Privacy policy

Last updated: 1 November 2026

This page explains what personal data I collect through customk.co, why, and what your rights are. I only collect what I need to answer you, deliver your order and keep my books.

Who's responsible

Karmela Josipović, running Custom K, obrt za dizajnerske i ostale usluge, vl. Karmela Josipović, Zorkovačka ulica 2, 10000 Zagreb, Croatia, OIB 58016043773. For anything about your data, write to [email protected].

What I collect and why

When you write to me (the site forms, Made for You, email or social media): your name, email address and message, and for Made for You the brief you put together. I use them to answer you and, for Made for You, to talk your idea through and prepare an offer and a quote. Legal basis: steps you ask for before a possible contract (Art. 6(1)(b) GDPR) and, for general questions, my legitimate interest in replying (Art. 6(1)(f)). Kept for up to 2 years after our last message, unless it leads to an order.

Photos and drawings you upload through Made for You: they're stored privately, never public, and only I see them. Before a photo leaves your device, your browser scales it down and strips its hidden data (EXIF), including the location where it was taken. Photos you pick but never send are deleted automatically within about a day. Photos you send are kept together with your request, for the same time as the messages above, and I delete them sooner whenever you ask. Legal basis: the same as for your request (Art. 6(1)(b)). While you put a brief together, your browser keeps it on your device (photos excluded); see the Cookie policy.

When you buy something: your name, email, phone number if you give it, delivery and billing address, what you ordered and whether it's paid. I don't see or store your card details. I use this to prepare and ship your order, handle returns and complaints, issue invoices, and email you links to your orders when you ask for them under Your orders. Your browser also remembers the orders you open there (order number and link only); see the Cookie policy. Legal basis: our contract (Art. 6(1)(b)) and my duties under tax and accounting law (Art. 6(1)(c)). Kept for as long as Croatian tax and accounting law requires me to keep records.

Gift cards: when you buy one, your name and email, the recipient's name and email if you send it to someone, the delivery date and your message. I use them to deliver the card, resend it if it's lost and keep track of its balance. Legal basis: our contract (Art. 6(1)(b)) and my duties under tax and accounting law (Art. 6(1)(c)). Kept while the card is valid and, for the sale itself, for as long as Croatian tax and accounting law requires me to keep records.

Discount codes: when a code is once per customer or only for newsletter subscribers, the email you enter with it. I check it against the newsletter list (for a subscribers' code) and keep only a scrambled fingerprint of it with the code, never the address itself, so the code can't be used twice with the same email. Legal basis: the discount you ask for (Art. 6(1)(b)). The fingerprint is kept for as long as the order it was used on.

Newsletter and waitlist: your email address, only if you sign up and confirm it. I use it to send you new drops and news from the studio, and to tell you when commissions reopen if they're closed. Legal basis: your consent (Art. 6(1)(a)). Kept until you unsubscribe; every email has an unsubscribe link.

Booth competitions (such as the Pac-Man high-score game at a fair): your first and last name and email address, and the scores you play. I use them to run the leaderboard and to contact the winner. The public leaderboard shows only your first name, the initial of your surname and your player tag. Entering also signs you up to the newsletter, which you confirm by email and can leave at any time (see above). Legal basis: running the competition you enter (Art. 6(1)(b)) and your consent for the newsletter (Art. 6(1)(a)). Your browser remembers your player tag; see the Cookie policy. Competition entries and scores are deleted once the prize has been handed over.

Analytics: only if you accept analytics cookies, I use Google Analytics to see how the site is used. Legal basis: your consent (Art. 6(1)(a)). Details are in the Cookie policy.

Error reports: if a page breaks in your browser, the site sends me a technical report through Sentry: what went wrong, the page address, and your browser and operating system. It doesn't include your name, email or IP address. Each page view also sends Sentry an anonymous "page loaded" signal, so I can see how often errors happen. If you've accepted analytics cookies, the report also has a short replay of the minute before the error, with all text and images hidden. Legal basis: my legitimate interest in a site that works (Art. 6(1)(f)), and your consent for the replay (Art. 6(1)(a)). Kept for up to 90 days.

Visiting the site: the services that host and protect the site process technical data such as your IP address and browser type, to deliver the pages and to block abuse and spam. Legal basis: my legitimate interest in a working, secure site (Art. 6(1)(f)). These logs are kept only briefly and aren't used to identify you.

Who I share it with

Only with services that help me run the shop, and only what they need:

• Stripe, for payments. Stripe also processes payment data under its own privacy policy.
• The carrier delivering your parcel (GLS or Hrvatska pošta): your name, address and contact details for delivery updates.
• My email and newsletter providers, to send and receive messages.
• Microsoft Azure and Cloudflare, which host the site and keep it fast and secure. Photos uploaded through Made for You are kept in private Microsoft Azure storage. Cloudflare Turnstile also checks that the forms, photo uploads, gift card purchases and gift card balance checks are sent by a person, not a bot.
• Google, for analytics, only with your consent.
• Sentry (Functional Software, Inc.), for error reports. They are stored in Sentry's EU data centre in Germany.
• My accountant and the tax authorities, for invoices, as the law requires.

I never sell your data or use it for advertising.

Data outside the EU

Some of these providers (such as Google, Stripe, Microsoft, Cloudflare and Sentry) may process data in the United States. These transfers are protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Your rights

You can ask me for a copy of your data, and ask me to correct it, delete it, limit how I use it or send it to you in a portable format. You can object to uses based on my legitimate interest, and withdraw your consent at any time (this doesn't affect what happened before). Just email [email protected]; I'll reply within one month.

If you think I've mishandled your data, you can complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr) or to the data protection authority in your EU country.

Good to know

• You don't have to give me any data, but I can't answer you or deliver an order without your contact and delivery details.
• I don't make automated decisions about you or build profiles.
• The site isn't meant for children under 16.
• If this policy changes, the new version is posted here with a new date.