Privacy statement
What data we collect, why, on what legal basis, how long we keep it, who we pass it to, and what your rights are.
1. Who processes your data
The controller is dD Tech, obrt za proizvodnju i usluge, owner Damir Druško, Vrtna ulica 24, 42202 Trnovec Bartolovečki, Croatia, OIB 60172908285.
For any question about processing and to exercise your rights: hello@playfulprints.eu.
The business has not appointed a data protection officer, as there is no legal obligation to do so — there is no large-scale monitoring and no large-scale processing of special categories of data.
2. What data we collect and why
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Name and surname, e-mail address, mobile number | carrying out the order, status notifications, locker collection code | performance of a contract (Art. 6(1)(b) GDPR) | with the order, following the periods in this table |
| Delivery address or chosen parcel locker | delivery | performance of a contract | with the order |
| Photographs you upload | making the ordered product | performance of a contract | 90 days after delivery, then deleted |
| The name printed on the product | production | performance of a contract | with the order |
| Order and payment data (amount, time, transaction reference) | issuing and fiscalising invoices, records of receipts | legal obligation (Art. 6(1)(c) GDPR) | 10 years, counted from the end of the year in which the invoice was issued |
| Order source: the label of the link or ad that brought you to the shop (e.g. Instagram, a Facebook ad) | measuring which channel and which ad lead to orders | legitimate interest (Art. 6(1)(f) GDPR) | as long as the order |
| When you tag us in an Instagram Story: your Instagram ID, username, the discount code issued, the date and the result of the automated check (whether our product is in the image) | sending a one-time discount code in an Instagram message and making sure each person receives only one code | legitimate interest (Art. 6(1)(f) GDPR) | 2 years from issuing the code |
| The image of the Story in which you tagged us | an automated check whether our product is in the image | legitimate interest (Art. 6(1)(f) GDPR) | not stored: it is checked once and discarded |
| E-mail address and password (customer account only) | signing in to the customer account | performance of a contract | until the account is deleted |
| IP address and server logs | security, detecting abuse, fixing faults | legitimate interest (Art. 6(1)(f) GDPR) | 30 days |
| Number of page visits, without identifying the visitor | traffic statistics | legitimate interest | aggregated, without personal data |
Passwords are stored only in encrypted (hashed) form and are not readable to us.
We do not collect special categories of data, we do not profile, and we do not sell data to anyone. The only automated decision is sending a discount code after you tag us in an Instagram Story; it has no legal effect for you, and on request a person reviews it.
3. Who we pass data to
We share data only with the processors necessary to run the shop:
| Recipient | What it receives | Why |
|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | payment data, e-mail address, amount | card payment. Card details are entered on Stripe's page — we neither see nor store them |
| BOX NOW d.o.o., Oreškovićeva ulica 6H/1, 10000 Zagreb, OIB 02844526916 | name, telephone, chosen parcel locker | delivery and the collection code |
| Hosting provider (Croatia, EU) | everything stored in the application | server and data storage |
| Minimax (Seyfor) | the data needed for an invoice | issuing, fiscalising and storing invoices |
| Cloudflare, Inc. | notices of Instagram messages and tags (Instagram ID, message text, link to the Story), in transit | secure transfer of that notice to our system |
| Anthropic PBC (USA) | the Story image, only for the check | automated check whether our product is in the image, through the business API |
When you tag us in an Instagram Story or we send you a code by Instagram message, Meta Platforms Ireland Ltd. (Instagram) processes that data as an independent controller, under its own privacy policy.
Bookkeeping is done by the owner of the business — data is not passed to an external accounting service.
Data is stored within the European Union. Stripe, as a global service provider, may process data outside the EU as well, under the safeguards provided by the GDPR (standard contractual clauses). The image of a Story in which you tagged us is processed by Anthropic in the USA, only to check the product, and we do not store it; Instagram notices pass through Cloudflare. Both transfers to the USA are made under the standard contractual clauses in their data processing agreements.
We do not use Google Analytics or any other external visitor-tracking tool. We keep visit statistics ourselves, on our own server, without cookies and without identifying the visitor.
4. Cookies
We use only the cookies necessary for the shop to work — the cart, signing in and the order confirmation. The list, purpose and duration of each one are on the Cookies page.
5. Your rights
Under the GDPR you have the right to:
- access the data we hold about you,
- rectification of inaccurate data,
- erasure (the right to be forgotten), except for data we are obliged to keep by law, such as invoices,
- restriction of processing and objection to processing based on legitimate interest,
- portability of data,
- withdrawal of consent where processing is based on it, without affecting the lawfulness of earlier processing.
Send your request to hello@playfulprints.eu. We reply within one month.
We also delete photographs before the retention period ends at your request, once the order has been delivered.
If you consider that our processing breaches the rules, you may lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.
6. Customer account
An account is not needed to buy — an order can be placed as a guest. If you open an account, you confirm the address by clicking the link in the message; an unconfirmed account cannot order. We delete the account and the data with it at your request, keeping the invoice data we are obliged to keep by law.
7. Security
Traffic between your browser and our servers is protected by TLS encryption. Uploaded photographs are stored outside the publicly accessible part of the server, and access to an individual photograph checks whether it belongs to your cart or order. Access to the administration is protected by a password and a limit on sign-in attempts.
8. Changes to this statement
We may change this statement; the version in force is always the one published on this page.
Version 1.2, in force from 19 October 2026.