Privacy Policy

The protection of your personal data is an issue we take very seriously. Therefore, your personal data is always strictly confidential and processed in accordance with legal data protection regulations, as well as this privacy policy.

1. Identity and Contact Information of the Data Controller

This privacy policy applies to all personal data processed by VG Group d.o.o. under the GDPR (hereafter, the “Data Controller”):

Legal Entity Name: VG Group d.o.o.

Registered Office: Gora pri Pečah 20, 1252 Vače, Slovenia

Company Registration Number: 8419949000

VAT Number: SI 9703831

Court Register Entry: 2022/34182

Contact Email Address: info@4endurance.com

We place great importance on your privacy and process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data (hereinafter: the “GDPR”), as well as other applicable legislation governing the protection of personal data, including any amendments and supplements thereto.

If you have any additional questions or comments regarding the processing of your personal data, you may contact us at any time by email at: info@4endurance.com.

2. What does “processing of personal data” mean?

The processing of personal data (hereinafter, “data”) includes any handling of data that can identify you as a natural person. You can find information about the specific data involved in this Privacy Policy. The term “processing” is very broad and encompasses activities such as collecting, storing, using your data, or sharing it with third parties.

3. What data do we process?

Below, we clarify the types of data that we may process from you. We may receive the following data either directly or indirectly from you.
You may provide us with your personal data directly when you make a purchase on our website, contact our company, or enter into a contract with us as a supplier, service provider, or other business partner.
We may also obtain your personal data indirectly from third parties. In such cases, you do not provide this personal data directly to VG Group d.o.o.; rather, you have authorized a third party to disclose your personal data to other entities.

3.1. Customer Data

3.1.1. Data — Customer Account

Our website allows you to create a personal customer account, which enables you to place orders, make purchases, and view your purchase history. By creating a customer account, you provide the data controller with the following information:

• General identification data (last name, first name, date of birth)
• Contact information (last name, first name, email address, address, telephone number)
• Tokenized payment data/payment confirmation data (account number, expiration date, cardholder name – CVV/full card numbers are processed by payment providers and not stored by the Data Controller)
• Order history
• Company registration number and other company-related information where such information may lead to the identification of a natural person
• Delivery addresses (if different from the stated permanent residential address)
• Shopping cart contents
• Gender (optional)
• Account information (username, password)

3.1.2. Data When Placing an Order Without an Account

When you place an order without creating an account, we process the data you provide during checkout, including:

• General identification data (last name, first name)
• Contact information (email address, delivery address, telephone number)
• Payment details necessary to process the transaction
• Ordered products/services and order number

3.1.3. Data When Contacting Customer Support

If you have any questions, complaints, or comments, you can contact our customer support team.
When you contact our customer support team, we may process the following data:

• General identification data (name, first name)
• Contact information (email address and address if the reason for contacting is related to it)
• Payment card details (to the extent that the reason for contacting customer service is related to it)
• Ordered products/services and order number/customer number

3.1.4. Data in the Context of After-Sales Services, Contests, and Other Promotional Activities

The quality of our services, customer satisfaction and the overall customer experience are extremely important to us. In this context, the data controller processes the following information:

• General identification data (name, first name)
• Contact information (email address and address if relevant)
• Ordered products/services and order number/customer number
• Feedback on the products sold and, more generally, on the services provided

3.2. Supplier Data

In the course of our business activities, we work with external suppliers, service providers and other business partners. In this context, the data controller may process the following personal data:

• Contact information of the contact person within the supplier/service provider's company (name, first name, email address, telephone number)
• Company number and other company-related data insofar as they can lead to the identification of a natural person
• Contractual data (e.g., company name, address, VAT number, contractual terms and other information necessary for the performance of the contractual relationship)
• Payment and billing information (e.g., bank account details, invoices and other information necessary for processing payments)
• Platform user account information (e.g., registration details)
• Feedback, testimonials, quotes and promotional content, such as photographs and videos

3.3. Website visitors

When you visit our website as a customer or non-customer, the following personal data may be processed, depending on your own personal preferences:

• IP address, browser type, date and time of visit, pages visited, duration of visit, location data, technical device information (operating system, screen resolution), source of website traffic, user interests, and information about how you use the website (through strictly necessary, analytics and marketing cookies)
• First name, last name, email address, telephone number, address and order number (through our AI-powered chat)
• Email address (through the online newsletter subscription form)
• Data relating to an incomplete purchase or abandoned shopping cart (shopping cart contents, email address and information relating to a checkout process that was initiated but not completed)

Cookie Details: For more detailed information about the cookies we use — including their names, providers, duration, and how consent is obtained — please refer to our Website Cookie Policy.

Based on your consent, we may share information about your website interactions (e.g., pages viewed, products interacted with) with advertising platforms such as Google and Meta for the purpose of creating advertising audiences and personalising ads.

4. For What Purposes Do We Process Your Data?

Personal data is processed exclusively within the framework of the Data Controller, specifically for the following purposes:

• Carrying out our core business activities and operating our online store (sales, advertising, marketing, etc.)
• Providing after-sales services
• Carrying out marketing and promotional activities
• Complying with legal, administrative, and tax obligations
• Communicating with customers and prospective customers
• Collecting and analysing product feedback and improving our products and Customer experience
• Displaying personalised advertisements

5. On What Legal Grounds Do We Process Your Data?

VG Group d.o.o. processes personal data solely for the purposes described in Chapter 4 and only based on one or more of the legal grounds set out in Article 6 GDPR, as described below.
Where we have obtained your consent to process your personal data, we may use pseudonymised identifiers, such as a hashed email address or telephone number, for the purposes of personalised advertising and creating target audiences on advertising platforms such as Google and Meta. Such processing enables us to display personalised advertisements to you.

5.1 Performance of a Contract or Pre-Contractual Measures (Art. 6(1)(b) GDPR)

Personal data is processed where this is necessary for entering into, performing, or terminating a contract with you, including for the following purposes:

• Operating our webshops and core business activities
• Creating and managing customer accounts
• Processing orders, payments, and deliveries
• Providing customer support and after-sales services
• Communicating with customers and prospects in the context of a contractual relationship
• Managing relationships with suppliers and service providers

5.2 Compliance with Legal Obligations (Art. 6(1)(c) GDPR)

We process certain personal data where necessary to comply with the legal and regulatory obligations applicable to VG Group d.o.o., including accounting, tax, and administrative obligations, as well as data retention requirements imposed by applicable laws and regulations.

5.3 Legitimate Interests (Art. 6(1)(f) GDPR)

We process certain personal data based on our legitimate interests, provided that such interests are not overridden by the fundamental rights and freedoms of the individuals whose personal data is processed. Such legitimate interests include:

• Marketing and promotional activities, in line with the EU e-Privacy Directive
• Improving the quality of our products and services
• Maintaining customer relationships and ensuring customer satisfaction
• Training employees and evaluating our activities
• Compiling statistics and internal reporting related to our activities
• Preserving and using evidence in the context of liability, disputes, or legal proceedings
• Ensuring the security of our websites, IT systems and company premises

5.4 Consent (Art. 6(1)(a) GDPR)

In certain cases, personal data is processed based on your prior consent, including for the following purposes:

• Marketing activities that do not fall under legitimate interest
• The use of analytical and marketing cookies
• The use of photos, videos, testimonials, or other media on our website or social media channels
• Participation in contests and promotional campaigns

How to withdraw your consent:

• Newsletter/marketing emails: You can unsubscribe at any time by clicking the unsubscribe link at the bottom of every marketing email we send you.
• Other consent-based processing: Contact us at info@4endurance.com to withdraw any other specific consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

5.5 Profiling and Personalised Advertising

As part of our marketing and advertising activities, we may carry out profiling within the meaning of Article 4(4) of the GDPR where we have obtained your prior consent to do so.

In this context, profiling means the automated processing of certain personal data relating to your use of our website (for example, pages visited, products viewed, search queries, products added to your shopping cart, or purchases made) for the purpose of evaluating your interests, preferences, and other personal aspects in order to provide personalised advertising.

How profiling works

If you consent to the use of analytics and/or marketing cookies on our website:

• Information about your use of the website may be collected through cookies or similar technologies
• This information may be shared with advertising platforms such as Google and Meta
• These platforms may use this information to create advertising audiences
• Based on the audiences created in this way, personalised advertisements may be displayed to you

Hashed identifiers and audience matching

Where you have provided the relevant consent, we may use hashed identifiers (such as encrypted email addresses or telephone numbers) for the purpose of creating advertising audiences (for example via "Customer Match" or similar services). These identifiers are not shared in plain, readable form.

Purchase and conversion events

Where permitted by your consent, purchase or conversion events may be used to limit or exclude you from further personalised advertising (for example, to avoid showing advertisements for products you have already purchased).

Automated decision-making

The profiling described above is limited to the personalisation of advertisements and does not produce legal effects or similarly significantly affect individuals within the meaning of Article 22 of the General Data Protection Regulation (GDPR). It does not affect your ability to purchase products, access services, or exercise your rights.

Legal Basis and Withdrawal of Consent

Profiling for the purposes of personalised advertising is carried out exclusively on the basis of your prior consent (Article 6(1)(a) of the General Data Protection Regulation (GDPR)).

6. Data Source

Most of the personal data we process is obtained directly from you in connection with your use of our services. In certain cases, we may also obtain personal data about you from external service providers or publicly available sources. For additional information about the sources from which we obtain your personal data, you may contact us at any time.

7. Who Do We Share Your Data With?

We do not disclose your personal data to third parties unless this is necessary for the purposes of processing described above or where we are legally required to do so.
Where necessary for the conduct of our business activities, we also engage external service providers that act as processors of personal data. These service providers process personal data solely on our behalf and in accordance with our instructions and are contractually required to maintain the confidentiality and security of personal data pursuant to a data processing agreement.

Where necessary for the relevant purpose of processing, we may share your personal data with the following categories of third parties:

• Postal, courier, transport and delivery service providers, where necessary to deliver a shipment or product to you
• Payment service providers, where necessary to process payments made by you or payments made by us
• External representatives, advisers and other business partners, where their involvement is necessary for the performance of our core or supporting business activities
• Information technology and other technology service providers that assist us in managing and maintaining our systems and business operations
• Competent public authorities, courts, regulatory authorities and providers of regulated professional services, such as accountants, auditors and lawyers, where necessary to comply with legal obligations or to protect and enforce our rights and interests
• Providers of user research and survey platforms that we use to collect feedback, measure customer satisfaction and improve our services

International Transfers of Personal Data

Some of our processors or other recipients of personal data may be established outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we ensure that such transfers are carried out only where appropriate safeguards are in place in accordance with the GDPR. This includes transfers to countries for which the European Commission has adopted an adequacy decision or transfers based on Standard Contractual Clauses (SCCs) approved by the European Commission. Transfers of personal data to the United States are carried out only where the recipient is certified under the EU–US Data Privacy Framework or where other appropriate safeguards, such as Standard Contractual Clauses, are in place.

8. For How Long Do We Store Your Data?

We do not retain your personal data for longer than is necessary for the purposes for which it was collected or otherwise processed. The retention period depends on the type of personal data, the purpose of processing, and applicable legal requirements. Upon expiry of the applicable retention period, personal data will be securely deleted, anonymised, or blocked, unless we are required by law to retain it for a longer period.

Specific legislation may require us to retain certain personal data for a longer or shorter period. We always determine retention periods based on applicable legal requirements, while taking into account the balance between your rights and expectations and what is necessary to achieve the purposes for which we process personal data.

9. Where Do We Store Your Data and How Is It Protected?

We implement appropriate technical and organisational measures to protect your personal data against destruction, loss, misuse, unauthorised access, disclosure, alteration, or any other form of unlawful or unauthorised processing.

We also ensure that our processors and other contractual partners that process personal data on our behalf implement appropriate technical and organisational security measures to reduce the risk of security incidents.

If your personal data is processed or transferred outside the European Economic Area (EEA), we ensure that such processing or transfer takes place only in countries for which the European Commission has adopted an adequacy decision or based on other appropriate safeguards in accordance with the GDPR. Transfers of personal data to the United States are carried out only where the recipient is certified under the EU–US Data Privacy Framework or where other appropriate safeguards, such as Standard Contractual Clauses, are in place.

10. Technical and Organisational Measures (TOMs)

We implement appropriate technical and organisational security measures to prevent the destruction, loss, falsification, alteration, unauthorised access, or unlawful disclosure of your data. These measures include:

• Encryption in transit: Data transmitted through our online stores is protected using the HTTPS/TLS protocol. This ensures that communication between the user’s browser and the online store is encrypted and protected against unauthorised interception during transmission.
• Session management: Session cookies are automatically deleted when the session ends. Other cookies are used and managed in accordance with your preferences and the consent you have provided.
• Password protection: Passwords are stored using secure one-way hashing functions and appropriate salting in accordance with industry standards. Passwords are never stored in a readable or reversible form.
• Payment security: Payment card data is securely transmitted through trusted payment service providers. We do not store sensitive payment card information.
• Server logging: To ensure the security, stability and proper functioning of our systems, we automatically log certain technical information, such as browser information, referring URL, IP address and the time of the server request. This data is retained for a maximum of 12 months.

External service providers are contractually required to protect the confidentiality of personal data and may process such data only to the extent necessary to provide services on our behalf and in accordance with our instructions. We retain personal data only for as long as necessary to achieve the purposes described in this Policy or as required by applicable laws and regulations. Upon expiry of the applicable retention period, personal data is deleted or anonymised.

11. What Are Your Rights?

You have various rights in relation to the processing of your personal data. To exercise these rights, please contact our team using the contact details provided in Section 1 of this document.

Right of Access and to Obtain a Copy

You have the right to obtain confirmation as to whether we process your personal data and to access such data and information about its processing. You also have the right to obtain a copy of the personal data we process.

Right to Rectification

You have the right to request the rectification of inaccurate personal data and the completion of incomplete personal data without undue delay.

Right to Erasure (Right to Be Forgotten)

You have the right to request the erasure of your personal data in the circumstances provided for by the GDPR. We may not always be able to comply with this request, particularly where we are required to continue processing personal data in order to fulfil contractual or legal obligations.

Right to Restriction of Processing

In certain circumstances, you have the right to request the restriction of the processing of your personal data, for example, while the accuracy of the data is being verified.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal. To unsubscribe from marketing emails, you may use the unsubscribe link provided in each email.

Right to Object

You have the right to object to the processing of personal data based on our legitimate interests. Where we use personal data for direct marketing purposes, you have the right to object to such processing at any time.

Right to Data Portability

Where processing is based on consent or a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to request that it be transmitted to another data controller, where technically feasible.

Right to Lodge a Complaint with a Supervisory Authority

If you believe that we are processing your personal data in violation of applicable law, you have the right to lodge a complaint with the competent data protection supervisory authority.

In the Republic of Slovenia, this is the Information Commissioner of the Republic of Slovenia.

You also have the right to lodge a complaint with the data protection supervisory authority in the EU Member State of your habitual residence, place of work, or the place where the alleged infringement of the GDPR occurred.

12. How to Exercise Your Rights

You may exercise your rights by contacting us at info@4endurance.com. In certain cases, we may ask you to provide appropriate documentation to verify your identity. Such documentation will be used solely for processing and fulfilling your request in accordance with the GDPR.

13. May Children Use Our Website?

Our website and products are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you are under the age of 18, you may purchase or use our products only with the consent and under the supervision of a parent or legal guardian. If we become aware that we have collected personal data from a minor without the appropriate consent of a parent or legal guardian, we will take appropriate steps to delete such data.

14. Questions Regarding Data Protection

If you have any questions regarding privacy or the protection of personal data, you may contact us at info@4endurance.com.

© 2026 4Endurance · Last updated: August 11, 2026