Privacy

Controller

The controller of your personal data is Budilica d.o.o., OIB 78247996875. Registered office: Meraška ulica 6, 10000, Zagreb.

For any question or request about your personal data, write to budilicatotic@gmail.com.

What data we collect

With a purchase we keep one piece of personal data: your email address, which you enter when you buy.

Like every website, our server sees your device's IP address each time a page is opened; it is personal data too. We use it only to protect against abuse: the record that limits the number of requests and payment attempts from one IP address is kept for 24 hours. That record is not linked to your purchase and does not go into our backups. The server's access logs do not contain your device's IP address.

The number of children and the institution you are buying for are not personal data. We do not collect children's or parents' names, OIB (personal identification number), postal address or phone number. There is no profiling, no newsletter and no tracking cookies.

You enter your card details on Stripe's page; they never reach our servers. The invoice shows neither your name nor your email address.

If you contact us for help and do not have your purchase code, we can also find the purchase by the last four digits of your card: we then enter them in a search in Stripe. We do not store those digits; with Apple Pay and Google Pay they are the digits of a substitute card number, so you will often not know them.

Purposes and legal bases

• Sending the ticket and invoice by email, sending them again and helping with a purchase: performance of a contract (Article 6(1)(b) of the General Data Protection Regulation).
• Issuing and keeping invoices: a legal obligation (Article 6(1)(c)). Invoices are kept for 11 years by the invoicing service provider, without your email address.
• Protection against abuse (the IP address in the limit on the number of requests and payment attempts from one IP address): legitimate interest (Art. 6(1)(f)), protecting the site and its customers from abuse.
• Finding a purchase by the last four digits of your card when you contact us for help without a purchase code: legitimate interest (Article 6(1)(f)), helping the buyer. The digits are not stored.

How long we keep data

• Email address: 2 years from your last purchase with that address. We then replace it with a random identifier that cannot be linked to the address; the invoices remain, without personal data.
• A purchase that was not paid: we delete the address after 7 days.
• Encrypted database backups: 13 months.
• Records used to limit the number of requests and payment attempts (IP address): 24 hours; they are not included in backups.
• The last four digits of your card when we help you: we do not store them.
• Invoices (amount, items, JIR): 11 years, as the law requires, without the email address.

Processors and data transfers

• Stripe: payment by card, Apple Pay and Google Pay. Stripe is an independent controller of your card details. It receives your email address with the payment and keeps it under its own rules, even after we have replaced it with an identifier. Transfer outside the EU: standard contractual clauses. The Apple Pay and Google Pay buttons on the payment page are drawn by Stripe's script, which your browser loads from Stripe's servers; Stripe's collection of device data for fraud prevention is switched off for it.
• Invoicing service provider: issuing, fiscalising and archiving invoices. It never receives your email address.
• Email delivery service provider (data centre in Frankfurt): sending email. Transfer to the US: the EU–US Data Privacy Framework or standard contractual clauses.
• Error tracking service provider (data centre in the EU): reports of errors in the system, without personal data. Transfer to the US: the EU–US Data Privacy Framework or standard contractual clauses.
• Storage service provider (data centre in Frankfurt): storage of encrypted backups. Transfer to the US: the EU–US Data Privacy Framework or standard contractual clauses.
• Server hosting provider (EU): the server this site runs on.

We will send you the names of the processors and a copy of the standard contractual clauses on request to budilicatotic@gmail.com.

Your rights

You have the right to access your data and to have it corrected or erased, the right to restrict processing, the right to object to processing and the right to data portability. Once your address has been erased we can no longer send you the invoice by email; the invoice is kept without personal data.

Send your request to budilicatotic@gmail.com; give the email address your request is about and, if you have it, the purchase code.

If you believe that we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP).

Cookies

The public pages set no cookies. Details: cookies.