Privacy policy
Privacy Policy
Last updated: 29 October 2026
This policy explains what personal data we collect when you visit shop.tlos.hr, buy from us or contact us, why we collect it, who we share it with and what your rights are. We process personal data in accordance with the General Data Protection Regulation (GDPR) and Croatian law.
1. Who processes your data
Controller: Tlos laboratorijsko staklo d.o.o. Petra Svačića 10, 10450 Donja Zdenčina, Croatia Company ID (OIB): 31421355633 Email: shop@tlos.hr
For any questions about your data, email us at shop@tlos.hr.
2. What data we collect
- Order data: name, shipping and billing address, email, phone number, ordered products, amount, payment method and the selected GLS parcel locker.
- Payment data: card details are processed by the payment provider. We do not see or store them. We only receive confirmation that the payment was successful.
- Customer account: if you create one, your email and order history.
- Communication with us: the content of emails and contact form messages.
- Newsletter: your email address, if you sign up.
- Website usage data: IP address, device and browser type, pages viewed and products in your cart. This is collected with cookies, as described in section 6.
3. Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Processing orders, payment, delivery, returns and complaints | performance of a contract |
| Issuing invoices and keeping accounting records | legal obligation |
| Answering your questions | performance of a contract or our legitimate interest in replying to you |
| Sending the newsletter | your consent, which you can withdraw at any time |
| Visitor analytics and advertising (Shopify analytics, Meta Pixel) | your consent, given through the cookie notice |
| Website security and fraud prevention | our legitimate interest |
Order data is required to conclude and perform the contract. Without it, we cannot ship your parcel.
We do not make decisions about you based solely on automated processing. Shopify automatically screens orders for fraud, but we decide on every order ourselves.
4. Who we share data with
We share data only with those who help us run the shop, and only to the extent they need it:
- Shopify: the platform the online shop runs on.
- Payment providers: Shopify Payments and PayPal.
- GLS: name, address, phone and email to deliver your parcel.
- PeakShip: the app we use to create GLS shipments and select parcel lockers.
- Meta (Facebook and Instagram): website usage data to measure and show ads, only if you have consented.
- Competent authorities, when required by law.
We do not sell your data.
5. Transfers outside the European Union
Some of these providers (for example Shopify and Meta) also process data outside the EU, in Canada or the United States. Such transfers use the mechanisms required by the GDPR: a European Commission adequacy decision (for Canada and for companies certified under the EU-US Data Privacy Framework) or standard contractual clauses.
6. Cookies
Cookies are small files that a website stores in your browser.
- Necessary cookies make the cart and checkout work. They do not require your consent.
- Analytics and marketing cookies (Shopify analytics and Meta Pixel) are set only if you accept them in the cookie notice on your first visit.
You can change your consent at any time using the cookie settings link at the bottom of the page, or by deleting cookies in your browser. The list of cookies used by Shopify is available at https://www.shopify.com/legal/cookies
7. How long we keep data
- Orders and invoices: 11 years, as required by Croatian accounting law.
- Customer account: until you delete it or ask us to delete it.
- Newsletter: until you unsubscribe.
- Enquiries and correspondence: two years from the last contact, unless they relate to an order or complaint.
- Cookies: for the duration of each cookie, as listed by Shopify.
8. Your rights
You have the right to:
- request access to your data and a copy of it;
- request correction of inaccurate data;
- request deletion of your data, except data we must keep by law;
- request restriction of processing;
- request transfer of your data to another controller;
- object to processing based on legitimate interest and to direct marketing;
- withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
Send your request to shop@tlos.hr. We will reply within one month at the latest. Before replying, we may ask you to confirm your identity.
If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr, or with the data protection authority in your EU country.
9. Children
The online shop is not intended for anyone under 16. We do not knowingly collect their data. If we learn that we have, we will delete it.
10. Security
The website uses an encrypted connection (HTTPS). Payments are processed by providers that meet the security standard for card payments (PCI DSS). Only staff who need order data for their work have access to it.
11. Changes to this policy
We may change this policy. We will publish the new version on this page with a new "last updated" date.