Privacy policy
Privacy Policy
Controller: Magic beans spletna trgovina d.o.o., trading as Magic beans d.o.o., brand OSNP (Open Source Nutrition Project)
Kongresni trg 8, 1000 Ljubljana, Slovenia
VAT ID: SI52473929 · Company reg. no. (matična številka): 9805508000
Registered 5 December 2024, entry Srg 2025/9838, District Court in Ljubljana
Email: hq@opnsrc.nu
Represented by Nenad Kojić, prokurist
Last updated: 23 August 2026
We are the controller of your personal data, which means we decide what is collected and why, and we are the ones answerable for it. We have not appointed a Data Protection Officer, because we are not required to. Write to hq@opnsrc.nu and a human reads it.
This policy says what we actually do. It does not describe things we might one day do, and it does not list categories of data we do not collect in order to look thorough.
The short version
- We collect what an order needs: your name, address, email, and what you bought.
- Payment card details never reach us. Shopify Payments handles them.
- We run a Meta (Facebook) advertising pixel, because we advertise on Facebook and Instagram. It stays off unless you accept marketing cookies, and you can withdraw at any time.
- We do not sell your data to data brokers, and nobody outside the list below gets it.
- The people who see your data are the ones who have to: our shop platform, our payment processor, our warehouse, and the carrier who brings the parcel.
- You can ask us what we hold, get a copy, correct it, or have it deleted.
1. What we collect, why, and on what legal basis
When you place an order
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, delivery and billing address, email, phone (if given) | To take, fulfil and deliver the order, and to contact you about it | Performance of a contract, Art. 6(1)(b) |
| Order contents, amount, currency, order number | To fulfil the order and handle returns, refunds and warranty claims | Performance of a contract, Art. 6(1)(b) |
| Payment status and the last four digits and card type | To confirm payment and process refunds. We never receive the full card number | Performance of a contract, Art. 6(1)(b) |
| Invoice data, including VAT details for business buyers | Because tax and accounting law requires us to issue and keep invoices | Legal obligation, Art. 6(1)(c) |
Giving us this data is not optional in the sense that without it there is no order. It is the minimum required to send a parcel to a person and charge them for it.
When you contact us
We keep your email address and the content of your message so we can answer, and so we have a record if the matter comes back later. Legal basis: our legitimate interest in answering customers and defending claims, Art. 6(1)(f), or performance of the contract where the message is about an order.
When you subscribe to email updates
Only if you actively tick the box. We keep your email address and the fact and time of your consent. Legal basis: consent, Art. 6(1)(a). Every message carries an unsubscribe link, and unsubscribing takes effect immediately.
We do not add you to a mailing list because you bought something. Buying is not consent.
When you visit the website
The site runs on Shopify. Shopify sets cookies that are strictly necessary for the shop to work: keeping your cart, keeping you logged in, and protecting against fraud and abuse. These do not require your consent because the site cannot function without them.
Shopify also collects basic usage and performance data about the storefront on our behalf.
Anything beyond the strictly necessary runs only if you agree to it in the cookie banner. Two things sit behind that consent, and we would rather name them than hide them in a category list.
The Meta (Facebook) pixel. We advertise on Facebook and Instagram, and this is the piece that tells us whether those ads lead anywhere. It reports to Meta that you visited, which pages you looked at, and whether you bought, and it lets us show ads to people who have been here before. It does not run until you accept marketing cookies, and it stops when you withdraw. Legal basis: consent, Art. 6(1)(a). For what the pixel collects and sends, Meta Platforms Ireland Limited and we are joint controllers, under Meta's Controller Addendum: we decide to run it and for what, Meta decides how it works and what else it does with the data. You can exercise your rights against either of us, and Meta's own privacy policy covers what happens on their side.
Judge.me. Runs the product reviews. It measures how the review widget is used, which is why it sits behind the analytics category, and if you leave a review it receives what you write along with your name, email and the order it relates to.
You can change your mind at any time. CONSENT PREFERENCES at the bottom of every page reopens the banner, and withdrawing is as easy as agreeing was.
The banner offers four categories: Required, which is the strictly necessary set above and cannot be switched off, and Personalization, Marketing and Analytics, which are yours to accept or refuse individually. The Meta pixel sits under Marketing. Judge.me and Shopify's own measurement sit under Analytics.
Google Fonts. Our pages load typefaces from Google's font servers, which means your IP address reaches Google when a page loads. Legal basis: our legitimate interest in the site rendering as designed, Art. 6(1)(f). If you would rather this did not happen, tell us; we can self-host the fonts and remove the transfer entirely.
2. Who else sees your data
Everyone below processes data on our instructions under a data processing agreement, except the carriers and the authorities, who are controllers in their own right for what they do.
| Who | What they do | Where |
|---|---|---|
| Shopify International Ltd. | Runs the shop, stores orders and customer accounts | EU (Ireland), with transfers to Canada and the USA under Standard Contractual Clauses |
| Shopify Payments | Processes card payments, holds the card data we never see | As above |
| DTM Natura d.o.o. (Warehouse.si), Tržaška cesta 132, Ljubljana | Picks, packs and ships orders, and receives returns | Slovenia |
| Pošta Slovenije d.o.o. | Delivers Slovenian orders | Slovenia |
| Packeta | Delivers orders elsewhere in the EU | EU |
| Meta Platforms Ireland Limited | Runs the advertising pixel, and only if you accepted marketing cookies. Joint controller with us for what it collects, not our processor | Ireland, with transfers to the United States |
| Judge.me | Runs the product reviews and the review invitations | EU |
| Google Workspace | Carries our email, including your messages to us | Ireland, with transfers to the United States |
| KONTOART, racunovodski servis | Bookkeeping and statutory accounts | Slovenia |
| Tax authority, and courts or police where the law requires it | Statutory obligations | Slovenia |
Carriers receive your name, address, phone number and the parcel details. They need them to deliver.
We do not sell personal data to data brokers, and nobody outside this table receives it. We do share data for advertising, in one specific way and only with your consent: the Meta pixel described in section 1. There is no Google Ads tag, no TikTok pixel and no data broker in this list, and if that ever changes this policy changes first.
3. Transfers outside the EU
Three of the recipients above involve data leaving the EU. Everyone else in the table is in the EU.
Shopify transfers to Canada and the United States. Its Data Processing Addendum relies on the European Commission's 2021 Standard Contractual Clauses and on Shopify's Binding Corporate Rules between Shopify entities, and on the Commission's adequacy decision for Canada.
Meta transfers pixel data to the United States, under the transfer terms in its Controller Addendum and Business Tools terms.
Google, which carries our email, transfers to the United States under the terms of its Cloud Data Processing Addendum.
We link to each of those documents rather than summarise them, because they are the ones that actually govern and they change without asking us. If you want to know what protects a specific transfer, write to hq@opnsrc.nu and we will send you the current terms and the clause that applies.
4. How long we keep things
| What | How long | Why |
|---|---|---|
| Invoices and accounting records | 10 years from the end of the financial year | Slovenian tax and accounting law |
| Order and delivery records | 5 years from the order | The general limitation period for contractual claims |
| Warranty and complaint correspondence | 5 years from the case closing | To defend or resolve claims |
| Customer account, if you create one | Until you delete it, or 3 years after your last order | No reason to keep a dormant account |
| Newsletter subscription | Until you unsubscribe | Consent lasts until withdrawn |
| General enquiries with no order attached | 2 years | Long enough to be useful, short enough not to hoard |
| Your cookie choice, and the fact and time you made it | 12 months, then we ask again | We have to be able to show that consent was given, and a year-old choice is a stale one |
| What the Meta pixel sent to Meta | Meta's own retention periods apply, not ours | Once it reaches Meta it sits under their policy, which we do not control and will not pretend to |
When a period ends we delete or anonymise. We do not keep things "just in case".
5. Your rights
Under the GDPR you can ask us to:
- tell you what we hold about you and why (Art. 15),
- correct anything wrong (Art. 16),
- delete it (Art. 17), where we are not required by law to keep it, which for invoices we are,
- restrict what we do with it while a dispute is resolved (Art. 18),
- hand it over to you or another provider in a machine-readable file (Art. 20),
- object to processing we base on legitimate interest (Art. 21),
- withdraw consent at any time where consent is the basis, without affecting what was lawful before (Art. 7(3)).
Write to hq@opnsrc.nu. We answer within one month. If a request is genuinely complex we may take up to two more months, and we will tell you inside the first month if that happens and why.
We do not charge for this. We may ask you to confirm who you are, but only enough to be sure we are not handing your data to somebody else.
Automated decisions. We do not make decisions about you by automated means and we do not profile you.
6. If you think we have got it wrong
Tell us first at hq@opnsrc.nu, and we will fix it if we can.
You also have the right to complain directly to the supervisory authority, and you do not have to go through us:
Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia)
Dunajska cesta 22, 1000 Ljubljana
gp.ip@ip-rs.si · +386 1 230 97 30
www.ip-rs.si
If you live in another EU country, you may complain to your own national data protection authority instead.
7. Security
Traffic to and from this site is encrypted with TLS. Order data lives on Shopify's infrastructure with access limited to the people who need it. Card data never touches our systems.
We are a small company and we will not pretend to be a bank. What we will do is tell you: if a breach happens that puts your rights at risk, we notify the Information Commissioner within 72 hours and we notify you without undue delay. In plain language, and with what actually happened in it.
8. Children
We do not sell to anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, write to hq@opnsrc.nu and we will delete it.
9. Changes to this policy
When we change it we update the date at the top and, if the change is significant, we say so on the site. Previous versions are available on request from hq@opnsrc.nu.