Privacy notice

Privacy Policy – Bear & Merlin Webshop

Last updated: 12.08.2025

This Privacy Policy describes how Bear & Merlin (hereinafter: “we”, “our” or “seller”) collects, uses, and protects your personal data when you use our website and services.

1. Data Controller

Bear and Merlin d.o.o.
Ulica Frana Supila 7b, 42000 Varaždin
VAT ID: HR-86325173761
E-mail: info@bear-and-merlin.com

2. Purpose of Data Collection

  • Processing and delivery of orders
  • Issuing invoices and keeping purchase records
  • Sending notifications related to orders (order status, delivery)
  • Responding to inquiries and complaints
  • Fulfilling legal obligations, including the sale of alcoholic beverages (age verification)

3. Data We Collect

  • Full name
  • Delivery address and/or billing address
  • E-mail address
  • Phone number
  • Date of birth
  • Purchase history in our webshop

Note: Credit or debit card data is not stored on our servers. Payments are processed via secure and certified payment service providers (payment gateway).

4. Legal Basis for Processing

  • Contractual obligation (order processing)
  • Legal obligation (tax and accounting regulations)
  • Consent (e.g. for marketing newsletters)
  • Legitimate interest (service improvement, fraud prevention)

5. Cookies

Our website uses cookies to improve user experience and analytics. Details are described in our Cookie Policy.

6. Sharing Data with Third Parties

  • Delivery services (for order delivery)
  • Payment service providers (transaction processing)
  • IT and hosting partners (system maintenance)
  • Accounting and legal services (legal obligations)

All partners we work with are obliged to maintain the confidentiality and protection of your data in accordance with GDPR.

7. Data Retention

  • For as long as necessary to fulfil the contract (order delivery)
  • In accordance with legal retention periods for accounting documentation (10 years)
  • Until the withdrawal of consent for marketing activities

8. User Rights

  • Request access to your data
  • Correct inaccurate or outdated data
  • Request deletion of data (“right to be forgotten”)
  • Restrict data processing
  • Transfer your data to another service provider
  • Object to data processing

To exercise your rights, please contact us using the details in section 1.

9. Data Security

We use technical and organisational security measures to prevent unauthorised access, loss, or misuse of data. Only authorised persons have access to the data.

10. Sale of Alcoholic Beverages – Age Verification

The sale of alcoholic beverages is permitted only to persons over 18 years of age. When purchasing, we may request confirmation of your age and/or identity verification via the delivery service.

11. Changes to the Privacy Policy

We reserve the right to amend this Privacy Policy. All changes will be published on this page with the effective date.

12. Contact

For all questions regarding the processing and protection of personal data, you can contact us at:

E-mail: info@bear-and-merlin.com