Privacy policy

Data Controller

The controller responsible for the Ero Lounge online store is:

Additional business details are available in our Legal Notice / Impressum.

Adults Only

Our website and products are intended only for adults aged 18 years or older.

We do not knowingly collect personal information from minors. If you believe that a minor has provided personal information to us, contact info@erolounge.com so that we can investigate and take appropriate action.

Personal Information We Collect

The information we collect depends on how you use the store and may include:

Contact, billing and delivery information

Your name, email address, billing address, delivery address, country, telephone number where provided, and delivery instructions or preferences.

Order and transaction information

Products ordered, order number and date, price, payment status, fulfilment status, shipping and tracking information, returns, cancellations, refunds, customer notes and order-related communications.

Payment information

Payments are processed through Shopify checkout and the payment method you select at checkout. Ero Lounge does not receive or store your complete payment-card number. Shopify and the relevant payment provider may process card, wallet, transaction, authentication and fraud-prevention information under their own security and privacy arrangements.

Customer account information

If you use a customer account, we may process your account identifier, contact details, addresses, preferences, marketing choices and order history. Shopify provides the account and authentication infrastructure.

Customer-service information

Information you provide when contacting us through email, the contact form, chat, a return or cancellation request, a complaint, a warranty request or a product-safety enquiry.

Device, usage and cookie information

IP address, browser and device information, operating system, language, pages viewed, interactions with the store, approximate location derived from technical data, cookie identifiers, consent choices, logs and similar technical information.

Marketing information

Your newsletter subscription status, marketing consent, communication preferences and interaction with marketing messages where applicable.

Intimate and Potentially Sensitive Information

Order history for intimate products may be private and, depending on context, could reveal sensitive information. We do not require you to provide information about your health, sex life or sexual orientation in order to make a normal purchase.

Please do not send medical, sexual or other special-category personal data unless it is genuinely necessary for a customer-support, product-safety, complaint or legal request. If you voluntarily provide such information, we will use it only as necessary to handle that request and where processing is permitted by applicable law.

Product names are not displayed on the outside of parcels. Necessary order information is shared only with parties involved in payment, fulfilment, delivery, support, accounting, security, legal compliance or product safety.

How We Obtain Information

We obtain personal information:

• directly from you when you place an order, create or use an account, contact us, subscribe to marketing or submit a request;
• automatically when you use the website, including through cookies, logs, pixels and similar technologies;
• from Shopify and the service providers used to operate the store;
• from payment, fulfilment, shipping, fraud-prevention, analytics, marketing, customer-support and compliance providers where relevant.

Why We Use Personal Information

Orders and contract performance

We use personal information to accept and process orders, receive payment confirmation, arrange fulfilment and delivery, provide order updates, manage customer accounts, and handle returns, cancellations, refunds, warranty matters and related support.

Legal basis: taking steps at your request before entering into a contract and performing our contract with you.

Customer support and service improvement

We use information to answer enquiries, investigate complaints, resolve delivery or product issues and improve our customer service and store operation.

Legal basis: contract performance, compliance with legal obligations and our legitimate interests in providing support and improving our services, provided those interests do not override your rights.

Accounting, tax and legal compliance

We process order, invoice and communication records to meet accounting, tax, consumer-protection, product-safety and other legal obligations, and to establish, exercise or defend legal claims.

Legal basis: legal obligation and legitimate interests in protecting our legal rights.

Security and fraud prevention

We use technical, device, payment-status and order information to protect the website and accounts, prevent fraud and abuse, investigate suspicious activity and maintain service security.

Legal basis: our legitimate interests in protecting customers, the store and our services, and legal obligation where applicable.

Product safety and recalls

We may use order and contact details to provide safety instructions, product warnings, recall notices or other important product-compliance information.

Legal basis: legal obligation and legitimate interests in protecting customer safety.

Marketing communications

If you actively subscribe, we may send product news, offers, guides or store updates. You can unsubscribe at any time using the link in an email or by contacting us.

Legal basis: your consent, or another lawful basis only where specifically permitted by applicable law.

Cookies, analytics and advertising

Strictly necessary technologies support functions such as the shopping cart, checkout, account access, security and fraud prevention. With consent where required, analytics and marketing technologies may help us understand store usage and measure or improve marketing.

Legal basis: consent for non-essential analytics and marketing technologies; contract performance, legal obligation or legitimate interests for necessary store, security and fraud-prevention functions, as applicable.

Information Required to Place an Order

Information marked as required during checkout is necessary to conclude or perform the purchase contract, process payment, deliver the order and comply with legal requirements. If you do not provide required information, we may be unable to accept or fulfil the order.

Fields described as optional are voluntary, although a carrier or payment provider may request additional information when necessary to provide its service or prevent fraud.

Who Receives Personal Information

We disclose personal information only where necessary for the purposes described in this policy. Recipient categories may include:

• Shopify and providers supporting the e-commerce platform, hosting, checkout, customer accounts and store security;
• the payment provider selected during checkout and fraud-prevention providers;
• our fulfilment service, suppliers, distributors and warehouse partners, including Dreamlove where it fulfils an order;
• shipping carriers and delivery providers;
• email, contact-form, chat and customer-support providers;
• analytics, consent-management and marketing providers where their use is permitted and, where required, you have consented;
• IT, hosting, security and cloud-service providers;
• accountants, legal advisers, insurers and compliance providers;
• courts, regulators, tax authorities, law-enforcement bodies or other public authorities where disclosure is required or legally permitted.

We provide recipients only with information reasonably necessary for the relevant service or legal purpose.

Shopify

Our store is hosted and operated using Shopify. Shopify provides the e-commerce platform, checkout, customer accounts, order management, security, analytics infrastructure and related services.

Shopify may process personal information as our service provider or processor. For certain Shopify services, security, fraud-prevention, product-improvement or legal purposes, Shopify may also process information under its own responsibility. If you use Shop, Shop Pay or another Shopify consumer service, Shopify's own privacy terms also apply.

You can learn more in Shopify's Privacy Policy for Consumers.

International Data Transfers

Shopify and other service providers may process personal information outside Croatia or the European Economic Area.

Where GDPR transfer restrictions apply, transfers must be supported by an appropriate legal mechanism, such as an adequacy decision, Standard Contractual Clauses or another safeguard permitted by law. Further information may be available in the relevant provider's privacy notice or on request.

Cookies and Similar Technologies

We use cookies and similar technologies to operate the store, retain preferences, maintain the cart and checkout, protect accounts, prevent fraud, understand store usage and support marketing where permitted.

Strictly necessary technologies may operate without consent when they are required to provide a service you requested or to maintain essential store and security functions. Non-essential analytics, personalization and marketing technologies are used only where permitted and, where required, after you consent.

You can review or change your choices using Shopify's cookie-preference interface whenever it is displayed. Depending on the active theme, a Cookie preferences control may also be available in the store footer. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.

Data Retention

We keep personal information only for as long as needed for the purpose for which it was collected, including:

• order, invoice, payment-status and accounting records for the periods required by Croatian and EU tax, accounting and business laws;
• return, complaint, warranty and product-safety records until the matter is resolved and for any applicable legal or limitation period;
• customer-account information while the account is active and afterwards where records must be retained for legal, security or order-history purposes;
• marketing information until you unsubscribe, withdraw consent or the information is no longer needed for the stated purpose;
• cookie-consent records for as long as reasonably necessary to record and manage your choices;
• technical and security logs for periods reasonably necessary to operate and protect the service, investigate incidents and comply with law.

We may retain limited information for longer where required to comply with law, prevent fraud, resolve disputes or establish, exercise or defend legal claims.

Your Data-Protection Rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of personal information;
• request restriction of processing;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing;
• receive certain information in a portable format and request its transfer where applicable;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a data-protection supervisory authority.

These rights are not absolute. For example, legal retention duties, fraud prevention, product-safety obligations or legal claims may prevent immediate deletion of some information.

To exercise a right, email info@erolounge.com. Please describe your request clearly. We may request information reasonably necessary to verify your identity and protect your account and data.

Complaints

If you have a concern about our processing of personal information, please contact us first at info@erolounge.com.

You may also lodge a complaint with the supervisory authority in the EU or EEA country where you live, work or believe an infringement occurred. In Croatia, the supervisory authority is:

Security

We use Shopify and other service providers to support the technical and organisational security of the store, checkout and customer information. Access to personal information is restricted according to operational need.

No method of transmission or storage is completely secure. Keep account-access links and devices secure, and contact us promptly if you suspect unauthorized use of your account or personal information.

Third-Party Links

The website may contain links to third-party websites, services or applications. Their privacy and security practices are governed by their own notices. Review those notices before providing personal information directly to a third party.

Automated Decision-Making

Ero Lounge does not itself use solely automated decision-making that produces legal or similarly significant effects for customers.

Shopify, payment providers or fraud-prevention providers may use automated tools to authenticate payments, assess fraud or protect services. Their own privacy notices provide further information about processing carried out under their responsibility.

Changes to This Policy

We may update this Privacy Policy to reflect changes in law, our services, providers or processing activities. The current version will be published on this page with an updated date.