Skip to main content

Privacy policy

This page explains which personal data we process when you shop in our online store, book a course, register a gift voucher or write to us, why we do it, who we share it with and what your rights are. We follow Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on the protection of personal data.

Effective from: 23 October 2026

1. Who processes your data

The website nidavellir.ooo and the Nidavellir knife workshop are operated by:

bitWorks s. r. o.
Považské Podhradie 214, 017 04 Považská Bystrica, Slovakia
Company ID (IČO): 44 193 530
Registered in the Commercial Register of the District Court Trenčín, section Sro, file No. 31909/R

For data protection matters write to gdpr@nidavellir.ooo or call +421 949 057 544. We have not appointed a data protection officer (DPO), as the law does not require it.

2. What data we process and why

2.1 Orders in the online store – knives, accessories, courses and gift vouchers

  • Data: name, email, phone, the content and price of the order, payment method; for deliveries also the address or chosen pick-up point. For courses the participants’ names, for gift vouchers the names “From” and “For”, for a made-to-order knife your requirements (type, steel, handle, description).
  • Purpose: to accept and fulfil the order, deliver goods or the voucher, prepare the course, communicate with you about the order and handle complaints.
  • Legal basis: performance of a contract and steps before entering into it (Art. 6(1)(b) GDPR); issuing and keeping accounting documents and handling complaints are legal obligations (Art. 6(1)(c) GDPR).
  • How long: while the order is handled and during the warranty period; accounting documents for 10 years from the end of the year they relate to (Slovak Accounting Act No. 431/2002 Coll.).

If you give us the names of other people (course participants or the voucher recipient), please let them know and point them to this page. We use their names only for the course and the voucher.

The data needed for an order is a contractual requirement – without it we cannot process the order. You do not need a customer account to buy.

2.2 Customer account

  • Data: name, email, password (stored only in encrypted form – we do not know it), billing details and saved delivery addresses, company details if you buy as a business, and an overview of your orders, knives, vouchers, courses, warranties and service or complaint requests (including photos you attach).
  • Purpose: so that you do not have to enter your details with every purchase and have your orders, warranties, vouchers and service in one place.
  • Legal basis: performance of a contract – the account you asked for (Art. 6(1)(b) GDPR).
  • Email confirmation: after registration we send you an email with a link. Confirming it shows us that the address is yours; only then do we add the orders and vouchers you made with this address without logging in.
  • Delivery addresses: you can also save other people’s addresses (for example when sending a gift). Please save them only if they agree; we use them only for delivery.
  • Owners’ wall: if you tick the consent in your account, we show your first name (and town, if you fill it in) on the About us page. You can withdraw the consent in your account at any time (Art. 6(1)(a) GDPR).
  • How long: until you close the account – in your account (Account details → Request account deletion) or by email to gdpr@nidavellir.ooo. Order data is then kept only as described in section 2.1.

2.3 Buying as a business – data from public registers

When you buy as a company or sole trader and start typing the name or company ID, we fill in the billing details from the Slovak Register of Legal Entities (kept by the Statistical Office). We keep a copy of its public data – the name of the company or trader, company ID and registered or business address, including data of sole traders – in our own database, update it daily and delete entities that no longer exist. We use it only to fill in billing details. The tax ID comes from the Register of Financial Statements and the VAT ID is checked in the European Commission’s VIES system. The legal basis is our legitimate interest in correct billing details and an easier purchase (Art. 6(1)(f) GDPR); the data is kept while it is in the register.

2.4 Gift voucher registration and date requests

  • Data: name, phone, email, voucher number, chosen course and date, number of people and your comment (for example when a date would suit you).
  • Purpose: to check the voucher, reserve your seat or agree on another date with you.
  • Legal basis: performance of a contract and steps taken at your request before entering into it (Art. 6(1)(b) GDPR).
  • How long: until the course has taken place; if it does not take place, until the request is settled, at most 1 year.

2.5 Contact forms, email and phone

  • Data: name, email, phone (if given), the message and the page you wrote from.
  • Purpose: to answer your question.
  • Legal basis: our legitimate interest in answering questions (Art. 6(1)(f) GDPR); for questions about an order, performance of a contract (Art. 6(1)(b)).
  • How long: until the question is settled, then at most 1 year. Messages that lead to an order are kept with the order.

2.6 Notice of a free seat (“Let me know”)

  • Data: email and the course date you are interested in.
  • Purpose: to email you when a seat becomes free on a fully booked date.
  • Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to gdpr@nidavellir.ooo.
  • How long: until we send the notice or the date has passed.

2.7 News from the workshop (newsletter)

  • Data: email, first name, language of the website and a record of your consent – when and where you gave it (with an order or in your account) and its wording.
  • Purpose: to send you an occasional email from the workshop – new knives, open course dates and what we are working on.
  • Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the newsletter box at the checkout or in your account. The box is optional and your purchase does not depend on it; without your consent we send you no news.
  • Withdrawal: at any time with one click on the link in every email, in your account (Account details → Unsubscribe) or by writing to gdpr@nidavellir.ooo.
  • How long: until you withdraw your consent. After you unsubscribe we send you nothing more; we keep the record of the consent and its withdrawal for 3 more years so that we can prove our emails were sent lawfully (legitimate interest, Art. 6(1)(f) GDPR).

2.8 Spam protection of forms

Our contact forms are protected by Google reCAPTCHA, which evaluates technical data about your device and behaviour on the page (such as IP address and cookies) to tell people from bots. The legal basis is our legitimate interest in protecting the website from abuse (Art. 6(1)(f) GDPR). The service is operated by Google Ireland Limited.

2.9 Cookies, statistics and videos

We use necessary cookies to run the store (for example the cart). Statistics cookies (Google Analytics) and embedded YouTube videos load only with your consent, given in the cookie banner (Art. 6(1)(a) GDPR), which you can change at any time. Details are in our Cookie policy.

2.10 Server logs

When you visit the website, the server automatically records technical data (IP address, time, page visited, browser). We use it for security and troubleshooting – our legitimate interest (Art. 6(1)(f) GDPR). Logs are kept only briefly, according to the hosting provider’s settings.

3. Who we share data with

We do not sell your data. We share it only as far as necessary with:

  • WebSupport s.r.o. – website and database hosting (processor);
  • Microsoft Ireland Operations Limited – Microsoft 365 email service we use to send and receive email (processor);
  • Google Ireland Limited – Google Analytics (only with consent), reCAPTCHA and YouTube;
  • Packeta Slovakia s.r.o. – delivery of parcels (name, phone, email, pick-up point or address);
  • the bank – processes your payment details as an independent controller when you pay by bank transfer;
  • SuperFaktura, s.r.o. – invoicing system in which we issue proforma invoices and invoices (processor);
  • Matej Kristín, company ID 56 043 490 – bookkeeping (processor);
  • public authorities (for example the tax office or a court) where the law requires it.

4. Transfers outside the European Union

Google and Microsoft may also process data in the USA. Such transfers rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework, 10 July 2023), under which these companies are certified, or on standard contractual clauses approved by the European Commission.

5. Your rights

  • to know whether and which of your data we process, and to get a copy (Art. 15 GDPR);
  • to have incorrect data corrected or incomplete data completed (Art. 16);
  • to have data erased when we no longer need it or process it unlawfully (Art. 17) – we cannot erase data we must keep by law;
  • to restrict processing (Art. 18);
  • to receive the data you gave us in a machine-readable format and transfer it (Art. 20);
  • to object to processing based on legitimate interest (Art. 21);
  • to withdraw consent at any time – this does not affect processing before the withdrawal;
  • to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

To exercise your rights, email gdpr@nidavellir.ooo. We reply without undue delay and within one month at the latest.

6. Automated decision-making

We do not use automated decision-making or profiling that would have legal or similarly significant effects on you.

7. Changes

We may update this information, for example when we add a new service (card payments or a service for sending our news). The current version with its effective date is always on this page.