Privacy & Cookies

1. Who controls your data

The controller is Storyboard d.o.o., Vladimira Nazora 22, 10432 Bregana, Croatia, MBS 080654530, OIB 25708336932. For privacy requests, email legal@crownofadam.com.

2. Data we use and why

Providing order and delivery information is necessary to complete your purchase. If you do not provide it, we cannot process or deliver the order. We do not use your data for solely automated decisions that produce legal or similarly significant effects.

Marketing emails and consent

Crown of Adam is operated by Storyboard d.o.o.. If you choose to join our newsletter, we use your email address to send product and new-drop updates, discount codes and early access offers. The checkbox starts unchecked and subscribing is optional. Buying a product, sending a contact message, accepting the Terms, or consenting to cookies does not subscribe you to marketing emails.

We record the email address, server-recorded UTC signup time, the form used, your affirmative checkbox-and-submit action, the exact consent wording and its version, and the Privacy Notice version shown with the form. Earlier records retain their original evidence; information that was not recorded at the time is not invented. Our current website signup uses a single opt-in: we record the submitted choice but do not claim to have independently verified ownership of the address through a confirmation email.

You can withdraw consent free of charge using the unsubscribe link in a marketing email, our website unsubscribe form, or by emailing legal@crownofadam.com. No account or login is required. Withdrawal stops future marketing and does not affect processing that was lawful before withdrawal. Essential order, delivery, refund and customer-service messages may still be sent where necessary.

We record when consent is withdrawn and exclude that address from the active mailing list. A limited suppression record prevents accidental re-import or re-enrolment; please contact us if you want to rejoin after unsubscribing. Marketing consent is not used to authorise unrelated purposes or to waive your rights.

Newsletter consent records are held in private server storage hosted by Plus Hosting in Croatia. Our hosted business mailbox also receives internal signup and unsubscribe notifications. We use Resend, operated by Plus Five Five, Inc. in the United States, to deliver campaigns. Resend receives the recipient email address, message content and delivery information such as delivery status, bounces, complaints and unsubscribe events. We do not intentionally enable Resend's optional per-recipient open or click tracking.

Each marketing email must identify Crown of Adam / Storyboard d.o.o. and provide a working unsubscribe option and contact address. An unsubscribe recorded by the website or Resend must be synchronised before another campaign is sent.

3. Payments and delivery providers

Stripe. Checkout and card processing are provided by Stripe. You enter payment details on Stripe's hosted page; we receive confirmation, identifiers and limited payment details rather than your full card number. Stripe processes data under its own privacy policy.

Delivery. We share the information needed to deliver your parcel with Hrvatska pošta for standard delivery or, if you choose a Croatian locker, with BOX NOW. This can include your name, phone, email, address or chosen locker, parcel details and delivery status. BOX NOW describes its processing in its personal data notice.

4. Other recipients

Plus Hosting Grupa d.o.o. (Plus Hosting), Croatia, provides the website hosting, private server storage and business email accounts. See Plus Hosting's privacy policy.

Plus Five Five, Inc. (Resend), United States, processes campaign recipient addresses, message content and delivery metadata as our email-delivery processor. See Resend's privacy policy, Data Processing Addendum and subprocessor list.

We may also use IT-security and professional-service providers acting under appropriate obligations. Fonts are served directly by this website, without requests to Google Fonts. Google receives minimised analytics data only after analytics consent; see Google's privacy policy. Meta Pixel is disabled and the website does not send browsing, product or purchase events to Meta. We may disclose information where required by law, to regulators or authorities, or to establish, exercise or defend legal claims. We do not sell personal data.

5. International transfers

Website and mailbox data held by Plus Hosting is hosted in Croatia under the selected hosting arrangement. Resend, Stripe and Google operate internationally. Resend's current Data Processing Addendum incorporates the European Commission Standard Contractual Clauses for transfers outside the EEA and also states participation in the EU–US Data Privacy Framework. Other transfers must likewise use an applicable adequacy decision or Standard Contractual Clauses, with supplementary safeguards where required. Provider policies contain further details.

6. How long we keep data

We keep order, invoice and payment records for the period required by applicable tax, accounting and consumer law. Customer-service and complaint records are kept while needed to resolve the issue and for applicable limitation periods. Security logs are retained for a limited operational period unless needed to investigate abuse. Newsletter consent evidence is kept while a subscription is active and normally for three years after withdrawal to demonstrate how we handled consent, unless a specific legal obligation or dispute justifies longer retention. After that, only the minimum suppression details needed to prevent unwanted marketing are retained. Browser consent evidence is normally retained for three years, with monthly retention maintenance. Browser privacy choices expire after 180 days, when we ask again. Newsletter and security rate-limit entries use one-hour windows and are removed on subsequent activity or scheduled maintenance. We periodically review active mailing lists and remove records that no longer serve the stated purpose. We delete or anonymise data when it is no longer needed, unless the law requires longer retention.

7. Cookies and browser storage

Cookies are small files stored by a browser. This site also uses local storage, which serves a similar purpose. Essential storage works without consent because it is needed for a service you request. Google Analytics remains off until you select it and save, or choose “Accept optional”. “Reject optional” refuses it, and the optional checkbox is not preselected. You can reopen the choice at any time using “Cookie settings” in the footer.

Stripe may set strictly necessary security and fraud-prevention cookies when you move to its hosted checkout. BOX NOW may process technical data when you open its locker selector. Google Analytics loads only after optional consent. We configure its page measurement with a generic storefront URL and title, no page referrer, and advertising signals disabled. The newsletter unsubscribe page loads no analytics scripts. Declining optional analytics does not prevent shopping or newsletter signup.

8. Your rights

Subject to the GDPR and applicable exceptions, you may ask to access, correct, erase or restrict your personal data, receive portable data, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. You have an unconditional right to object to processing for direct marketing. We may request proportionate identity verification where necessary for access, erasure or other requests involving personal information; unsubscribing itself requires no account or login. We normally respond within one month. If a permitted extension is necessary because of complexity or the number of requests, we will explain this within the first month; an extension can be up to two further months.

Contact legal@crownofadam.com. You may also complain to the Croatian Personal Data Protection Agency (AZOP), using its rights-violation procedure, or to the supervisory authority where you live or work.

9. Security, children and changes

We use proportionate technical and organisational safeguards, but no internet transmission is completely risk-free. The store is not directed to children and we do not knowingly seek children's data without the involvement required by law.

We may update this notice when providers, features or legal requirements change. The effective date above identifies the current version. Material changes will be highlighted where appropriate.