Skip to content
Menu
Studio Victus
SearchMy accountCart

Privacy policy

Version 1, in force since 5 October 2026

1. Controller

The controller of personal data is Iron Hill j.d.o.o., Železna Gora 198A, 40313 Železna Gora, OIB 62676175346. For privacy questions, write to info@studio-victus.example. We have not appointed a data protection officer, as we are not required to. [Confirm with a lawyer.]

2. What data we process

  • name, e-mail, phone and delivery address;

  • company details for the invoice (name, OIB, address), if you enter them;

  • the personalisation, which may contain names, dates and places of other people (for example a child for a christening);

  • data about orders, quotes, payments and delivery;

  • account data (e-mail and password, which is stored only as a hash);

  • a review you write in your account for a completed order: the rating, the text and the display name you enter;

  • IP address in security logs and for limiting the number of attempts.

  • Performance of a contract: processing the order, the quote, production, delivery and messages about the order.

  • Legal obligation: issuing invoices and keeping accounting records.

  • Legitimate interest: website security and protection against abuse, and visit analytics without cookies and without identifying visitors.

  • Consent: publishing your review (given by submitting it) and a newsletter if one is introduced; you can withdraw consent at any time, and the review is then removed.

4. Recipients

  • hosting provider: Hetzner Online GmbH, data centres in the EU;

  • e-mail delivery provider: Sendinblue SAS (Brevo), France;

  • storage of encrypted backups: Backblaze, Inc., data centre in the EU (the Netherlands); backups are encrypted before they are sent, so the provider cannot see their content;

  • couriers GLS Croatia and BOX NOW (name, address or parcel locker, phone, e-mail);

  • e-racuni.hr, for issuing invoices, and the accounting service;

  • OpenFreeMap (maps) and Photon by komoot (place search): when you open the place picker on the map, your browser connects to their servers, which see your IP address and the search term. We send them no other personal data.

  • BOX NOW (parcel locker map): when you open the parcel locker map at checkout, your browser loads it from the servers of BOX NOW and the services BOX NOW uses for it (maps, address search), which see your IP address and what you type. The map is not loaded until you open it. We send the chosen locker to BOX NOW only with the parcel.

5. Transfers outside the EU

We do not transfer data outside the European Union. If any of the providers above processes data outside the EU, we will name it here with the legal basis of the transfer.

6. How long we keep data

  • orders and invoices: 11 years, as the accounting rules require [confirm with the accountant];

  • account: until the account is deleted;

  • reviews: while they are published, at most until the account is deleted or consent is withdrawn;

  • cart without an order: 60 days;

  • security logs: at most 30 days;

  • encrypted backups of the whole database and files, in a data centre in the EU: 14 days plus at most 7 days of protection against accidental deletion, so erased data disappears from them within 21 days at the latest.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object, and the right to withdraw consent. To use them, write to info@studio-victus.example. In your account you can download your data and delete the account yourself; your orders are then anonymised and invoices kept as long as the law requires.

You can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr.

8. Cookies

We use only strictly necessary cookies, without which the website does not work, so no consent is needed:

  • better-auth.session_token: signing in to your account, up to 30 days;

  • sv_cart and sv_cart_n: a guest’s cart and the number of items, up to 60 days;

  • sv_order: access to an order after a tracking link, 24 hours.

Visit analytics (Umami) run on our own server, use no cookies and store nothing on your device. They record the pages visited, where the visit came from (for example a search engine), the country, browser, operating system and type of device. Your IP address is not stored, and the addresses of private order links are not recorded. The website’s language comes from the page address, not a cookie.

9. Automated decisions

We make no decisions based solely on automated processing and do no profiling.

10. Changes

We may change this policy; the date of the last change is shown at the top of the page.