Privacy policy
Last updated: 29.9.2026
1. Who is the controller of your personal data
The controller of personal data collected through xway.si is PNEUS 4X4 d.o.o., trading as XWAY POWERSPORTS, Ulica Bojana Vodopivca 5, 5294 Dornberk, Slovenia, Company Registration No. 1673645, VAT ID SI40625940 (referred to below as "we" or "XWAY"). For any question about this policy or to exercise your rights, contact us at info@xway.si or at our store address: Žnidarčičeva 23, Šempeter pri Gorici, Slovenia.
2. What personal data we collect
- Basic contact details: name, surname, address, e-mail, phone number.
- Order details: delivery and billing address, items ordered, payment confirmation.
- Account details: username, password (encrypted), security questions, if you create an account.
- Browsing behaviour: items viewed, items added to your cart or wishlist.
- Data from your communications with us: the content of messages you send us (e-mail, forms, chat).
- Technical data via cookies: device, browser, IP address, interaction with the Website — see the cookies section below.
3. Why we process your data and on what legal basis
| Purpose of processing | Legal basis (GDPR) |
|---|---|
| Processing your order, delivery, returns, customer support | Performance of a contract (Art. 6(1)(b)) |
| Meeting accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
| Preventing misuse and fraud, website security | Legitimate interest (Art. 6(1)(f)) |
| Analysing website performance, improvements | Legitimate interest (Art. 6(1)(f)) |
| Marketing communications (newsletters, offers) | Consent (Art. 6(1)(a)) — you may withdraw it at any time |
4. Who we share personal data with
We may share your data with providers who help us run our business, strictly to the extent needed for their service:
- Shopify — our e-commerce platform provider (data processor).
- Payment service providers — to process payments.
- DPD and other carriers — to deliver shipments.
- Public authorities, where required by law.
Each of these providers processes your data under its own privacy policy and, where relevant, on our instructions.
5. Transfers of data outside the EU/EEA
Because we use Shopify, some of your data may also be processed outside the EU/EEA, including in the United States. In such cases we rely on recognised transfer mechanisms (such as the European Commission's Standard Contractual Clauses), which ensure an adequate level of protection for your data.
6. Cookies
The Website uses cookies for basic site functionality, analytics, and — with your consent — marketing and personalisation. You can change your cookie preferences at any time via the cookie banner on our site. For details on cookies related to the Shopify platform, see shopify.com/legal/cookies.
7. Retention period
We keep your data only for as long as necessary for the purpose it was collected for — for example, order data is kept for the period required by mandatory accounting rules, account data for as long as you keep an account with us, and marketing data until you withdraw your consent.
8. Your rights
Regarding your personal data, you have the following rights:
- Right of access — to see what data we hold about you.
- Right to rectification — to correct inaccurate data.
- Right to erasure — to the extent permitted by law (for example, not for data we must retain for accounting reasons).
- Right to restrict processing.
- Right to data portability.
- Right to object to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before the withdrawal.
You can submit a request to info@xway.si. We will respond within the timeframe required by law.
9. Complaints
If you believe we are processing your data in breach of applicable law, you may lodge a complaint with:
Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec)
Dunajska cesta 22, 1000 Ljubljana, Slovenia
www.ip-rs.si
If you live in another EU country, you also have the right to lodge a complaint with the data protection authority in your country of residence.
10. Children's data
Our services are not intended for people under 16, and we do not knowingly collect personal data from children. If you believe we have inadvertently collected data about your child, please contact us so we can delete it.
11. Data security
We implement technical and organisational measures to protect your data, but no system is completely secure. We recommend not sending sensitive information to us over unsecured channels.
12. Changes to this policy
We may update this policy from time to time. Each update is reflected in the date at the top of the page.
13. Contact
For any question about this policy or to exercise your rights: info@xway.si | 068 688 202 | Žnidarčičeva 23, Šempeter pri Gorici, Slovenia.