Privacy Policy

PRIVACY POLICY

Last updated: 13 August 2026

Article I — Data Controller and General Provisions

This website, kallosprolashcollection.com (the "Website"), is operated by CE - MAKOR d.o.o. for services and trade, Ulica Karla Metikoša 2, 10000 Zagreb, Republic of Croatia, VAT ID (OIB): 47366287988 ("Kallos", "we", "us", "our"), which acts as the Data Controller of your personal data within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Croatian Act on the Implementation of the General Data Protection Regulation. This Privacy Policy applies to all visitors and customers of the Website, including consumers and business customers (e.g. salons, beauty studios, distributors), noting that certain rights under the Croatian Consumer Protection Act apply to consumers only.

For any questions about this Privacy Policy or to exercise your rights, contact us at info@kallosprolashcollection.comor by post at the address above.

Article II — What Data We Collect

a) Data you provide directly: first and last name, email address, postal address, phone number, order details (card payment data is processed via CorvusPay/Shopify Payments and is not stored by us), and, for business customers, additionally company name, VAT/tax ID, and contact-person details;

b) Website usage data: IP address, browser type and version, pages visited, time and duration of visit;

c) Cookies and similar technologies — a full list is available in our Cookie Notice.

Article III — Third-Party Tools We Use

To operate, analyze, and market the Website, we use the following service providers:

  • Shopify Inc. — hosting and e-commerce platform; your data is stored on servers located in the European Union;
  • Google Analytics (Google Ireland Limited / Google LLC) — website traffic analysis;
  • Meta Pixel (Meta Platforms Ireland Ltd.) — measuring ad performance on Facebook and Instagram and displaying relevant ads;
  • Microsoft Clarity (Microsoft Ireland Operations Ltd. / Microsoft Corporation) — analysis of on-site user behaviour to improve the user experience;
  • Shopify Email — sending newsletters to users who have voluntarily subscribed via our sign-up bar or pop-up;
  • CorvusPay — processing of online card payments.

Cookies that are not strictly necessary for the Website to function (analytics and marketing cookies) are only set after you give your consent via our automated cookie consent banner (Shopify Cookie Banner), shown to visitors from the European Union/EEA and other regions where this is legally required. You may change or withdraw your consent at any time via the cookie settings available on the Website.

Article IV — Purpose and Legal Basis of Processing

  • Fulfilling your order and our contract with you — Art. 6(1)(b) GDPR;
  • Compliance with legal obligations (e.g. tax and accounting law) — Art. 6(1)(c) GDPR;
  • Sending newsletters and marketing communications — based on your consent, Art. 6(1)(a) GDPR, which you may withdraw at any time via the link in any email or by request to info@kallosprolashcollection.com;
  • Website analytics (Google Analytics, Microsoft Clarity) and marketing advertising (Meta Pixel) — based on your consent given via the cookie banner, Art. 6(1)(a) GDPR;
  • Our legitimate interest in the secure operation of the Website, fraud prevention, and business development — Art. 6(1)(f) GDPR.

Article V — Transfers of Data Outside the EU/EEA

Google, Meta, and Microsoft may process data outside the European Union/European Economic Area, including in the United States. Such transfers rely on the European Commission's adequacy decision for participants in the EU-U.S. Data Privacy Framework, where the recipient is certified under that programme, or on European Commission-approved Standard Contractual Clauses, where it is not. Additional information on the safeguards applied is available on request.

Article VI — Data Retention Period

  • Order and invoice data: retained in accordance with the periods set by Croatian tax and accounting law;
  • Newsletter data: until you withdraw your consent;
  • Analytics/marketing cookies: per the default periods listed in our Cookie Notice, or until consent is withdrawn;
  • Business customer (B2B) data: for the duration of the business relationship and in accordance with the statutory retention periods for business records.

Article VII — Your Rights

Under the GDPR you have the right to: access your data (Art. 15), request rectification (Art. 16), request erasure (Art. 17), request restriction of processing (Art. 18), data portability (Art. 20), and object to processing (Art. 21), as well as the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Requests may be sent to info@kallosprolashcollection.com. You also have the right to lodge a complaint with the Croatian Data Protection Agency (AZOP), www.azop.hr.

Article VIII — Security

We take reasonable technical and organizational measures to protect your data against loss, misuse, unauthorized access, disclosure, or destruction, including SSL encryption of data transmission and PCI-DSS standards for payment processing.