Skip to content
Book a consultation

GDPR for online shops and marketing

GDPR for online shops and marketing in practice

Every order, every newsletter sign-up and every cookie in a browser involves processing personal data. For some, a contract or a legal obligation is enough; marketing cookies and retargeting need consent. Problems usually hide in the details: a pre-ticked box, a reject button buried in the settings, or cookie consent that is also treated as newsletter consent.

We start by going through what data your shop collects, who receives it and why. On that basis we prepare the privacy notice, the cookie banner settings and the newsletter process. We add agreements with couriers, payment gateways, hosting providers and marketing tools, and set up how customer requests are handled. If the Slovak data protection authority gets involved, we represent you.

What we help with

  • Privacy notice under Article 13 GDPR
  • Cookie banner and cookie policy
  • Newsletters: consent, double opt-in and soft opt-in for existing customers
  • Assessing retargeting and profiling under Article 22 GDPR
  • Processor agreements under Article 28 GDPR
  • Transfers outside the EU: standard contractual clauses and the Data Privacy Framework
  • Customer request procedures and representation before the Slovak data protection authority

Worth knowing

Cookies

Apart from strictly necessary cookies, such as those for the basket and login, prior consent is required. Pre-ticked boxes are not valid consent (Court of Justice of the EU, Planet49, C-673/17), and the reject button should be as prominent as the accept button.

Soft opt-in

Contact details obtained in a sale may be used to market similar products without consent, provided the customer could refuse when the details were collected and can unsubscribe easily and free of charge in every email.

Deadline for requests

A customer's request for access, correction or erasure must be dealt with within 1 month. For complex cases the deadline can be extended by 2 months.

Proof of consent

The controller must be able to demonstrate consent (Article 7(1) GDPR). Double opt-in, where the subscriber confirms via a link in an email, serves as evidence.

Common questions

  • As a rule, yes. The Meta Pixel or a Google Ads tag track visitor behaviour, so they should only fire after consent in the cookie banner. Extensive profiling may also require a data protection impact assessment under Article 35 GDPR.

  • Only under the soft opt-in conditions: similar products, a chance to refuse when the contact was collected, and an unsubscribe option in every message. Everyone else needs to have consented.

  • The Slovak data protection authority supervises the GDPR. For cookies and marketing emails under Act No. 452/2021 Coll., the Slovak telecoms and postal regulator may also be involved, depending on the breach.

Related articles

Articles are in Slovak.

Preparing for the consultation

What to prepare for your consultation

Tick what you already have. You can print the list or save it as a PDF. Your ticks are remembered only in your browser.

For every matter

Also for this area

0 of 8 ready

Discuss your matter with a lawyer

In a consultation we assess your situation, suggest a way forward and tell you what costs to expect.

€90 incl. VAT, 30 minutes, in person or online

This page is for general information, reflects Slovak law at the time of writing and is not a substitute for advice on your particular matter.