Original, sealed productsTracked shippingA fiscalised receipt with every order
HR EN

Privacy policy

1. Controller

The controller of your personal data is 4U d.o.o., Ivana Zajca 34, 31000 Osijek, Croatia, OIB 74109715528. For any question about personal data, write to our registered address or use the contact details on the Contact page.

2. Order data

When you order, we process the details you enter: name, e-mail address, phone number, delivery and billing address, your order note and the products ordered. The legal basis is the performance of the contract and our legal obligations (accounting, fiscalisation). Orders and receipts are kept for as long as accounting and tax rules require.

To fulfil an order we share data only with those who need it:

  • Stripe (card payments): you enter card details directly with Stripe; we never see or store them.
  • Resend (sending order e-mails).
  • Fakturo (issuing fiscalised receipts): a retail receipt does not name the customer.
  • the delivery service you choose (name, address, phone).

3. Cookies

We use no cookies for tracking, advertising or statistics, and the site loads no third-party scripts. We set exactly one cookie, tcgm_cart, and only when you add a product to the cart. It is needed for the cart to work (a strictly necessary cookie), holds only a random cart identifier and expires after 30 days. That is why the site shows no cookie banner.

4. Cookie-free visit statistics

To know which pages and products are viewed, our server records page visits itself, without cookies and without any script in your browser. Nothing is written to or read from your device. We record:

  • the page visited (without the parameters in its address) and its language,
  • the domain of the site you came from and campaign tags (utm_source, utm_medium, utm_campaign),
  • the country, the device type (desktop, mobile, tablet), the browser and the operating system,
  • the purchase steps (product view, add to cart, checkout started, purchase) as aggregate counts.

We do not store your IP address. To recognise the same visitor within one day we use a one-way hash of the IP address and the browser identification, computed with a random secret value (a salt) that is valid for one calendar day. The salt is permanently deleted by the first nightly pass after that day ends, after which the hash can no longer be linked to an IP address or to the same visitor on another day. A salt exists for about 26.5 hours at most, plus the retention period of our database backups (at most 7 days).

The country is derived from the IP address with an offline database on our own server (IP geolocation by DB-IP, licensed CC BY 4.0); the address is not sent to anyone.

Individual visit records are kept for 90 days and aggregate daily counts indefinitely. Only aggregate numbers are ever viewed, never an individual visitor. Orders are counted as daily totals with no link to browsing. The legal basis is our legitimate interest in understanding how the shop is used.

5. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, to the extent the General Data Protection Regulation (GDPR) provides. Statistics records contain nothing that identifies you, so we cannot find or single them out. You may also lodge a complaint with the Croatian Personal Data Protection Agency (azop.hr).

6. Changes

We will announce material changes to this policy on this page.