Last updated: 30 October 2025

ZOO305 (“we,” “us,” “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit zoo305.com, purchase products, book camps, or interact with our content, emails, and social channels.

If you have questions, contact us at zoran@kubekreative.com.

Who we are (Controller):
ZOO305 (trading name) operated by Kube Kreative Corp. (or your applicable legal entity)
Registered in: USA (primary operations April–October)
Email: zoran@kubekreative.com

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Croatian/EU laws.

1) Data we collect

a) Data you provide directly

  • Account & checkout data: name, email, phone, billing/shipping address, company name, VAT ID (if provided).
  • Order data: items purchased, size selections, personalization notes (if any), delivery instructions.
  • Booking & membership data: preferred dates, fitness goals, emergency contact (if you collect it—optional), membership tier.
  • Support & correspondence: messages sent via forms, email, or chat.
  • Marketing preferences: newsletter opt-in/opt-out.

b) Data we collect automatically

  • Usage data: pages viewed, clicks, referring URL, time on page, approximate geolocation (country/region).
  • Device/technical data: IP address, browser type/version, device type, operating system.
  • Cookies & similar technologies: for essential site functionality, analytics, remembering cart/session, and marketing (see Cookies below).

c) Data from third parties

  • Payment processors (e.g., Stripe/PayPal): payment status, last 4 digits of card, expiration, transaction ID (we do not store full card numbers).
  • Email service providers (e.g., Mailchimp/Sendinblue): email engagement (opens/clicks), unsubscribe status.
  • Analytics/ads partners (e.g., Google Analytics, Meta): aggregated stats, ad attribution.

2) Purposes & legal bases (GDPR Art. 6)

  • Provide the site, shop, and services (manage accounts, process orders, deliver goods, handle bookings/camps).
    Legal basis: Contract performance (Art. 6(1)(b)); legitimate interests (site operation).
  • Payments & fraud prevention.
    Legal basis: Contract performance; legitimate interests (fraud prevention).
  • Customer support & communications (order updates, service messages).
    Legal basis: Contract performance; legitimate interests.
  • Marketing & newsletters (only if you opt in; easy opt-out anytime).
    Legal basis: Consent (Art. 6(1)(a)); legitimate interests for similar-product emails to existing customers where permitted.
  • Analytics & improvement (measure performance, fix bugs, improve UX, plan inventory).
    Legal basis: Legitimate interests; consent where local law requires for non-essential cookies.
  • Legal obligations (tax, accounting, regulatory requests).
    Legal basis: Legal obligation (Art. 6(1)(c)).
  • Security (detect, prevent, and respond to security incidents).
    Legal basis: Legitimate interests.

3) How we share data

We share personal data with trusted processors only as needed to operate the site and fulfill your requests:

  • E-commerce & hosting: WooCommerce/WordPress, web host/CDN, website security & backup tools.
  • Payments: Stripe, PayPal (or your chosen provider).
  • Fulfillment & logistics: shipping carriers, warehouse/print partners (if used).
  • Email & CRM: Mailchimp/Sendinblue (newsletters, service emails).
  • Analytics & advertising: Google Analytics, Meta (Facebook/Instagram) Ads (pseudonymized/aggregated where possible).
  • Professional services: accountants, legal advisors, only as necessary.

We require processors to protect data under GDPR-compliant terms. We do not sell personal data.

4) International transfers

Some providers may process data outside the EU/EEA. Where this occurs, we rely on adequacy decisions, Standard Contractual Clauses (SCCs), and additional safeguards as required by GDPR.

5) Data retention

  • Orders, invoices, tax records: kept for the period required by law (typically 6–11 years depending on jurisdiction).
  • Accounts & membership: kept while your account is active and for a reasonable period thereafter to handle inquiries or reactivation.
  • Marketing data: until you withdraw consent or opt out.
  • Support emails: typically 24 months unless needed longer to resolve issues or meet legal obligations.
    We securely delete or anonymize data when no longer needed.

6) Your rights (EU/EEA)

Subject to conditions and exemptions under GDPR, you have the right to:

  • Access your personal data and obtain a copy.
  • Rectify inaccurate or incomplete data.
  • Erase data (“right to be forgotten”).
  • Restrict processing in certain circumstances.
  • Object to processing based on legitimate interests or direct marketing.
  • Data portability for data you provided to us.
  • Withdraw consent at any time (for consent-based processing).
    To exercise rights, email zoran@kubekreative.com. You also have the right to lodge a complaint with your local Data Protection Authority (in Croatia: AZOP).

7) Cookies & similar technologies

We use:

  • Essential cookies (required for site security, cart/session, checkout).
  • Analytics cookies (to understand usage and improve performance).
  • Marketing/advertising cookies (to show relevant promotions and measure campaigns).

On your first visit, we display a cookie consent banner where you can accept, reject, or customize non-essential cookies. You can change preferences anytime via “Cookie Settings” in the footer. Browser settings also allow you to block cookies (site may not function properly without essential cookies).

(Add a separate “Cookie Policy” page if you prefer, listing cookie names, providers, purpose, and lifespan.)

8) Payments

All card payments are processed by certified payment processors (e.g., Stripe/PayPal). We do not store full credit-card numbers. Processors use industry-standard security and are PCI-DSS compliant.

9) Security

We implement appropriate technical and organizational measures to protect personal data, including HTTPS encryption, limited access controls, and regular updates/backups. No system is 100% secure; we monitor and improve protections continuously.

10) Children’s privacy

Our site and camps are not directed to children under 16. We do not knowingly collect data from children under 16 without verifiable parental consent. If you believe a child has provided data, contact us to delete it.

11) Seasonal operations notice

ZOO305 operates on-site in Croatia from mid-April to end of October. Off-season (November–March) services focus on remote training, digital content, and shop operations. This does not change your GDPR rights or our security/retention practices.

12) Third-party links & social media

Our site may link to third-party websites or social platforms. Their privacy practices are governed by their own policies. Please review them before providing personal data.

13) Changes to this Policy

We may update this Policy from time to time. Material changes will be highlighted on this page (and/or via email where appropriate). Please review periodically.

14) Contact

Data Controller: ZOO305 / Kube Kreative Corp. (update to your legal entity)
Email: zoran@kubekreative.com
Postal address: Kube Kreative Corp. 1000 Brickell Ave, Ste: 715, Miami, FL 33131, USA

For EU/EEA users, you may also contact your local Data Protection Authority.

Optional add-ons you may want (tell me if you want me to include them now):

Cookie Policy table with exact cookies, lifespans, and providers.

Data Processing Addendum (DPA) summary for B2B group bookings.

Health/Emergency data clause (if you collect medical info for camps).

Photography consent (if you publish participant photos).