Privacy Policy
Privacy Policy
Last updated: September 2026
Protecting your personal data is important to us. In this privacy policy, we inform you about which personal data we process when you visit our online shop, place orders, contact us, or use our marketing and analysis services, the purposes for which this is done, and the rights you are entitled to.
1. Controller
The entity responsible for the processing of personal data on this website is:
Carma Ventures
Lipa 45
51000 Rijeka
Croatia
Email: hello@ylloshots.com
YLLO is a brand of Carma Ventures.
For questions regarding data protection or to exercise your data protection rights, you can contact the email address mentioned above at any time.
2. What personal data we process
Depending on your use of our online shop, the following personal data in particular may be processed:
Name, billing and shipping address, email address, telephone number, order and contract data, payment and transaction information, communication data, newsletter and marketing data, as well as technical information such as IP address, browser type, device type, operating system, cookie identifiers, page views, and interactions with our website.
We process this data in particular to provide and secure our online shop, to carry out orders and payments, to deliver goods, to communicate with you, and—provided you have given your consent—for analysis, personalization, and marketing purposes.
3. Orders and contract processing
When you place an order in our online shop, we process the personal data required to fulfill the order.
This includes, in particular, contact details, billing and delivery addresses, information about the ordered products, payment information, and data required to process the delivery.
Legal basis: Art. 6(1)(b) GDPR.
Insofar as we are legally obliged to retain certain business and transaction data, further processing is carried out on the basis of Art. 6(1)(c) GDPR.
4. Shopify
Our online shop is operated via the e-commerce platform Shopify.
For merchants in Europe, the Middle East, and Africa, Shopify International Limited, Ireland, is generally the primary Shopify contracting party. Shopify also acts as the primary headquarters for GDPR purposes.
Shopify processes personal data required to provide our shop, process orders, facilitate payments, provide security features, and operate other Shopify services.
Personal data may be passed on to other Shopify companies and selected sub-processors. Shopify notes that while certain data of European merchants may be stored in Europe, international data transfers may still occur within the scope of the platform. For this purpose, Shopify uses, among other things, adequacy decisions and standard contractual clauses of the European Commission.
Further information on processing by Shopify can be found in Shopify’s privacy policy. Shopify Privacy Policy
5. Shopify Network Intelligence and advanced Shopify services
Insofar as Shopify Network Intelligence is activated in our shop, Shopify may use certain customer and usage data in conjunction with data from other Shopify shops to provide advanced services. This can include, among other things, improved personalization, shop features, performance optimization, and advertising functions.
Shopify expressly points out that additional information and consent requirements may apply when Network Intelligence is activated. For users in the EEA, consents for non-essential tracking and advertising functions must be taken into account in particular.
Insofar as consent is required, processing is carried out on the basis of Art. 6(1)(a) GDPR.
6. Payment processing
For payment processing, we provide the payment methods available in the respective Shopify checkout.
Depending on your selection, the following payment methods or payment services may be used in particular:
Shopify Payments
Shop Pay
PayPal
Apple Pay
Google Pay
as well as other payment methods offered at the time of your order in the Shopify checkout.
During payment processing, your name, billing address, order information, transaction information, and the payment data required for the chosen payment method may be processed.
Processing is carried out by the respective payment service provider according to their own privacy policy.
Legal basis: Art. 6(1)(b) GDPR.
We generally only receive the payment information necessary to process and allocate your order.
7. Shipping service providers
To deliver your order, we pass on the personal data required for this purpose to the respective shipping service provider.
We use, in particular:
Hermes
DHL
UPS
This includes, in particular, your name and delivery address, as well as your email address or telephone number if required for delivery.
The data is transmitted solely to the extent necessary for the delivery of your order.
Legal basis: Art. 6(1)(b) GDPR.
8. Cookies and similar technologies
Our website uses cookies and similar technologies.
Technically necessary cookies may be used to provide basic functions of our shop, such as the shopping cart, checkout, security features, language settings, or login functions.
In addition, analysis, marketing, and personalization cookies may be used.
Non-essential cookies and comparable tracking technologies are—where legally required—only used after you have provided your consent via our cookie banner.
Legal basis: Art. 6(1)(a) GDPR, insofar as consent is required.
You can change or revoke your consent at any time with effect for the future via the cookie or privacy settings of our shop.
9. Google Analytics
We use Google Analytics, an analysis service provided by Google, to understand how visitors use our online shop.
In this context, information such as page views, interactions, devices, browsers, approximate location, technical identifiers, and conversion events may be processed.
Where legally required, Google Analytics is only activated after you have provided your consent.
For users in the European Economic Area, Google requires appropriate consent signals for relevant measurement, personalization, and advertising functions. The Google Consent Mode is used to technically transmit these consent decisions to Google.
Legal basis: Art. 6(1)(a) GDPR.
You can revoke your consent at any time via our cookie settings.
10. Meta Pixel
We use the Meta Pixel for analysis, marketing, and advertising purposes.
The pixel can track which pages are visited and which actions take place on our website, such as product views, shopping cart actions, or orders.
This information can be used to measure the effectiveness of advertising campaigns, create target groups, and—provided you have consented—personalize advertising.
In this process, technical data, IP address, browser and device information, cookie identifiers, and information about website interactions may be processed.
Legal basis: Art. 6(1)(a) GDPR, insofar as consent is required.
11. TikTok Pixel
We use the TikTok Pixel to analyze the use of our online shop and to measure the performance of our TikTok advertising campaigns.
The TikTok Pixel can track website events, such as visiting a product page, adding a product to the shopping cart, or completing an order. TikTok explicitly describes the pixel as a technology for measuring website traffic, campaign performance, and conversion events.
In this process, technical browser and device information, IP-related data, cookie identifiers, and interactions with our shop may be processed.
Where legally required, the TikTok Pixel is only activated after you have provided your consent.
Legal basis: Art. 6(1)(a) GDPR.
For users in the EEA, TikTok identifies, among others, TikTok Technology Limited in Ireland as the controller.
12. Shopify Analytics
We use the analysis functions provided by Shopify to evaluate the use of our shop.
For this purpose, data such as visitor numbers, page views, order and revenue data, conversion rates, device information, and other technical usage data may be processed.
Shopify points out that merchants are generally responsible for the data-protection-compliant configuration of their shop and the privacy features used.
The respective legal basis depends on the specific function and may be Art. 6(1)(b), (f), or—in the case of analysis and tracking functions requiring consent—(a) GDPR.
13. Newsletter and Shopify Email
When you sign up for our newsletter, we process your email address and any other data you voluntarily provide in order to send you messages about YLLO, our products, promotions, and offers.
We use Shopify Email for some of our email communication.
Legal basis: Art. 6(1)(a) GDPR.
You can revoke your consent at any time with effect for the future. For this purpose, you can, in particular, use the unsubscribe link contained in every marketing email.
14. Klaviyo
We also use Klaviyo for newsletters, marketing automation, and customer communication.
In this context, data such as name, email address, phone number, IP address, order history, website interactions, email opens and clicks, as well as cookie and device information may be processed.
Klaviyo confirms that typical customer data can include names, email addresses, phone numbers, IP addresses, and cookie data, and that a Data Processing Agreement is concluded with customers.
Insofar as we use Klaviyo for marketing communication or profiling, the processing is generally based on your consent.
Legal basis: Art. 6(1)(a) GDPR.
You can revoke your consent at any time via the unsubscribe link in our emails or by contacting us.
15. Contacting us
When you contact us by email, contact form, or by other means, we process the information provided by you to process and respond to your inquiry.
If your inquiry relates to an order or a potential contract, the processing is based on Art. 6(1)(b) GDPR.
In the case of general inquiries, the processing may be based on our legitimate interest in responding to customer and business inquiries in accordance with Art. 6(1)(f) GDPR.
16. Legal bases for processing
Depending on the respective processing activity, we rely in particular on the following legal bases:
Art. 6(1)(a) GDPR – Consent
Art. 6(1)(b) GDPR – Contract performance and pre-contractual measures
Art. 6(1)(c) GDPR – Fulfillment of legal obligations
Art. 6(1)(f) GDPR – Protection of legitimate interests
Insofar as we rely on legitimate interests, these consist in particular of the secure and economical operation of our online shop, the processing of inquiries, and the prevention of abuse and fraud.
17. Recipients of personal data
Personal data may be transferred to the following recipients or categories of recipients, provided this is necessary for the respective purpose:
Shopify and affiliated Shopify companies
Payment service providers
Hermes
DHL
UPS
Google
Meta
TikTok
Klaviyo
IT and technical service providers
Hosting and cloud service providers
Accounting and tax consulting
Authorities and public bodies, provided there is a legal obligation
A transfer only takes place if there is a corresponding legal basis for it.
18. International data transfers
Some of the service providers we use operate internationally. Therefore, personal data may also be processed outside of Croatia or outside of the European Economic Area.
This may apply in particular to Shopify, Google, Meta, TikTok, Klaviyo, as well as their affiliated companies or sub-processors.
To the extent that personal data is transferred to a country outside the EEA and there is no adequacy decision by the European Commission, appropriate safeguards in accordance with the GDPR are used—where necessary—in particular, standard contractual clauses.
For international transfers, Shopify uses, among other things, the adequacy decision for Canada as well as standard contractual clauses of the European Commission.
19. Storage period
We store personal data only as long as is necessary for the respective processing purpose.
Order, contract, and invoice data may also be stored in accordance with the applicable statutory retention requirements.
Data processed based on consent will generally be processed until the consent is withdrawn or the purpose of the processing ceases to exist, provided there is no legal basis for further storage.
Once the respective processing purpose has ceased and statutory retention periods have expired, personal data will be deleted or anonymized.
20. Data security
We take appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, or other unauthorized processing.
Data transmission via our website is generally encrypted.
21. Your data protection rights
Subject to the legal requirements, you have, in particular, the following rights:
Right of access to your personal data
Right to rectification of inaccurate or incomplete data
Right to erasure
Right to restriction of processing
Right to data portability
Right to object to certain types of processing
Right to withdraw consent with effect for the future
A withdrawal does not affect the lawfulness of the processing that took place based on your consent before the withdrawal.
To exercise your rights, you can contact us at:
22. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.
Since Carma Ventures is based in Croatia, the Croatian data protection supervisory authority is a relevant supervisory authority:
Agencija za zaštitu osobnih podataka – AZOP
Ulica Metela Ožegovića 16
HR-10000 Zagreb
Croatia
Email: azop@azop.hr
Phone: +385 (0)1 4609-000
You may also contact another competent data protection supervisory authority in accordance with the GDPR.
23. Cookie and consent settings
You can change your choices regarding non-essential cookies, analysis, and marketing technologies at any time via the cookie or data protection settings on our website.
Our Shopify store should be configured so that your consent decision is respected by the integrated services. Shopify provides functions for this under Settings → Customer Privacy.
24. Changes to this Privacy Policy
We reserve the right to amend this privacy policy if our online store, our technical systems, the service providers we use, or legal requirements change.
You can find the current version of this privacy policy on this page at any time.
Before publishing, I would perform one final technical check in Shopify: Go to Settings → Customer Privacy and verify that the cookie banner for the EU/EEA is enabled and that Meta Pixel, TikTok Pixel, Google Analytics, and other non-essential marketing tags actually respond to consent. Google requires appropriate consent signals for EEA traffic; Shopify provides the privacy/consent infrastructure for this, but correct configuration is the responsibility of the merchant.