Privacy Policy

1. Data controller

The data controller is Herbie d.o.o., Glavna 109, 31303 Podolje, OIB: 28646355258, MBS: 030244049 (the "Seller").

For all questions concerning the processing of personal data, the User may contact the following email address: herbiehrvatska@gmail.com.

2. Definitions

2.1 User means any natural person who visits the website www.beherbie.com, regardless of whether they make a purchase.

2.2 Personal data means any information relating to an identified or identifiable natural person (e.g., first and last name, email address, delivery address, IP address, order data).

2.3 Processing means any operation performed on personal data, whether by automated means or not, such as collection, recording, storage, adaptation, consultation, use, disclosure, erasure, or destruction.

3. Categories of personal data

The Seller collects and processes the following categories of personal data:

3.1 Order data: first and last name, delivery address, billing address, email address, telephone number, information about ordered products, payment method.

3.2 User account data: first and last name, email address, password (encrypted), order history.

3.3 Communication data: content of email messages, inquiries submitted via the contact form, and other correspondence with the Seller.

3.4 Technical data: IP address, browser type, operating system, date and time of access, data concerning interaction with the website.

3.5 Newsletter subscription data: email address, date and time of subscription, subscription confirmation status.

4. Purposes and legal bases for processing

The Seller processes personal data for the following purposes and on the following legal bases in accordance with Article 6 of the General Data Protection Regulation (GDPR):

4.1 Performance of the contract (Art. 6(1)(b) GDPR) — processing the data from section 3.1 is necessary to receive and process the order, deliver products, process payments, communicate with the Customer regarding the order, and handle complaints and returns. The Seller does not need the User’s additional consent for this processing because it is necessary for the performance of the contract that the User enters into by completing the order.

4.2 Legal obligation (Article 6(1)(c) GDPR) — processing of data is necessary to fulfil the Seller’s obligations under tax, accounting, and other regulations (the Accounting Act, the General Tax Act).

4.3 Consent (Article 6(1)(a) GDPR) — the processing of data for the following purposes is based on the User’s voluntary consent: (i) sending newsletters (promotional offers, product news), (ii) activating analytics cookies (Google Analytics 4), (iii) activating marketing cookies (Meta Pixel). The User may withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. Consent to newsletters may be withdrawn by clicking the unsubscribe link in any email message or by sending a request to herbiehrvatska@gmail.com. Consent to cookies may be withdrawn through the cookie settings on the website.

4.4 Legitimate interest (Article 6(1)(f) GDPR) — processing of technical data is necessary to ensure the technical functionality of the website, protect against fraud and misuse, and detect and resolve technical issues. The Seller’s legitimate interest is the secure and functional operation of the website.

5. Recipients of personal data

The Seller forwards personal data to the following recipients solely to the extent necessary to achieve the stated processing purposes:

5.1 Shopify International Ltd. (Ireland) — provider of an online commerce platform. Shopify processes order data, user account data, and technical data as a processor in accordance with the Seller’s instructions.

5.2 CorvusPay (Corvus Info d.o.o.) (Zagreb, Croatia) — card payment service provider. CorvusPay processes payment transaction data. The Seller does not have access to Users’ payment card data — this data is entered directly into the secure environment of the CorvusPay system.

5.3 Delivery services — GLS, DPD, Croatian Post — delivery services through which the Seller delivers orders. The delivery service receives the Customer’s first and last name, delivery address, and telephone number solely for the purpose of delivering the shipment. The choice of delivery service depends on the destination and type of shipment.

5.4 Omnisend (Lithuania) — provider of email marketing services. Omnisend processes email addresses and subscription data exclusively for sending newsletters, based on the User’s consent.

5.5 Google Ireland Limited (Dublin, Ireland) — provider of the Google Analytics 4 service. It processes technical data on visits to and interaction with the website based on the User’s consent. The data is pseudonymized (the IP address is shortened).

5.6 Meta Platforms Ireland Limited (Dublin, Ireland) — provider of the Meta Pixel service. It processes data on the User’s interaction with the website for the purpose of measuring advertising effectiveness, based on the User’s consent.

The Seller does not sell, rent, or disclose personal data to third parties for commercial purposes.

6. International data transfers

Some of the recipients listed above process data outside the European Economic Area (EEA):

6.1 Shopify — data may be processed in Canada and the United States. The transfer is protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

6.2 Google and Meta — pdata may be transferred to the United States. The transfer is based on the EU-U.S. Data Privacy Framework (DPF) pursuant to the European Commission’s adequacy decision of July 10, 2023, with Standard Contractual Clauses (SCCs) applied as an additional safeguard.

6.3 Omnisend — headquartered in Lithuania (EEA). If Omnisend uses subprocessors outside the EEA, the transfer is protected by Standard Contractual Clauses.

6.4 CorvusPay, GLS, DPD and Hrvatska pošta — data is processed within the EEA.

7. Cookies

7.1 What cookies are. Cookies are small text files stored on the User’s device when visiting a website.

7.2 Necessary cookies. Cookies that are essential for the functioning of the website (e.g., session cookies and shopping cart cookies) are activated automatically and do not require the User’s consent. Without these cookies, the website cannot function properly.

7.3 Analytics cookies (Google Analytics 4). They are used to analyze visits and User behavior on the website for the purpose of improving content and the user experience. They are activated exclusively with the User’s prior consent via the cookie consent banner.

7.4 Marketing cookies (Meta Pixel). They are used to measure the effectiveness of advertisements and display relevant content to the User. They are activated exclusively with the User’s prior consent via the cookie consent banner.

7.5 Cookie management. The User may change or withdraw consent for analytics and marketing cookies at any time through the cookie settings on the website. Disabling necessary cookies may limit the functionality of the website.

8. Newsletter

8.1 Subscription. The User may subscribe to the newsletter by entering their email address. Subscription is voluntary and based on the User's consent.

8.2 Content. The newsletter may contain information about products, promotional offers, and news related to the Seller's business activities.

8.3 Unsubscribe. The User may unsubscribe from the newsletter at any time by clicking the unsubscribe link included in every email or by sending a request to herbiehrvatska@gmail.com. After unsubscribing, the User's email address is deleted from the subscriber database.

8.4 Processor. The newsletter is sent via the Omnisend platform. Omnisend processes email addresses solely in accordance with the Seller's instructions and for the purpose of sending the newsletter.

9. Data Retention Periods

The Seller retains personal data only for as long as necessary to fulfill the purpose of processing or as required by law:

9.1 Order data and invoices — 11 years from the end of the financial year in which the invoice was issued, in accordance with the Accounting Act.

9.2 User account data — until the User's account is deleted at the User's request, except for data that the Seller is required to retain by law.

9.3 Communication data — 2 years from the last communication, unless related to a complaint or legal claim.

9.4 Newsletter subscription data — until the User unsubscribes from the newsletter.

9.5 Technical data and cookies — analytics data (Google Analytics 4) are retained for 14 months. Cookies expire according to the periods specified in the cookie settings on the website.

10. User Rights

The User has the following rights regarding the processing of their personal data in accordance with the GDPR:

10.1 Right of access (Art. 15 GDPR) — the right to obtain confirmation as to whether personal data are being processed, as well as access to that data and information about the processing.

10.2 Right to rectification (Art. 16 GDPR) — the right to request the correction of inaccurate personal data.

10.3 Right to erasure (Art. 17 GDPR) — the right to request the deletion of personal data if there is no longer a purpose or legal basis for processing or retaining it.

10.4 Right to Restriction of Processing (Article 18 of the GDPR) — the right to request restriction of processing in certain circumstances (e.g., while the accuracy of the data is being verified).

10.5 Right to Data Portability (Article 20 of the GDPR) — the right to receive personal data in a structured, commonly used, and machine-readable format and transmit it to another controller.

10.6 Right to Object (Article 21 of the GDPR) — the right to object to processing based on the Seller’s legitimate interest.

10.7 Right to Withdraw Consent — if processing is based on consent, the User has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The User may submit requests to exercise the aforementioned rights by email: herbiehrvatska@gmail.com. The Seller shall respond to the request without undue delay and no later than 30 days from receipt of the request.

11. Right to Lodge a Complaint with the Supervisory Authority

If the User believes that the processing of personal data violates the GDPR or other data protection rules, they have the right to lodge a complaint with the Personal Data Protection Agency (AZOP):

Personal Data Protection Agency
Selska cesta 136, 10000 Zagreb
www.azop.hr
azop@azop.hr

12. Automated Decision-Making

The Seller uses automated verification systems within the online commerce platform (Shopify) and payment system (CorvusPay) exclusively to prevent payment card fraud. These systems may automatically assess the order risk based on technical and payment data. If the system automatically rejects or places an order on hold, the User has the right to request a review of the decision by the Seller by sending an inquiry to herbiehrvatska@gmail.com. Apart from the above, the Seller does not carry out profiling that produces legal effects for the User or significantly affects them.

13. Data Security

The Seller applies appropriate technical and organizational measures to protect personal data from unauthorized access, loss, destruction, or disclosure. The website uses SSL/TLS encryption to protect data during transmission. Card data is processed exclusively in the PCI DSS-certified environment of the payment service provider (CorvusPay), and the Seller has no access to it.

14. Amendments to the Privacy Policy

The Seller reserves the right to amend this Privacy Policy. Amendments shall take effect on the date of their publication on the website.