Lili Mala Farma

Privacy Policy

Draft for legal review

This page is a draft prepared for the owner's review and legal check. It is not legal advice. Details in square brackets are placeholders to be completed before publication.

Controller

[Legal name and legal form]

Trading as Lili Mala Farma

OIB: [OIB]

[Registered address]

Email: lili@lilimalafarma.hr

Phone: +385 91 4646442

This policy explains which personal data Lili Mala Farma collects when you use lilimalafarma.hr, create an account, sign in with Google, place an order, start a subscription or contact us, why we use it, who receives it, and what rights you have under the General Data Protection Regulation (GDPR).

1. Who we are

The controller of your personal data is the business listed above, trading as Lili Mala Farma, a microgreens farm in Zagreb, Croatia.

For any question about your personal data, or to exercise your rights, write to lili@lilimalafarma.hr or call +385 91 4646442 (Monday to Friday, 08:00 to 16:00).

2. What data we collect

  • Account data: your name and email address, and your password if you register with one. Passwords are stored only as a one-way (bcrypt) hash, never in readable form.
  • Google sign-in data: if you sign in with Google, your name, email address, profile picture and Google account identifier (see section 4).
  • Order data: the products, quantities and prices you ordered, your choice of delivery or pickup, your delivery address (street, city, postal code), phone number, any order notes, and the order status.
  • Subscription data: the products you chose, delivery frequency and day, payment plan (monthly or yearly), delivery address or pickup location, phone number, start date, minimum-term end date, status and, if the subscription is cancelled, when it was cancelled.
  • Delivery records: when each delivery was made and which member of our team recorded it, with any delivery note.
  • Payment data: payments are made on Stripe's secure payment page. Stripe collects your card details and billing address; we never see or store your card number. We receive and keep your name, email address, phone number and Stripe's reference numbers for the payment, customer and subscription.
  • Contact form data: your name, email address and message.
  • Basket data: the products in your basket, linked to your account or, if you are not signed in, to an anonymous basket identifier stored in a cookie.
  • Cookie consent records: if you accept analytics, a random consent identifier, your choice, the policy version, the time and your browser's user-agent string, as evidence of your consent. If you reject, no such record is stored.
  • Technical data: like any website, our servers process your IP address and the details of each request in order to deliver the pages to you.

3. Why we use your data and on what legal basis

  • To create and run your account and sign you in, with a password or with Google: performance of a contract (Article 6(1)(b) GDPR).
  • To take, prepare and deliver your orders and subscriptions, and to send order, subscription, cancellation and delivery confirmation emails: performance of a contract (Article 6(1)(b)).
  • To take payment and, for monthly subscriptions, recurring payment through Stripe: performance of a contract (Article 6(1)(b)).
  • To keep order and payment records as required by accounting and tax law: legal obligation (Article 6(1)(c)).
  • To answer messages you send through the contact form: our legitimate interest in responding to enquiries (Article 6(1)(f)), or steps you ask us to take before entering into a contract (Article 6(1)(b)).
  • To keep the website and the sign-in process secure: our legitimate interest (Article 6(1)(f)).
  • To run cookieless, aggregated analytics and to remember your basket between visits: your consent (Article 6(1)(a)), which you can withdraw at any time in the cookie settings.

We do not send marketing emails, we do not sell your data, and we do not use it for automated decision-making or profiling.

4. Sign in with Google

If you choose to sign in with Google, we request only basic profile access (the OpenID Connect scopes openid, email and profile). Google then shares your name, email address, profile picture and Google account identifier with us.

We use this data only to create your Lili Mala Farma account, sign you in, and link your orders and subscriptions to your account. If an account with the same email address already exists, signing in with Google links Google sign-in to that account.

Our sign-in software stores the sign-in tokens Google issues together with your account. We do not use them to access any other Google service or data. We do not share Google user data with third parties, sell it, or use it for advertising.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove our access at any time in your Google Account settings, and you can ask us to delete your account.

5. Who receives your data

  • Stripe (Stripe Payments Europe, Ltd., Ireland): card payments and monthly subscription billing. Stripe also processes payment data under its own privacy policy, for example to prevent fraud.
  • Resend: sends our transactional emails (order, subscription, cancellation and delivery confirmations) and forwards contact form messages to our inbox. Your name, email address and the content of these emails pass through Resend.
  • Google (Google Ireland Limited): only if you choose to sign in with Google.
  • Hosting: the website and its database run on servers operated by [hosting provider and server location].
  • Our delivery team, who see the name, delivery address, phone number and items of the orders they deliver.
  • Public authorities, where the law requires us to disclose data.

If you consent to analytics, they run on a self-hosted Umami instance and are not shared with a third-party analytics company.

6. Transfers outside the European Economic Area

Some of these providers (Resend, and for some processing Stripe and Google) are based in, or may transfer data to, the United States. Such transfers rely on the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses.

7. How long we keep your data

  • Account data: for as long as your account exists. When you ask us to delete your account, we delete it, except for the order and payment records we must keep by law.
  • Order, payment and subscription records: for as long as accounting and tax law requires, which in Croatia is generally 11 years.
  • Contact form messages: for as long as needed to handle your enquiry and any follow-up.
  • Basket: items in a basket are cleared after 12 hours.
  • Cookie consent records: for as long as we need to be able to show that you gave consent.
  • Cookies: as listed in our Cookie Policy.

8. Your rights

  • Access: you can ask which personal data we hold about you and receive a copy (Article 15 GDPR).
  • Rectification: you can ask us to correct inaccurate data (Article 16).
  • Erasure: you can ask us to delete your data, including your account (Article 17).
  • Restriction: you can ask us to restrict processing in certain cases (Article 18).
  • Portability: you can ask for the data you gave us in a structured, machine-readable format (Article 20).
  • Objection: you can object to processing based on our legitimate interest (Article 21).
  • Withdrawing consent: you can withdraw your analytics consent at any time in the cookie settings; this does not affect processing before the withdrawal.

To exercise any of these rights, write to lili@lilimalafarma.hr. We will reply within one month and may ask you to confirm your identity first.

You also have the right to lodge a complaint with the Croatian supervisory authority: Agencija za zaštitu osobnih podataka (AZOP, Croatian Personal Data Protection Agency), Selska cesta 136, 10000 Zagreb.

9. Do you have to give us your data?

You do not have to, but without a name and email address we cannot create an account or send confirmations, and without a delivery address and phone number we cannot deliver your order. Consent to analytics is optional and has no effect on what you can buy.

10. Security

The website is served only over an encrypted (HTTPS) connection, passwords are stored only as one-way hashes, and card data is handled by Stripe and never reaches our servers.

11. Children

Our shop is not aimed at children under 16, and we do not knowingly collect their personal data.

12. Cookies

We use strictly necessary cookies to keep you signed in and to remember your basket, and, only with your consent, cookieless analytics. The details are in our Cookie Policy.

13. Changes to this policy

We will update this policy when the way we process personal data changes. The version below shows which version is in force.

Policy version: 1.0