Privacy policy

This Privacy Policy explains how Adria Gifts collects, uses, shares and retains personal data when you visit our online store, open a customer account, make a purchase, receive a gift, subscribe to updates or contact us.

1. Controller and contact details

The controller of personal data is Mad About It d.o.o. za trgovinu i usluge, with its registered office at Dugoselska ulica 10, 10000 Zagreb, Croatia, OIB 66978587529, trading as Adria Gifts.

For questions about the processing of personal data or to exercise your rights, contact us at iva@madaboutit.hr or by post at the registered-office address above.

2. Who this Policy applies to

This Policy applies to:

• visitors to the online store and users of its functions;
• customers, customer-account users and people who begin the checkout process;
• gift recipients whose details are provided to us by a purchaser;
• people who submit an enquiry, written complaint, withdrawal request, return request or product complaint;
• people who report an incident, unsafe product or adverse reaction;
• people who voluntarily subscribe to a newsletter or other marketing communications.

If a purchaser orders a gift for another person, they should provide only the data necessary for delivery and inform the recipient that their data has been provided to Adria Gifts. We do not use a recipient's data for marketing merely because they have received a gift.

3. Sources of data and mandatory data

We obtain data directly from you when you enter it in the store or send it to us; automatically through the website and essential technical logs; from a purchaser who designates a gift recipient; and from payment providers, carriers, Shopify and other partners involved in fulfilling the order.

Data marked as mandatory is necessary to enter into or perform a contract or to comply with a legal obligation. Without a name, contact details, address, order details and successful payment confirmation, we generally cannot accept, charge for or deliver an order. Opening a customer account, subscribing to a newsletter and accepting non-essential cookies are voluntary.

Please ensure that the information you provide is accurate and do not provide data that is not necessary for the relevant purpose.

4. Categories of personal data

Depending on your interaction with us, we may process:

• full name, address, email address and telephone number;
• billing and delivery details and information about the gift recipient;
• basket contents, products ordered, amounts, discounts, refunds and order status;
• payment status, transaction identifier, selected payment method and limited information returned by the payment provider;
• customer-account data, language, market and saved preferences;
• the content of communications, written complaints, product complaints, return requests or withdrawal requests;
• IP address, device and browser type, cookie identifiers, usage logs, security events and information needed to prevent fraud;
• records of consent and selected privacy preferences;
• information required for an immediate age check where an order contains alcohol;
• information needed to handle a product-safety incident or recall;
• email address, marketing preferences, and newsletter delivery and basic interaction data.

5. Overview of processing activities

Processing and purpose	Data and source	Legal basis and recipients	Retention period
Store operation, basket and technical security	IP address, device, browser, essential cookies and security logs; collected automatically	Performance of a contract and legitimate interest in secure operation; Shopify and technical providers	Essential logs as technically required; security logs for 12 months, longer in the event of an incident or claim
Customer account and order	Identity, contact details, addresses, billing information, order contents and status; from the purchaser or user	Contract and steps before entering into a contract; Shopify and store-function providers	Account while active; orders and statutory records for 11 years
Payment and fraud prevention	Amount, payment method and status, transaction identifier and security indicators; from the purchaser and payment systems	Contract, legal obligations and legitimate interest; Shopify Payments, Stripe and PayPal	According to statutory periods and providers' rules; accounting records for 11 years
Invoicing, fiscalisation and stock records	Customer, order, invoice, payment and delivery data	Legal obligation and performance of the contract; E-RAČUNI d.o.o. and competent authorities	11 years, or longer where required by specific legislation
Delivery and tracking	Name, address, contact details, order, consignment number and, where necessary, age-verification information	Performance of the contract and legal obligation; selected carriers and logistics partners	As long as needed for delivery, complaints and the defence of claims
Support, returns, complaints and withdrawal	Contact details, order, communications, evidence and refund data	Contract, legal obligation and legitimate interest in demonstrating compliance	Ordinary enquiries for 3 years; written complaints for at least 1 year; legal claims for up to 5 years after resolution
Newsletter and direct marketing	Email address, consent, unsubscribe record and basic message interaction	Consent; Shopify Email and message-delivery providers	Until unsubscribe or 2 years of inactivity; evidence of consent for up to 5 years after withdrawal
Optional analytics and advertising	Device and cookie identifiers and use of the website	Consent; only providers actually activated and identified in the privacy settings	Until consent is withdrawn or the cookie expires, as stated in the Cookie Policy
Age verification	Result of a reliable age check through the prescribed technical solution	Legal obligation; e-Građani and necessary technical providers	Only during the immediate verification, without retaining a copy of an identity document
Product safety and recalls	Identity, contact details, product, incident and necessary health data voluntarily provided by the person	Legal obligation; explicit consent, vital interests or legal claims for health data	For the duration of the safety measure, mandatory period or related legal claim

6. Orders, customer accounts and gift recipients

We use data to display the basket, process and confirm an order, provide a customer account, communicate about a purchase, handle returns and complaints, and provide support. Processing is necessary to take steps at your request before entering into a contract and to perform the contract.

A customer account is not required for a purchase where the store offers guest checkout. We retain account data while the account is active. After closure, we remove profile data that is no longer needed, but retain orders, invoices and other information that we must keep by law or to resolve claims.

7. Payments and fraud prevention

Payments are processed through Shopify Payments, for which the contracting entity for Croatia is Shopify International Limited and the payment processor is Stripe Payments Europe, Limited. If the customer selects PayPal, payment data is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A.

Payment providers may process data as independent controllers for their own legal obligations, security, fraud prevention and provision of payment services. Their own privacy policies also apply: Stripe Privacy Policy and PayPal Privacy Statement.

Adria Gifts receives the transaction status, amount and identifier, together with limited information needed to associate the payment with the order. We do not store the full card number or card security code.

8. Invoicing, fiscalisation and e-Računi

For invoicing, fiscalisation, order processing and stock records, we use E-RAČUNI d.o.o., Varaždinska ulica I odvojak 11, Jalkovec, 42000 Varaždin, OIB 86196084068. Data needed for invoices and statutory records is transferred to this system, including customer, order, payment, refund and delivery information.

E-RAČUNI d.o.o. primarily processes this data on our instructions as a processor. For certain regulated activities, including its work as an information intermediary, it may have its own obligations. According to the provider's published terms and Privacy Policy, data is stored exclusively within the European Union.

9. Delivery

We provide selected carriers and logistics partners only with the data needed to collect, transport, track and deliver a consignment: name, address or selected collection point, contact details and consignment information. Information needed for an additional age check is provided only where such a check is actually required under applicable rules or the carrier's terms. The partner processes data in accordance with its legal obligations and delivery rules.

10. Shopify, Shop and Shopify Network Intelligence

The online store is hosted on the Shopify platform, provided to European traders by Shopify International Limited, Ireland. Shopify processes data needed for hosting, displaying the store, customer accounts, the basket, checkout, orders, Shop and Shop Pay, fraud prevention, communications and other selected functions.

Shopify Network Intelligence is enabled in the store. Shopify may securely associate visit and purchase data with a user's interactions with other Shopify traders and services to provide enhanced services such as security, platform operation, personalisation and, only where the necessary consent has been given, advertising. This function does not give other traders direct access to Adria Gifts customer data.

For optional purposes in the European Union and European Economic Area, Shopify respects the choices made through our banner and cookie preferences. If you do not consent to optional cookies or withdraw consent, device data is marked so that Shopify Network Intelligence does not use it for optional purposes.

Further information is available in the Shopify Consumer Privacy Policy. For requests concerning processing for which Shopify is an independent controller, you can use the Shopify Privacy Portal. For processing that Shopify carries out on our instructions, you may first send your request to Adria Gifts.

11. Newsletter, analytics and advertising

We send newsletters and other marketing communications only to people who have voluntarily subscribed and given appropriate consent. You can unsubscribe using the link in each marketing communication or by contacting iva@madaboutit.hr. Unsubscribing does not affect messages necessary to fulfil an order, ensure safety or comply with legal obligations.

We enable optional analytics, measurement and advertising only with the required consent. The specific active providers and technologies are identified in the Cookie Policy and cookie preferences. We do not treat inactive services as data recipients merely because we may plan to use them in the future.

12. Cookies and consent management

Essential cookies are used to operate the store, ensure security, provide the basket and checkout, and save your choices. Analytics, functional and advertising cookies that are not essential are used only after appropriate consent.

Details of their types, providers, purposes and duration are provided in the separate Cookie Policy. You can change your choices at any time using the Cookie Preferences link in the footer. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

13. Age verification

Where an order contains alcohol or another age-restricted product, we carry out a reliable age check through the prescribed technical solution, including e-Građani where applicable.

Data obtained through the age check is used solely for immediate verification. Adria Gifts does not retain a copy of an identity card or another identity document and does not use the result for marketing or profiling.

14. Product safety and special-category data

When an incident, unsafe product or adverse reaction is reported, we may request information needed to identify the product, manage a recall, make contact and comply with legal obligations. If you voluntarily provide health data, we process it only to the extent necessary to handle the report and where you have given explicit consent, processing is necessary to protect your or another person's vital interests, or it is needed to establish, exercise or defend legal claims.

Please do not send medical records or other sensitive data that is not necessary to describe the incident. Where necessary, we may provide the data to a supplier, manufacturer, person responsible for the product, insurer or competent authority.

15. Recipients of data

Depending on the purpose, personal data may be received by:

• Shopify International Limited and its approved subprocessors;
• Shopify Payments, Stripe Payments Europe, Limited and PayPal;
• E-RAČUNI d.o.o.;
• selected carriers and logistics partners;
• providers of email, security, hosting and store functions that are actually enabled;
• suppliers, manufacturers, responsible persons and insurers where necessary for a complaint or product-safety matter;
• professional advisers, auditors and accountants subject to confidentiality obligations;
• courts, tax authorities, police, inspectorates and other competent authorities where disclosure is required or necessary for a legal claim.

We do not sell personal data. We provide each recipient only with data appropriate to its role and the specific purpose.

16. Transfers outside the EEA

Shopify and certain other providers operate internationally, so data may be processed outside the European Economic Area, including in Canada and the United States. In those cases, appropriate safeguards apply, such as a European Commission adequacy decision, standard contractual clauses and additional technical or organisational measures.

According to that provider's published information, data processed for us by E-RAČUNI d.o.o. is stored exclusively within the European Union.

17. Retention periods

We retain personal data only for as long as necessary for the purpose of processing or for a mandatory statutory period:

• orders, invoices and tax and accounting records: 11 years;
• customer account: while active, after which data not covered by statutory retention periods is removed;
• records of written complaints: at least 1 year from receipt;
• documents needed for legal claims: up to 5 years after final resolution, unless a longer period applies;
• ordinary support enquiries: 3 years after the enquiry is closed;
• newsletter: until unsubscribe or 2 years of inactivity;
• evidence of marketing consent: up to 5 years after withdrawal, solely to demonstrate lawfulness;
• security and anti-fraud logs: 12 months, unless needed for an incident investigation or legal claim;
• age-verification data: only during the immediate age check; no copy of an identity document is retained;
• product-safety and recall data: for the duration of the safety measure, legal obligation or related legal claim;
• anonymised statistical data: without a time limit because it can no longer be linked to an identifiable person.

When a retention period expires, we delete or irreversibly anonymise the data, or restrict access where a legal obligation requires it to be retained.

18. Automated decision-making and prices

Adria Gifts does not make solely automated decisions that produce legal or similarly significant effects. Payment and security systems may automatically flag or refuse a high-risk transaction to prevent fraud. Where applicable, you can contact us for further review and an explanation of the available steps.

We do not use automated profiling to set an individual price. Differences in price resulting from the market, currency, taxes, excise duties, delivery or a general promotion do not constitute personalised pricing.

19. Your rights

Subject to the conditions of the General Data Protection Regulation, you have the right to:

• obtain confirmation of whether we process your data and access that data;
• request correction of inaccurate data or completion of incomplete data;
• request erasure where the statutory conditions are met;
• request restriction of processing;
• receive data in a structured, commonly used and machine-readable format and transmit it to another controller where applicable;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• object to processing based on legitimate interests, in which case we will stop processing unless we demonstrate compelling legitimate grounds that override your rights or the processing is needed for legal claims;
• object to direct marketing at any time, after which we will no longer use the data for that purpose;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where the statutory conditions apply.

Send your request to iva@madaboutit.hr. To protect personal data, we may request proportionate proof of identity. We respond without undue delay, normally within one month. In complex cases, this period may be extended by a further two months, and we will inform you in due time.

If you believe that processing infringes data-protection law, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP) or the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.

20. Children

Our online store is not directed at children. We do not intentionally collect children's personal data or send them marketing communications. Products containing alcohol may be purchased only by persons aged 18 or over. If we learn that we have collected a child's personal data without a valid legal basis, we will delete it or take other appropriate measures.

21. Data security

We apply appropriate technical and organisational measures, including access restrictions, secure communications, permission management, data minimisation, backups and provider checks. Access is granted only to people who need it for their work and are bound by confidentiality.

No system is entirely risk-free. We assess a potential incident without delay and notify the competent authority and affected individuals where the legal conditions for notification are met.

22. External links

The store may contain links to third-party websites. Once you leave our store, that third party's privacy policy applies to its processing. We recommend that you read it before providing any data.

23. Changes to this Policy

We may amend this Policy to reflect changes in law, technology, providers or processing activities. We will publish the new version and effective date on this page and provide appropriate notice of a change that significantly affects your rights. A new purpose that requires consent will not rely on consent previously given without an appropriate new notice or consent.

Version: 1.0 Published: 1 September 2026 Effective from: 1 September 2026