Privacy Policy

PRIVACY POLICY

Effective Date: October 28, 2026

At Gevalto d.o.o., accessible from gevalto.com, we are committed to protecting your privacy and ensuring that your personal data is handled in a safe, transparent, and lawful manner in accordance with the General Data Protection Regulation (EU GDPR) and applicable data protection laws.

1. Data Controller & Contact Information

Gevalto d.o.o. is the official data controller responsible for processing your personal data.

  • Legal Entity Name: Gevalto d.o.o.

  • Registered Office: Čučerska cesta 16a, 10040 Zagreb, Croatia, EU

  • Court Register: Commercial Court in Zagreb (Trgovački sud u Zagrebu)

  • Registration Number (MBO): 080965525

  • VAT ID Number: HR71361764550

  • Authorised Representative: Genc Prekpalaj

  • Contact E-mail: info@gevalto.com

2. Information We Collect

We collect personal data necessary to provide our services, process orders, and maintain website performance:

  • a. Order & Account Data: When you purchase products or register an account, we collect your name, billing and shipping address, email address, phone number, payment details, and order history.

  • b. Communication Data: Information provided when contacting customer support via email, contact forms, or WhatsApp.

  • c. Technical & Usage Data: When visiting our website, server logs automatically capture your IP address, browser type, operating system, referring URLs, and browsing duration.

  • d. Cookies and Tracking Data: We use essential cookies to run the website and non-essential cookies (analytics and marketing) strictly based on your explicit consent managed via our Cookie Banner.

3. Legal Bases for Processing

We process your personal data under the following GDPR legal grounds:

  • Performance of a Contract (Art. 6(1)(b) GDPR): Processing required to manage and deliver your orders, process payments, provide size/fit customer support, handle pre-orders, and manage your user account.

  • Legal Obligation (Art. 6(1)(c) GDPR): Processing necessary to comply with legal duties, including accounting, tax reporting, and issuing commercial invoices under national laws.

  • Legitimate Interests (Art. 6(1)(f) GDPR): Processing needed to ensure website security, prevent fraudulent transactions, defend against legal claims, and optimize site functionality.

  • Consent (Art. 6(1)(a) GDPR): Processing for voluntary subscriptions (e.g., newsletters) and non-essential analytical/marketing cookies. You may withdraw consent at any time.

4. How We Share Your Information

We never sell, rent, or trade your personal data. We share data only with necessary third-party service providers acting on our behalf:

  • Logistics & Delivery Partners: Courier services (e.g., DHL, DPD, local postal services) to deliver your orders.

  • Payment Service Providers: Secure payment processors (e.g., Stripe, WooPayments, PayPal) to process payments and handle transaction verification.

  • IT Infrastructure & Hosting: Cloud hosting providers, web analytics tools, and maintenance agencies ensuring website operations.

  • Legal & Professional Advisors: External accountants, legal counsels, and auditors for tax and legal compliance.

5. International Data Transfers

Your data is primarily processed and stored within the European Economic Area (EEA). If personal data is transferred to a country outside the EEA, we ensure appropriate safeguards are implemented in compliance with GDPR, such as:

  • European Commission Adequacy Decisions.

  • European Commission Standard Contractual Clauses (SCCs).

  • Verification under the EU-U.S. Data Privacy Framework (DPF) for US-based service providers.

6. Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the operational, tax, or legal purpose for which it was collected:

  • Invoices & Financial Records: Retained for 11 years pursuant to statutory Croatian bookkeeping and tax laws.

  • Account Data: Retained for as long as your account remains active. If you terminate your account, your data will be permanently deleted, barring unresolved legal disputes or fiscal retention mandates.

  • Inquiries & Customer Support: Retained for up to 3 years following the resolution of the matter.

7. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

  • Right of Access: Request a copy of the personal data we hold about you.

  • Right to Rectification: Request correction of inaccurate or incomplete personal data.

  • Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data when it is no longer needed or processing is unlawful.

  • Right to Restriction: Request restriction of processing under legally defined circumstances.

  • Right to Data Portability: Obtain your personal data in a structured, machine-readable format.

  • Right to Object: Object to data processing based on legitimate interests or direct marketing purposes.

  • Right to Withdraw Consent: Revoke any given consent at any time with future effect.

To exercise any of these rights, please contact us at info@gevalto.com.

8. Right to Lodge a Complaint

If you believe that our processing of your personal data violates applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority:

  • Agencija za zaštitu osobnih podataka (AZOP)

    Selska cesta 136, 10000 Zagreb, Croatia

    Phone: +385 1 4609 000

    E-mail: azop@azop.hr

    Website: www.azop.hr

9. Security & Children’s Privacy

We use appropriate administrative, technical, and physical security measures (including SSL encryption) to protect your personal data. Our website is not directed at children under the age of 16, and we do not knowingly collect personal data from minors.

10. Updates to This Policy

We may update this Privacy Policy periodically. Any changes will be posted on this page with an updated “Effective Date.”