Privacy Policy

Aurolegends d.o.o., Zagrebačka cesta 24F, Donji Laduč, Croatia, OIB: 58282353398, MBS: 081690566, registered with the Commercial Court in Zagreb (hereinafter: the “Company”, “we”), respects your privacy and protects the personal data of its users, business partners and other persons with whom it does business and whose personal data it collects and processes in its day-to-day operations.

This Data Protection and Privacy Policy is the core document describing the purpose and objectives of collecting, processing and managing personal data, as well as ensuring an adequate level of data protection (hereinafter: the “Policy”). To ensure fair and transparent processing, the Company provides you with clear information on the processing and protection of personal data it collects and processes, and enables you to easily oversee and manage your personal data and consents.

The Policy is drawn up in accordance with applicable law, including Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR) and the national law implementing it.

The Company has designated a data protection contact whom you may reach by e-mail at the address published on our website, or by post at: Aurolegends d.o.o., Zagrebačka cesta 24F, Donji Laduč, Croatia.

DATA WE COLLECT

1.1. When you visit our website and webshop

You may visit our website and webshop without providing any information about yourself. In that case we will collect technical access data that your browser automatically sends to our server when you browse our site. Access data includes: date and time of access; the address of the page you accessed; request content; information about the browser and operating system you use; online identifiers (e.g. IP address); error messages; the last page you visited before being referred to our site.

When you visit our website, your access data will be automatically stored in our server log files and subsequently anonymised (e.g. by shortening or deleting your IP address). After this process it is no longer possible to draw conclusions about you from the log files.

When you use our webshop we may also collect data you provide directly through available features (e.g. which products interest you when you use search).

1.2. Cookies

Our website and webshop use cookies to improve your experience. A cookie is a small text file that your browser stores on your device for a period set by the provider. Cookies allow local storage of information such as language settings, shopping cart content and temporary identifiers so that your chosen settings can be restored on future visits. This information is only stored if you allow it. Our site cannot access information without your permission or access other files on your device.

On your first visit you can choose which level of cookies you wish to accept and thus control how cookies are used. You can view and delete cookies in your browser’s security or privacy settings, and configure your browser to refuse third-party cookies or all cookies if you prefer.

1.3. When you place an order in the webshop

We will collect data on the products you order and data required to fulfil your orders, including: details of ordered products (e.g. item numbers and sizes); name and surname; delivery address; e-mail address; phone number for delivery contact; payment-related data; returns and complaints data (e.g. reason for return, defect reports); order numbers; tracking numbers; and, if you request a B2B invoice, company name, contact person, company address and tax ID.

Even if you place several orders as a guest using the same main details, our systems may keep your data in a single customer record to maintain our customer database.

1.4. When you contact us

We will collect the communication data you provide when you contact us via the contact form on our website, by e-mail, phone or otherwise. Depending on the channel, this may include contact details (e.g. e-mail or phone number) and the content of your message. Customer service phone calls are not recorded.

We may also use social networks (e.g. Facebook, Instagram) to interact with customers. The Company has no control over the terms of service or data protection policies of social networks. Please check what personal data you share with us via social media.

1.5. Newsletter

If you subscribe to our newsletter, we will store the data you provide for that purpose (e-mail address) for sending the newsletter. You may unsubscribe at any time using the unsubscribe link at the bottom of each newsletter.

1.6. Abandoned cart

If you enter your e-mail address at checkout without completing the purchase, it may be stored and used to send an automated abandoned-cart reminder. You may opt out of such e-mails at any time. If you have questions or want your data deleted, contact us using the e-mail address published on our website.

HOW WE USE THE DATA WE COLLECT

2.1. Website and webshop visits

When you visit and browse our site we process access data, server logs and cookies collected in this context to make the website, its content and features available to you and to ensure the stability and security of our systems. Legal basis: GDPR Art. 6(1)(f) – legitimate interest – technical availability of the website.

2.2. Order processing and performance of the contract

We process your data to perform contracts we have with you and to provide the services and products you requested. Further details can be found in our General Terms and Conditions. Legal basis: GDPR Art. 6(1)(b) – processing necessary for the performance of a contract.

2.3. Customer support and communication

We process your data to provide customer support, handle requests to our customer service and for non-commercial service communication (e.g. security or technical support). Legal basis: GDPR Art. 6(1)(b) – performance of contract.

2.4. Payment processing

Depending on the payment method you choose, the data required for payment may be passed to the payment provider. The payment provider collects data within its own application; their privacy notice applies. The Company does not store or have access to full payment credentials. Legal basis: GDPR Art. 6(1)(b) – performance of contract.

2.5. Optimisation and improvement of our offer

We may use data you provide (e.g. orders, returns) for internal statistics and market research. Before use we anonymise the data (e.g. by removing or replacing identifying details). This helps us see which pages and products are popular, which devices are used and from which regions our site is accessed, and to optimise our offer and develop new features. Legal basis: GDPR Art. 6(1)(f) – legitimate interest.

WEB ANALYTICS AND THIRD PARTIES

3.1. Google Analytics

Our website may use Google Analytics (Google LLC, USA). Google Analytics uses cookies to collect access data when you visit our site. Google may combine this data into pseudonymous user profiles and process it (including in the USA) after IP anonymisation. We cannot identify you from this data. Google uses the data on our behalf to analyse use of our site and to produce reports. For more information see Google Analytics privacy. You can opt out using a browser add-on: Google Analytics opt-out. Legal basis: GDPR Art. 6(1)(f) – legitimate interest.

3.2. Social networks and advertising

Our site may use conversion or remarketing tools (e.g. Facebook Pixel, Google AdWords) for marketing. These may use cookies and similar technologies to analyse use of our site and to show you relevant ads. The providers (e.g. Facebook, Google) have their own privacy policies and may process data in the USA or elsewhere. You can adjust your privacy settings in your social media or Google account and use browser or industry opt-out tools (e.g. youronlinechoices.eu) to limit personalised advertising.

WHEN WE SHARE PERSONAL DATA

We will share your data only if: you have given explicit consent (GDPR Art. 6(1)(a)); sharing is necessary to establish, exercise or defend legal claims and there is no overriding interest in not sharing (Art. 6(1)(f)); there is a legal obligation (Art. 6(1)(c) or (e)); or sharing is necessary to perform a contract with you (Art. 6(1)(b)).

Some processing may be carried out by external service providers (e.g. IT, hosting, consulting) on our behalf. They may only use the data to perform their services and are bound by our instructions and data processing agreements under GDPR Art. 28.

HOW LONG WE KEEP YOUR DATA

We keep your data only as long as necessary to fulfil our contractual or legal obligations or the purposes for which they were collected, or while we have a legitimate interest in retaining them. In other cases we delete personal data unless we must retain it by law (e.g. retention of orders and payment-related data often up to 10 years). Where deletion is not permitted, we restrict processing so that data are used only for the legal purpose. We may also restrict rather than delete where allowed by law (e.g. for legal defence), for the duration of the applicable limitation periods.

YOUR DATA PROTECTION RIGHTS

You may contact our data protection contact at any time to exercise your rights (see contact details in the introduction). You have the right to: obtain information about our processing of your personal data and an overview of the data we hold; have inaccurate data corrected; request erasure (or, where erasure is not possible, restriction of processing); restrict processing; receive a digital copy of the personal data you provided (data portability); lodge a complaint with a supervisory authority. The competent supervisory authority in Croatia is the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), Martićeva 14, 10000 Zagreb, azop@azop.hr.

WITHDRAWAL OF CONSENT AND RIGHT TO OBJECT

To withdraw consent or to object, contact our data protection contact using the details in the introduction. GDPR Art. 7(3) gives you the right to withdraw any consent you have given; we will then stop processing based on that consent. GDPR Art. 21 gives you the right to object to processing based on legitimate interests (Art. 6(1)(f)) or to processing for direct marketing.

DATA SECURITY

We use appropriate technical measures to protect your data from unauthorised access and from risks during transmission. These measures are updated as appropriate. We use a secure protocol (SSL) to encrypt data you enter on our website during transmission.

CHANGES TO THIS POLICY

We may update this Data Protection and Privacy Policy from time to time when we change our website or when the law changes. Material changes will be reflected in this document; where required we will seek your consent.

Last updated: 16.02.2026.