1. Data controller
- Provider
- K&J GROUP, storitve, d.o.o.
- Registered office
- Ulica Roberta Hvalca 8, 2000 Maribor, Slovenija
- Company registration number
- 8142165000
- VAT number
- SI38342618
- VAT status
- VAT registered
- Business register
- Poslovni register Slovenije (AJPES)
- Registration court
- Okrožno sodišče v Mariboru
- Share capital
- 7.500,00 EUR
- info@curioluma.com
For questions or to exercise your rights, contact info@curioluma.com.
2. Information we process
- Your name and email address.
- Recipient details and product preferences, including name, age group, occasion, description and style.
- Photos and uploaded filenames when you choose a photo-based book.
- A delivery address for printed products.
- Package, sample, approval, payment and fulfilment details.
- Limited technical and security information, including pseudonymised request records and an audit trail.
3. Purposes and legal bases
We prepare your sample and fulfil orders on the basis of steps requested before entering a contract and performance of the contract. Payment and accounting records are processed for contract performance and legal obligations. Delivery and order notifications support performance of the contract. Portal security, abuse prevention and evidence of confirmations rely on our legitimate interest in a secure, accountable service.
After you enter a valid email address, we may automatically save the current step and a limited summary of your choices for up to 7 days to support your ongoing request. This summary excludes photos, filenames, names, exact age and free text.
Contact messages
We use the name, email address, subject and message you provide to handle your enquiry. Messages are accessible to authorised staff in the private portal and retained for up to 90 days from receipt. They are not used for advertising or automatically sent to OpenAI.
4. Photographs and children
Photos are used only to prepare the requested product and are not published. The person supplying material must have the right or another valid legal basis to use it, including photographs of other people or children.
5. Service providers and recipients
Data may be processed, as necessary, by hosting and maintenance providers, email providers, printers, delivery services, accounting or other legally required recipients, and Stripe when you pay.
Automatic sending to OpenAI is currently disabled. Material stays within CurioLuma and our team prepares the sample manually. This notice will be updated before any later activation.
Online payment is currently disabled; no data is sent to Stripe until you actually initiate a payment.
6. Transfers outside the EEA
Some technology providers may process data outside the European Economic Area. Where this happens, an appropriate transfer mechanism, such as an adequacy decision or standard contractual clauses, is used together with additional safeguards when needed.
7. Retention
- Photos and information for incomplete orders: up to 14 days.
- After completion, rejection or cancellation: up to 30 days, except records that must be retained longer for accounting, tax or legal obligations.
- Technical security and audit records: up to 90 days, unless a specific incident or legal claim requires longer retention.
- A limited summary of an unfinished form: up to 7 days.
After the applicable period, data is deleted or irreversibly anonymised where appropriate.
8. Required information
Required fields are necessary to prepare your sample or fulfil the selected order. We cannot accept an order without them. The initial request alone does not create a payment obligation.
9. Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. Send requests to info@curioluma.com. If you consider processing unlawful, you may complain to the Information Commissioner of the Republic of Slovenia.
10. Automated decisions
CurioLuma does not use automated decision-making with legal or similarly significant effects on individuals. Technical assistance with illustration design is not decision-making about a person.
11. Security and changes
We use restricted access, encrypted transmission, private file storage, time-limited links and audit records. No online system is entirely risk-free. Material changes are accompanied by a new version and effective date.
Optional analytics and advertising
With analytics permission, CurioLuma also records activity linked to your order: arrival from an email and which sample pages you open. These records are visible to our team, are not sent to advertising providers, and are kept for up to 90 days. We do not record your screen, mouse movements or typing. Necessary only declines this too. Without analytics permission, order actions such as approvals, correction submissions and payments are still recorded to process your order.
If enabled by CurioLuma, Google Analytics 4 (Google Ireland) helps us understand site usage. Meta Pixel (Meta Platforms Ireland) and Google Ads (Google Ireland) measure advertising. Each loads only after your permission for that service; analytics is a separate choice from advertising. Necessary only declines all three. You can change or withdraw your choice below without affecting your order.
We measure visits, sample requests and confirmed purchases (amount in EUR including VAT and shipping, plus a pseudonymous event ID). Providers receive technical connection data such as IP address, browser and, where available, consented ad-click identifiers. Photos, descriptions, personal book titles, contact details, payment-card details and private access links are not included. Measurement runs in a separate technical document at api.curioluma.com so advertising scripts cannot read your order page. No advertising scripts run in administration.
- cl_consent_v1: essential choice cookie, up to 180 days; renewed choice after tracking settings change. The choice applies separately on each domain.
- cl_ad_clicks_v1 and cl_ad_sent_v1: consented local storage for ad attribution and duplicate prevention, up to 90 days. cl_ad_pending_v1: pending events for up to 5 minutes in the current tab.
- Meta may use _fbp / _fbc and Google Ads _gcl_* advertising cookies. Browsers may block or shorten their storage. Provider processing and retention are described in their notices below; they may also process data outside the EEA.
- Google Analytics may use _ga and _ga_* analytics cookies, configured for up to 90 days without extending expiry on each visit. Analytics alone does not permit advertising-click storage. Google Signals and advertising personalisation are disabled for this analytics integration.
Meta: cookies · Google: advertising · Google Analytics: data use