Privacy Policy

Last updated: July 26, 2026.

This Privacy Policy explains what personal data we collect when you visit our online store, the purposes for which we process it, how long we retain it, and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and the Act on the Implementation of the General Data Protection Regulation.

1. Data Controller

I SAID YES, owned by Meggie Topić, Carera 34, 52210 Rovinj, Croatia; Tax ID: upon request; E-mail: info@isaidyees.com

For any questions regarding the processing of personal data and the exercise of your rights, you may contact us at the email address listed above.

We are not required to appoint a data protection officer.

2. What data we collect, why, and on what legal basis

Purpose of processing	Data	Legal basis	Shelf life
Order processing and delivery	name and surname, address for delivery and billing, e-mail, telephone, content of the order	execution of the contract (Art. 6, paragraph 1, point b)	until delivery + term for warranty and material defects (2 years)
Issuance and storage of invoices	account information, payment information (without card information)	legal obligation (Art. 6, paragraph 1, point c) – Accounting Act, VAT Act	11 years from the end of the business year
Online store user account	username, email, password (encrypted), order history, address book	performance of a contract / consent	until the user account is deleted
Handling of complaints and claims	data from the complaint and the associated order	legal obligation (Consumer Protection Act)	at least one year from receipt of the complaint
Contact form and email	name, email, phone, message content	legitimate interest in responding to an inquiry (Art. 6, paragraph 1, point f)	up to 12 months after the last communication
Newsletter	Email address, name, open and click data	Consent (Art. 6(1)(a))	Until withdrawal of consent
Traffic analytics	IP address (shortened), device, browser, on-site behavior	consent	see Section 3
Marketing and remarketing	cookie identifiers, viewed products, conversions	consent	see section 3.
Site security and server logs	IP address, access time, requests	Legitimate interest in system security	Up to 30 days

Providing the data marked as mandatory on the order form is necessary for the conclusion and performance of the contract. Without this information, we cannot process the order. Providing data for the newsletter is voluntary.

3. Cookies and tracking technologies

We place cookies that are not essential for the website’s operation only after you have given your consent via the cookie notice. You can change or withdraw your consent at any time via the cookie settings on the website.

Cookie categories:

Necessary – shopping cart, login, security, remembering cookie preferences. These are set without consent because they are essential for the store to function.
Functional – memory of language, currency and similar preferences.
Analytical – measurement of traffic and user behavior.
Marketing – measuring ad performance and displaying relevant ads.

Tools we use:

Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) – visitor statistics. We use IP address anonymization and Google Consent Mode, so data is collected only after consent has been given.
Google Search Console – data on page visibility in search results; it does not use cookies on your device.
Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) – measuring the effectiveness of Facebook and Instagram ads and remarketing. For the collection and transfer of data via Pixel, we and Meta act as joint data controllers in the sense of Art. 26. GDPR, based on Meta’s addendum on joint processing management. Meta is responsible for further processing carried out by Meta for its own purposes. Data collected by Pixel is not anonymous – Meta can link it to your user profile.

Refusing or subsequently withdrawing consent does not affect the ability to make purchases in our store.

4. Recipients of data

We do not sell personal data. We share it only with service providers who process it according to our instructions, based on concluded data processing agreements (Art. 28 of the GDPR):

Riot (https://riot.hr/) – creation, hosting, maintenance and technical support of the website. Data is stored and processed in data centers in the territory of the European Union.
Payment service provider WSPay and bank transactions – payment processing. We do not see or store your card details; you enter them directly with the payment service provider.
Delivery service GLS, BoxNow and others as needed – delivery of the shipment.
Accounting service – maintenance of business records.
Email marketing service provider MailerLite (https://www.mailerlite.com/) – sending newsletters.
Google Ireland Limited and Meta Platforms Ireland Limited – as described in Section 3.

We may also disclose data to competent authorities when there is a legal obligation to do so.

5. Data transfer outside the EEA

Our website and database are hosted on servers within the European Union.

When using Google and Meta services, the contracting partners are their Irish entities; however, in certain cases, data transfers to the United States may occur. Such transfers are based on the European Commission’s adequacy decision regarding the EU-U.S. Data Privacy Framework of July 10, 2023, for organizations certified under that framework, as well as on the European Commission’s Standard Contractual Clauses, accompanied by appropriate supplementary safeguards.

Please note that the level of protection in third countries may be lower than in the EU and that oversight by state authorities is not entirely ruled out.

6. Data security

All traffic between your browser and our website is protected by TLS encryption (HTTPS). Access to personal data is restricted to individuals who require it to perform their duties. We implement regular security updates, perform backups, and maintain server access controls.

6.1. Online Payment Security Statement

The confidentiality of your data is protected and secured through the use of the latest version of TLS encryption. Online payment pages are secured using the Secure Socket Layer (SSL) protocol with 128-bit data encryption. SSL encryption is a process of encoding data to prevent unauthorized access during transmission.

This enables secure information transmission and prevents unauthorized access to data during communication between the user and the Monri WebPay payment system, and vice versa.

The Monri WebPay system and financial institutions exchange data using a virtual private network (VPN), which is also protected against unauthorized access.

Monri Payments is a card payment service provider certified to the PCI DSS Level 1 standard and regulated by the rules of Visa and Mastercard.

The merchant does not store credit card numbers, and they are not accessible to unauthorized persons.

The online store uses the 3D Secure security protocol, which enables additional user authentication during online card payments, thereby ensuring a higher level of protection and transaction security through your bank’s system.

7. Your rights

Regarding your personal data, you have the right to:

to access – to request confirmation as to whether we are processing your data and to obtain a copy thereof;
for rectification – to request the rectification of inaccurate data or the completion of incomplete data;
to erasure (“right to be forgotten”) – subject to limitations arising from our statutory retention obligations (e.g., invoices);
to the restriction of processing;
to data portability – to receive data in a machine-readable format or request its transfer to another controller;
to object to processing based on legitimate interest, including objecting to direct marketing at any time;
to withdraw consent at any time, without affecting the lawfulness of processing prior to the withdrawal. You may withdraw your consent for the newsletter by clicking the unsubscribe link in any message or by sending an email to our address.

You may send your request to our email address. We will respond no later than one month after receiving the request. To protect your data, we may request additional verification of your identity.

Right to lodge a complaint with the supervisory authority: Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, E-mail: azop@azop.hr · www.azop.hr

8. Automated decision-making

We do not engage in automated decision-making that would produce legal effects concerning you or similarly significantly affect you. Marketing profiling is limited to displaying more relevant ads and is carried out only with your consent.

9. Minors

Our online store is not intended for persons under the age of 16, and we do not knowingly collect their personal data. If we discover that we have collected such data without the consent of the holder of parental responsibility, we will delete it without delay.

10. Personal data breach

In the event of a personal data breach, we will notify AZOP within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. If the breach poses a high risk, we will also notify you directly without undue delay.

11. Changes to this Privacy Policy

We may amend this Policy from time to time to ensure compliance with legislation or to reflect changes in our business operations. We always publish the updated version on this page, indicating the date of the last amendment. We will notify you directly—via email or a website notification—of any significant changes that affect your rights.