This policy explains which personal data we collect when you buy from us, why we process it, who we give it to and what rights you have. Effective from 2 November 2026.
Who processes your data
The controller is Le Diameve d.o.o., Siječanjska 4, 10000 Zagreb, Croatia, OIB 69491787083.
For any questions about data protection, write to info@lediameve.eu or by post to the address above.
Which data we collect
We collect only what we need to make your ring, deliver it and help you afterwards.
| Type of data | What exactly |
| Identity and contact | name and surname, e-mail address, telephone number |
| Addresses | delivery address and billing address |
| Customer account | sign-in e-mail address and the order history linked to the account |
| Order | the selected product and its configuration, ring size, engraving text, amount, date, order number |
| Payment | payment method, payment status and the last four digits of the card. We do not see or store the full card number. |
| Correspondence | messages you send us and our replies, including defect claims, complaints and return requests |
| Technical data | IP address, device and browser type, pages you visited and data from cookies |
| Advertising-pixel data (only with your consent to marketing cookies) | the pages and products you viewed, actions in the store (adding to the cart, starting checkout, a purchase with its amount and currency), an identifier from a cookie, a click identifier if you came via one of our ads, IP address and browser and device data. The pixels do not transmit your name, e-mail address, address or telephone number. |
| Social networks | your profile name and the content of messages and comments you send us on Instagram or Facebook |
As a rule we obtain the data directly from you. The exception is data about another person that you provide to us yourself — a name and a date in the engraving, or the recipient's address when you are sending the ring as a gift. We also receive data from the payment service providers: the payment status and the payment method used. Technical data is collected automatically by our platform when you visit the store. Advertising-pixel data is collected only if you accept marketing cookies in the cookie notice; without that consent the pixels do not load.
Engraving text. If you enter someone else's name or a date in the engraving, that too is personal data. We process it solely to make the ring and do not use it for anything else.
If you have given us another person's data (the engraving or the recipient's address), as a rule we do not inform that person directly, because we do not have their contact details and because doing so would involve a disproportionate effort (Article 14(5)(b) GDPR); we use the data solely to make and deliver the ring, we keep it with the order for the periods set out in the “How long we keep the data” section, and on request we provide that person with all the information in this policy.
Why we process it and on what basis
| Purpose | Data | Legal basis | How long we keep it |
| Concluding and performing the contract: order, production, delivery, payment | identity, contact, addresses, order, payment | performance of the contract | for the duration of the contractual relationship and until our liability for lack of conformity and the limitation periods have expired |
| Withdrawal from the contract, returns and refunds | identity, contact, order, payment | performance of the contract and legal obligation | as above |
| Defect claims and the legal guarantee | identity, contact, order, correspondence | legal obligation | at least until the two-year liability period expires |
| Consumer complaints | identity, contact, content of the complaint | legal obligation | one year from receipt of the complaint |
| Issuing and keeping invoices, tax and accounting obligations (including fiscalisation — we submit invoice data in real time to the Croatian Tax Administration (Porezna uprava)) | identity, address, invoice data | legal obligation | 11 years, under the accounting regulations |
| Maintaining the customer account | sign-in e-mail address, order history linked to the account | performance of the contract (at your request) | until you close the account; order and invoice data according to the other periods in this table |
| Answering your enquiries | contact, correspondence | legitimate interest | 2 years from the last message |
| Store security and fraud prevention | technical data, payment data | legitimate interest | 12 months |
| Establishing and defending legal claims, including out-of-court dispute resolution | all relevant data | legitimate interest | until the limitation period expires |
| Analytics cookies: understanding how the store is used and improving it | technical data | your consent (Article 6(1)(a) GDPR; for storing and reading data on your device, Article 43(4) of the Croatian Electronic Communications Act (Zakon o elektroničkim komunikacijama)) | according to the Cookie Policy |
| Marketing cookies and advertising pixels: finding out which of our ads or links led to a visit or a purchase, and showing you our ads, based on your visit to the store, on the services of Meta and Google and on the websites and apps of those platforms' partners (retargeting) | technical data, advertising-pixel data | your consent, separate from your consent to analytics cookies (legal basis as in the row above) | cookies according to the Cookie Policy; we keep visitors in retargeting audiences for at most 30 days from the visit; the platforms keep the data under their own privacy policies, and we receive from them only aggregated reports that do not identify you |
| Presence on social networks: presenting the store, answering your messages and comments, and aggregated statistics on our profiles | profile name, content of messages and comments; we receive statistics only in aggregated form | legitimate interest: presenting our store and communicating with you where you contact us | messages and comments for as long as the platform keeps them or until you or we delete them; our notes on an enquiry 2 years from the last message |
| Recording your cookie choice: respecting it and being able to show under which notice it was made | your cookie choice with its date and time, the version of the cookie notice it was made under and the pseudonymous consent identifier of our platform Shopify; if you are signed in, also your customer account | legal obligation (Article 6(1)(c) in conjunction with Article 7(1) GDPR: we must be able to show that consent was given) | Shopify's record of your choice for as long as that choice is valid (1 year); the entry ld_consent_v as stated in the Cookie Policy; our monthly exports of the consent log 3 years |
Providing the data is not a legal obligation, but without identity, contact and address details we cannot conclude or perform the contract.
Who we give your data to
We do not sell personal data. We give it only to the recipients listed in this table, in the role stated next to each and only to the extent they need.
| Recipient | Role | What it receives | Where |
| Shopify | processor — web store platform | all order data and technical data | European Union, Canada, United States and Singapore |
| Shopify (Shop Pay and Shop) | independent controller — Shop Pay one-click checkout and the Shop ecosystem | Shop Pay account data and the checkout and order data of customers who pay via Shop Pay; when our pages load, also technical data (IP address and browser data) and, if the browser allows third-party cookies, the cookie _shop_app_essential (see the Cookie Policy) | European Union, Canada, United States and Singapore |
| Shopify Payments | processor — payment processing | payment data and data needed for fraud prevention | European Union and United States |
| Stripe Payments Europe, Limited (Ireland), which processes payments for Shopify Payments | independent controller where it processes the data for its own purposes, in particular to meet its own legal obligations (for example the prevention of money laundering and fraud); Stripe's privacy policy: stripe.com/privacy | payment data and data needed for fraud prevention | European Union (Stripe describes any transfers outside the European Economic Area in its own privacy policy) |
| Bancontact, together with your bank (only if you pay with Bancontact) | independent controllers — carrying out the Bancontact payment, under their own terms and privacy notices | the payment details you enter on the Bancontact page or in the app of Bancontact or of your bank, the amount and the payment reference | European Union |
| Delivery (courier) services | independent controller — delivery | name, address, telephone and e-mail address for shipment notifications; the specific service for your shipment is stated in the dispatch notification | European Union |
| External goldsmith atelier (ring production) | processor — ring production | the ring's 3D model and, where ordered, the engraving text. Without your name, address or contact details. | Croatia |
| External accounting service | processor — accounting | invoices showing the ring and the price. Without your name, address or contact details. | Croatia |
| Microsoft (Microsoft 365) | processor — e-mail on the lediameve.eu domain | content of correspondence with customers (orders, invoices, returns, defect claims, complaints, data-related requests) | European Union and United States |
| Easify (product options app) | processor — product option configurator on the product page | the product options selected and the technical data needed for the configurator to work | European Union |
| Revoq (EU withdrawal button app) | processor — electronic function for withdrawing from the contract (the withdrawal form and the confirmation of receipt) | name, e-mail address, order number, the items you select and the date and time of your statement | European Union (Germany, the Netherlands and Ireland) |
| Meta Platforms Ireland Limited (Facebook, Instagram) | joint controller with us for collecting data with the Meta pixel in our store and transmitting it to Meta; processor when it prepares ad performance reports for us; independent controller for its other further processing, including showing ads | advertising-pixel data, only with your consent to marketing cookies | European Union and United States |
| Google Ireland Limited (Google Ads) | joint controller with us for collecting data with the Google tag (pixel) in our store and transmitting it to Google (Google regards itself as an independent controller for this too; see below the table); independent controller for its further processing, including conversion measurement and retargeting | advertising-pixel data, only with your consent to marketing cookies | European Union and United States |
| Lawyer or other professional | independent controller | only the data necessary for the specific matter | Croatia |
| Centar za mirenje pri Hrvatskoj gospodarskoj komori (Mediation Centre at the Croatian Chamber of Economy), the body for alternative resolution of consumer disputes (Terms and Conditions, section 18), and the mediator who conducts the proceedings | independent controller | only the data needed for proceedings brought before it (identity, contact and order data, and the correspondence about the dispute) | Croatia |
| Competent authorities | recipient under a legal obligation | only what the law requires | Croatia |
With every processor we have a contract obliging it to process the data exclusively on our instructions and to protect it. Delivery services and the payment service providers (Stripe Payments Europe, Limited, which processes payments for Shopify Payments; and Bancontact, if you pay with it, together with your bank) process data for their own services as independent controllers, under their own legal obligations.
If there is a change of status (a merger, a sale of the business or insolvency), the data may pass to a legal successor, who may process it only in accordance with this policy.
For the services in which it acts as an independent controller (Shop Pay and the Shop ecosystem), Shopify has its own privacy policy at shopify.com/legal/privacy/app-users, and you can also exercise your rights in relation to Shopify directly at privacy.shopify.com.
For collecting data with advertising pixels in our store and transmitting it to a platform, we are responsible together with that platform (judgment of the Court of Justice of the European Union in Case C-40/17, Fashion ID): we are responsible for ensuring that the pixel loads only after your consent and for informing you about it in this policy, and the platform for what it does with the data after the transmission. You can exercise your rights with us or directly with the platform; if you send us a request that concerns the platform, we will forward it to the platform.
With Meta, this allocation is laid down in Meta's Controller Addendum (facebook.com/legal/controller_addendum). Google has not concluded such an arrangement with us: under its terms it regards itself as an independent controller of the data it receives through the Google tag. We nevertheless treat the collection and transmission as joint and fulfil the duties described above ourselves. You can send a request concerning Google to Google (its privacy contact form is linked from policies.google.com/privacy) or to us, and we will forward it to Google.
The data the platforms receive, and everything you do on them, are governed by their privacy policies: Meta at facebook.com/privacy/policy; Google at policies.google.com/privacy. The platforms may use cookies and similar technologies to collect or receive data from our store and elsewhere on the internet and use it to measure and target ads; you can object to the use of the data for ad targeting in each platform's ad settings (Meta: facebook.com/adpreferences; Google: myadcenter.google.com, and how Google uses data from sites that use its services: policies.google.com/technologies/partner-sites) and, for participating companies, at youronlinechoices.eu.
E-mail news
We do not currently send e-mail news, and we do not collect consent to receive it: no form on our website, no checkbox at checkout and nothing in the customer account signs you up for news. Before we start sending e-mail news, we will update this policy and ask for your consent separately.
Social networks
We are present on Instagram and Facebook (Meta Platforms Ireland Limited). When you visit our profile or send us a message or a comment, the platform also processes your data, under its own privacy policy.
For the statistics on our Facebook page (Page Insights), we and Meta are joint controllers (judgment of the Court of Justice of the European Union in Case C-210/16, Wirtschaftsakademie); the obligations are allocated by Meta's Page Insights Controller Addendum (facebook.com/legal/terms/page_controller_addendum), under which Meta has primary responsibility for this processing. We receive the statistics on our profiles only in aggregated form, without data on individual persons.
We read messages in other languages with the translation the platform itself offers. When we write a reply in your language, we enter into the translation tool only the text of our reply, without your name, order number or other data about you.
Please do not send us order or payment details in a social-network message; send them by e-mail to info@lediameve.eu.
Transfers outside the European Economic Area
Shopify, our platform, also processes data outside the European Economic Area, in particular in Canada, the United States and Singapore. Canada has a European Commission adequacy decision. Transfers within the Shopify group are based on Binding Corporate Rules which, following an opinion of the European Data Protection Board, were approved by the European supervisory authorities; for onward transfers to sub-processors Shopify applies the European Commission's standard contractual clauses. Shopify Payments is part of the Shopify group, so the same mechanisms apply to payment processing. Our e-mail service provider Microsoft (Microsoft 365) may also process correspondence in the United States; Microsoft is certified under the EU–US Data Privacy Framework and additionally applies the European Commission's standard contractual clauses.
Meta Platforms Ireland may transfer the pixel data to Meta Platforms, Inc. in the United States, which is certified under the EU–US Data Privacy Framework. Google Ireland may transfer the data to Google LLC in the United States, which is certified under the EU–US Data Privacy Framework. These transfers take place only if you have accepted marketing cookies.
The United States and Singapore have no general European Commission adequacy decision, so transfers to those countries rely on the mechanisms set out above. The text of Shopify's Binding Corporate Rules is published at shopify.com/legal/binding-corporate-rules. You can request a copy of the safeguards applied at info@lediameve.eu.
How long we keep the data
The periods are listed in the table above. When a period expires, we delete the data or irreversibly anonymise it.
We keep invoice data longer than the rest because tax and accounting regulations require us to. This applies even when you request deletion.
Your rights
At any time you have the right to:
• request access to your data and a copy of what we hold about you
• request rectification of inaccurate data or completion of incomplete data
• request erasure, where we have no basis for keeping the data any longer
• request restriction of processing, while we verify your objection or the accuracy of the data
• request portability — that we provide the data you gave us in a machine-readable format or send it to someone else
• object to processing that we base on legitimate interest
• withdraw consent for cookies, at any time and as easily as you gave it, via the “Cookie Settings” link in the footer. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• object to direct marketing, at any time and without giving reasons; after an objection we no longer process your data for that purpose. For ads based on your visit to the store, use the “Cookie Settings” link in the footer: we cannot link a request sent by e-mail to your browser.
Before acting on a request, we may ask for the information we need to confirm your identity, so that data is not disclosed to an unauthorised person. Send your request to info@lediameve.eu. We reply without delay, and at the latest within one month. If the request is complex, we may extend the period by a further two months and will inform you of this.
The procedure is free of charge. We may charge a fee only if a request is manifestly unfounded or repeated without reason.
Complaint to the supervisory authority
If you believe we process your data contrary to the regulations, you can lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka):
Agencija za zaštitu osobnih podataka, Ulica Metela Ožegovića 16, 10000 Zagreb · azop@azop.hr · +385 1 4609-000 · azop.hr
If you live in another European Union member state, you can also lodge a complaint with the supervisory authority of that state.
Security
The store runs over an encrypted connection. You enter card details directly with the payment service provider, and the payment details for Bancontact (such as your Bancontact card number) on the Bancontact page or in the app of Bancontact or of your bank — those details do not reach us and we have no access to them. Only people who need it for their work have access to order data.
Automated decision-making
We do not make decisions based solely on automated processing that would have legal effects on you. The payment service provider automatically calculates fraud-risk indicators, but the decision to decline or cancel an order is always taken by a person. If you accept marketing cookies, the advertising platforms listed in the table of recipients may show you our ads based on what you viewed in the store (retargeting). This is profiling without legal or similarly significant effects on you. By withdrawing your consent via the “Cookie Settings” link you stop further collection; the platforms keep or delete the data collected until then under their own rules. We do not send the platforms customer lists or your name, e-mail address, address or telephone number, and we do not build audiences from customer data.
Children
The store is not intended for persons under 18 and we do not knowingly collect their data. If we learn that we have collected such data, we delete it.
Changes to this policy
We may change this policy. The new version applies from the day it is published, and the effective date is stated at the top of the page. If a change materially alters how we process your data, we will inform you before it takes effect.
Contact
info@lediameve.eu · +385 97 613 0902
Le Diameve d.o.o., Siječanjska 4, 10000 Zagreb, Croatia
