Privacy policy

This Privacy Policy explains how we collect and process personal data when you use our website and online shop, place an order or send an enquiry. We process data lawfully, fairly and transparently, and only to the extent necessary, in accordance with the General Data Protection Regulation (GDPR).

1. Data controller

[NAZIV TVRTKE d.o.o.], Trnovčica 71, 10040 Zagreb, OIB: [OIB], email: [GDPR EMAIL]. We respond to data subject requests within 30 days.

2. Purposes, legal bases and retention

• Order processing (name, email, phone, delivery address, order contents, company data for invoices) – performance of a contract, Art. 6(1)(b) GDPR. Retention: until delivery and any complaint is resolved; invoices 11 years under Croatian accounting and tax law (Art. 6(1)(c)).
• Contact and wholesale enquiries – legitimate interest in replying, Art. 6(1)(f). Retention: 12 months from last contact.
• Website security (hosting provider technical logs) – legitimate interest. Retention: up to 12 months.

We do not carry out profiling or automated decision-making. We do not request special categories of personal data.

3. Recipients and processors

We never sell or rent your data. Only authorised staff and the following processors may receive it:

• Cloudflare, Inc. – website hosting and protection;
• FormSubmit (formsubmit.co) – forwarding form contents (orders and enquiries) to our email;
• Unsplash (images.unsplash.com) – delivery of some product photos; your browser sends its IP address when loading an image, no cookies;
• [EMAIL PROVIDER] – business email;
• [PAYMENT PROVIDER / PayPal] – payment processing (we never receive card details);
• [COURIER] – delivery outside Zagreb (name, address, phone).

Where data is transferred to the USA, the transfer relies on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

4. Cookies

This site uses no analytics or marketing cookies. Your cart is stored only in your browser’s local storage (localStorage), which is strictly necessary for the shop to work. See the Cookie policy.

5. Security

The site uses TLS/SSL encryption. Only authorised persons can access data, with appropriate technical and organisational measures. Data breaches are handled under Art. 33 and 34 GDPR.

6. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21). Send requests to [GDPR EMAIL]; exercising your rights is free. You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Martićeva 14, 10000 Zagreb, azop@azop.hr.

7. Changes

We may update this policy; the new version is published on this page.

Version 1.0, effective from [PUBLICATION DATE].