Privacy policy

Last updated: 2026-08-29

The controller of personal data is Atelier Aura, obrt za izradu ukrasa, Kninska 1, 31000 Osijek, OIB 11111111111. For any question about personal data, contact info.atelier.aura@gmail.com.

What we collect

Order details: first and last name, email address, phone number, delivery address, and where a company invoice is requested, company name and tax number.
Order content: products ordered, personalisation text, order note, payment method and amount.
Your email address if you sign up for a back-in-stock notification or for news.
Business enquiry details: name, company, tax number, email, phone and message.
Technical data needed to run and secure the site, such as IP addresses in security logs.

Why we process it, and on what basis

Performance of a contract — processing your order, production, delivery, status updates and invoicing.
Legal obligation — retention of accounting records.
Legitimate interest — site security and prevention of abuse, such as fraudulent cash-on-delivery orders.
Consent — back-in-stock notifications and news by email. You may withdraw consent at any time.

How long we keep it

Orders and invoices: 11 years, as required by accounting regulations.
Back-in-stock sign-ups: until the notification is sent, and no longer than 12 months.
Business enquiries: 12 months from the last communication.
Security logs: 30 days.

Who we share it with

We do not sell personal data and do not pass it to third parties for marketing. We share it only with processors necessary to provide the service:

Google Ireland Limited / Google Cloud — website and database hosting (Firebase). Data is stored in a European Union data centre (Frankfurt, Germany).
Brevo — sending transactional emails (order confirmation, status updates).
Courier service — name, address and phone number, solely to deliver the parcel.
Accounting service — invoice data, to meet legal obligations.

Cookies and local storage

We do not use cookies for analytics or advertising and there is no consent banner. Your cart is stored in your browser’s local storage and is necessary to provide the service; it does not reach us until you submit an order. See the “Cookies and local storage” page for details.

Your rights

Send requests to info.atelier.aura@gmail.com. We respond within 30 days at the latest. If you believe your rights have been infringed, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP).

Right of access to the data we hold about you.
Right to rectification of inaccurate data.
Right to erasure, subject to our legal obligation to retain invoice data. In that case we delete your name, address, email and phone, and keep the amount and order number.
Right to restriction of processing and right to object.
Right to data portability.
Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Security

The site uses an encrypted connection (HTTPS). Only authorised persons can access order data, and only after signing in. Personal data is not written to application logs, and the database is backed up daily.