‌Effective Date: October 15, 2026‌

Welcome to the privacy policy of CARDUELIS PET SHOP j.d.o.o. za proizvodnju i trgovinu. This document outlines how we collect, use, store, process and protect your personal data when you visit our website www.carduelispetshop.com, browse our collection of pet grooming tools, water bottles and other pet accessories, place orders, interact with our customer services or use any features available on our platform. As a pet accessories retailer proudly based in Croatia, we are fully committed to complying with the EU General Data Protection Regulation (GDPR) and all applicable local data protection laws, to ensure your personal information is handled with the highest level of care, transparency and respect for your privacy rights.

Our full contact details for all data protection and privacy related inquiries are as follows:

• Full company name: CARDUELIS PET SHOP j.d.o.o. za proizvodnju i trgovinu
• Registered and operational address: Zagrebačka ulica 228, 35000 Slavonski Brod, Croatia
• Contact email: bramble@carduelispetshop.com
• Contact telephone number: +385 99 763 0484

1. Core Data Processing Principles We Follow

All our personal data processing activities strictly adhere to the 7 foundational principles defined under GDPR, to guarantee your data is managed fairly and responsibly:

1. ‌Lawful, Fair and Transparent Processing‌: All data handling activities are based on clear, legal grounds, with no hidden or undisclosed processing operations. We will never process your personal data in ways that are incompatible with the purposes you have been informed of.
2. ‌Purpose Limitation‌: Personal data is only collected for specific, explicitly stated and legitimate business purposes related to running our pet e-commerce store, and will not be further processed in any manner that conflicts with these original purposes.
3. ‌Data Minimisation‌: We only collect the minimum scope of personal information that is strictly necessary to fulfill the stated processing purposes. We do not collect unnecessary, irrelevant or excessive personal data that is not required to deliver our products and services to you.
4. ‌Data Accuracy‌: We take all reasonable measures to ensure all personal data we hold about you is accurate, up to date and complete. We will promptly correct or erase any information that is found to be inaccurate, taking into account the purposes for which it was processed.
5. ‌Storage Limitation‌: Personal data is retained only for the duration strictly required to achieve the purposes for which it was collected, in compliance with applicable commercial, tax and legal record-keeping obligations. After the relevant retention period expires, your personal data will be securely and permanently erased or anonymized.
6. ‌Integrity and Confidentiality‌: We implement comprehensive technical, administrative and physical security measures to protect your personal data against unauthorised access, accidental loss, destruction, damage, unlawful alteration, disclosure or any other form of illegal processing.
7. ‌Accountability‌: We maintain complete, documented records of all our personal data processing activities, and are fully able to demonstrate full compliance with all applicable GDPR requirements to relevant data supervisory authorities at any time.

2. Categories of Personal Data We Collect

We only collect personal information that is directly relevant to providing you with a seamless shopping experience for our range of pet accessories. The categories of personal data we may collect include:

• Basic identity information: your full name, billing and delivery address, and telephone number, which are required to process and fulfill your product orders correctly.
• Contact information: your valid email address, which we use to send you order confirmations, shipping updates, respond to your customer inquiries, and send optional marketing communications only if you have given your explicit, prior consent.
• Transaction and order information: details of the pet products you have purchased, order value, payment method (we do not store full credit card or payment card details, as all payment processing is handled through certified, secure third-party payment service providers), and your order history on our website.
• Technical usage data: information about your device, browser type and version, time zone setting, IP address, website pages you visit, referral sources, your browsing paths across our product categories including our pet hair removal gloves, pet brushes, portable pet bottles and other new arrivals, access timestamps, and other anonymous analytical data that helps us improve website performance and user experience.
• Communication data: any information you voluntarily provide when you contact us via email, our website contact form, or telephone, such as product questions, return requests, custom service inquiries, or feedback about our pet accessories.

We will never collect any special categories of sensitive personal data, including information related to your racial origin, religious beliefs, health status, biometric data or other highly sensitive information, unless you voluntarily choose to provide such information and we are legally permitted to process it under GDPR rules.

3. Legal Bases for Processing Your Personal Data

All of our data processing activities are supported by one or more clear legal grounds defined under Article 6 of GDPR:

1. ‌Performance of a contract‌: Most of the processing related to your order fulfillment is necessary for the performance of the sales contract we enter into with you when you purchase our pet products. This processing includes handling your payment, arranging shipping, processing refunds and communicating with you about your order status. Without this data, we would not be able to deliver the products you have ordered to your specified address.
2. ‌Your explicit, freely-given consent‌: For processing activities that are not strictly necessary for order fulfillment, such as sending you optional promotional emails about our new arrivals, best-selling pet gear or exclusive discount offers, we will only carry out such processing after you have given your clear, informed and unambiguous consent. You retain the full right to withdraw this consent at any time, by clicking the unsubscribe link included in all our marketing emails, or sending us a notification to our contact email listed above. Withdrawing your consent will not affect the lawfulness of any processing we carried out before your withdrawal.
3. ‌Compliance with legal obligations‌: We process your personal data when it is necessary for us to comply with our legal responsibilities, such as retaining transaction records for tax authorities, commercial register requirements and consumer protection regulations that apply to our business operating in Croatia.
4. ‌Legitimate interests‌: We may process your basic personal data for legitimate business purposes that do not override your fundamental privacy rights, such as improving our website functionality, preventing fraud and payment security risks, optimizing our product catalog of pet accessories to better match customer demands, and sending you service-related notifications that are necessary for the normal operation of your account on our store. Before carrying out processing based on legitimate interests, we will always conduct a careful balancing test to ensure your privacy rights are fully protected, and the processing does not cause any unnecessary harm to you.

4. Purposes for Which We Use Your Personal Data

All your personal data is processed exclusively for the following specific, clearly defined purposes:

• To successfully process, confirm, fulfill and deliver the orders you place on our website, including arranging product shipment to your nominated address, providing accurate delivery tracking information, and processing return and refund requests in line with our published Refund and Returns Policy.
• To manage your customer account on our website, allowing you to view your order history, save your preferred delivery addresses, track ongoing orders, and manage your product wishlist for future purchases of our pet grooming tools and travel pet bottles.
• To respond promptly and effectively to your customer support inquiries, questions about product features, sizing guidance for our pet brushes, water bottle functionality, or any other requests you submit to us via our contact channels.
• To send you strictly necessary service-related notifications, including critical website security alerts, updates to our terms of service, privacy policy or shipping policy, and important announcements related to changes to our platform operations.
• With your separate explicit consent, to send you optional marketing communications, including information about new product launches, seasonal promotions, exclusive discount campaigns, and updates related to our best-selling pet accessories that you may be interested in.
• To perform website analytics, usability testing and performance optimization, to help us identify technical issues with our website, improve page loading speeds, optimize the layout of our product pages for a better user experience, and continuously enhance the overall shopping journey for all our customers.
• To detect, prevent, investigate and mitigate fraudulent transactions, payment fraud, security breaches and other illegal or malicious activities that may threaten the security of our website, our customers and our business operations.
• To comply with all applicable legal, regulatory, judicial and administrative requirements, including responding to valid court orders, official law enforcement requests, and fulfilling our statutory record-keeping obligations under Croatian and EU legislation.

5. Disclosure and Sharing of Your Personal Data

We will never sell, rent or trade your personal data to any unrelated third parties for their own marketing purposes without your explicit prior written consent. We may only share your personal data with carefully selected third parties who act as our data processors, strictly on our instructions, for the limited purposes required to run our e-commerce operations, as listed below:

• Authorized shipping and logistics providers: We share your delivery name, address and contact phone number with trusted courier services, solely for the purpose of arranging the safe and timely delivery of your ordered pet products to you.
• Certified payment service providers: We share necessary transaction details with PCI-DSS compliant payment processors, to securely process your payments and complete your purchases. As stated earlier, we never store full payment card credentials on our own servers.
• Authorized IT service providers: We may share limited necessary data with our website hosting providers, cloud service operators, website maintenance contractors and cybersecurity service providers, who support us to operate, secure and maintain the normal functionality of our www.carduelispetshop.com e-commerce platform.
• Competent public authorities and regulatory bodies: We may disclose your personal data when we are legally required to do so by binding law, court order, or valid official request from a recognized governmental authority, to protect our legal rights, property or safety, as well as the rights, property and safety of our customers or the general public.

All third-party data processors we cooperate with are required to sign a formal data processing agreement with us, which mandates that they implement the same level of data security protections as we do, and they may only process your personal data strictly in accordance with our documented instructions, and not for any of their own independent purposes.

6. International Transfers of Personal Data

As a business based within the European Union, all primary storage and processing of your personal data takes place on servers located within the European Economic Area (EEA). If in the future it becomes necessary to transfer a subset of your personal data to a third country located outside of the EEA, we will strictly comply with all GDPR requirements for cross-border data transfers. We will ensure that the destination country has an adequate level of data protection recognised by the European Commission, or we will put in place appropriate, legally valid safeguards such as using the European Commission approved Standard Contractual Clauses (SCCs), to fully protect your personal data rights, and guarantee that your personal information receives the same level of protection as it is entitled to within the EU. You may contact us at any time to request a copy of these safeguards if any international data transfers take place.

7. Data Retention Periods

We do not keep your personal data for any longer than is reasonably necessary to fulfill the exact purposes for which it was originally collected, in line with applicable legal requirements:

• For order-related personal data (including your name, delivery address, transaction records), we retain this data for the full duration required to complete your order, plus the legally mandatory commercial and tax record retention period defined under Croatian law, which is typically 10 years from the date of transaction completion. After this period expires, we will securely erase or anonymize these records.
• For marketing-related contact information (your email address for promotional communications), we retain this data for as long as you maintain an active opt-in to receive our marketing materials, or until you request to unsubscribe and opt out from all marketing communications. After you opt out, we will immediately remove your email address from all our marketing mailing lists.
• For account-related personal data, we retain all information linked to your customer account for as long as you choose to keep your account active on our website. If you request to permanently delete your account, we will erase all associated personal data within 14 working days, except for the limited data we are legally required to retain for mandatory tax, accounting or legal compliance purposes.
• For anonymous website usage analytics data, we retain this data for a maximum period of 24 months, after which all records are fully anonymized and cannot be linked back to any individual identifiable user.

8. Your Full GDPR Data Subject Rights

Under the General Data Protection Regulation, you hold a comprehensive set of enforceable rights over your personal data. You may exercise any of these rights at any time, completely free of charge, by sending us a written request to our contact email bramble@carduelispetshop.com. We will respond to your legitimate request within a maximum of 30 calendar days, and we will only request minimal necessary information from you to verify your identity before processing your request:

1. ‌Right of Access‌: You have the right to obtain clear confirmation from us as to whether or not we are processing your personal data, and to receive a free copy of all the personal information we hold about you, along with full supplementary details about our processing activities.
2. ‌Right to Rectification‌: You are entitled to request that we correct any inaccurate, incomplete or out of date personal data we hold relating to you, at any time. If your delivery address, phone number or email has changed, we will update our records for you immediately upon your notification.
3. ‌Right to Erasure (Right to be Forgotten)‌: You have the right to request that we permanently erase your personal data without undue delay, under eligible circumstances including when the data is no longer necessary for the original purposes we collected it for, you have withdrawn your consent for the processing, or our processing of your data has no remaining valid legal ground. This right is subject to a small number of limited exceptions, for situations where we are legally required to retain certain data to comply with our statutory legal obligations.
4. ‌Right to Restriction of Processing‌: You are entitled to request that we temporarily suspend the processing of your personal data, for scenarios including when you contest the accuracy of your data, you believe our processing is unlawful, or you no longer require us to process the data but you need the information to establish, exercise or defend your own legal claims.
5. ‌Right to Data Portability‌: You have the right to receive all personal data that you have directly provided to us, in a structured, commonly used, machine-readable format, and you have the right to transmit this data to another data controller without any obstruction from our side, for all processing activities that are based on your consent or the performance of our contract with you.
6. ‌Right to Object‌: You have the full right to object at any time to our processing of your personal data that is based on our legitimate interests. If you object to processing for direct marketing purposes, we will immediately stop all related processing of your personal data for these marketing purposes, without any further questions or delays.
7. ‌Right to Withdraw Consent‌: Wherever our processing of your personal data is based entirely on your prior explicit consent, you may withdraw that consent at any time. This withdrawal is completely free, easy to exercise, and will not negatively impact the lawfulness of any processing activities that we completed before you withdrew your consent.
8. ‌Right to Lodge a Complaint‌: If you believe that our processing of your personal data violates applicable GDPR rules, or you are not satisfied with the way we have handled your data protection request, you have the full right to submit a formal complaint to the competent national data protection supervisory authority located in the EU member state of your habitual residence, place of work, or where you believe the alleged GDPR infringement took place.

9. Data Security Protection Measures

We have implemented a robust multi-layered set of technical and organizational security measures to ensure your personal data is fully protected against all foreseeable risks:

• All personal data transmitted between your browser and our website is encrypted using industry-standard TLS 1.3 encryption, to prevent any unauthorised interception during data transfer.
• All personal data stored on our servers is encrypted at rest using advanced AES-256 encryption protocols.
• Strict role-based access control systems are enforced, so that only a very limited number of authorized, specially trained staff from our team have access to your personal data, and only to the minimum extent necessary to perform their assigned job duties.
• We conduct regular, periodic security audits, vulnerability scans and penetration testing of our entire e-commerce platform, to identify and patch any potential security weaknesses in a timely manner.
• Our team maintains a fully documented data breach response and notification plan, which defines clear procedures to detect, investigate, contain and report any accidental or unlawful personal data breach. In the unlikely event that a personal data breach occurs that poses a high risk to your rights and freedoms, we will notify the relevant competent data supervisory authority, and notify you directly, in full compliance with the 72-hour notification requirement defined under GDPR.

10. Use of Cookies and Similar Tracking Technologies

Our website www.carduelispetshop.com uses cookies and other similar small tracking files to enhance your browsing experience, improve website functionality and analyze how our platform is being used by visitors.

• Strictly Necessary Cookies: These cookies are absolutely essential to enable the core, basic functionality of our e-commerce website, including maintaining your shopping cart contents, keeping you logged into your account when you browse different product pages, and ensuring the checkout process runs smoothly. These cookies do not collect any personally identifiable information about you, and cannot be disabled through our cookie banner, as the website cannot function properly without them.
• Functional Cookies: These cookies remember your personal preferences when you visit our store, such as your selected language, your preferred currency, and saved product filter settings, to deliver a more customized, convenient user experience during your subsequent visits.
• Analytical and Performance Cookies: These cookies help us collect anonymous, aggregated usage data about how visitors interact with our website pages, including which pet product categories are most frequently viewed, average time spent on our site, and any error messages users encounter. This data helps us continuously optimize our website performance and improve our product offering for all customers.

When you first land on our website, you will be presented with a clear, easy-to-use cookie consent banner, which allows you to customize your cookie preferences, accept only selected categories of non-necessary cookies, or reject all non-essential cookies. You can adjust and modify your cookie settings at any time at a later date, by accessing the cookie configuration page located on our website footer.

11. Children’s Privacy

Our pet accessories e-commerce website is intended for use by general adult consumers, and we do not knowingly collect or solicit any personal data from children under the age of 16 years old. If we ever become aware that we have accidentally collected personal information from a child under 16 without the verifiable explicit consent of their parent or legal guardian, we will take immediate action to securely erase that personal data completely from all our servers and records. If you believe we may have collected any personal data from a child under 16, please contact us immediately via our listed contact email.

12. Links to Third-Party Websites

Our website may occasionally contain hyperlinks to external third-party websites that are not operated or controlled by CARDUELIS PET SHOP. This includes links to our trusted payment service providers, shipping tracking portals, and other related partner resources. Please note that once you click any of these external links and navigate away from our website, the data processing and privacy practices of those third-party websites are not governed by this Privacy Policy. We hold no responsibility or liability for the content, privacy policies or data protection practices of any external third-party websites. We strongly advise you to review the separate published privacy policy of every website you visit, before you choose to submit any of your personal data to those platforms.

13. Updates to This Privacy Policy

We may periodically revise and update the terms of this Privacy Policy from time to time, to reflect changes to our business operations, new product offerings, updates to applicable EU and Croatian data protection laws, or when required by new guidance issued by relevant data protection supervisory authorities. When we make material significant changes to this policy, we will update the “Effective Date” posted at the top of this document, and we will publish a clear, prominent notification on the homepage of our website www.carduelispetshop.com to inform you of the upcoming changes, a reasonable period of time before the revisions come into force. We encourage you to revisit this Privacy Policy on a regular periodic basis, to stay informed about how we are protecting your personal data.

14. How to Contact Us for Privacy Inquiries

If you have any questions, comments, concerns or requests related to this Privacy Policy, or any aspect of how we process your personal data, please do not hesitate to reach out to our team at any time:

• Send an email to our dedicated privacy team at bramble@carduelispetshop.com
• Call us on our telephone number +385 99 763 0484 during our regular business hours
• Send written postal correspondence to our registered business address: Zagrebačka ulica 228, 35000 Slavonski Brod, Croatia

We will make every effort to respond to your privacy related inquiry as quickly as possible, and resolve any issues you may have in a transparent and fair manner.