Privacy

Who controls this data

The data controller for this shop is ZLATNA GRUPA društvo s ograničenom odgovornošću, za trgovinu i usluge (registered number 060497034).

Ulica 141. brigade hrvatske vojske 37 21000 Split Hrvatska

For anything on this page — including a request to see, correct or delete your data —write to info@pouchesempire.com.

What we collect

When you browse: An age-confirmation cookie and, if you add something to your basket, an opaque basket token. Neither identifies you.Lawful basis: the age cookie, a legal obligation not to sell nicotine products to anyone below the legal age where they are (Article 6(1)(c)); the basket token, steps taken at your request before a contract (Article 6(1)(b)).
When you order: Your email address, the items and prices at the time of purchase, and the delivery details you give when you pay.Lawful basis: performance of the contract you are entering into (Article 6(1)(b)), and, for the parts of the order that are an accounting record, a legal obligation (Article 6(1)(c)).
When you pay: Card details are entered on the payment provider's own hosted page. They never reach this site's servers. We store only the provider's reference identifiers so an order can be matched to a payment.Lawful basis: performance of the contract (Article 6(1)(b)); the payment record itself is kept under a legal obligation (Article 6(1)(c)).
When you contact us: Your name, email address and message, the order number if you give one, and a hashed form of your network address that is used only to limit automated abuse of the form.Lawful basis: our legitimate interest in answering enquiries and in keeping the form usable by people rather than by scripts (Article 6(1)(f)) — which is why the network address is stored as a salted hash and never as the address itself. Where the message is about an order you have placed, answering it is performance of that contract (Article 6(1)(b)).
When you look up an order: The order number and email address you enter are checked against the order, and nothing else is recorded.Lawful basis: performance of the contract (Article 6(1)(b)).
When you apply to the creator programme: Your name, username, email address and the code you ask for, plus a password, which is stored only as a one-way hash by our authentication provider and is never readable by us. If you are approved and ask to be paid, the payment details you enter — a PayPal address, or a bank account number and the name on it. These are kept for as long as your creator account exists and for as long afterwards as tax and accounting law requires us to keep a record of what we paid you. Ask us and we will close the account.Lawful basis: performance of the creator agreement (Article 6(1)(b)); a record of what we paid you is kept under a legal obligation (Article 6(1)(c)).
When someone uses a creator's code: The order is linked to that code so the commission can be calculated. The creator is shown the date, the value and the status of the order — never the name, email address or delivery address of the person who placed it.Lawful basis: performance of our agreement with the creator (Article 6(1)(b)). As the person who placed the order, nothing identifying you is disclosed to them.

What we do not collect

Card numbers, CVCs or expiry dates — these never touch our servers.
Advertising or cross-site tracking identifiers.
Analytics cookies, or any statistics tool from a third party. Our own visit counting works without cookies or device storage and keeps no IP address — seethe cookies page for exactly what it records.
Customer account details — buying needs no account and there is nothing to sign up for. The only accounts on this site belong to the creator programme, which is opt-in and separate from shopping.

Cookies

Age confirmation: Two cookies: one our server reads to know you confirmed you are of legal age, and one your browser reads so a page served from our cache can take the overlay down without asking again. Kept 30 days. Strictly necessary.
Basket: An opaque token linking your browser to a basket. Kept 30 days. Strictly necessary.
Checkout draft: The address and options you have typed at checkout, so a refresh does not empty the form. Kept 30 minutes. Strictly necessary.
Order view: Set only after you place an order or look one up, so the order page can show it to you without the reference in the address bar. Kept two hours. Strictly necessary.
Creator code: Set only when you arrive through a creator's link, so their code can be applied at checkout. Holds the code and nothing about you. Kept 30 days. Strictly necessary for the discount you followed the link for; it is not tracking.
Sign-in session: Only for staff and approved creators who sign in; a shopper never receives one. Kept seven days.

Every one of these is strictly necessary for the function you asked for, and there is no analytics, advertising or marketing cookie, so no consent banner is shown. The full list, with each cookie's name and exact lifetime, is on the cookies page. Adding anything beyond this would require asking first.

The age check on your order

Before an order is dispatched, a member of our team confirms it is going to someone of legal age for their destination, and we record when that was done and who did it against the order. We do not ask for, or store, a date of birth or an identity document. See our age policy for how the check works.

Lawful basis: a legal obligation not to supply nicotine products to anyone below the legal age for their destination (Article 6(1)(c)).

Who else processes your data

We do not sell your data, we do not share it for advertising, and no third party receives it for purposes of their own. These are the companies that operate the systems this shop runs on, acting on our instructions:

Supabase: Our database, and the sign-in used by the creator programme and by our own staff. Every order, contact message and creator record described above is stored there. The project is hosted in the European Union, in Frankfurt.
Vercel: Hosting. Every page and every form submission is handled by a server function, and all of them are pinned to Frankfurt in our deployment configuration rather than to whichever region is closest to the visitor.
Stripe: Card payments. Your card details are entered on Stripe's own page and never reach this site; we receive a reference to the payment and its result.

Where your data is held

Your data is stored and processed in the European Union. The database is in Frankfurt and every one of this site's server functions runs in the same city, which is a setting in our deployment rather than a description of the default — by default they would run wherever the request arrived.

We do not transfer your data outside the European Economic Area for any purpose of our own. The companies above are headquartered in the United States and their own staff can reach the systems they operate for us; that access happens under the data-processing terms each of them publishes, and it is not something we direct. Where card payments are taken, the processor decides where it processes them, because those details are given to it directly and never pass through this site.

How long we keep things

Age confirmation, basket and order-view cookies: Thirty days, thirty days and two hours respectively, as set out under Cookies above.
Stock held while you pay: Thirty minutes. A job runs every minute and releases anything past that, so an abandoned checkout returns its stock to sale without anyone intervening.
Orders and their line items: Kept for at least 11 years, the record-keeping period that applies to us as a seller under tax and accounting law. That obligation is longer than any request to erase them could override — the same records answer a refund, a warranty claim and an audit. Nothing deletes them automatically; a deletion is a deliberate act by us.
Messages sent through the contact form: Kept while the enquiry is open and afterwards as the record of what was asked and answered. Nothing deletes them automatically. Ask us and we will remove yours, unless it relates to an order we are obliged to keep a record of.
Creator accounts and payment details: Kept while the account exists, and the record of what we paid for as long as accounting law requires. Ask us and we will close the account.
Stock movements: Permanent, and they reference products rather than people.

Your rights

Under the GDPR you may request access to your data, correction, erasure, restriction, portability, or object to processing. Write to info@pouchesempire.com and we will respond within one month. You may also complain to the data-protection supervisory authority in the country where you live, or where you work, or where you believe the problem happened — you do not have to come to us first. The authority for the country we are established in is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.