Legal Information
This Privacy Policy explains how Occhi e mani j.d.o.o., operating the AbbysStore website, collects, uses, stores and protects personal data.
Last updated
4 November 2026
Section 1
The controller responsible for processing personal data through the AbbysStore website is:
Company
Occhi e mani j.d.o.o.
Responsible representative
Filip Golac
Registered address
Prešernova 3, 10000 Zagreb, Croatia
OIB
24328933412
Privacy contact
contact@abbysstore.com
References to “AbbysStore”, “we”, “us” or “our” in this policy refer to Occhi e mani j.d.o.o.
Section 2
We collect only personal data reasonably necessary to operate the website, respond to requests, review card collections, process orders, payments and order inquiries and comply with legal obligations.
Your name, email address, inquiry subject, message and any other information you voluntarily include in your message.
Your first and last name, email address, optional telephone number, country, submitted ManaBox link, CSV/TXT export or pasted list, additional notes and the information contained in the collection list you submit.
Your name, email address, telephone number, delivery address, country, selected products, quantities, selected purchase method and optional order notes.
If you create an account: your name, email address, sign-in details (passwords are stored only in hashed form), saved delivery details, order history, wishlist, want lists and price alerts you set up, Store Credit balance and loyalty records.
When you accept a buying offer: your full name, address, personal identification number (OIB) or equivalent, IBAN where you choose bank payout, the accepted contract and its time of acceptance, shipment and tracking details, the cards received and payout or Store Credit records. If you agree a sale with us on WhatsApp, we also keep the WhatsApp number used to send you the contract link.
If you buy from AbbysStore on Cardmarket or CardTrader, the marketplace gives us your name, delivery address, username and order details so that we can ship the order and issue an invoice.
When you buy in our shop, we record the items, amount, payment method and the fiscalised invoice. Your name or email is recorded only if you ask for an invoice by email or an invoice issued to a company.
Limited technical information may be processed automatically when required for security, error prevention, reliable operation and protection of the website.
Messages and records created when you communicate with AbbysStore regarding products, orders, sales, shipping, complaints or other business matters.
If you use the AbbysStore app for iPhone or Android: your account sign-in, stored securely on your device; the collection and wishlist you choose to save to your account; and the sell lists you send to us (processed as sell requests above). Card searches, card prices and photos used to read a card are handled on your device or sent directly to public card databases (Scryfall, TCGdex, YGOPRODeck, Lorcast) without your name or account details; card photos are not uploaded to AbbysStore. The shopping cart, sell list drafts and price alerts stay on your device until you send a request or go to checkout. The app does not use advertising or tracking. You can delete your account in the app under Account → Delete account.
Please do not submit sensitive personal data, payment-card details, identity documents or information that is not necessary for your inquiry through contact forms or email. Card details for online purchases should be entered only in Stripe checkout.
Section 3
Personal data is processed only where a valid legal basis applies. Depending on the situation, processing may be necessary to respond to your request, enter into or perform a contract, comply with law, protect legitimate business interests or act on your consent.
Purpose
Data
Contact details and message content
Legal basis
Steps taken at your request, legitimate interests and, where applicable, performance of a contract
Purpose
Data
Identity, contact details, country, submitted card list and notes
Legal basis
Steps taken at your request before entering into a potential agreement
Purpose
Data
Contact, delivery, order and product information
Legal basis
Steps taken at your request before entering into a contract and performance of a contract
Purpose
Data
Account, order history, saved lists, alert and credit information
Legal basis
Performance of a contract (the account and the features you choose to use)
Purpose
Data
Identity, address, OIB, IBAN, contract, shipment and card information
Legal basis
Performance of a contract and compliance with accounting and tax obligations for purchased goods
Purpose
Data
Name, delivery, order and invoice information
Legal basis
Performance of a contract and compliance with legal obligations
Purpose
Data
Email address, subscription and consent records, unfinished checkout contents
Legal basis
Your consent, which you can withdraw at any time
Purpose
Data
Correspondence, transaction and complaint information
Legal basis
Performance of a contract, compliance with legal obligations and legitimate interests
Purpose
Data
Transaction, invoice and legally required customer information
Legal basis
Compliance with applicable legal obligations
Purpose
Data
Limited technical, access and security information
Legal basis
Legitimate interest in protecting the website, business and users
Where information is required to prepare or perform a contract, failure to provide it may prevent us from processing your order, collection review or other request.
Section 4
We do not keep personal data longer than necessary for the relevant purpose. Retention may be extended where required by accounting, tax, consumer-protection or other applicable laws, or where necessary for legal claims.
Unless the communication becomes relevant to an order, contract, complaint, legal claim or another legal obligation.
Retention
Up to 24 months
This allows AbbysStore to review the request, continue correspondence and respond to follow-up questions.
Retention
Up to 24 months
Unless longer retention is necessary for dispute handling, fraud prevention or legal claims.
Retention
Up to 24 months
Where information forms part of invoices, accounting documents, business books or legally required transaction records.
Retention
At least 11 years
They form part of the accounting records for purchased goods, including second-hand goods sold under the margin scheme.
Retention
At least 11 years
Saved lists, alerts and preferences are deleted with the account. Orders and invoices linked to the account are kept as accounting records.
Retention
Until you delete the account
Only information reasonably necessary to establish, exercise or defend legal claims is retained.
Retention
Until final resolution and expiry of relevant limitation periods
Withdrawal does not affect processing that was lawful before withdrawal.
Retention
Until consent is withdrawn
When a retention period expires, data is deleted, anonymised or securely restricted unless continued storage is legally required.
Section 5
We do not sell or rent personal data. Information may be shared only where necessary with trusted recipients that support our operations or where disclosure is required by law.
Gmail is used to receive, send and store business correspondence. Resend sends automated emails such as order and buylist confirmations, offers, shipping updates, alerts and newsletters.
Vercel hosts the website. Supabase stores the database, customer accounts and uploaded files. They process data only to provide these services to us.
Stripe processes online card payments. Order, contact and payment information needed to complete the payment is shared with Stripe. AbbysStore receives payment references and status information but does not store full card details.
Accountants, legal advisers or other professional service providers may receive data where necessary for compliance, advice or dispute resolution.
Invoices are issued through the e-računi invoicing service. Invoice data (name, address, OIB for businesses, items and amounts) is processed there and fiscalised with the Croatian Tax Administration where required.
If you choose to contact us or agree a buylist on WhatsApp, WhatsApp (Meta) processes those messages under its own terms.
Data may be disclosed to courts, tax authorities, regulators, law-enforcement bodies or other competent authorities where legally required.
Name, phone number, email and delivery address are provided to BOX NOW or another selected postal or courier provider to deliver orders and buylist shipments and to send tracking updates.
Cardmarket and CardTrader process your data under their own privacy terms when you buy through them, and share with us the details needed to ship and invoice your order. Our stock and prices are synchronised with them without customer data.
Some service providers may process data outside the European Economic Area. Where applicable, we rely on lawful transfer mechanisms and appropriate safeguards required by data protection law.
Section 6
Subject to the conditions and limitations provided by applicable law, you may exercise the following rights:
You may ask whether we process your personal data and request a copy of the data and relevant processing information.
You may request correction of inaccurate data or completion of incomplete personal data.
You may request deletion where the data is no longer necessary, consent has been withdrawn or another applicable condition is met.
You may request that processing be restricted in circumstances provided by applicable data protection law.
Where applicable, you may request personal data you provided in a structured, commonly used and machine-readable format.
You may object to processing based on legitimate interests. We will stop unless compelling legitimate grounds or legal claims require continued processing.
Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.
You may lodge a complaint with the Croatian Personal Data Protection Agency or another competent supervisory authority.
Send your request to contact@abbysstore.comOpen contact form. Clearly describe the right you wish to exercise. We may ask for reasonable information necessary to verify your identity before acting on the request.
Section 7
We apply reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, misuse or access.
Personal data is accessible only where reasonably necessary for business purposes.
We use reputable communication, hosting and infrastructure services.
We request only information reasonably necessary for the relevant purpose.
No internet transmission or storage system can be guaranteed to be completely secure. Users should avoid sending payment-card information, passwords or unnecessary sensitive data through contact forms or email.
Section 9
Please contact us first if you have a question or concern about how your personal data is processed:
You also have the right to lodge a complaint with the Croatian supervisory authority:
Croatian Personal Data Protection AgencySection 10
This Privacy Policy may be updated when website features, processing activities, service providers or legal requirements change.
The current version will always be published on this page. The date shown at the beginning of the policy indicates when it was most recently updated.
Contact AbbysStore for access, correction, deletion or another privacy-related request.
Submit a Privacy Request