Effective from: 31 October 2026
This English text is a translation provided for convenience only. The Croatian version is the official and legally binding version; in case of any discrepancy, the Croatian version prevails.
UNTAMED d.o.o. processes customers’ personal data only as far as needed to make, take payment for, ship and legally record your order. We do not sell your data or use it for profiling.
1. Controller
UNTAMED d.o.o., Zadravečka ulica 11, 10000 Zagreb, Croatia
OIB (tax number): 69583807388 · MB (registration number): 5412986
Email: org@untamed.hr · Phone: +385 95 906 1237
We have not appointed a Data Protection Officer because it is not required for our type and scale of processing. Please send any questions to the email above.
2. What we process, why, and for how long
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Making and delivering your order | name, email, address or chosen GLS parcel locker, phone, products ordered | Art. 6(1)(b) – performance of a contract | until the warranty period ends (2 years from delivery) |
| Invoicing and accounting | invoice data; for an R1 invoice also company name and OIB | Art. 6(1)(c) – legal obligation | 11 years (Croatian Accounting Act) |
| Card payment | you enter card details directly with Stripe; we only see payment status, card brand and last 4 digits | Art. 6(1)(b) | same as the order |
| Customer account (if you create one) | email, protected password, addresses, order history | Art. 6(1)(b) | until you ask us to delete the account |
| Complaints, withdrawals, enquiries | message content, order details | Art. 6(1)(b) and (c) | 2 years after the matter is closed |
| Security and site operation | IP address, strictly necessary cookies (cart, login) | Art. 6(1)(f) – legitimate interest | see the Cookie Policy |
| Visit and purchase statistics (Google Analytics) | pages and products viewed, products added to the cart, purchases, device and browser type, approximate location, online identifiers | Art. 6(1)(a) – consent (cookie banner) | 14 months; you can withdraw consent at any time |
Fields marked with an asterisk at checkout are needed to conclude the contract; without them we cannot fulfil your order. We ask for your phone number for parcel-locker delivery because GLS sends the pickup code to it.
3. Who we share data with
| Recipient | Role | Data received |
|---|---|---|
| Stripe Payments Europe, Ltd., Ireland | card payment processing | card details, amount, email, billing address |
| Google Ireland Limited, Ireland | visit and purchase statistics (Google Analytics), only with your consent | usage data and online identifiers listed above |
| General Logistics Systems Croatia d.o.o. (GLS) | delivery | name, address or parcel locker, phone, email |
| print partner | production | products ordered and order number |
| hosting and website maintenance provider | hosting and maintaining the shop | data stored in the shop |
| accounting firm | bookkeeping | invoice data |
| public authorities | where required by law | only the data requested |
Our processors are bound by contracts that require them to protect your data.
4. Transfers outside the EU
Stripe may transfer some data to Stripe group companies in the United States. These transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Google may likewise transfer Google Analytics data to Google LLC in the United States on the basis of the EU–US Data Privacy Framework. All other data stays in the EU.
5. Your rights
You have the right to:
- access the data we hold about you and get a copy
- have inaccurate data corrected
- have data erased, except data we must keep by law (e.g. invoices)
- restrict processing
- receive your data in a machine-readable format (portability)
- object to processing based on legitimate interest
Send requests to org@untamed.hr. We reply without undue delay and within one month at the latest. We may ask you to confirm your identity first.
If you believe your rights have been infringed, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr, www.azop.hr, or with the data protection authority in your EU country of residence.
6. Security
The site runs over HTTPS. Card details never pass through our server and we do not store them. Order data is accessible only to people who need it for their work.
7. Children
The shop is not intended for anyone under 16, and we do not knowingly collect their data.
8. Automated decisions
We make no decisions about you based solely on automated processing and do no profiling.
9. Changes
We may update this policy when our processing or the law changes. The current version, with its effective date, is always published on this page.