This policy explains how Obsidian Core s. r. o. (operating the Joyla e-shop) processes your personal data when you use our website and services. Your privacy is a priority for us. As a globally operating e-shop, we process personal data in accordance with the strict standards of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Slovak Act No. 18/2018 Coll. on Personal Data Protection, and we strive to extend these high standards of data protection to all our customers worldwide, subject to applicable local laws.
- Data Controller The data controller determining the purposes and means of processing your personal data is:
Company Name: Obsidian Core s. r. o. Registered Office: 9. Mája 44, 977 03 Brezno, Slovak Republic Company Registration No. (IČO): 57420343 Tax ID (DIČ): 2122711998 Email: hello@getjoyla.com
(hereinafter referred to as the "Controller" or "we")
- Purposes and Legal Basis for Processing We process your personal data only to the extent necessary for specific purposes. For customers within the European Economic Area (EEA), the UK, and jurisdictions with similar frameworks, we rely on the following legal bases:
A) Order fulfillment and service delivery
Purpose: Creation of a personalized song, payment processing, and electronic delivery of the digital product.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR). Without providing this data, the service cannot be delivered.
B) Accounting and tax obligations
Purpose: Issuing invoices and maintaining accounting records.
Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR) under relevant national accounting and tax laws.
C) Customer support and communication
Purpose: Answering your inquiries and resolving complaints.
Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR) in providing high-quality customer service.
D) Marketing and analytics (Cookies, Pixel)
Purpose: Tracking website traffic, analyzing user behavior, and delivering targeted advertising (Facebook Pixel, Google Analytics).
Legal basis: Your explicit consent (Art. 6(1)(a) GDPR), which you provide via the cookie banner or browser settings.
E) Abandoned checkout reminders
Purpose: If you enter your email address in the checkout but do not complete the payment, we temporarily store your email, the details you filled in and the contents of your cart, so we can send you a reminder (at most two emails) with a link to finish your order right where you left off.
Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR) in enabling you to complete an initiated purchase. Every reminder contains an unsubscribe link, and saved carts are deleted automatically within 7 days.
- Categories of Processed Data We process the following categories of data:
Identification and contact data: First name, last name, and email address (used for digital product delivery).
Personalization data: Information you enter into the song creation form (e.g., names of the people the song is for, their traits, personal stories). Notice: The customer is fully responsible for ensuring they have the right and necessary consent to provide personal data about third parties (e.g., the recipient) for the purpose of creating the song.
Transaction data: Information regarding received payments (we do not see or store your credit card details; these are processed securely and exclusively by our payment gateway).
Technical data: IP address, device type, and data collected via cookies and tracking pixels.
- Data Recipients and International Data Transfers Your personal data is treated as strictly confidential. Access is limited to authorized personnel and our trusted third-party partners whose services are essential for the operation of our e-shop:
IT and cloud service providers: To ensure website operation, data hosting, and digital content generation.
Payment service providers: For secure processing of transactions.
Accounting firm / Tax advisor: For bookkeeping and tax compliance.
Marketing platforms: Google Ireland Ltd. (Analytics) and Meta Platforms Ireland Ltd. (Facebook/Instagram).
International Transfers: As an international business utilizing global analytics, marketing, and cloud infrastructure, some of your data may be transferred to servers located outside your country of residence, including the USA. For users in the EU/EEA, such transfers are safeguarded in compliance with the GDPR, primarily through Standard Contractual Clauses (SCCs) approved by the European Commission or based on an adequacy decision (such as the EU-U.S. Data Privacy Framework).
Technology Partner for Song Creation: For the purpose of providing our core service—creating personalized songs—we utilize technology solutions provided by Suno, Inc., headquartered in Delaware, USA. Only the data strictly necessary to generate the audio recording (e.g., song lyrics or story keywords) is transmitted to their system. We deliberately avoid sending direct identification data unless it is an essential part of the song's requested content.
Suno, Inc. processes data in the USA. The protection of your data is ensured in compliance with the GDPR through Standard Contractual Clauses (SCCs) and robust technical measures implemented by the provider. By submitting an order, you acknowledge that without this necessary data transfer to our technology partner, the getjoyla.com service cannot be provided.
- Retention Period We retain your personal data only for as long as necessary to fulfill the intended purpose:
Accounting records: 10 years (as mandated by law).
Order processing and complaint data: For the duration of statutory warranty and limitation periods (typically 3–4 years).
Marketing data (Cookies): Until your consent is withdrawn, up to a maximum of 2 years.
Abandoned checkout data (email, checkout details, cart contents): Deleted automatically within 7 days of your last activity, or immediately upon your objection/unsubscribe request.
- Your Rights as a Data Subject Regardless of where you are located, we strive to give you comprehensive control over your personal data. Under the GDPR (and similar global privacy laws), you hold the following rights:
Right of access: To request information about whether and how we process your personal data.
Right to rectification: To request the correction of inaccurate or outdated data.
Right to erasure (right to be forgotten): To request the deletion of your data if the purpose of processing has ended or you have withdrawn your consent.
Right to restriction of processing: In specific cases defined by law.
Right to data portability: To receive your data in a structured, commonly used, and machine-readable format.
Right to object: To object to processing based on our legitimate interests.
Right to withdraw consent: At any time, if the processing is based on your consent (e.g., marketing).
You can exercise your rights at any time by contacting us via email at: hello@getjoyla.com.
Right to lodge a complaint: If you believe that the processing of your personal data violates applicable privacy laws, you have the right to file a complaint with the data protection supervisory authority in your country of residence, or with our primary regulator: The Office for Personal Data Protection of the Slovak Republic (Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk).
-
Cookies Our website uses cookies to ensure essential site functionality and to measure the effectiveness of our advertising. You can reject or manage your preferences for marketing and analytical cookies at any time via the cookie banner displayed upon entering the website or through your web browser's settings.
-
Changes to this Policy We may update this Privacy Policy from time to time to reflect changes in legal requirements or our operational practices. The current and valid version will always be published on this page.
This policy is effective as of October 1, 2025.