Privacy Policy

Last updated: 27 October 2026

Privacy Policy – Artletshop

This Privacy Policy explains how Artletshop collects, uses, stores, shares and protects personal data when you visit our website, contact us, create an account or purchase artworks through https://artletshop.com.

We respect your privacy and process personal data in accordance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679), applicable Croatian legislation and other relevant data protection requirements.

We do not sell your personal data to third parties.

1. Who We Are – Data Controller

The online art gallery and store Artletshop features original, one-of-a-kind artworks. Their creators are the artists Branka Radonić and Vjeran Čengić.

Artletshop is operated by STUDIO 3DIVINE d.o.o., the legal entity responsible for operating the online store and processing personal data in connection with its activities.

Data Controller:

  • Company: STUDIO 3DIVINE d.o.o.
  • Registered address: Medvedgradska 38a, 10000 Zagreb, Croatia
  • Company identification number (OIB): 28121112922
  • Website: https://artletshop.com
  • Email: info(at)artletshop.com
  • Contact form: Contact Artletshop

For any questions about this Privacy Policy or the processing of your personal data, please contact us using the details above.

2. Personal Data We Collect

Depending on how you interact with Artletshop, we may collect the following categories of personal data:

a) Account and Order Information

  • First and last name
  • Email address
  • Billing and shipping addresses
  • Telephone number, where provided or required for delivery
  • Account details and order history
  • Purchased artworks, transaction references and order status
  • Information required for invoicing, shipping, returns and refunds

b) Payment Information

Payments may be processed through secure third-party payment service providers, including Stripe and PayPal, or through direct bank transfer.

Payment service providers handle payment information according to their own security standards and privacy policies.

Artletshop receives the transaction information necessary to confirm payments, manage orders, process refunds and maintain accounting records.

c) Contact and Communication Information

When you contact us by email or through our contact form, we may collect your name, email address, message and any other information you voluntarily provide.

If you contact us concerning shipping damage, an artwork’s condition or a return, we may also process photographs and related documentation.

d) Technical and Security Information

When you visit our website, certain technical information may be processed, including:

  • IP address

  • Browser and device information

  • Operating system

  • Pages requested and access times

  • Technical logs and security-related information

  • Cookies and session identifiers necessary for website functionality

This information helps us maintain website functionality, protect against unauthorized access and prevent malicious activities.

e) Comments and Uploaded Content

If commenting or uploading content is available on the website, information submitted through those features may be processed together with relevant technical information for security and spam prevention.

Please avoid submitting unnecessary sensitive personal data or images containing location information, such as embedded GPS metadata.

3. Why We Process Your Personal Data

We process personal data only for specified, legitimate purposes, including:

  • Order processing: managing purchases, payments, order confirmations, packaging, delivery and refunds.
  • Customer account management: maintaining accounts, order histories and account-related functionality.
  • Customer support: responding to inquiries, complaints, return requests and other communications.
  • Legal and accounting compliance: issuing and retaining required records and meeting tax, accounting and other statutory obligations.
  • Website security: identifying suspicious activity, preventing fraud, protecting customer accounts and maintaining technical security.
  • Website operation and improvement: maintaining functionality, diagnosing technical problems and improving the shopping experience.
  • Marketing communications: sending promotional messages where permitted by applicable law and where any required consent has been obtained.

We do not use personal data collected for order fulfillment for unrelated marketing purposes without an appropriate legal basis.

4. Legal Bases for Processing

Under Article 6 of the GDPR, personal data may be processed on the following legal bases:

Performance of a Contract – Article 6(1)(b)

Processing necessary to complete purchases, deliver artworks, manage orders, process contractual returns or provide requested account services.

Legal Obligations – Article 6(1)(c)

Processing necessary to comply with applicable accounting, taxation, consumer protection and other legal obligations.

Legitimate Interests – Article 6(1)(f)

Processing necessary for legitimate interests, including maintaining website security, preventing fraud, handling inquiries, protecting legal claims and ensuring reliable website operation, provided these interests are not overridden by individuals’ fundamental rights and freedoms.

Consent – Article 6(1)(a)

Processing based on consent where required, such as certain marketing communications or non-essential cookies and tracking technologies.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Sharing Personal Data

We may share personal data with trusted service providers only when necessary for legitimate business activities and in accordance with applicable law.

These may include:

  • Payment processors: Stripe, PayPal and relevant banking institutions.
  • Shipping and logistics providers: carriers and delivery services responsible for transporting artworks.
  • Hosting and technical service providers: companies providing website hosting, maintenance, security and technical infrastructure.
  • Accounting and professional advisers: where required for accounting, tax compliance, legal advice or the protection of legal rights.
  • Relevant public authorities: when disclosure is required by applicable law or a lawful request.

Where external providers process personal data on our behalf, we take appropriate steps to ensure that the processing is subject to applicable data protection requirements.

Certain independent service providers, such as payment institutions, may process personal data as separate data controllers under their own privacy policies.

Artletshop does not sell or rent personal data to third parties.

6. International Data Transfers

Artletshop is based in Croatia, within the European Union.

Some external service providers may process or store personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA and the GDPR requires additional safeguards, such transfers must be supported by an applicable European Commission adequacy decision, appropriate contractual safeguards such as Standard Contractual Clauses, or another legally recognized transfer mechanism.

You may contact us for further information about applicable international transfers and relevant safeguards.

International shipping may also require us to provide necessary delivery information to carriers, customs authorities or other recipients in the destination country.

7. How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected or for the period required by applicable law.

Retention periods depend on the type of information:

  • Order and accounting records: retained for the applicable statutory period. Relevant Croatian accounting legislation generally requires certain accounting records to be retained for at least 11 years, subject to specific legal exceptions or different requirements.
  • Customer account information: retained while the account remains active, with certain information retained longer where required for completed transactions, legal obligations or legitimate legal claims.
  • Customer inquiries and correspondence: retained for the period reasonably necessary to respond, resolve the matter and address any related legal obligations or claims.
  • Security and technical logs: retained for periods reasonably necessary for security monitoring, investigation and technical operation, subject to the applicable system configuration and legal requirements.
  • Marketing consent records: retained as necessary to demonstrate compliance with consent requirements and applicable legal obligations.

Once personal data is no longer required, it will be deleted, anonymized or otherwise handled in accordance with applicable data protection law.

A request to delete an account does not automatically require deletion of information that must legally be retained, such as certain accounting records.

8. Your Rights Under the GDPR

Subject to the conditions and limitations established by applicable law, you have the right to:

  • Access: request information about personal data we process concerning you.
  • Rectification: request correction of inaccurate or incomplete personal data.
  • Erasure: request deletion of personal data where the legal conditions are met.
  • Restriction: request restrictions on certain processing activities.
  • Objection: object to processing based on legitimate interests and object at any time to processing for direct marketing.
  • Data portability: receive certain personal data in a structured, commonly used, machine-readable format and request its transfer where applicable.
  • Withdrawal of consent: withdraw consent at any time where consent is the legal basis for processing.
  • Automated decision-making: exercise applicable rights concerning decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

To exercise your rights, contact us at info(at)artletshop.com or through our contact form.

We may request information reasonably necessary to verify your identity before responding to a request involving personal data.

We will respond within the time limits established by the GDPR, generally within one month, subject to any legally permitted extension.

Right to Lodge a Complaint

If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority.

In Croatia, the supervisory authority is:

Croatian Personal Data Protection Agency (AZOP)

Website: https://azop.hr

You may also contact us directly so that we can review and address your concerns.

9. Cookies and Similar Technologies

Artletshop uses cookies and related technologies to support website functionality, maintain secure sessions and provide essential online shopping features.

Strictly Necessary Cookies

These may support:

  • Shopping cart and checkout functionality
  • Customer login and account sessions
  • Security and fraud-prevention functions
  • Language and necessary website preferences
  • Other technical functions required to provide the services requested by visitors

Strictly necessary cookies do not require consent where they meet the applicable legal criteria.

Analytics and Marketing Technologies

If analytics, advertising or other non-essential tracking technologies are introduced or enabled, their use will be disclosed and any required consent will be obtained before they are activated.

Such technologies will not be treated as strictly necessary merely because they may help improve the website or measure marketing performance.

Where non-essential cookies are used, visitors must be able to accept or reject them and subsequently withdraw consent in accordance with applicable requirements.

Browser settings may also allow users to block or delete cookies, although disabling strictly necessary cookies may affect certain website functions.

Information about the specific cookies and third-party services actually used must remain consistent with the website’s current technical configuration.

10. Third-Party Services and Embedded Content

Our website may contain links to external websites or embedded content, such as videos, images or other materials hosted by third parties.

When you interact with external websites or third-party services, those providers may process personal data in accordance with their own privacy policies.

Where embedded content or third-party tools use non-essential tracking technologies, the applicable requirements for prior information and consent must be respected.

Artletshop is not responsible for the independent privacy practices of external websites that it does not control.

We encourage visitors to review the privacy policies of relevant third-party services.

11. Website Security and Data Protection

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, misuse, alteration and unlawful disclosure.

These measures may include:

  • Secure HTTPS connections
  • Access restrictions and account protection
  • Website firewall and security monitoring
  • Security updates and technical maintenance
  • Controlled access to administrative systems
  • Security logging and measures to detect suspicious or malicious activity
  • Appropriate backup and recovery procedures

Our website uses security technologies, including Wordfence, to help detect and prevent unauthorized access, abusive automated requests and other security threats.

No method of transmission or electronic storage can guarantee absolute security. However, we take reasonable measures appropriate to the risks involved.

12. Information Required for Purchases

Certain personal data is necessary to process and fulfill an order.

For example, we generally require customer identification, contact details, a delivery address and the payment information necessary to complete the transaction.

If essential information is not provided, we may be unable to process the order, complete payment or arrange delivery.

Providing information through optional contact or account features is voluntary, except where specific information is necessary to provide the requested service.

Artletshop is intended for adult customers. Persons under 18 years of age should not independently place orders through the website.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in applicable law, our business operations, website functionality or data processing practices.

The latest revision date will be displayed at the top of this page.

Where applicable law requires additional notice or consent for material changes to data processing, we will provide such notice or obtain consent as required.

We encourage visitors to review this Privacy Policy periodically.

14. Contact

If you have any questions about this Privacy Policy, the use of personal data or your rights under the GDPR, please contact:

STUDIO 3DIVINE d.o.o. – Artletshop

Medvedgradska 38a
10000 Zagreb, Croatia

Email: info(at)artletshop.com

Contact: Contact Artletshop

Website: https://artletshop.com

We will review your inquiry and respond in accordance with applicable data protection requirements.