Privacy Policy

Data Controller

The Data Controller is MaK boutique, obrt za trgovinu i usluge, vl. Matea Karlušić. The public brand name used on the website is MaK Boutique.

The business address is Lovački put 2, 21000 Split, Croatia. The registered activity is 47761 - Retail sale of flowers. The business was established in 2023.

Personal Data We Collect

When you use the contact form, you may provide your full name, email address, optional phone number, inquiry subject and message.

We also record your acknowledgement that you have read this Privacy Policy and limited information needed to submit the inquiry securely.

The website or hosting provider may process basic technical data sent by your browser, such as IP address, request time, requested page and browser information.

How We Collect Data

We collect data when you enter it into the form, send an email, call, open a WhatsApp conversation or contact MaK Boutique through social media.

A social link does not send data to that social network before you click it. Once opened, the third party's own terms and privacy rules apply.

The Google Maps frame is embedded on the contact page and loads when that page is viewed.

Processing Purposes

We use inquiry data to respond to requests and discuss bouquets, flower boxes, decoration, gifts, weddings or other services requested by the visitor.

Technical data is used to operate the website, support security, prevent form abuse and troubleshoot technical issues.

Google Analytics 4 is used only if you explicitly allow analytics settings. We do not activate Google Tag Manager, Meta Pixel, TikTok Pixel or newsletter signup.

Legal Bases

Responding to an inquiry and discussing a possible order is generally based on taking steps at your request before a potential arrangement is agreed.

Website security, abuse prevention and basic technical logs are based on the legitimate interest of maintaining a secure and functional website.

Google Analytics 4 and other optional analytics or marketing technologies require prior consent where required.

Contact Form and Communication

Information submitted through the contact form is delivered to MaK Boutique so that we can reply to your inquiry.

After a successful security check, the form is validated server-side and sent to MaK Boutique through PHPMailer and the configured SMTP transport. Hosting and email service providers may process the data needed to deliver the message and reply.

Technical and Security Data

To protect the website and contact form, limited technical data and information needed to prevent abuse may be processed. The Turnstile token is verified server-side before email delivery.

The hosting provider may temporarily keep technical logs for security, maintenance and diagnostics. These logs are not intended for marketing profiling.

Cookies and Browser Storage

The website uses necessary browser storage to remember privacy settings. This is not an HTTP cookie.

Google Analytics 4 cookies are not set before analytics consent. More detail is available in the Cookie Policy.

Google Maps and External Services

The contact page includes an embedded Google Maps frame that loads automatically, together with separate links for opening the place and starting directions. Cloudflare Turnstile loads only when needed to protect the contact form.

When you open the contact page with the Google Maps frame or an external Google Maps link, Google may process technical data under its own privacy policy and terms.

The website includes external links to WhatsApp, Instagram, Facebook, TikTok and Google Business Profile/reviews. These services are not loaded as embeds before you click.

Recipients and Processors

Inquiry data is received by MaK Boutique so the business can reply and discuss the requested service. Hosting and email providers may process technical or communication data where necessary to operate the service.

We do not sell personal data and do not share it with social networks simply because their links appear on the website.

Transfers Outside the European Economic Area

Some external providers, such as Google, Meta, TikTok or WhatsApp, may process data outside the European Economic Area when you open their services.

Such processing is governed by the relevant provider's rules, contractual mechanisms and safeguards.

Retention Periods

Inquiries are kept for as long as reasonably needed to reply, continue communication, keep a record of arrangements and protect legitimate interests.

If an inquiry leads to a business relationship or documentation retention obligation, some data may be kept longer under applicable law.

Hosting and security logs are generally retained for a limited period according to provider settings.

Data Subject Rights

Under applicable law, you may request access, rectification, erasure, restriction, portability, objection and information about processing.

To exercise your rights, contact us using the email shown on this page. We may ask for reasonable identity verification where necessary.

Withdrawal of Consent

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Privacy settings can be reopened through the Cookie Settings button in the footer.

Data Security

We apply appropriate technical and organisational measures taking into account the nature of the website and the processing involved.

No transmission or storage method can be described as completely secure, so please do not send sensitive information that is not needed for your inquiry.

External Links and Social Media

The website may link to external pages and profiles. Once you open such a link, that service's privacy policy and terms apply.

TikTok, Instagram, Facebook and YouTube embeds and marketing pixels are not currently implemented.

Children

The website is not intended to collect children's data. If you believe a child's data has been submitted without an appropriate basis, contact us so we can review it.

Changes to This Policy

This policy may be updated when website functionality, the contact form, hosting, analytics, marketing technologies or other processing practices change.

Contact and Right to Lodge a Complaint

For privacy questions, contact MaK Boutique at makboutique.split@gmail.com.

If you believe processing is contrary to applicable rules, you may contact the Croatian supervisory authority: Agencija za zaštitu osobnih podataka (AZOP).

Last updated

This page was last updated on September 30, 2026.