Privacy Policy – Gifts by My

Effective Date: September 30, 2026

1. Introduction

Gifts by My j.d.o.o. (referred to as “we”, “us”, or “our” in this policy) is committed to protecting the personal data and privacy rights of all users who access and use our e-commerce website www.giftsbymy.com, browse our product catalogues, place orders, and interact with our online shopping services. This Privacy Policy is formulated in full compliance with applicable global personal data protection regulations, including the General Data Protection Regulation (GDPR) and relevant Croatian and European Union data protection laws, to clearly explain how we collect, process, store, share, and protect your personal information during your use of our services.

By visiting, registering an account, browsing products, completing a purchase transaction, or accessing any features of www.giftsbymy.com, you confirm that you have read, understood, and agree to the terms outlined in this Privacy Policy. If you do not agree with any part of this policy, please refrain from using our website and related shopping services.

Our core principle for personal data processing is legality, fairness, and minimization: we only collect information that is strictly necessary to deliver high-quality e-commerce services to you, and we will never process your personal data in ways that are incompatible with the purposes stated in this document.

2. Data Controller Information

The data controller responsible for your personal information processing under applicable data protection laws is:

‌Entity Name‌: Gifts by My j.d.o.o.
‌Registered Address‌: Ulica Vladimira Nazora 36, 49247 Zlatar-Bistrica, Croatia
‌Contact Email‌: [email protected]
‌Contact Telephone‌: +385 49 461 540

You may reach out to us at any time using the contact details listed above to submit questions, requests, or complaints related to your personal data and this Privacy Policy.

3. Types of Personal Information We Collect

We only collect personal information that is directly relevant to the operation of our e-commerce platform and the fulfillment of your orders, in accordance with the data minimization principle. The information we process falls into two main categories: information you actively provide to us, and information we automatically collect when you use our website.

3.1 Information You Actively Provide

This refers to all data you submit voluntarily when interacting with our services:

‌Account Registration Information‌: When you create a user account on www.giftsbymy.com, you will be required to provide a valid email address and set a secure account password. You may also optionally supplement your profile with a display name, gender, or date of birth to personalize your shopping experience, and these optional fields will not affect your access to core transaction functions if left blank.
‌Transaction and Order Fulfillment Information‌: When you place an order on our platform, we will collect your full name, recipient contact number, full shipping address, and order-specific notes to ensure that your purchased gifts and products can be accurately delivered to the designated location. During the payment process, we will only collect necessary payment verification information such as transaction amount and order matching identifiers: we never store your complete bank card number, card verification code, or full payment account credentials, and all sensitive payment data is processed directly through our certified third-party payment service providers.
‌Customer Service Correspondence Information‌: When you contact our support team via email, online chat, or message system to inquire about product details, track order status, submit a return or exchange request, or provide feedback, we will record the content of your correspondence, relevant order numbers, and attached verification materials such as product photos to help us resolve your request efficiently.
‌Voluntary Survey and Preference Information‌: You may choose to participate in our optional user satisfaction surveys or product preference feedback activities, and the information you submit in these activities will only be used to optimize our product selection and shopping service experience.

3.2 Information We Automatically Collect

When you access and browse www.giftsbymy.com, we automatically collect non-sensitive technical data to maintain the stability, security, and performance of our platform:

‌Device and Technical Log Information‌: This includes your device model, operating system version, browser type and language settings, IP address, network access provider, unique device identifier, time of access, pages you viewed, click tracks, and website interaction duration. This data helps us troubleshoot system failures, prevent malicious login attempts and fraud risks, and optimize the loading speed of our website for different device types.
‌Location Information (Optional)‌: If you grant permission for our website to access your geolocation data via your device settings, we will collect your approximate regional location information to recommend region-specific gift products, calculate accurate shipping costs, and inform you of local delivery timelines. You can revoke this location permission at any time through your browser or device system settings, and this revocation will not affect your ability to browse products and complete normal transactions.
‌Cookie and Similar Tracking Technology Data‌: We use Cookies, pixel tags, and other standard tracking technologies to remember your login status, save your preferred shopping cart contents during your visit, analyze anonymous website traffic trends, and provide you with a smoother personalized browsing experience. You can adjust your browser settings to refuse Cookie storage at any time, but please note that disabling Cookies may limit the functionality of some parts of our website, such as automatically retaining your shopping cart items between visits.

4. Purposes for Processing Your Personal Information

We strictly limit the use of your personal information to the specific, clearly stated purposes we notified you of at the time of collection, and will never reuse your data for purposes unrelated to the original reason of collection without obtaining your separate explicit consent. The core processing purposes include:

‌Transaction Fulfillment and Order Delivery‌: We use your order information, shipping details, and contact data to process your purchase, arrange logistics and delivery services, update you with real-time order status notifications, process after-sales return and exchange applications, and ensure that the entire shopping process from order placement to product receipt runs smoothly.
‌Platform Security and Risk Prevention‌: We use device information, login IP data, and behavioral logs to verify account identity, detect abnormal login activities, prevent fraudulent transactions, malicious order submissions, and network attack threats, and create a safe and reliable shopping environment for all users of our platform.
‌Personalized Shopping Experience Optimization‌: Based on your browsing history, product collection records, and past purchase preferences, we will recommend gift products that may match your interests, send targeted notifications about exclusive promotions and new product launches that suit your consumption habits, and help you quickly find the customized gift solutions you need. You can opt out of receiving these personalized marketing notifications at any time through the account settings page, or by replying to the unsubscribe link included in every marketing email we send.
‌Legal Compliance and Regulatory Cooperation‌: When we receive legally valid formal documents issued by judicial authorities, administrative law enforcement agencies, or other authorized competent departments, we may disclose your relevant personal information as required, to fulfill our legal obligations of safeguarding public safety and promoting the implementation of laws.
‌Internal Service Improvement and R&D‌: We will process de-identified, anonymized user data for statistical analysis, to optimize our website interface design, adjust product inventory structure, improve customer service workflows, and continuously upgrade the overall service quality of our e-commerce platform. Anonymized data cannot be associated back to any specific individual user, and its use will not violate your personal privacy rights.

5. Information Sharing and Disclosure Rules

We will never sell, rent, or trade your personal identifiable information to any third parties for commercial marketing purposes that are not related to the delivery of the services you ordered. We only share your personal data with third parties under the following strictly limited, legally compliant circumstances:

‌Authorized Service Partners‌: We will only share the minimum necessary information with our carefully screened, contractually bound third-party service providers who help us operate the platform and complete order fulfillment:
- Logistics and courier partners: We share your recipient name, contact number, and shipping address exclusively for the purpose of arranging product delivery. All our logistics partners are required to delete your personal delivery information immediately after the order is successfully completed, and are prohibited from using this data for any other unrelated purposes.
- Payment service providers: We share transaction amount, order identification information, and necessary verification data with our accredited payment processors to complete secure fund settlement. These payment providers are all certified under global payment card industry security standards, and they will never expose your sensitive payment credentials to us or any other unauthorized parties.
- Technical service providers: We may share anonymized, non-identifiable behavioral data with our website operation and data analysis partners, to help us optimize website performance, resolve system faults, and improve service functions. These partners are not allowed to re-identify any personal user identity from this processed data.
  We have signed strict data protection agreements with all the above third-party partners, which clearly stipulate that they can only process your personal information in accordance with our instructions and applicable data protection laws, and must adopt corresponding security measures to protect your data from unauthorized access or leakage.
‌Legal Required Disclosure‌: We may disclose your personal information when we determine that disclosure is necessary to comply with applicable laws, regulations, legal procedures, or enforceable government requirements, to protect the legitimate rights, property, and personal safety of our company, our users, or the general public.

6. Personal Data Storage and Security Protection

All your personal information collected by www.giftsbymy.com will be stored in servers located within the European Economic Area (EEA), and we will never transfer your personal data to regions or countries outside the EEA without ensuring that the recipient provides an adequate level of data protection, and complies with all applicable cross-border data transfer regulatory requirements.

We will only retain your personal identifiable information for the period necessary to achieve the specific purposes for which it was collected: for transaction data, we will retain it for the duration required by Croatian commercial accounting and tax laws; if you delete your user account, we will completely erase all your personal profile, order history, and behavioral data from our active systems within 15 working days, except for the data we are legally obligated to retain for compliance purposes.

We implement layered technical and management security measures to fully protect your personal information from unauthorized access, misuse, leakage, tampering, or destruction:

All sensitive personal information including your password, shipping details, and transaction data is encrypted using industry-standard AES encryption algorithm for storage, and transmitted between your device and our server via SSL/TLS secure encrypted connection.
We set up strict hierarchical access control for our internal staff: only a very limited number of authorized employees who need to process your data to complete their work can access relevant personal information, and all access records are fully logged and audited regularly.
We conduct periodic full system vulnerability scans and security audits, and maintain a comprehensive personal data breach emergency response plan. In the event of an accidental personal information security incident, we will immediately take remedial measures to contain the risk, notify all affected users in accordance with legal requirements, and report the incident to the relevant data protection regulatory authority within the legally specified time frame.

7. Your Data Subject Rights

Under applicable data protection laws, you enjoy a full set of rights over your personal information processed by us, and we have set up convenient response channels to ensure that you can exercise these rights freely:

‌Right of Access‌: You can log into your account at any time to view all your personal profile information, historical order records, and stored shipping addresses stored on our platform. You may also send us a request via the provided contact details to obtain a full copy of all the personal data we hold about you.
‌Right to Rectification‌: If you find that any of your personal information we hold is inaccurate or incomplete, you can directly modify it in your account settings page, or contact our customer support team to submit a correction request. We will process your request and update the relevant data without unreasonable delay.
‌Right to Erasure (Right to be Forgotten)‌: You have the right to request us to delete all your personal identifiable information under the conditions that the data is no longer necessary for the original collection purpose, you withdraw your consent to the processing, or our processing of the data violates applicable laws. We will verify your identity before processing the deletion request, and complete the erasure process within 15 working days, except for the data we are legally required to retain.
‌Right to Restriction of Processing‌: You have the right to request us to temporarily restrict the processing of your personal data in situations where you dispute the accuracy of the data, our processing is unlawful, or we no longer need the data but you require it for the establishment, exercise, or defense of legal claims.
‌Right to Data Portability‌: You may request us to export the personal data you have provided to us, in a structured, commonly used, machine-readable format, for the purpose of transferring this data to another data controller as you wish.
‌Right to Withdraw Consent‌: You can withdraw your previously granted consent for processing your personal information at any time, for example by turning off location permissions on your device settings, unsubscribing from marketing emails, or adjusting your privacy preferences in your account settings. The withdrawal of consent will not affect the legality of data processing we have carried out before the withdrawal, based on your previous valid consent.
‌Right to Lodge a Complaint‌: If you believe that our processing of your personal information has violated applicable data protection laws and infringed your privacy rights, you have the right to submit a complaint to the relevant local data protection supervisory authority in Croatia or your country of residence.

All requests related to the exercise of your data subject rights can be submitted to us via the contact email [email protected]. We will respond to your request within a maximum of 30 days after verifying your identity, and we will not charge any fees for processing legitimate, non-repetitive rights requests without a valid legal reason.

8. Updates to this Privacy Policy

We may revise and update the terms of this Privacy Policy periodically to adapt to changes in our business operations, new regulatory requirements, or feedback from user communities. When we make material changes to this policy, we will prominently post the updated version on the privacy policy page of www.giftsbymy.com, update the “Effective Date” marked at the top of the document, and send a prominent notification to all registered users via email or in-platform system message at least 7 days before the revised policy takes effect.

Your continued access to our website and use of our shopping services after the effective date of the revised Privacy Policy will be regarded as your confirmation and agreement to the updated terms. If you do not agree with the content of the revised policy, you may choose to stop using our services and apply for account deletion before the new policy takes effect.

9. Contact Information

If you have any questions, concerns, or suggestions regarding this Privacy Policy, or if you need to submit any requests related to the processing of your personal information, please do not hesitate to contact us at any time via:

Email: [email protected]
Postal Address: Ulica Vladimira Nazora 36, 49247 Zlatar-Bistrica, Croatia
Telephone: +385 49 461 540