Slikica

Privacy Policy

1. Data Controller

The controller of personal data is:

  • Company: Stolarija Rusan
  • Registered address: Karivaroš 35 A, 49245 Gornja Stubica, Croatia
  • OIB (Tax ID): 79199048265
  • Email: info@slikica.com
  • Phone: +385 99 57 88 370

This Privacy Policy explains how we collect, use, store, and protect your personal data when using the online store slikica.com.

2. What Personal Data We Collect

We collect the following categories of personal data:

2.1. Data You Provide Directly

  • Identification data: first and last name
  • Contact data: email address, phone number
  • Address data: delivery address (street, house number, postal code, city, country)
  • Order data: selected products, personalized photographs, special requests
  • Payment data: card type (card details are processed exclusively through the CorvusPay system and are not stored by us)

2.2. Data Collected Automatically

  • Technical data: IP address, browser type, operating system
  • Usage data: pages you visit, time of visit, referring page
  • Cookies: cookie-related data can be found in our separate Cookie Policy

3. Purposes and Legal Basis for Processing

Purpose of processing Legal basis (Art. 6 GDPR)
Order fulfillment and product delivery Performance of a contract (Art. 6(1)(b))
Issuing invoices and tax obligations Legal obligation (Art. 6(1)(c))
Communication regarding orders Performance of a contract (Art. 6(1)(b))
Handling complaints and claims Legal obligation (Art. 6(1)(c))
Sending promotional notifications (newsletter) Consent (Art. 6(1)(a))
Improving service and user experience Legitimate interest (Art. 6(1)(f))
Fraud prevention Legitimate interest (Art. 6(1)(f))

4. Recipients of Personal Data

We may share your personal data with the following categories of recipients:

  • Delivery services: for order delivery (name, address, phone number)
  • Payment service provider: CorvusPay d.o.o. for processing card transactions
  • Accounting service: for maintaining business records and issuing invoices
  • Hosting provider: for storing data on secure servers
  • Government authorities: when required by law (tax administration, courts)

We do not sell, rent, or share your personal data with third parties for marketing purposes without your explicit consent.

5. Transfer of Data to Third Countries

Your personal data is processed within the European Economic Area (EEA). In the event of a transfer outside the EEA, we will ensure appropriate safeguards in accordance with the GDPR (standard contractual clauses or an adequacy decision).

6. Data Retention Periods

  • Order and invoice data: 11 years (in accordance with Croatian tax regulations)
  • Complaint data: 2 years from the resolution of the complaint
  • Customer photographs: deleted 30 days after product delivery, unless longer retention is necessary for complaint resolution
  • Newsletter subscriptions: until withdrawal of consent
  • Cookies: according to the periods specified in the Cookie Policy

7. Your Rights

Under the GDPR, you have the following rights:

  • Right of access (Art. 15) — the right to obtain information about the processing of your data and a copy of your personal data
  • Right to rectification (Art. 16) — the right to correct inaccurate or incomplete data
  • Right to erasure (Art. 17) — the right to have your data deleted (“right to be forgotten”), subject to legal limitations
  • Right to restriction of processing (Art. 18) — the right to restrict processing in certain situations
  • Right to data portability (Art. 20) — the right to receive your data in a structured, commonly used, and machine-readable format
  • Right to object (Art. 21) — the right to object to processing based on legitimate interest
  • Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out prior to withdrawal

To exercise your rights, please contact us at: info@slikica.com

We will respond to your request within 30 days.

8. Right to Lodge a Complaint

If you believe that the processing of your personal data is in violation of the GDPR, you have the right to lodge a complaint with the supervisory authority:

Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136, 10000 Zagreb, Croatia
Phone: +385 1 4609 000
Email: azop@azop.hr
Web: https://azop.hr

9. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or destruction, including:

  • SSL/TLS encryption for data transmission
  • Secure servers with controlled access
  • Regular backups
  • Restricted access to personal data limited to authorized personnel only

10. Changes to the Privacy Policy

We reserve the right to amend this Privacy Policy. We will notify you of any significant changes via the online store or by email.

Last updated: March 26, 2026.