Privacy Policy

Last updated: 23 September 2025

1. Who we are (Controller)

Ero Lounge (erolounge.store) is operated by VELES GROUP, obrt za trgovinu i usluge, vl. Alexey Kurdyukov, Milčetići 20, 51511 Malinska, Croatia, OIB 91794538442.

We act as the controller of your personal data.

• Privacy contact: privacy@erolounge.store

• General enquiries: info@erolounge.store

• Order support: orders@erolounge.store

2. What this policy covers

This policy explains how we process personal data when you browse our site, manage cookie consent, create an account, place orders, make payments, receive invoices/updates, or contact us. The website offers products intended for adults (18+).

3. Data we process & purposes

• • Site delivery & security (legitimate interests): IP address, user-agent, requested URLs, timestamps, error/server logs. Used for fraud/abuse prevention, uptime, caching/CDN, and troubleshooting.

  • Consent management (legal obligation/consent): your cookie choices and an audit trail of consent.

  • Analytics/measurement (consent): loaded only after you accept Statistics cookies; used to understand performance and improve the site.

  • Customer accounts & checkout (contract): name, email, billing/shipping address, phone, order contents, notes — needed to process and deliver purchases and provide support.

  • Payments (contract/legal obligation): order ID, amount, currency, status/result; card data is processed by our PCI-DSS compliant payment processor with SCA/3-D Secure where required — we do not store card numbers.

  • Invoicing & compliance (legal obligation/contract): invoice details and tax/accounting records.

  • Support & communications (legitimate interests/contract): your messages and our replies via email and site chat; we send transactional emails (order/invoice/shipping, password resets). Marketing emails are sent only if you opt in and include an unsubscribe link.

4. Recipients (categories)

We share data only with service providers under contracts and appropriate safeguards (as processors where applicable), including:

• Web hosting / security / CDN & email delivery (e.g., hosting provider, CDN, SMTP).

• Payment processing and fraud prevention (e.g., payment processor).

• Analytics/measurement (only if you consent).

• Customer communications & helpdesk/chat.

• Accounting/invoicing tools.

• EU/EEA logistics & fulfilment partners and carriers (to pack/ship your order).

5. International transfers

If a provider processes data outside the EEA, transfers use approved safeguards (e.g., Standard Contractual Clauses and, where required, additional measures). You may request a copy or summary of the relevant safeguards by emailing privacy@erolounge.store.

6. Legal bases (GDPR Art. 6)

• Contract (Art. 6(1)(b)) – accounts, checkout, payments, delivery, support.
• Legal obligation (Art. 6(1)(c)) – invoicing/tax, consumer law.
• Legitimate interests (Art. 6(1)(f)) – site security, fraud prevention, responding to enquiries, essential service improvement, and direct marketing to existing customers (you can object at any time).
• Consent (Art. 6(1)(a)) – analytics/marketing cookies and newsletters (if enabled; you can withdraw consent at any time).

7. Retention

• Orders/invoices: kept as required by applicable accounting/tax law.
• Customer accounts: kept until you request deletion or after 24 months of inactivity, unless legal retention applies.
• Analytics: per the retention settings in the analytics tool and only where consented.
• Support emails/chats: generally up to 12 months after resolution unless legal retention applies.

8. Your rights

You can access, rectify, erase, restrict, port, and object to processing based on legitimate interests. You can withdraw consent at any time (this won’t affect past lawful processing).
Request via privacy@erolounge.store. We may ask for information to verify your identity. You can complain to your local authority or to the Croatian DPA (AZOP).

9. Children

The site is for adults 18+. Do not use or purchase if you are under 18.

10. Cookies & consent

See our Cookie Policy/Statement for details. You can change choices anytime via “Cookie settings” in the footer. Where supported, we honor browser privacy signals for consent preferences.

11. Security

We apply technical and organizational measures appropriate to the risk (TLS/HTTPS, access controls, backups, least-privilege). Card details are processed by our PCI-DSS compliant payment processor with SCA/3-D Secure where required; we do not store card numbers. No method is 100% secure, but we work to protect your data.

12. Data Protection Officer

We are not required to appoint a DPO. For privacy matters, contact privacy@erolounge.store.

13. Sources of data

Data comes from you (forms, checkout, account, support) and from service providers as needed to deliver services (e.g., payment status from the processor, parcel tracking from carriers). Where analytics is enabled, we receive aggregated metrics only after your consent.

14. Automated decision-making

We do not conduct decisions based solely on automated processing that produce legal or similarly significant effects.

15. Updates