Privacy Policy

This Policy explains how we collect and process personal data in accordance with the General Data Protection Regulation (GDPR) and Croatian law.

1. Controller

KASALO DIGITAL, obrt za web dizajn i razvoj aplikacija, vl. Luka Kasalo
Tvrtkova 1, 22300 Knin, Croatia
OIB: 05372595966
Registered in the Croatian Register of Crafts (Obrtni registar)
E-mail: luka.kasalo.web@gmail.com

2. Data we process

• Orders: name, email, mobile number, delivery address, products ordered, amount, payment method (no card data).
• Account (optional): email, password (stored only as a cryptographic hash), saved delivery details, favorites.
• Communication: content of emails you send us (e.g. complaints, returns).
• Technical data: anonymised visit statistics (Vercel Web Analytics, cookieless), server security logs and, only with your consent, usage data via Google Analytics (pseudonymous identifier, pages, device, approximate location).

3. Purposes and legal bases

• Performance of the contract – processing orders, delivery, returns, complaints (Art. 6(1)(b) GDPR).
• Legal obligations – issuing and keeping invoices, fiscalisation, accounting (Art. 6(1)(c)).
• Legitimate interest – site security, fraud prevention, anonymous visit statistics (Art. 6(1)(f)).
• User account – at your request, to provide the account service (Art. 6(1)(b)).
• Analytics via Google Analytics – based on your consent (Art. 6(1)(a)), which you may withdraw at any time.

We do not send marketing messages and do not use your data for automated decision-making.

4. Recipients

• Vercel Inc., USA – website hosting and anonymous statistics.
• Neon Inc. – database (data stored in the EU).
• Stripe Payments Europe Ltd., Ireland – payment processing; PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg – if you pay with PayPal.
• Google Ireland Ltd. – sending emails (order confirmations, invoices) and, with consent, Google Analytics.
• Suppliers and couriers – name, address and mobile number, for delivery only.
• Croatian Tax Administration – invoice data for fiscalisation; our accountant – invoices, if used.

Transfers outside the European Economic Area (e.g. USA) are protected by appropriate safeguards such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

5. Retention

• Invoices and order data – at least 11 years, as required by accounting and tax law.
• User account – until you delete it (possible at any time in your account settings).
• Google Analytics – 14 months.
• Complaint and return correspondence – until limitation periods expire.

6. Your rights

You have the right of access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interest. Send requests to luka.kasalo.web@gmail.com; we will reply within one month. Erasure does not apply to data we must keep by law (e.g. invoices).

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or with the supervisory authority in your country.

7. Security

The site uses an encrypted connection (HTTPS). Passwords are stored only as hashes and we do not store card data.

8. Changes

This Policy is valid from 4 October 2026. Changes will be published on this page.