Last updated: 25 September 2026
1. Introduction and Data Controller
Welcome to MightyLu j.d.o.o. (“we,” “our,” “us”). We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you visit our website www.mightylu.com (the “Site”) and purchase our fitness equipment, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR.
The data controller is MightyLu j.d.o.o., Dobrinjska ulica 17, 10000 Zagreb, Croatia, OIB 26937773008, email: info@mightylu.com.
2. Information We Collect
- Identification and contact data: name, email address, phone number, shipping address and billing address.
- Order and transaction data: products purchased, order history, payment method and payment status. Card payments are processed by our payment provider; we do not see or store your full card details.
- Customer account data: if you create an account, your login details and saved addresses.
- Communication data: messages you send us by email, phone or via the Site, including complaints and withdrawal notices.
- Newsletter data: your email address and consent, if you subscribe to our newsletter.
- Technical and usage data: IP address, browser type, device, language and information about how you use the Site, collected through cookies and similar technologies where you have given consent (see our Cookie Policy).
3. Purposes and Legal Bases
- Processing and delivering your order, payments, returns and customer support – performance of a contract (Art. 6(1)(b) GDPR).
- Invoicing, accounting and tax records, handling legal guarantee claims – compliance with legal obligations (Art. 6(1)(c) GDPR).
- Site security, fraud prevention and enforcing our rights – our legitimate interests (Art. 6(1)(f) GDPR).
- Analytics (Google Analytics) and advertising (Meta Pixel) – your consent given through our cookie banner (Art. 6(1)(a) GDPR).
- Newsletter – your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email.
You may withdraw any consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
4. Who We Share Your Data With
We share personal data only with service providers who process it on our behalf and under our instructions, or where required by law:
- Payment providers: WooPayments (Automattic) and its processing partner Stripe, for card and Google Pay payments.
- Delivery companies: DPD and GLS, to deliver your order (name, address, phone number, email).
- Analytics and advertising: Google (Google Analytics) and Meta Platforms (Meta Pixel), only with your consent.
- Newsletter: Mailchimp (Intuit), only if you subscribe.
- Consent management: CookieYes, to record your cookie preferences.
- Hosting and IT maintenance providers of our Site.
- Accounting and legal advisers, and public authorities where required by law.
- Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred to the new owner.
5. Transfers Outside the EU/EEA
Some of our service providers (for example Google, Meta, Stripe and Mailchimp) may process data in the United States. Such transfers are based on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
6. How Long We Keep Your Data
- Order, invoice and accounting records: for the period required by Croatian accounting and tax legislation.
- Data related to complaints and the legal guarantee: for as long as claims can be made, and until they are resolved.
- Customer account data: until you delete your account or ask us to delete it.
- Newsletter data: until you unsubscribe.
- Cookie data: for the periods stated in our Cookie Policy.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, use, or disclosure, including encrypted (HTTPS) connections. However, no data transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.
8. Your Rights
You have the following rights regarding your personal data:
- Access: you can request access to the personal data we hold about you.
- Rectification: you can request correction of inaccurate or incomplete data.
- Erasure: you can request deletion of your personal data, subject to our legal obligations.
- Restriction: you can request restriction of processing in certain circumstances.
- Portability: you can request the transfer of your personal data to another party.
- Objection: you can object to processing based on our legitimate interests.
- Withdrawal of consent: you can withdraw your consent at any time, for example via the cookie settings or the unsubscribe link in our emails.
To exercise these rights, please contact us at info@mightylu.com. You also have the right to lodge a complaint with a supervisory authority, in Croatia the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or the authority in your country of residence.
9. Cookies and Tracking Technologies
We use cookies and similar technologies. Non-essential cookies (analytics and advertising) are only set after you give your consent in our cookie banner, and you can change your choice at any time. Details are available in our Cookie Policy.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this policy periodically.
11. Contact Us
If you have any questions or concerns about this Privacy Policy, please contact us at:
MightyLu j.d.o.o.
Dobrinjska ulica 17
10000 Zagreb, Croatia
Email: info@mightylu.com
Phone: +385 91 613 4554
