Privacy

Who is responsible

23 d.o.o., Gosposvetska cesta 2, 1000 Ljubljana, is the data controller for this site. Write to info@twenty3.store with any question about your data.

What we collect

When you reserve a piece

Your name, email address, phone number, and any note you add. We use these to hold the piece, send your confirmation, and contact you about the collection. The legal basis is performance of a contract at your request.

When you subscribe to our letter

Your email address, on the basis of your consent. Every letter carries an unsubscribe link, and you can withdraw consent at any time.

When you create an account

Your email address, a password we never see in readable form, and the name you give us. We use these to sign you in and to show you your own reservations. The legal basis is performance of a contract at your request. Passwords are stored hashed by our authentication provider; nobody at the store can read them.

An account is optional. You can reserve a piece as a guest, and nothing is lost by doing so — you simply will not see your history in one place.

When you write to us in the chat

The message you send, the page you sent it from, and the email address you give us if you choose to. We use these only to answer you. The legal basis is our legitimate interest in replying to a question you asked us. Giving an email address is optional; without one we can only answer while you have the page open.

If you give us a phone number instead of, or as well as, an email address, we use it for the same purpose and nothing else.

While the chat window is open, what you are currently typing is shown to the member of staff before you press send, so that they can begin helping you sooner. This is held as a single current value, never a history of what you typed and deleted, and it is erased the moment you send the message or empty the box. The chat window says so on its face.

Chat conversations are kept for twelve months and then deleted.

Automatically

Our hosting provider records standard server logs — IP address, browser type, pages requested — to keep the site running and secure. We do not use advertising or tracking cookies, and we run no analytics that profile you.

What we store on your device

Your shopping bag is kept in your own browser's local storage so it survives moving between pages. It never leaves your device until you submit a reservation. Clearing your browser data removes it.

Who else sees it

We do not sell or trade your data. It is handled by the service providers who run this shop for us, and by nobody else:

• Vercel — hosting of the website
• Supabase — the database holding the catalogue and your order, stored in the EU
• Google (Gmail) — sending your confirmation email and our internal notice that a chat message has arrived
• Telegram — where used, to alert a member of staff that a chat message is waiting. Only the alert passes through Telegram; the conversation itself stays in our own database. Telegram processes this outside the EU.
• Google Fonts — typefaces used on the site

We may also disclose data where the law requires it.

How long we keep it

Chat conversations are kept for twelve months. Order records are kept as long as accounting and tax law requires. Newsletter addresses are kept until you unsubscribe. Account details are kept until you ask us to close the account. Cancelled reservations are removed within twelve months.

Your rights

Under the GDPR you may ask us to show you the data we hold about you, correct it, delete it, restrict how we use it, or send it to you in a portable form. You may also object to processing based on our legitimate interests. Write to info@twenty3.store and we will answer within one month.

To close your account and have it removed, write to us and we will delete it within one month. Where accounting law requires us to keep a record of a completed sale, that record stays, but it is detached from your account.

If you believe we have handled your data wrongly, you may complain to the Information Commissioner of the Republic of Slovenia (ip-rs.si).

Last updated · August 2026