Privacy policy

1. Data Controller

The controller of personal data collected through the TULIP STUDIO website and online store is:

TULIP STUDIO.CO, trade business for retail, floristry and other services, owned by Lana Bašić
Prilaz Gjure Deželića 8
10 000 Zagreb, Croatia
OIB: 29051024620
MBO: 98551175
Email: info@tulipstudio.hr
Phone: +385 91 7640 525

For any questions regarding the processing of personal data or the exercise of your rights, you may contact us using the email address above.

2. Personal Data We Collect

Depending on how you use our website and online store, we may collect the following data:

- first and last name
- delivery and/or billing address
- email address
- phone number
- order and purchased product information
- recipient information provided by the customer
- greeting card message or other information you voluntarily enter when placing an order
- information you send through contact forms
- information related to communication with us
- technical information related to website use, such as IP address, device and browser type, and information associated with cookies and similar technologies.

We do not collect or store full payment card details. Card and other electronic payments are processed by the relevant payment service providers.

3. Purposes and Legal Bases for Processing

We process personal data only where there is an appropriate legal basis.

Order processing and fulfilment
We use personal data to process orders and payments, prepare products, arrange delivery or store pickup, communicate about orders, and handle complaints.

The legal basis is the performance of a contract or taking steps at your request before entering into a contract.

Compliance with legal obligations
Certain data must be retained in order to comply with tax, accounting, fiscal and other legal obligations.

The legal basis is compliance with a legal obligation to which the controller is subject.

Responding to enquiries and communications
If you contact us through a contact form, email, telephone or another channel, we use your data to respond to your enquiry and continue communication with you.

The legal basis may be taking steps at your request before entering into a contract or our legitimate interest in responding to enquiries from users and customers.

Protection of our rights and store security
We may process certain data to prevent fraud, misuse and security incidents, and to establish, exercise or defend legal claims.

The legal basis is our legitimate interest in operating securely and protecting our rights.

Marketing
If you voluntarily subscribe to receive marketing communications, we will use your data for that purpose based on your consent. You may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Orders Through the Online Store

When placing an order, we may process information about the customer and recipient, delivery address, contact details, order contents, selected delivery or pickup method, and other information required to fulfil the order.

If you order a product for another person, you are responsible for the accuracy of the recipient information you provide and for having an appropriate basis for providing it.

We use this information only to the extent necessary to fulfil the order, communicate with you, arrange delivery, issue invoices and comply with legal obligations.

5. Contact Forms

If you send us an enquiry through a contact form, we process the information you enter into the form.

This information is primarily used to respond to your enquiry, prepare an offer or continue communication.

Information from ordinary enquiries is generally retained until the communication is concluded and thereafter only for as long as reasonably necessary for record-keeping or the protection of possible legal claims.

Please do not send sensitive personal data through contact forms unless it is necessary for your enquiry.

6. Payments

Payments through the online store are processed by the payment service providers available at the time of purchase.

TULIP STUDIO does not receive or store full payment card numbers, card security codes or other information processed directly by the payment service provider for payment authorisation.

Individual payment service providers may independently process certain personal data in accordance with their own privacy policies.

7. Delivery

If you choose delivery, we may provide the information required to carry out the delivery to the person or service provider responsible for delivery.

This may include:

- recipient's first and last name
- delivery address
- phone number
- special instructions required for delivery.

This information is used solely for the purpose of carrying out the delivery and related communication.

8. Shopify and Other Service Providers

Our online store uses the Shopify platform.

For the operation of the store, Shopify and its authorised subprocessors may process customers' personal data on our behalf to the extent necessary to provide technical, hosting, security, transactional and other related services.

We may also share data with other service providers that are necessary for our business operations, for example:

- payment service providers
- delivery service providers
- accounting and tax advisers
- IT and hosting service providers
- email and communication service providers
- apps and integrations used in our Shopify store.

We provide such recipients only with the information necessary for them to provide their services.

9. Transfers Outside the European Economic Area

Some of our service providers or their subprocessors may process personal data outside the European Economic Area.

Where personal data is transferred to countries for which the European Commission has not adopted an adequacy decision, the transfer is carried out using appropriate safeguards provided for under applicable data protection laws.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Essential cookies are required for the basic operation of the online store, including security, cart functionality, remembering certain settings and completing purchases. Consent is not required for cookies that are strictly necessary to provide the service.

If we use analytics, functional or marketing cookies that are not strictly necessary, they are activated in accordance with your choices and, where required, only after your consent has been obtained.

You can change your choices through the privacy or cookie settings tool available on the website.

The types of cookies actually used may change depending on the features, Shopify apps and other services currently active on the online store.

11. How Long We Keep Personal Data

We keep personal data only for as long as necessary for the purpose for which it was collected.

Information related to orders, invoices and business records is retained for the periods required by applicable tax, accounting, fiscal and other laws.

Information required for handling complaints, disputes or protecting legal claims may be retained for as long as such claims may arise or be pursued.

Data processed on the basis of consent is retained until consent is withdrawn or the purpose of processing ceases to apply, unless there is another legal basis for continued retention.

When data is no longer required, it is deleted, anonymised or otherwise made no longer identifiable, unless there is a legal obligation to retain it.

12. Your Rights

Under applicable data protection laws, and where the legal conditions are met, you may exercise:

- the right of access to your personal data
- the right to rectification of inaccurate or incomplete data
- the right to erasure of personal data
- the right to restriction of processing
- the right to data portability
- the right to object to processing
- the right to withdraw consent at any time where processing is based on consent
- the right not to be subject to a decision based solely on automated processing, where such right applies.

To exercise your rights, you may contact us at:

info@tulipstudio.hr

Before acting on a request, we may ask for additional information necessary to verify the identity of the person making the request.

13. Right to Lodge a Complaint

If you believe that your personal data is being processed in violation of applicable rules, you have the right to lodge a complaint with the competent supervisory authority:

Croatian Personal Data Protection Agency – AZOP
Ulica Metela Ožegovića 16
10 000 Zagreb
Croatia
Email: azop@azop.hr
www.azop.hr

14. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or unauthorised disclosure.

Access to personal data is limited to persons and service providers who need the data to perform their work.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, the functionality of our online store or applicable laws.

The current version will always be available on this website.

Last updated: September 2026.