Privacy policy
Which data we collect, why, and for how long.
Who processes your data
The controller of personal data is:
- Name: LAKRIS ACTIVE BRAND j.d.o.o. za trgovinu
- Address: Ul. admirala Jakova Šubića od Cezana 16, 23000 Zadar, Croatia
- OIB (tax number): 87203238610
- Contact: lakrisactivebrand@gmail.com
Which data we collect, and why
| Purpose | Data | Legal basis |
|---|---|---|
| Fulfilling an order | Name, email, phone, delivery address or chosen parcel locker, the order lines, the amount. | Performance of a contract (Article 6(1)(b) GDPR). |
| Issuing an invoice | The data from the order, plus the company name, OIB and VAT ID for a company purchase. | Legal obligation (Article 6(1)(c) GDPR): accounting and tax rules. |
| Answering an enquiry | Name, email, phone if you enter one, the content of your message. | Legitimate interest in answering an enquiry (Article 6(1)(f)). |
| Newsletter by email | Email address. | Consent (Article 6(1)(a)), which you may withdraw at any time. |
| Visit statistics | A daily pseudonym for the visit, the page visited, the type of event. No IP address and no cookie. | Legitimate interest in understanding how the shop is used (Article 6(1)(f)). |
| Security of the admin panel | The IP address of failed login attempts. | Legitimate interest in protecting the system (Article 6(1)(f)). |
| Evidence of your cookie decision | A random identifier for the decision, which categories you allowed, the version of the cookie list, the language, where the decision was made and when. No IP address, nothing about your browser, and nothing that would tie the decision to a person. | Legal obligation to be able to demonstrate consent (Article 7(1) GDPR). |
We need the data we mark as required in order to fulfil an order. Without it we cannot accept the order. Everything else is optional.
How long we keep it
- Orders and invoices: for as long as accounting and tax rules require.
- Enquiries from the form: we keep them for as long as it takes to resolve the enquiry. The period after which a resolved exchange is deleted has not been set yet; until it is, messages are kept and nothing deletes them on its own.
- Newsletter subscription: until you unsubscribe.
- Evidence of cookie decisions: a retention period has not been set yet, so these records are not deleted for now. Once a period is set, it will be stated here.
- Visit statistics: individual records for at most 14 months.
- Records of login attempts: 24 hours.
Who we pass it to
We do not sell your data. We pass it only to those without whom an order cannot be fulfilled:
- The delivery service: name, address or chosen parcel locker, phone and email, in order to deliver.
- The invoicing service: the data needed to issue an invoice.
- The payment provider: card payments are handled by Stripe. You enter your card details on Stripe’s own page; the full card number never reaches us and we do not store it. We exchange order and payment identifiers and the amount with Stripe, so that the payment can be processed and so that we know whether it succeeded.
- BOX NOW: when you choose parcel locker delivery, we pass on the data needed for delivery and the identifier of the locker you chose. BOX NOW is also the provider of the embedded map: when you open the locker map at checkout, your browser connects directly to its servers and to the servers that map uses. Until that click nothing is loaded.
- The email service provider: correspondence with customers and messages about an order pass through a mailbox at an external email service provider, so that provider processes the address and the content of the message.
- The hosting provider: as a processor, under contract.
For part of this processing Stripe acts as a processor on our behalf, and for part as an independent controller: for fraud prevention, meeting its own legal obligations and improving its service it determines the purposes and means itself. For that part of the processing its own privacy policy applies, not ours.
We do not transfer data outside the European Economic Area, unless that is necessary for one of the services above; in that case, under the appropriate safeguards set out in the GDPR.
Some recipients process data outside the European Economic Area as well. For transfers out of the EEA Stripe names more than one mechanism at the same time: a certification under the EU–US Data Privacy Framework, which takes precedence where more than one applies, with the European Commission’s Standard Contractual Clauses kept in place as a fallback. This paragraph should be confirmed by a lawyer before publication.
Visit statistics
We keep our statistics ourselves, on our own server. They set no cookie, do not remember your IP address and send nothing to a third party.
Instead of an identifier we use a daily pseudonym computed from a secret known only to the server. That pseudonym changes every day, so the same visitor cannot be followed over time. For that reason we do not ask for consent for these statistics.
If we ever introduce an external analytics or advertising measurement tool, it will load only after your consent. The list of cookies is on the Cookie policy.
Your rights
Under the GDPR you have the right to:
- ask for access to your data and a copy of it,
- ask for inaccurate data to be corrected,
- ask for erasure, where there is no longer a basis for processing,
- ask for processing to be restricted,
- the portability of the data you gave us yourself,
- object to processing based on a legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
Send your request to lakrisactivebrand@gmail.com. We reply within the deadlines the GDPR prescribes.
You also have the right to lodge a complaint with a supervisory authority; in the Republic of Croatia that is the Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb.
Changes to this policy
We may amend this policy. The version in force is always the one on this page.