(f) GDPR. You may object.
Who we share data with
- the payment service provider processing your payment,
- the content supplier, where the distribution contract for that title requires it,
- the provider that sends our e-mail,
- the hosting and content delivery provider,
- Meta Platforms Ireland Ltd., if you allow advertising measurement; for this data we are joint controllers, and transfers to the US rely on the adequacy decision (Data Privacy Framework),
- our tax adviser and public authorities where the law requires it.
We do not sell personal data. Processors act only on our instructions and under a contract required by Art. 28 GDPR.
How long we keep it
- accounting records for ten years, as the law requires,
- order and library data for as long as the account exists,
- technical records briefly, normally a matter of months,
- the raw IP address in the proof of delivery for 90 days, then it is deleted automatically,
- advertising measurement data with the order for as long as the account exists, at Meta under its policies; you can withdraw consent at any time,
- the e-mail used for news until consent is withdrawn.
Your rights
- access to your data and a copy of it,
- rectification of inaccurate data,
- erasure where we no longer need it and no law prevents it,
- restriction of processing,
- portability of the data you gave us,
- objection to processing based on legitimate interest,
- withdrawal of any consent at any time.
We answer requests within one month. We verify your identity first, so that data is not disclosed to the wrong person.
Complaints
You have the right to lodge a complaint with a supervisory authority. Ours is the Office for Personal Data Protection of the Slovak Republic, Hranicna 12, 820 07 Bratislava.
Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you.