PRIVACY POLICY
1. Who processes your data
The controller of your personal data is Svila d.o.o., Radićevo šetalište 23, 10000 Zagreb, Croatia, OIB 90585357995 (hereinafter: we). For any questions about your data, write to us at info@starsilk.hr or by post to the address above.
This policy explains what data we collect through the starsilk.hr online shop, why, how long we keep it, who we share it with and what your rights are. It complies with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR.
2. What data we process and why
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Order, payment, delivery and invoicing | name and surname, address, postcode, city, phone, email, order contents; for companies, company name and tax number (OIB) | performance of a contract (Art. 6(1)(b) GDPR) | for the duration of the order and the complaint period |
| Accounting and tax obligations | invoice data | legal obligation (Art. 6(1)(c)) | 11 years (Croatian Accounting Act) |
| Withdrawal, claims and complaints | order data, your message and our reply | legal obligation and performance of a contract | until statutory liability periods expire, at least 2 years |
| Customer account (if you open one) | email, password (encrypted), addresses, order history | performance of a contract | until you request deletion of the account |
| Newsletter and special offers | email, name, email open data | your consent (Art. 6(1)(a)) | until you unsubscribe |
| Analytics and advertising (cookies) | website usage data, IP address, cookie identifiers | your consent in the cookie banner | according to your cookie settings, up to 2 years |
| Website security and abuse prevention | IP address, technical logs | legitimate interest (Art. 6(1)(f)) | up to 6 months |
We do not see or store your payment card details. Card payments are processed directly by the payment service provider.
We do not make decisions about you based solely on automated processing and do not create profiles that would have legal or similarly significant effects on you.
3. Who we share data with
We share data only with those who need it to fulfil your order or run the shop, and only to the extent necessary:
- Logistics and delivery: euShipments (warehousing and shipping) and the couriers it works with (address, name, phone, email for shipment tracking)
- Payment: Viva Wallet (card payments) and our bank (bank transfers)
- Website hosting: Databox d.o.o., Croatia
- Newsletter delivery: MailerLite (only if you have subscribed)
- Analytics and advertising: Google (Google Analytics) and Meta (Facebook/Instagram pixel), only if you have allowed this in your cookie settings
- Accounting service and competent public authorities where required by law
We have contracts with our processors obliging them to keep the data secure and use it only for our purposes. We do not sell your data.
Some service providers (e.g. Google and Meta) may transfer data outside the European Economic Area, usually to the USA. Such transfers are based on a European Commission adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses.
4. Cookies
We use necessary cookies (basket, login, security, storing your cookie choice) without consent because the website cannot work without them. We only enable analytics and marketing cookies if you accept them in the cookie banner. You can change your choice at any time via the cookie settings link at the bottom of the page. A detailed list of cookies is available in our Cookie Policy.
5. Your rights
You have the right to:
- request access to your data and a copy of it
- request rectification of inaccurate or incomplete data
- request erasure of your data, except data we must keep by law (e.g. invoices)
- request restriction of processing
- request portability of data you have provided to us
- object to processing based on legitimate interest
- at any time withdraw your consent, e.g. by unsubscribing via the link in every newsletter email or by changing your cookie settings; withdrawal does not affect the lawfulness of processing before withdrawal
Send your request to info@starsilk.hr. We will reply without undue delay and within one month at the latest. If you believe we are processing your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr.
6. Data security
The website uses an encrypted connection (HTTPS), only authorised persons have access to the data, and customer account passwords are stored encrypted. Order data is backed up regularly.
7. Changes to this policy
We may change this policy when regulations or the way we work change. The current version is always published on this page.
This policy applies from 19 October 2026.
