Privacy Policy

This website is operated by the official Croatian distributor of Dok Bua Ku / Twinlotus oral care products and data controller, Balti Savjetovanje d.o.o., Lopašićeva 6, 10000 Zagreb, Croatia. The OIB and court-register details will be published before online sales open. For any privacy matter, use the contact form at https://twinlotus.hr/en/contact.

We collect only the data you give us and the minimum needed to run the site:

• Enquiry and pre-order form: name, email address, phone number (optional), the product you ask about, and your message.
• Orders (once the web shop is live): name, email, phone, delivery address, the items you order, and payment status. Card details are processed by our payment provider (Revolut) and never reach our servers.
• Technical data: basic server logs (IP address, browser type, pages visited) kept for security and troubleshooting.

• To answer your enquiries and process pre-orders: performance of a contract or steps prior to one (Art. 6(1)(b) GDPR).
• To fulfil and deliver orders and handle complaints: Art. 6(1)(b) GDPR.
• To meet legal obligations such as accounting and tax rules: Art. 6(1)(c) GDPR.
• To send newsletters or marketing: only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Data is stored in the European Union (our database and file storage run in an EU data centre in Frankfurt, Germany). Enquiries are kept for up to 2 years after our last contact. Order and invoice data is kept as long as Croatian accounting and tax law requires. Server logs are kept briefly and rotated automatically.

We never sell your data. We share it only with service providers needed to run the shop: website hosting (Vercel), database and storage (Supabase), payment processing (Revolut), email delivery, and the courier that delivers your order: and with authorities where the law requires it.

Under the GDPR you can ask us at any time for access to your data, correction, deletion, restriction of processing, data portability, or object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time.

To exercise any right, send a written request through https://twinlotus.hr/en/contact. You also have the right to complain to the Croatian Personal Data Protection Agency (AZOP, www.azop.hr).

Necessary cookies support language preferences and administrator sign-in. Your cookie choice is saved in this browser. Google Tag Manager loads Google Analytics and Microsoft Clarity only if you choose Accept all. Choose Cookie settings and Only necessary at any time to withdraw consent; the page reloads to stop the loaded analytics tools. No advertising tags are installed.

With your consent, Google Analytics measures page visits, product views, language changes, contact actions and successful enquiry submissions. When checkout is available, it measures checkout activity and verified purchases. Microsoft Clarity provides heatmaps and session recordings to help us find usability problems. Form data is masked. Administrator routes and order confirmation pages are excluded from recordings.

These tools do not load before consent or when you choose Only necessary. We do not send names, email addresses, phone numbers, delivery addresses or messages in analytics events. Google Analytics does not receive URL query parameters. Google and Microsoft process technical browser and usage data and may process data outside the European Economic Area under their privacy policies and applicable safeguards.

Consent is voluntary and is not required to send an enquiry or make a purchase. Choose Cookie settings, then Only necessary, to withdraw it. This clears accessible analytics cookies for this site and reloads the page. It does not automatically erase previously collected data; contact us through the contact page for requests about your data.

Provider policies: https://policies.google.com/privacy and https://privacy.microsoft.com/privacystatement. Google Analytics may use _ga and _ga_* cookies for up to two years. Clarity may use _clck for up to one year and _clsk for up to one day. Actual duration depends on provider and browser settings.