Orders received by 10:30 AM are shipped the same business day.
Free shipping on orders over €40
Payment on delivery, by card, or bank transfer
On working days: 9–21 AM/PM Subject: 10 AM - 3 PM | Sundays & holidays: closed
Privacy Policy
Secret d.o.o. Privacy Policy.INTRODUCTIONSECRET društvo s ograničenom odgovornošću, Vlašićka 26, 31 000 Osijek, OIB: 44508394351 (hereinafter referred to as „Secret“), attaches particular importance to the protection of personal data and privacy (hereinafter referred to as “privacy protection”) of website visitors, business partners, job candidates, its employees, former employees, as well as other individuals (hereinafter referred to as "Users") in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as the "Regulation" and/or "GDPR"), applicable regulations, best practices, and internationally accepted standards, in accordance with business and security requirements.Confidential and responsible processing of personal data is a central element of the corporate culture of Secret d.o.o. Osijek (hereinafter referred to as "Secret"). This particularly applies to the personal data of employees, business partners, candidates, visitors, etc. ("Data").The Privacy Policy describes the rules we follow in every processing of personal data, as well as information related to data linking, consents, data protection, where data is processed, in which cases we forward it to third parties, and what your rights are and whom you can contact regarding the protection of your privacy.1. ABOUT PERSONAL DATA PROTECTIONWith the Personal Data Protection Policy, we aim to transparently provide Users with clear information about the processing and protection of their personal data in one place, as well as to enable simple control and management of their personal data and consents. The Policy does not diminish the rights nor establish obligations for Users regarding the processing of personal data that Users have based on applicable regulations and possible contractual provisions on personal data protection.The Policy is a unilateral legally binding act and describes the purpose and objectives of collecting, processing, and managing personal data, based on leading global practices in the field of personal data protection. The Policy ensures an adequate level of data protection in accordance with the Regulation and other applicable valid laws related to personal data protection.The Policy applies to all Secret websites and domains, as well as to all services, products, and systems that involve the processing of personal data. It primarily concerns natural persons who apply for services, use services, or otherwise come into contact with Secret. Taking into account the legitimate interests of legal entity Users, the Policy also applies appropriately to legal entities in accordance with applicable regulations.The aim of the Policy is to establish appropriate processes for the protection and management of personal data of data subjects, i.e., website visitors, business partners, job candidates, employees, and other persons whose personal data is processed. By submitting your data, you consent to contact with us and thereby grant us the right to process your personal data in accordance with the indicated purpose.The privacy of your data is permanent. The Policy has been published as an official document and will come into effect on January 1, 2019.Please check the Personal Data Protection Policy periodically, considering possible changes that will be displayed on the Secret websites.2. DEFINITIONS OF INDIVIDUAL TERMS CONTAINED IN THIS POLICYPersonal data – is all data relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, network identifier, or by means of one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual. Personal data includes name, address, email address, IP and MAC address, GPS location, RFID tags and cookies on websites, telephone number, photograph, videos of individuals, OIB, biometric data (fingerprint, iris scan), genetic data, data on education and professional qualifications, salary data, data on credit liability, bank account information, health data, sexual orientation, voice, and any other data related to a natural person, i.e., the data subject, which can be used to directly or indirectly identify that person.Processing – means any operation or set of operations performed on personal data or on sets of personal data, whether or not automated, such as collection, restriction, erasure, or destruction.Controller – means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;Processor – means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;Recipient – means a natural or legal person, public authority, agency, or another body to whom personal data are disclosed, regardless of whether it is a third party;Third party – means a natural or legal person, public authority, agency or another body that is not the data subject, the controller, the processor, or persons authorized to process personal data under the direct authority of the controller or processor;Consent – see section 8 of the PolicyStorage system – means any structured set of personal data accessible according to specific criteria, whether centralized, decentralized, or distributed on a functional or geographical basisPersonal data breach – means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data that have been transmitted, stored, or otherwise processedIdentifiable natural person – is a person whose identity can be determined (directly or indirectly) in particular by reference to an identification number or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.Special category of personal data – refers to racial or ethnic origin, political opinions, religious or other beliefs, trade union membership, health or sex life, and personal data relating to criminal or administrative proceedings.3. SCOPE OF APPLICATIONThe policy applies to all personal data of Users or Prospective Users.Personal data is any data relating to an identified or identifiable natural person (hereinafter referred to as "data" or "personal data"). Processing of data is any operation performed on personal data, such as collection, recording, storage, use, transfer of personal data, and access to personal data.The policy does not apply to anonymous data. Anonymous data is data that has been altered in such a way that it cannot be linked to a specific natural person or cannot be linked without disproportionate effort, and therefore, in accordance with applicable regulations, is not considered personal data. The policy applies to all Secret services and products that involve the processing of personal data.The User's last expression of will regarding the processing of personal data applies to all other services that the User uses. As a rule, Secret is the data controller in relation to the personal data of its Users within the meaning of applicable personal data protection regulations.4. PRINCIPLES OF PERSONAL DATA PROCESSING4.1. TrustWe want to be a reliable partner to Users in protecting their privacy and to justify the trust they have placed in us. Furthermore, we want to be completely transparent and clear regarding the processing of Users' personal data. Users can always contact us with a request to change their personal data or to express their wishes regarding the purposes for which they want or do not want their data to be processed.Legality and Best PracticesIn processing personal data, we act in accordance with the law, but we always strive to apply higher standards and best European practices. All Secret employees who come into contact with personal data sign a Confidentiality Statement and undergo continuous training on personal data protection. Secret periodically conducts an internal audit of the implementation of all personal data protection policies, with the aim of complying with legal regulations and improving the level of protection within the Company.4.3. Limited Purpose of ProcessingWe collect and process personal data only for a specific and lawful purpose, and we do not further process it in a manner incompatible with that purpose, unless otherwise prescribed by law or with the User's consent.4.4. Data ReductionWe always use only such User data as is adequate and necessary for achieving a specific legitimate purpose, and no more than that.4.5. Processing in Unnamed FormWhenever possible and justified, we use data in an anonymized form. Anonymized data are primarily considered to be anonymous data. However, whenever possible and justified, especially for the protection of the User's personal data, we pseudonymize personal data, i.e., using special pseudonymization procedures (e.g., substitution, hashing, etc.), we “mask” it in such a way that it cannot be linked to an individual User without the use of additional information that is kept securely and separately (e.g., use of a key).4.6. Integrity and ConfidentialityWe process personal data in a secure manner, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage (e.g., only authorized individuals who need it for their job, and not other employees, have access to User personal data).4.7. Quality of personal dataWe place great importance on the quality of the data we process. The personal data we process must be accurate, complete, and up-to-date to ensure maximum protection of user data and prevent potential misuse. Therefore, it is important for us that the user informs us of any changes to their data immediately or as soon as possible.4.8. Limited storage timeWe store and process User data only for as long as is necessary to fulfill a specific legitimate purpose, unless applicable regulations stipulate a longer or shorter retention period for a particular purpose, or in other cases expressly prescribed by law. After that, the data is permanently deleted or anonymized. In general, we store data in accordance with regulatory requirements and best practices, and to enable traceability in the supply chain, consumer safety, protection and preservation of integrity, standards, and the like. The duration of data storage depends on the nature of the data and is subject to change. In accordance with the principles mentioned, User data will be accessed by Secret employees depending on their authorizations and job positions, in order to successfully fulfill the tasks defined for their job position. Also, some services for Secret are performed by other legal entities with whom User data will be shared only if they are necessary for the fulfillment of obligations from joint contracts or if sharing is based on the explicit request or consent of the User. Secret will also forward User data to other business entities or state institutions in cases where there is a legal basis for doing so.5. HOW WE COLLECT PERSONAL DATASecret collects Users' personal data (hereinafter: data) in several ways:1. We collect data primarily directly from the User or Potential user, in a way that they provide it to us. The most common example of this data collection method is placing an order for a specific product, where the User, if they wish to order the product, provides the data and documents necessary for identification (e.g., first name, last name, address, phone number, email address, etc.). We also collect data during communication with the User by phone, email, contact forms on our websites, online portals, and social media, when resolving complaints, processing inquiries, requests, etc. Such collected data is used to fulfill the User's requests. In cases where it is possible and legally permissible, Secret will not collect copies of documents but will only request them for review and will create a separate record of this. This applies in particular to documentation containing biometric or other special category personal data.2. We collect data that is generated automatically when the User uses the services and/or products or issues a service and/or product.3. We collect data from publicly available sources such as, for example, data from publicly published registers, the public telephone directory, publicly available services, commercial services, or publicly available numerations.4. We collect data based on contracts entered into with business partners.5. We collect data based on employment contracts and/or contracts for work, or when performing work or a specific service.6. We collect data through video surveillance installed in the Company's business premises, as well as from records of entry and exit to the Company's business premises. The use of video surveillance is described in more detail in the publicly available Policy on the Use of the Video Surveillance System. The aforementioned data are retained for 2 months. A prerequisite for any collection of Users' personal data is the existence of an appropriate legal basis established by law, legitimate interest, or the User's consent.6. WHAT TYPES OF PERSONAL DATA DO WE COLLECTDepending on the contracted service or product, User consents, and the purpose for which individual data is used, Secret is authorized to collect the User data types listed below. In doing so, we always collect only the data necessary to achieve a specific lawful purpose, legitimate business interest, and public interest. Furthermore, Secret does not process special categories of data or personal data relating to criminal convictions and offenses. Secret collects data on offenses committed at work and during work, for the purpose of fulfilling its legal obligations or for the possibility of proving the fulfillment of its obligations.6.1. Contractual DataContractual data in a broader sense includes so-called master data, i.e., data provided by the User for the purpose of concluding and executing the contract (e.g., name and surname, date and place of birth, postal address, delivery address, contact details (phone, email, etc.), Unique Personal Identification Number (OIB), Social Security Number (JMBG), ownership data, possession, lease, rental, concession, bank account number, marital status, citizenship, nationality, health status data, disability data, data on children, educational qualifications, etc.).6.2. User Communication with SecretThis includes, for example, the User's written or electronic communication with Secret, social media communication, the User's preferred communication channels, order placement, job applications, etc. We may also automatically collect certain data from your device when you visit our website and other related websites (“our website”). This data may display personal data such as: IP address, the name of the file you accessed, the date and time of access, the amount of data transferred, notifications about successful access, web browser, device type, and unique device identification numbers. We may also collect information about how your device has interacted with our website, such as information about the pages you have accessed and which links were opened.By collecting this information, we can better understand who visits our website, where visitors come from, and what content on our website they are interested in. We use this information for our internal analysis, to improve the quality of our website, and to tailor it to the interests of our visitors. Some of this data may be collected using cookies or similar technologies on our website. For details, please refer to the cookie information on our website or the terms of use of our website.6.2.1. Sending Requests, Resumes, or Job ApplicationsSecret, via your email address, allows you to send applications, resumes, job applications, and other supporting documentation.In addition to the data you send yourself, Secret may also obtain certain personal data during selection interviews or testing.Personal data obtained in this manner is used and processed during the selection process depending on Secret's changing recruitment needs.If a user sends an open application, they are also obliged to sign a consent form in which they give their agreement for the submitted data to be stored in the candidate database and used for future selection processes or job offers. Secret will store data collected in this way for 5 years from the date of the last consent received. If applications, resumes, job applications, etc. are sent by mail without an attached consent form, Secret will, unless it requires excessive effort, request the candidate to submit a signed consent form within 8 days. If the candidate does not submit the consent form within the specified period, the submitted personal data will be destroyed. (For more information on Consent forms, see Section 7.). Personal data submitted with job applications, as well as during selection testing or interviews, will only be accessible to specific employees who have previously signed a Personal Data Confidentiality Statement.6.3. Potential User DataThis data includes master data, particularly contact details (e.g., name and surname, e-mail address), but also the Potential User's interests in Secret's services or products. As a rule, Secret will record the data of those Potential Users who contact them expressing a desire for Secret to inform them and/or offer them certain products and/or services. Data about Potential Users will be deleted or anonymized after 5 years or, upon the request of the Potential User, earlier, with the exception of cases where we store data longer due to legal or statutory obligations (e.g., in the event of a dispute).6.4. Collecting Data from External SourcesOccasionally, we may receive personal data about you from external sources, e.g., data from publicly available registers, published information on websites, and from media.6.5 Special Categories of Personal Data (Sensitive Data)Sensitive personal data are data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, including the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning health or data relating to a person's sex life or sexual orientation.Special categories of personal data are usually processed based on one of the following legal bases: (a) based on your explicit consent (Article 9(2)(a) GDPR); (b) for the establishment, exercise, or defense of legal claims (Article 9(2)(f) GDPR); (c) if, in exceptional circumstances, it is necessary for the protection of your vital interests, and you are unable to give your consent (Article 9(2)(c) GDPR).As a rule, Secret will not collect sensitive data.7. WHAT PERSONAL DATA WE COLLECT AND FOR WHAT PURPOSESIn order for Secret to be able to provide a service to the User, and in accordance with the provisions below, it is necessary to process the minimal set of data required for the quality provision of each service. Otherwise, if the User refuses to provide the requested set of data, Secret may consequently be unable to provide the service or process the request. Accordingly, the User's personal data are processed when one of the following conditions is met:7.1. Execution of the contractSecret collects and processes (hereinafter: uses) User's personal data primarily for the purposes of concluding and executing contracts (where a contract is considered any clear expression of will) between the User and Secret, employment, and termination of employment. This particularly includes the use of data for verifying the User's identity, the User's solvency, providing the contracted service, calculating and charging costs, contacting the User if necessary in connection with the provision of the service, resolving complaints, eliminating disruptions, monitoring and ensuring the quality and security of services and products, user support, advice and assistance in using products and services, and other actions related to the conclusion and execution of the contract in accordance with the law.The legal basis for data processing for these purposes is the necessity for the execution of the User's contract or taking measures at the User's request before concluding the contract. In cases where the User does not wish to provide the data necessary for the conclusion and execution of the contract, Secret may not be able to conclude the contract and/or perform certain actions related to the execution of the contract.Secret collects personal data also for the fulfillment of obligations under an employment contract. 7.2. Legitimate interestFurthermore, Secret uses certain User data exclusively for its own records and to protect the legitimate interests of the User, except when these interests are overridden by the prevailing interests or fundamental rights and freedoms of the User that require the protection of personal data. For example, this includes the use of User data to prevent, detect, and process abuses to the detriment of the User or the Company, to ensure the safety of employees, Users, products, and services, to create services and offers that meet User needs and desires, for marketing activities and promotion, to ensure a superior user experience, for personalized customer support, and to optimize the electronic communication network, etc.The legal basis for processing data for these purposes is Secret's legitimate interest, except when this interest is overridden by the prevailing interest or fundamental rights and freedoms that require the protection of User data and/or the legal basis for protecting the vital interests of the User or another natural person. Exceptions are cases specified in Article 7 of the Policy when the legal basis is consent.7.3. For the purpose of fulfilling legal obligations and performing tasks in the public interestBased on a written request founded on valid regulations, Secret is obligated to provide or grant access to certain User personal data to the competent state authorities. The legal basis for data processing for these purposes is the fulfillment of legal obligations as well as the execution of tasks of public interest. We commit to complying with the laws of the Republic of Croatia and applicable European regulations.8. PERSONAL DATA PROTECTION MEASURESThe data controller is obliged to ensure that access to personal data is limited to authorized persons who have signed a confidentiality statement and have undergone internal training on personal data protection.The data controller is obliged to ensure the protection of personal data by ensuring that the IT network and systems are protected against:- fire,
- floods,
- power loss,
- unauthorized access,
- to use antivirus protection,
- encryption and pseudonymization of data where possible, as well as other appropriate measures to ensure the highest level of information security.