Privacy and cookies

The data controller is Eva Sušin s.p., Konovska cesta 48, 3320 Velenje. For any privacy question write to info@eva-licious.com.

When you request a free download or subscribe to the newsletter I record your email address, language, the consent statement you agreed to, the time and technical details of the request (IP address and browser) as proof of consent. I email you a confirmation or download link. Only when you click the link do I create an account and add you to the contacts for news, recipes and offers.

The legal basis is your consent. You can withdraw it at any time using the unsubscribe link in every email, or by writing to info@eva-licious.com.

For an account I store your name, email address and a hashed password (I can't see the password itself). If you sign in with Google I receive your name and email from Google. In your account I keep your favourite recipes, lists and course progress. The legal basis is providing the service you ask for by having an account.

When you buy, I process your email address, the product, the amount and payment details. Payment is handled by Stripe; I never see or store your card details. Invoices are issued through Space Invoices. The law requires me to keep invoice records for several years. The legal bases are performing the contract and a legal obligation.

Only with your consent I use PostHog (EU servers) for anonymous visit statistics and the HAL chat widget for messages you send me. If you decline or withdraw consent, neither is loaded. You can change your choice with the "Cookie settings" button in the footer.

Some pages embed maps (Google Maps), offers and ads (Klook), videos (YouTube), posts (TikTok) and photos (Instagram). These providers may set cookies and collect data about your visit. I only load that content with your consent; until then you see a notice instead.

Some links (for example Booking.com, iHerb, Klook) are affiliate links: if you buy or book through them I earn a small commission at no extra cost to you. After you click such a link, the partner or its network may set its own cookies. Pages with affiliate content carry a notice saying so.

For security and troubleshooting the server briefly records technical details of requests, including the IP address. The legal basis is my legitimate interest in running the site securely.

Data is processed on my behalf by providers I have appropriate agreements with: Where a provider transfers data outside the EU, this relies on standard contractual clauses or another lawful mechanism.

• Railway: hosting of the site and database (EU)
• Amazon Web Services (SES): sending email (Frankfurt)
• HAL: contacts, email campaigns and chat
• Stripe: payments
• Space Invoices: issuing invoices
• Sanity: content editing
• PostHog: analytics (EU, only with consent)
• Bunny: course video
• Cloudflare: DNS

Newsletter data is kept until you withdraw consent, account data until the account is deleted, invoice records for as long as the law requires. Proof of consent is kept for as long as needed to demonstrate that processing was lawful.

You have the right to access, correct, delete, restrict and port your data, to object to processing, and to withdraw consent. Write to info@eva-licious.com and I will reply within the legal deadline. If you believe I process your data unlawfully you can complain to the Slovenian Information Commissioner (www.ip-rs.si).

I may update this page, for example when I add a feature or a provider. The current version is always here, with the date of the last change at the top.