This privacy policy explains what information we collect when you visit lelutkasl.com, how we use it, and what rights you have. We have written it in plain language because we want you to understand it.
LeLutka makes virtual fashion goods sold inside Second Life. This website is a brand and reference site. It does not include accounts, logins, checkout, or e-commerce. Purchases happen inside Second Life under Linden Lab's own terms and our store policy.
Data controller
The data controller for personal data collected through this website is the company operating the LeLutka brand, registered in Croatia, contactable at studio@lelutkasl.com. Our full registered company details are available on request. The supervisory authority for data-protection complaints is AZOP, the Croatian Personal Data Protection Agency (azop.hr).
What we collect on this website
Because the site does not require an account or store user data, the information we touch is limited to what your browser sends to any web server.
Our hosting provider (Cloudflare) records standard server access logs for security, abuse prevention, and operational purposes. These logs include:
- Your IP address.
- Your browser type and version.
- The pages you visit and how long you stay on them.
- The date and time of each visit.
- The site that referred you, if any.
We do not place advertising or marketing cookies, we do not run third-party advertising or marketing analytics scripts, and we do not track you across other websites. Our fonts are served from our own domain, not from a third-party font network.
If you download the starter kit from download.lelutkasl.com, Cloudflare R2 logs the same request metadata for that request.
Children
This site is not intended for children. We do not knowingly collect data from anyone under the age of 16. If you believe a child has sent us information, please contact us and we will delete it.
Lawful basis for processing
Where the General Data Protection Regulation applies, we rely on the following lawful bases:
- Legitimate interests, for security, fraud prevention, and basic operation of the website.
- Consent, for any non-essential cookies, where applicable.
- Legitimate interests, for responding to email enquiries you send to us.
- Legal obligation, where we are required to keep or disclose information by law.
Where your information is stored
LeLutka is based in Croatia. Our hosting provider operates a global network. As a result, server logs may be processed in countries outside your own, including outside the European Economic Area. Wherever your data is stored, we apply the same privacy commitments described in this policy and rely on standard contractual clauses or equivalent safeguards where required.
Cloudflare acts as our processor under its published Data Processing Addendum and the European Commission's 2021 Standard Contractual Clauses (Module 2), which together cover any transfer of server-log or analytics data outside the European Economic Area.
How long we keep information
Server access logs for the brand site (lelutkasl.com) are retained only for as long as is needed for security and operational purposes, typically a few weeks.
Cloudflare R2 access logs for the starter kit download (download.lelutkasl.com) are retained on the same short security-and-operations horizon, typically no more than 30 days at the edge.
Any email correspondence you send to us is kept only for as long as is needed to handle your enquiry and any reasonable follow-up, and is deleted when it is no longer needed.
Security
We take reasonable steps to protect any information that passes through this website. The site is delivered over an encrypted connection. No system is perfectly secure, but the small amount of data this website touches keeps the risk surface narrow.
External links
This privacy policy applies only to lelutkasl.com. The website links to external services such as Discord, Bluesky, Flickr, and the Second Life Marketplace. Those services have their own privacy policies and we are not responsible for how they handle your data. We recommend you read their policies before using them.
Your rights
Depending on where you live, you may have rights under the General Data Protection Regulation, the California Consumer Privacy Act, or similar laws. These can include:
- The right to know what we hold about you.
- The right to access a copy of any information we hold.
- The right to ask us to correct inaccurate information.
- The right to ask us to delete your information.
- The right to object to how we use your information.
- The right to data portability, where applicable.
- The right to withdraw consent at any time, where consent is the lawful basis.
- The right to lodge a complaint with a data protection authority.
Because this website does not require an account, in most cases the only information we will hold about you is an email exchange, if you have ever written to us.
If you are in the European Union or the European Economic Area, the supervisory authority you can complain to is AZOP, the Croatian Personal Data Protection Agency (azop.hr). You may also lodge a complaint with the supervisory authority in your country of residence.
California residents
Under the California Consumer Privacy Act, California residents have specific rights, including the right to know what personal information we collect, the right to delete personal information, and the right to non-discrimination for exercising those rights. We have not sold or shared personal information for cross-context behavioural advertising in the preceding 12 months. We do not sell personal information.
The categories of personal information we have collected from California residents in the preceding 12 months, using the CCPA's statutory vocabulary, are limited to: identifiers (such as IP address, served via the standard server-log fields listed above) and internet or other electronic network activity information (such as the pages a visitor browses on lelutkasl.com and Core Web Vitals reported by the Cloudflare Web Analytics beacon for non-EU visitors). We have not collected any of the other categories enumerated by the statute. Because we do not sell or share personal information for cross-context behavioural advertising, no "Do Not Sell or Share" link is required.
Changes to this policy
We may update this policy from time to time. The current version is always posted at lelutkasl.com/privacy. The date at the top of this page shows when it was last updated. If we make a significant change, we will note it on the website.
Contact
For any privacy question or to exercise your rights, please contact us at studio@lelutkasl.com. We will respond within 30 days.