Privacy policy
PRIVACY POLICY
Last updated: September 25, 2026
This Privacy Policy explains how Ivé Lys Studio collects, uses, stores and otherwise processes personal data when you visit our online store, purchase our products, communicate with us or use other related services.
The Ivé Lys Studio online store uses the Shopify platform, which enables us to provide online store services.
1. Data Controller
The data controller responsible for the processing of personal data is:
Business name: Ivé Lys Studio, a craft business for manufacturing, trade and services, owned by Iva Moškun Mikašinović
Address: Vrlije 38, 51000 Rijeka, Croatia
E-mail: ivelystudio@gmail.com
For any questions relating to the processing of personal data or the exercise of your rights under the General Data Protection Regulation (GDPR), you can contact us at the above e-mail address.
2. What Personal Data We Process
Depending on how you use our online store and services, we may process the following categories of personal data:
- identification and contact details, such as your first and last name, delivery address, billing address, telephone number and e-mail address;
- order and purchase information, such as the products ordered, order value and date, delivery method, order status, and information related to returns or complaints;
- payment-related information, such as payment method, amount, status and transaction confirmation;
- user account information, if we provide the option to create user accounts;
- the content of communications you send to us, for example inquiries relating to products, orders, delivery or the exercise of your rights;
- technical information relating to the use of the online store, such as IP address, device and browser information, and website usage data, to the extent collected by Shopify or other tools we use;
- information relating to marketing communications where you have subscribed to them or where another appropriate legal basis exists.
Payment Information
We use external payment service providers to process payments in our online store.
Payment service providers we use:
Raiffeisenbank Austria d.d., registered office: Petrinjska 59, 10000 Zagreb, Croatia
Payments via Shopify Payments (Maestro, Mastercard, Visa, Apple Pay and Google Pay)
For processing credit and debit card payments, we use the Shopify Payments service provided by Shopify. When paying through Shopify Payments, the data required to complete the payment transaction is processed in accordance with the privacy policy and terms of the service provider. Shopify Payments uses security measures to protect payment data, including fraud detection and 3D Secure.
For faster payment, we may enable Apple Pay, Google Pay and Shop Pay. When paying via Apple Pay, payment information is transmitted from the user's device to the payment service provider; the user does not have to enter their card details directly into the online store.
When you select a particular payment method, the information necessary to process the transaction may be provided to the selected payment service provider. The payment service provider processes the data necessary for the authorization, processing and confirmation of the payment, in accordance with the role it has in the specific processing of personal data.
Ivé Lys Studio does not store full payment card details, such as the full card number and security code (CVV/CVC). Ivé Lys Studio may receive information necessary to record and confirm the transaction, such as the transaction amount, selected payment method, payment status and other transaction information available to the merchant through the Shopify system.
We process personal data related to payments when this is necessary for the performance of your order and purchase contract.
Legal basis: Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
If we are required to retain certain transaction information in order to comply with legal obligations applicable to us, the legal basis for such processing is Article 6(1)(c) GDPR.
Payment Card Information
If you make a payment by card or through another electronic payment system, the information required to process the payment is processed by the payment service provider.
Payment service providers we use:
Raiffeisenbank Austria d.d., registered office: Petrinjska 59, 10000 Zagreb, Croatia
Payments via Shopify Payments (Maestro, Mastercard, Visa, Apple Pay and Google Pay)
Ivé Lys Studio does not have access to your full payment card number, security code (CVV/CVC) or other card information that is directly processed by the payment service provider. We may receive information necessary to record and confirm the transaction, such as the payment amount, payment method and payment status.
3. Why We Process Personal Data and the Legal Basis
We process your personal data only where there is an appropriate purpose and legal basis under the GDPR.
Performance of Orders and Contracts
We process the information necessary to receive and process your order, process payment, deliver products, communicate with you regarding your order and handle requests related to your purchase because such processing is necessary for the performance of the contract with you or for taking steps at your request prior to entering into a contract.
Legal basis: Article 6(1)(b) GDPR.
This includes, for example, your first and last name, delivery and billing address, contact details, order information and the payment information required for the transaction.
Compliance with Legal Obligations
We may process and retain certain data where this is necessary to comply with legal obligations applicable to us.
Legal basis: Article 6(1)(c) GDPR.
Communication and Customer Support
If you contact us with a question regarding an order or the performance of a contract, we process your data to the extent necessary for the performance of the contract or for taking steps at your request.
For other inquiries, we process data, depending on the circumstances, on the basis of our legitimate interest in responding to inquiries and communicating with persons who contact us.
Legal basis: Article 6(1)(b) or (f) GDPR, depending on the nature of the communication.
Online Store Security and Fraud Prevention
We may process certain data to protect our online store, users and transactions, detect misuse and fraud, and ensure the security of our systems.
Legal basis: Article 6(1)(f) GDPR – our legitimate interest in protecting our business, users and information systems.
Marketing and Newsletter
If we offer newsletter subscriptions or other marketing communications based on your consent, we will use your contact details for this purpose only after you have provided the appropriate consent.
Legal basis: Article 6(1)(a) GDPR – consent.
You may withdraw your consent at any time, for example by using the unsubscribe link included in a marketing communication or by contacting us at ivelystudio@gmail.com. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
4. Where We Obtain Personal Data
We obtain most personal data directly from you when you:
- place an order;
- enter your information when making a purchase;
- create a user account, if this option is available;
- contact us;
- subscribe to a newsletter or other marketing communication, if available.
We may obtain certain data automatically through the Shopify platform and technologies necessary for the operation, security and functionality of the online store.
5. Who We Share Personal Data With
We do not disclose personal data to third parties without an appropriate purpose and legal basis.
Depending on the service you use, your personal data may be accessible to the following categories of recipients:
- Shopify, as the provider of the platform on which our online store operates;
- payment service providers for the processing and execution of payments; Raiffeisenbank Austria d.d., registered office: Petrinjska 59, 10000 Zagreb, Croatia;
- delivery and courier services for the delivery of ordered products; HP – Hrvatska pošta d.d., Box Now parcel lockers and GLS;
- providers of technical, hosting and other services necessary for the operation of the online store;
- providers of marketing and analytics services, if we use such services and if there is an appropriate legal basis for the relevant processing;
- professional advisers and competent public authorities where disclosure is necessary to comply with legal obligations, protect rights or respond to a lawful request;
- providers of product and service review services, such as Judge.me.
Where another party processes personal data on our behalf as a data processor, such processing is governed in accordance with the requirements of Article 28 GDPR.
6. Shopify
Our online store uses the Shopify platform. In connection with the operation of the platform, Shopify processes certain personal data of customers and visitors to the store.
Depending on the specific processing activity, Shopify may process data on our behalf or for its own purposes, in accordance with the role it has under applicable data protection rules.
More information about how Shopify processes personal data is available in Shopify's Privacy Policy:
https://www.shopify.com/hr/legal/privacy
7. Judge.me
Our online store uses Judge.me to collect, manage and display product reviews.
As part of providing its services, Judge.me may process certain personal data of customers and persons submitting reviews. When Judge.me receives personal data of our customers through our online store or e-commerce platform, Judge.me processes such data as a data processor on our behalf.
Where a user provides their personal data directly to Judge.me and directly uses its services, Judge.me may act as a separate data controller in accordance with its Privacy Policy.
More information about how Judge.me processes personal data is available in its Privacy Policy:
8. Transfers of Personal Data Outside the European Economic Area
Due to our use of Shopify and, depending on the configuration of the online store, other technology service providers, certain personal data may in individual cases be processed or made available outside the European Economic Area (EEA).
If personal data is transferred to a third country, such transfer is carried out in accordance with Chapter V of the GDPR, for example on the basis of an adequacy decision of the European Commission or by applying appropriate safeguards, such as the European Commission's Standard Contractual Clauses, where applicable.
If you would like additional information about the safeguards applicable to the transfer of your personal data outside the EEA, you may contact us using the contact details provided in this Privacy Policy.
9. How Long We Keep Personal Data
We do not retain personal data for longer than necessary for the purposes for which it was collected.
We retain information relating to orders and purchases for the period necessary to perform the contract and thereafter for as long as necessary to comply with our legal obligations and to establish, exercise or defend legal claims.
Data processed on the basis of consent is processed until consent is withdrawn, unless another legal basis exists for its continued retention after withdrawal.
Information relating to inquiries and communications is retained for as long as necessary to resolve the inquiry and, where justified, for a certain period after the communication has ended in order to protect our rights and demonstrate the content of the communication.
10. Your Rights
In accordance with the GDPR and subject to the conditions prescribed by the GDPR, you have the right to:
- request access to your personal data and information about its processing;
- request the rectification of inaccurate or completion of incomplete personal data;
- request the erasure of personal data;
- request restriction of processing;
- receive the personal data you have provided to us in a structured, commonly used and machine-readable format and, where the applicable conditions are met, request that such data be transmitted to another data controller;
- object to processing based on our legitimate interest;
- withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal;
- lodge a complaint with the competent supervisory authority.
If personal data is processed for direct marketing purposes, you have the right to object to such processing at any time, including profiling related to direct marketing.
To exercise your rights, you can contact us at:
E-mail: ivelystudio@gmail.com
We will respond to your request without undue delay and, at the latest, within one month of receiving the request. Where necessary due to the complexity or number of requests, this period may be extended by an additional two months, in which case we will inform you of the extension within one month of receiving the request, together with the reasons for the extension.
If we have reasonable doubts regarding the identity of the person submitting the request, we may request additional information necessary to confirm their identity.
11. Right to Lodge a Complaint
If you believe that your personal data is being processed in breach of the GDPR, you have the right to lodge a complaint with the competent supervisory authority.
In the Republic of Croatia, the competent supervisory authority is:
Croatian Personal Data Protection Agency (AZOP)
Ulica Metela Ožegovića 16, HR – 10 000 Zagreb, Croatia
AZOP can be contacted through the available channels listed on its website:
The right to lodge a complaint does not affect any other administrative or judicial remedies available to you.
12. Security of Personal Data
We apply appropriate technical and organizational measures to protect personal data against unauthorized or unlawful access, use, alteration, disclosure, loss or destruction, taking into account the nature, scope, context and purposes of processing and the risks to the rights and freedoms of individuals.
In protecting data, we also rely on the security measures of the Shopify platform and other service providers we use.
Access to personal data is restricted to persons and service providers who need such data to perform their respective tasks and provide services.
13. Children's Data
Our online store is not specifically intended for children and we do not knowingly collect children's personal data for purposes that are not necessary to provide our services.
If the processing of a child's personal data is based on consent in connection with the direct offering of information society services to a child, the special conditions set out in Article 8 GDPR apply.
If you believe that a child's personal data has been provided to us in breach of applicable data protection rules, please contact us so that we can review the circumstances and, where necessary, take appropriate measures.
14. Automated Decision-Making
We do not carry out automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
15. Cookies and Similar Technologies
Our online store uses cookies and similar technologies necessary for the operation of the store and, depending on the settings and consents provided, cookies and similar technologies for analytics and other purposes.
As our online store is built on the Shopify platform, Shopify may place certain cookies when you use the store that are necessary for the operation of the store, as well as cookies related to reporting and analytics. Shopify uses, among other things, cookies necessary for the operation of the shopping cart, the checkout process, security, storing users' privacy preferences and analytics relating to the use of the store.
Current information about cookies that Shopify may place on its merchants' online stores, their purposes and duration is available in Shopify's Cookie Policy:
https://www.shopify.com/legal/cookies
Where consent is required for the use of a particular category of cookies or similar technologies, such technologies are activated in accordance with the user's choice through the available privacy preference management tool.
Users can manage their cookie preferences through the available privacy settings and, where processing is based on consent, subsequently change or withdraw their consent.
16. Changes to the Privacy Policy
We may occasionally amend this Privacy Policy in order to reflect changes in the way we process personal data, changes to the services we use or changes in applicable data protection requirements.
The current version of the Privacy Policy will be published on this page, together with the date of its latest update.
If an amendment significantly affects the way in which we process personal data, we will take appropriate measures to inform you where such notification is required.
17. Contact
For any questions regarding this Privacy Policy, the processing of your personal data or the exercise of your rights, you can contact us:
Ivé Lys Studio
a craft business for manufacturing, trade and services, owned by Iva Moškun Mikašinović
Vrlije 38, 51000 Rijeka, Croatia
E-mail: ivelystudio@gmail.com