Privacy policy

Last updated: 2026-10-26

The controller of personal data is Atelier Aura, obrt za dizajn, izradu dekoracija i informatičke usluge, Trpanjska ulica 9, 31000 Osijek, OIB 44506360418. For any question about personal data, contact info@atelieraura.hr.

What we collect

Order details: first and last name, email address, phone number, delivery address, and where a company invoice is requested, company name and tax number.
Order content: products ordered, personalisation text, order note, payment method and amount.
Your email address if you sign up for a back-in-stock notification or for news.
Business enquiry details: name, company, tax number, email, phone and message.
Technical data needed to run and secure the site, such as IP addresses in security logs.
If you accept ad measurement cookies: the Google ad click identifier, the order number and amount, and the email address from the order, which your browser one-way encrypts (hashes) before sending it to Google.

Why we process it, and on what basis

Performance of a contract — processing your order, production, delivery, status updates and invoicing.
Legal obligation — retention of accounting records.
Legitimate interest — site security and prevention of abuse, such as fraudulent cash-on-delivery orders.
Consent — back-in-stock notifications and news by email. You may withdraw consent at any time.
Consent — measuring the performance of our Google ads (which ad led to an order). You may withdraw consent at any time via the “Cookie settings” link in the site footer.

Do you have to give us your data

Order details are necessary to conclude and perform the contract and to issue an invoice — without them we cannot accept the order. Back-in-stock sign-ups, news and business enquiries are voluntary.

We do not make decisions based solely on automated processing and do not profile customers.

How long we keep it

Orders and invoices: 11 years, as required by accounting regulations.
Back-in-stock sign-ups: until the notification is sent, and no longer than 12 months.
Business enquiries: 12 months from the last communication.
Order tracking link from the email: valid for 30 days after the order is shipped, collected or cancelled, and never longer than 180 days from the order.
Per-IP attempt counter, to protect forms from abuse: 24 hours.
Google Ads cookies in your browser: up to 90 days, or until you withdraw consent.
Server security logs: 30 days.
Database backups: 7 days — data deleted from the database disappears from backups no later than 7 days afterwards.

Who we share it with

We do not sell personal data and do not pass it to third parties for marketing, except for ad measurement with your consent (see “Ad measurement” below). Otherwise we share it only with processors necessary to provide the service:

Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Google Cloud and Firebase) — hosting of the website, database and files. Data is stored in a European Union data centre (Frankfurt, Germany).
Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France — sending emails: order confirmation and status, back-in-stock notifications, and forwarding business and contact-form enquiries to us.
Courier service (GLS or Croatian Post, depending on the parcel) — name, address and phone number, solely to deliver the parcel.
Accounting service — invoice data, to meet legal obligations.

Ad measurement (Google Ads)

Only if you consent, the site loads the Google Ads tag of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records that your visit came from one of our ads and, when you place an order, sends Google the order number and amount and your hashed email address, so we know which ads bring in orders. Google processes this data as an independent controller under its privacy policy (policies.google.com/privacy).

We do not use it for personalised ads, remarketing or analytics. Until you consent, the ad tag is not loaded at all and Google receives no data from this site.

Transfers outside the European Union

We store data in the European Union. For some tasks (such as technical support and security), Google and Brevo use affiliates and sub-processors outside the European Economic Area, mainly in the United States. Such transfers rely on the European Commission adequacy decision for the EU-US Data Privacy Framework, for companies certified under it, or on the European Commission standard contractual clauses (Article 46 GDPR). You can request a copy of these safeguards at the address above.

Cookies and local storage

We set cookies for measuring our Google ads only with your consent, which you give or refuse on the banner and can change via the “Cookie settings” link in the footer. We do not use analytics cookies. Your cart is stored in your browser’s local storage and is necessary to provide the service; it does not reach us until you submit an order. See the “Cookies and local storage” page for details.

Your rights

Send requests to info@atelieraura.hr. We respond within 30 days at the latest. If you believe your rights have been infringed, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP).

Right of access to the data we hold about you.
Right to rectification of inaccurate data.
Right to erasure, subject to our legal obligation to retain invoice data. In that case we delete your name, address, email and phone, and keep the amount and order number.
Right to restriction of processing and right to object.
Right to data portability.
Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Security

The site uses an encrypted connection (HTTPS). Only authorised persons can access order data, and only after signing in. The order tracking link contains a random key, shows only what the customer needs, and expires over time. Personal data is not written to application logs, and the database is backed up daily.