Privacy policy

With this policy, ELWE SPORT d.o.o. (hereinafter: ELWE) informs visitors to its website, clubs and everyone who contacts it about which personal data it processes, for what purposes, on what legal basis, how long it keeps the data and what rights you have. We process data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter: GDPR), the Croatian Act on the Implementation of the General Data Protection Regulation and the Croatian Electronic Communications Act.

When designing the website, we followed the principle of data minimisation: the website has no user accounts for visitors, uses no analytics or advertising tools and does not load content from other companies' servers unless you ask for it.

1. Controller

The controller of personal data is ELWE SPORT d.o.o., Mavri 1/1, Marčelji, 51216 Viškovo, Croatia, PIN 29969969159. For all questions about data protection and to exercise your rights under this policy, contact us at info@elwe.hr, by phone at +385 99 813 4755 or by post at the above address, marked “Data protection”.

2. Visiting the website

On every visit, your browser automatically sends technical data to the server: IP address, date and time of access, the address of the requested page and the type of browser and operating system. This data is processed by Cloudflare, Inc., the website hosting provider, on behalf of ELWE and solely to deliver the website, keep it secure and protect it from attacks.

• Legal basis: ELWE's legitimate interest in the website running reliably and securely (Article 6(1)(f) GDPR).
• Retention: technical logs are kept briefly, only as long as necessary to detect and stop attacks, and are then deleted or anonymised.

The website uses no tracking cookies, does not measure visits and does not create visitor profiles. Fonts and all images are hosted on our server, so your visit does not connect you to Google or other external services. What is stored in your browser is described on the page Cookies and browser storage.

3. Quote requests and contact

When you send us an enquiry using the form on the website, by email or by phone, we process the data you give us: first and last name, the name of your club or company, email address or phone number, the content of your message and the list of models, colours and approximate quantities you have selected.

• Purpose: replying to your enquiry, preparing a quote and agreeing on the kit.
• Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and, for general enquiries, ELWE's legitimate interest in replying to someone who has contacted it (point (f)).
• Retention: for as long as the correspondence continues and no longer than 12 months after the last message if we do not start working together. If an enquiry turns into an order, we keep the data for the periods required for business and accounting records.

A message sent through the form is forwarded directly to our email address and is not stored on the website's server. To protect the form from abuse, the server keeps only a hash of the IP address the message was sent from, for no longer than 15 minutes; the address itself cannot be read from it. Only the fields we need in order to reply to you are required. We cannot reply to an enquiry without contact details; the other fields are optional.

4. Quote list

The models you add to your quote list are stored only in your browser, on your device. ELWE cannot see them until you send your request. You can clear the list at any time on the quote page or by deleting the site data in your browser settings.

5. Working with clubs and producing kit

For the clubs we work with, we process the data of the club's contact persons (first and last name, role in the club, email address and phone number) and the data needed to produce and deliver the kit. When a club orders shirts with players' names and numbers, it sends us a list of names, numbers and sizes. We use this data solely to produce and deliver the kit ordered. The club that provides the data of underage players is responsible for that data and must ensure it was collected lawfully.

• Legal basis: entering into and performing the contract with the club (Article 6(1)(b)) and the legitimate interest of managing the business relationship (point (f)). For issuing invoices and keeping business records, the legal basis is a legal obligation (point (c)).
• Retention: we delete lists of players' names and numbers after the kit has been delivered and the period for complaints about the delivery has expired. Quotes, orders and invoices are kept for the periods required by accounting and tax law.

6. The map on the Contact page

The map on the Contact page is generated on our server from OpenStreetMap data. While you view, zoom or move it, you are not connected to any external service and no cookies are stored. The “Directions” and “OpenStreetMap” links are ordinary links: Google and OpenStreetMap only receive data about your visit once you click them, under their own rules.

7. Social networks and reviews

ELWE has profiles on Instagram (@elwe_sport) and Facebook, and we will list our Google review page here once it is open. The links to social networks on this website are ordinary links: until you click them, the networks receive no data about your visit. When you visit our profile or send us a message, the data is also processed by Meta Platforms Ireland Ltd. under its own rules. For profile visit statistics, ELWE and Meta are joint controllers within the meaning of Article 26 GDPR; ELWE only sees aggregated data, without the identity of individuals.

8. Photos

On the website and on social networks, we publish photos of our kit, models and matches of the clubs we supply. If you recognise yourself in a photo and would like us to remove it, let us know and we will remove it without delay.

9. Who has access to the data

We do not sell data or pass it on to third parties for marketing purposes. Access is limited to people who need the data for their work and to service providers who process data for us under a contract and on our instructions:

• the website hosting provider (Cloudflare, Inc.),
• the email service provider,
• the people who handle ELWE's accounting,
• delivery services, when we ship kit to a club.

We only disclose data to public authorities when required to do so by law.

10. Transfers outside the European Economic Area

The website hosting provider is based in the United States, so the technical data referred to in section 2 may be transferred outside the European Economic Area. The transfer is based on the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses (Articles 45 and 46 GDPR).

11. Security

The website is served exclusively over an encrypted connection (HTTPS). Access to data is limited to the people who need it, and we only collect the data we really need. If you suspect that someone has accessed your data without authorisation, contact us immediately.

12. Children

The website is not intended for children to submit personal data on their own. Enquiries about children's kit are sent by parents, coaches or clubs. If you are under 16, please ask a parent or your club to contact us on your behalf.

13. Automated decision-making

ELWE does not make decisions based solely on automated processing and does not profile visitors or clubs.

14. Your rights

In relation to your personal data, you have the right:

• of access to your data and to obtain a copy (Article 15 GDPR),
• to have inaccurate or incomplete data rectified (Article 16),
• to erasure when there is no longer a basis for processing (Article 17),
• to restriction of processing (Article 18),
• to portability of the data you provided to us on the basis of a contract or consent (Article 20),
• to object to processing based on legitimate interest (Article 21),
• to withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing before the withdrawal.

Send your request to info@elwe.hr. We will reply without undue delay and within one month at the latest. Exercising your rights is free of charge. To protect your data, we may ask you to confirm your identity before acting on your request.

15. Complaints to the supervisory authority

If you believe that our processing of your data breaches the regulations, you can lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), Selska cesta 136, 10000 Zagreb, azop.hr. We would be glad if you contacted us first, so that we can try to resolve the matter directly.

16. Changes to this policy

We will update this policy when we introduce a new service or when regulations require it. The date of the last change is shown at the top of the page.