Privacy policy

Last updated: 14 October 2026

This policy explains what personal data the BEEA SKIN web store collects, why, and what your rights are. We collect only what we need and we never sell personal data.

1. Who is responsible

The data controller is FENIKS INFO d.o.o. za proizvodnju, trgovinu i usluge (Feniks Info d.o.o.), Slavonska avenija 72, 10000 Zagreb, Croatia, OIB 40111298116. For anything about your data, write to gdpr@feniks-info.hr or by post to the address above, marked "Zaštita podataka".

2. What we collect and why

Orders and your account

Name, delivery and billing address, email, phone, what you ordered, payment status and order history.
Why: to take and deliver your order, invoice it, handle returns, service and complaints, and meet our accounting and tax duties.
Legal basis: the contract with you and our legal obligations.

"Find your routine" quiz and the newsletter

Your email, the answers you choose in the quiz (for example the skin topics you care about and how much time you have), the routine we suggest, the language you use and how you joined.
Why: to show you a routine, send you your credit code and the emails you asked for, and suggest devices and routines that fit your answers. We do not ask for medical information; please do not send us any.
Legal basis: your consent, which you can withdraw at any time with the link in every email or by writing to us. Withdrawing consent does not affect the lawfulness of processing before it.

Reviews

Your name as you choose to show it, email, the device, rating, text and any photos or videos you choose to send.
Why: to publish your review. Photos or videos of you are shown only with your consent, and we remove them whenever you ask.
Legal basis: your consent.

Withdrawals, service, complaints and messages

What you send us through the withdrawal form, email or post.
Why: to answer, to handle your request and to send the confirmation the law requires. Legal basis: the contract, our legal obligations and our legitimate interest in answering you.

Using the site

Technical data such as IP address, device and browser, pages visited and items in the bag, collected with cookies and similar technologies (see section 7).
Why: to run the store securely and, only with your consent, for analytics and marketing. Legal basis: our legitimate interest in a working, secure store (necessary cookies) and your consent (all other cookies).

Other emails

If you tick the box at checkout, we send you news and offers (legal basis: your consent). If you agreed to marketing emails and leave checkout without finishing, we may send a reminder about the items in your bag.
After you buy a device, we send you emails about using it (the first session, the first weeks) and may ask you once to review it (legal basis: the contract and our legitimate interest; you can object at any time).
Our emails measure whether they are opened and which links are clicked, so we can make them better. You can object to this at any time.

Order data is needed to deliver your order; without it we cannot sell to you. Everything for the quiz, the newsletter, reviews and marketing is optional. We do not make decisions about you based solely on automated processing.

3. Who receives your data

We share data only as far as needed:

with processors that run parts of the store for us under a data processing agreement: Shopify (store platform and checkout), Klaviyo (newsletter and other emails), Judge.me (reviews), and our business software, accounting and IT service providers;
with independent controllers where needed: payment providers (card and other payments), the courier (name, address, phone and email for the parcel), Google and Meta (analytics and advertising, only if you accept these cookies) and public authorities when the law requires it.

4. Data outside the EU

Some partners (for example Shopify, Klaviyo, Google and Meta) may process data outside the European Economic Area, including the United States. We allow this only with the safeguards of the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. You can ask us for a copy of these safeguards at gdpr@feniks-info.hr.

5. How long we keep data

Invoices and accounting records: 11 years, as Croatian accounting law requires.
Order data needed for returns, service and liability claims: until those periods end.
Quiz and newsletter data: until you unsubscribe or ask for deletion.
Reviews: while they are published; photos and videos until you withdraw consent.
Messages and complaints: up to 2 years after the matter is closed, unless we need them longer for a legal claim.

6. Your rights

You can ask for access to your data, a copy, correction, deletion, restriction of processing and data portability, and you can object to processing based on legitimate interest. You can withdraw consent at any time. Write to gdpr@feniks-info.hr; we answer within one month. You can also complain to the Croatian Personal Data Protection Agency (AZOP, Selska cesta 136, 10000 Zagreb, azop.hr) or the authority in your EU country.

7. Cookies

Necessary cookies keep the store working (bag, checkout, language, security) and do not need consent. Analytics and marketing cookies are used only if you accept them in the cookie banner, and you can change your choice at any time with "Cookie settings" at the bottom of every page. Shopify's cookies are described in the Shopify cookie policy.

8. Children

The BEEA SKIN store is for adults. We do not knowingly collect data from anyone under 16. If you think a child has sent us data, write to gdpr@feniks-info.hr and we will delete it.

9. Security

The whole store runs over an encrypted connection (HTTPS). Access to personal data is limited to the people and partners who need it for the purposes above.

10. Changes

We may update this policy, for example when we add a new service. The date at the top shows the current version; for important changes we will let you know by email or on the site.