Privacy policy.

The data controller is Hrast d.o.o., Belgrade, Serbia. Write to hello@hrast.example for anything in this policy, including a deletion request.

• Contact details you send: name, company, email, phone, address, VAT number.
• Order data: products, quantities, artwork files, delivery address, payment records.
• Correspondence: emails and sample requests.
• Website data: pages visited, referrer, approximate country and device type, in aggregated form.

• Contract: to quote, produce, invoice and deliver your order, and to handle warranty claims.
• Legitimate interest: to answer enquiries, prevent fraud, keep records for accounting and tell existing buyers about new ranges.
• Consent: for the wholesale catalogue mailing and marketing emails. Unsubscribe in one click and we stop immediately.
• Legal obligation: tax, bookkeeping and export record-keeping.

Only with the parties needed to complete an order, under written processing agreements:

• Carriers and freight forwarders — name, address, phone, parcel contents.
• Our accounting and banking providers — invoice and payment data.
• Our website and email hosting providers — contact and mailing data.
• Customs authorities where required for export.

We never sell personal data and never share it with advertising networks.

Our hosting and email providers operate within the EU. Where a carrier outside the EEA needs contact details to deliver, we rely on the transfer being necessary to perform the contract and limit the data to what that delivery requires.

• Order and invoice records: 10 years, for tax and warranty purposes.
• Enquiries that did not become orders: 24 months.
• Mailing list entries: until you unsubscribe.
• Website analytics: 14 months, aggregated.

You may ask for access, correction, deletion, a copy of your data, or restriction of processing, and you may object to processing based on legitimate interest. Email us and we act within 30 days. If you are unhappy with our answer, you may complain to the Serbian Commissioner for Information of Public Importance and Data Protection, or to the supervisory authority in your country.

This site sets only strictly necessary cookies and privacy-respecting analytics. Full details, including how to block them, are in the cookie policy.

Data sits behind access-controlled hosting with encryption in transit, staff accounts are individual and least-privileged, and artwork files are deleted from shared drives once a project is closed.

Material changes are emailed to trade customers before they take effect. The date at the top of this page shows the current version.