Last updated 2 October 2026
Privacy policy
We collect as little as we need to run the shop and keep you informed, and we never sell your data. This page explains what we collect, why, who helps us, and what you can ask of us.
Who we are
Crêt & Cime is run by [Ahmed Chikha], [Stupska do br.6], [71000] Sarajevo, Bosnia and Herzegovina. We are responsible for your personal data on this website (the "controller").
For anything about your data, write to chikhawr@gmail.com. We reply within one month, usually much sooner.
What we collect and why
When you join our list
We collect your email address and record when you gave consent. If you arrived from one of our ads, we also note which campaign brought you, so we know which ads work. We use this to send you news about Crêt & Cime, early access to new drops and your welcome code.
Legal basis: your consent. You can withdraw it at any time with the unsubscribe link in every email, or by writing to us. Our email provider records whether emails are opened or links clicked, which helps us send fewer, better emails.
When you place an order
We collect your name, delivery address, email address, what you ordered and the payment status. We use this to produce and deliver your order, to send order and shipping emails, to handle returns, and to keep the accounting records the law requires.
Legal basis: performing our contract with you, and our legal obligations for tax and accounting records.
When you pay
Payments are handled by PayPal, including card payments made without a PayPal account. PayPal processes your payment details as an independent controller under its own privacy policy. We receive your name, email, delivery address and a transaction reference. We never see or store your card details.
When you write to us
We use your email and message to answer you. Legal basis: our legitimate interest in replying to you, or taking steps you ask for before an order.
When you visit the site
Our hosting provider processes technical data such as your IP address, browser type and the pages requested, to deliver the site and protect it from attacks. Legal basis: our legitimate interest in a secure, working website.
Cookies and tracking
We don't use analytics, advertising or tracking cookies, and we don't use tools like Meta Pixel or Google Analytics. Our fonts are hosted on our own server, so loading the site doesn't contact Google.
- The site stores one small note in your browser's session storage so the opening animation plays only once per visit. It is deleted when you close the tab.
- Your bag is kept only in the open page and is not stored.
- When you pay, PayPal's checkout loads from PayPal and may use its own cookies, under PayPal's policy.
If we ever add analytics or advertising tools, we will ask for your consent first.
Who helps us
We share data only with the companies we need to run the shop, and only what each one needs.
| Company | What they do | Data |
|---|---|---|
| Brevo SAS, France | Newsletter and order emails | Email, name, consent record, email activity |
| Cloudflare, Inc., USA | Hosting, security, order processing | Technical data, order details in transit |
| Printful | Making and shipping your order, from facilities in Europe and the USA | Name, delivery address, email, items ordered |
| PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg | Payments (independent controller) | Payment and contact details |
| Delivery companies chosen by Printful | Delivering your parcel | Name, delivery address, sometimes email or phone for tracking |
Some of these companies process data outside Bosnia and Herzegovina and the EU, mainly in the USA. Where that happens, the transfer is protected by safeguards recognised under data protection law, such as the EU's standard contractual clauses or an adequacy decision.
How long we keep it
- Newsletter: until you unsubscribe. We keep a record of your consent for as long as we may need to prove it.
- Orders: as long as tax and accounting law in Bosnia and Herzegovina requires.
- Messages to us: until your question is resolved, then up to one year in case you follow up.
- Technical data: for the short periods our hosting provider keeps security logs.
Your rights
You can ask us to:
- show you the data we hold about you, and give you a copy
- correct data that is wrong
- delete your data, unless we must keep it by law (for example order records)
- limit how we use your data, or object to a use based on our legitimate interests
- send your data to you or another company in a common format
- withdraw your consent at any time, without affecting anything done before
Write to chikhawr@gmail.com. We may ask you to confirm your identity before acting on a request.
Complaints
If you think we've mishandled your data, please tell us first so we can fix it. You also have the right to complain to the Personal Data Protection Agency of Bosnia and Herzegovina (Agencija za zaštitu ličnih/osobnih podataka u BiH, azlp.ba). If you live in the EU, you can also complain to the data protection authority in your country.
Children
Our shop and newsletter are not meant for anyone under 16, and we don't knowingly collect their data.
Changes
We'll update this page when how we handle data changes, and show the new date at the top. If a change matters to you, for example a new use of your email, we'll tell you by email first.