La Moda · Legal
Privacy policy
How La Moda handles the personal data of visitors to this website.
Last updated 31 August 2026
1.Who the controller is
The controller of personal data collected through this website is Atria d.o.o., Ivana Kukuljevića 4, 42000 Varaždin, Croatia, trading as the La Moda shop. The company's full registration details are on the Legal notice page.
For any question about data protection, or to exercise your rights, write to info@atria.com.hr or to the address above.
We have not appointed a data protection officer, because the conditions in Article 37 of the GDPR are not met. Enquiries sent to the address above reach the person responsible for this directly.
2.What this site is, and what it is not
This site presents a physical shop in Varaždin. There is no online shopping, no cart, no prices, no payment and no user accounts, so no personal data is collected for any of those purposes.
We run no newsletter, build no visitor profiles, make no automated decisions with legal effect on you, and neither sell nor pass on personal data to third parties for marketing.
3.What we process, and on what basis
Everything this site processes is in the table below. Nothing beyond it is collected.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering an enquiry sent through the contact form | First name, last name, email address and the message | Legitimate interest (Art. 6(1)(f)) - replying to someone who contacted us | Up to 12 months from the last message in the exchange, unless the enquiry leads to a business relationship that requires longer |
| Remembering the language you chose | A cookie holding the value hr or en, with no visitor identifier | Necessary for a service you explicitly requested (Art. 6(1)(f), and exempt from consent as a strictly necessary cookie) | 12 months, or until you clear cookies in your browser |
| Website usage statistics | Page views, pages, referrer, country, device type and loading speed - no cookies and no visitor identifier | Legitimate interest (Art. 6(1)(f)) - understanding how much the site is used | Aggregate only; individual visits are not stored |
| Security and availability | Technical server logs, including the IP address, while the request is being served | Legitimate interest (Art. 6(1)(f)) - protection against abuse and fault diagnosis | Short-term, per the hosting provider’s settings |
| Showing the map of the shop | The IP address and browser data Google receives when the map loads | Consent (Art. 6(1)(a)) - the map loads only once you ask for it by clicking | We store nothing; Google’s own retention applies |
Providing data is neither a statutory nor a contractual requirement. If you do not write to us we simply cannot reply; everything else on the site remains available to you.
4.The contact form
A message sent through the form on the Contact page is delivered to the shop’s mailbox through an email delivery provider. It is read only by shop staff who need it in order to reply.
The form is for ordinary questions about the selection, availability and opening hours. Please do not put anything in it you would not send by ordinary email, and in particular no health or financial details or other special categories of personal data under Article 9 of the GDPR.
5.Usage statistics without cookies
We use Cloudflare Web Analytics for usage statistics. It sets no cookies, stores nothing on your device, does not fingerprint your browser and does not follow you across other websites. Your IP address is used only while the request is being served, to determine the country, and is not stored.
That is exactly why this site has no cookie consent banner: there is no tracking to consent to. The details are in the Cookie policy.
We deliberately do not use Google Analytics, the Meta Pixel or other advertising and tracking tools. Should that ever change, we will ask for your consent before switching any of them on.
6.Who receives the data
We do not sell personal data and do not pass it to third parties for their own purposes. It is available to the following processors, solely to perform the service they provide for us and under a data processing agreement:
- Cloudflare, Inc.
- Website hosting, content delivery and usage statistics. Privacy policy: https://www.cloudflare.com/privacypolicy/
- Resend, Inc.
- Delivery of contact form messages to our mailbox. Privacy policy: https://resend.com/legal/privacy-policy
- Google Ireland Limited
- Displaying the location map, and only after you ask for it by clicking. Privacy policy: https://policies.google.com/privacy
We may disclose data to the competent authorities where a legal provision requires it, for instance on a court order.
7.Transfers outside the European Economic Area
Cloudflare and Resend are companies established in the United States, and processing may involve a transfer of data outside the European Economic Area. Such transfers rely on the European Commission’s standard contractual clauses, together with the additional safeguards set out in our agreements with those providers.
You may request a copy of the safeguards a transfer relies on at our contact address.
8.How long we keep data
The retention period for each purpose is in the table above. Once it expires we delete the data, unless a legal provision requires us to keep it longer, in which case we keep it for that purpose only and use it for nothing else.
9.Your rights
The GDPR gives you the following rights over your personal data:
- Access
- Confirmation of whether we process your data and, if we do, a copy of it.
- Rectification
- Correction of inaccurate data and completion of incomplete data about you.
- Erasure
- Deletion of data once it is no longer needed for the purpose it was collected for, or once you have successfully objected to the processing.
- Restriction
- A temporary halt to processing while, for example, the accuracy of the data is checked.
- Objection
- Objection to processing based on legitimate interest. We then stop, unless we can demonstrate compelling legitimate grounds to continue.
- Portability
- The data you gave us yourself, in a machine-readable format, where processing is automated and based on consent or a contract.
- Withdrawal of consent
- Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
Send your request to info@atria.com.hr. We will respond without undue delay and within one month of receiving it at the latest. Exercising these rights is free of charge. If a request reaches us from someone we cannot connect to the data we hold, we may ask for further information to verify identity.
10.The right to complain to a supervisory authority
If you believe your personal data is not being processed lawfully, you have the right to lodge a complaint with a supervisory authority. In Croatia this is:
- Agencija za zaštitu osobnih podataka (AZOP)
- Selska cesta 136, 10000 Zagreb, Croatia, tel. +385 1 4609 000, azop@azop.hr, https://azop.hr
We would be glad if you came to us first, so we can try to resolve the matter with you.
11.Security
The site is served over an encrypted connection (HTTPS) only. Messages from the contact form are accessible only to the people who need them in order to reply. Fonts and other assets are served from our own servers rather than from third-party networks, so your visit is not reported to anyone else unnecessarily.
12.Children
The site is not directed at children and we do not knowingly collect their personal data. If you believe a child has sent us their details, contact us and we will delete them.
13.Links to other sites
The site links to the shop’s social media profiles and to a map of its location. The owners of those sites are responsible for their content and their handling of data, and their own privacy policies apply.
14.Changes to this policy
We change this policy when what the site does changes. A revised version applies from the day it is published, and the date of the last revision is at the top of this page. We will flag any material change clearly on the site.