PRIVACY POLICY

Nurtured You

Last updated: 23 September 2026

This policy explains what personal data we collect when you visit nurturedyou.co, why we collect it, who we share it with, and what rights you have over it. It is written to be read, not skimmed. If anything here is unclear, email lorenav.zg@gmail.com and we will explain it in plain words.

1. WHO WE ARE

1.1 This website is run by Lorena Vukić, trading as Nurtured You.

1.2 Our contact details are:

1.3 Under the General Data Protection Regulation (GDPR), Lorena Vukić is the data controller for the personal data described in this policy. That means she decides why and how your data is used, and she is responsible for protecting it.

1.4 Nurtured You currently operates as an individual business activity and is not yet entered in the Croatian craft or court register. When registration is complete, this page will be updated with the registration details and tax number.

1.5 We have not appointed a Data Protection Officer. We are not required to have one. Send all privacy questions to lorenav.zg@gmail.com.

2. WHAT DATA WE COLLECT AND WHY

2.1 Visiting the website

This website is hosted by Squarespace. Squarespace collects personal information when you visit, including information about your browser, network and device, the web pages you visited before arriving here, the web pages you view while here, and your IP address. Squarespace needs this data to run the website and to protect and improve its platform. Squarespace's privacy policy is at squarespace.com/privacy.

Legal basis: our legitimate interest in running a secure, working website.

2.2 Site analytics

This website collects personal information to power site analytics: information about your browser, network and device, the web pages you visited before arriving here, and your IP address. It may also include details of how you use the site, such as clicks, internal links, pages visited, scrolling, searches and timestamps. This information goes to Squarespace, our website analytics provider, and to Google Analytics, so we can understand how many people visit and which parts of the site they use.

Legal basis: your consent, given through the cookie banner. Analytics cookies are not placed until you accept them.

2.3 Waitlist and contact forms

When you join the waitlist or send us a message through a form on this website, we collect your first name, last name and email address, along with anything you write in the message field. We use this to reply to you, to send you the free Colour Analysis video and PDF fabric guide, and to tell you when the sewing pattern is released. This goes to Squarespace, our website hosting provider, and is stored in our Squarespace account. We do not send form submissions to any other company.

Legal basis: your consent when you submit the form, and our legitimate interest in answering people who contact us.

2.4 Spam protection on forms

Our forms are protected by Google reCAPTCHA Enterprise, which tells real people apart from automated bots. To do this, Google receives information about your browser, network and device, your IP address, and how you interact with the page. Google's privacy policy is at policies.google.com/privacy.

Legal basis: our legitimate interest in keeping the site free of spam and abuse.

2.5 Marketing emails

If you tick the newsletter box, we send you emails about new patterns, resources and updates. Every email has an unsubscribe link at the bottom, and you can use it at any time. We provide your name and email address to Squarespace, our email marketing provider, so it can send these emails on our behalf. Squarespace records whether you opened an email and whether you clicked a link, so we can see what people find useful.

Legal basis: your consent, which you can withdraw at any time by unsubscribing or by emailing lorenav.zg@gmail.com.

2.6 Buying a digital sewing pattern

When you buy a digital sewing pattern on this website, we collect the personal data needed to complete and record the sale: your name, email address, billing address, country, and details of what you bought. This goes to Squarespace, which hosts the online store, and to Stripe, which processes the payment.

We never see or store your full card number. Stripe handles card details directly under its own security standards. Stripe's privacy policy is at stripe.com/privacy.

Legal basis: performance of the contract between you and us, and our legal obligation to keep accounting records.

2.7 Advertising and measurement

This website uses the Meta Pixel and the Pinterest tag.

The Meta Pixel tells us how many people visited the site or joined the waitlist after seeing one of our posts or ads on Facebook or Instagram, and lets us show ads to people who have visited before. It sends Meta information about your browser and device, your IP address, the pages you view here, and actions you take, such as submitting the waitlist form. Where automatic advanced matching is switched on, Meta also receives a scrambled, unreadable version of the email address or phone number you type into a form, which Meta uses to match the action to an account. Meta's privacy policy is at facebook.com/privacy/policy.

The Pinterest tag does the same job for Pinterest. It sends Pinterest information about your browser and device, your IP address, and the pages and actions you complete here, so we can measure which Pins bring people to the site. Pinterest's privacy policy is at policy.pinterest.com/en/privacy-policy.

Meta and Pinterest each decide, independently of us, how they use the data they receive through these tools. For some of this processing we and Meta act as joint controllers, meaning you can exercise your rights with either of us.

Legal basis: your consent, given through the cookie banner. Neither tool loads until you accept marketing cookies.

2.8 Pinterest save buttons

Images on this website show a Pinterest save button when you hover over them, so you can pin them to your own boards. When the page loads, Pinterest receives information about your browser and device, your IP address, and the page you are viewing.

Legal basis: your consent, given through the cookie banner.

2.9 Embedded video

This website embeds video from YouTube. When a page with a video loads, YouTube and Google receive information about your browser, network and device, your IP address, and the page you are viewing, whether or not you press play. YouTube's terms and Google's privacy policy explain what they do with it. Google's privacy policy is at policies.google.com/privacy.

Legal basis: your consent, given through the cookie banner.

2.10 Fonts

This website serves and renders fonts using Google Fonts. To display the site to you, Google may receive information about your browser, network or device, information about the page you are viewing, and your IP address.

Legal basis: our legitimate interest in displaying the website correctly.

2.11 What we do not collect

We do not ask for health information, and we do not want you to send it to us. We do not collect data revealing your racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation. Please do not include information like this in a form or an email to us.

3. WHO WE SHARE DATA WITH

3.1 We do not sell your personal data. We do not trade it, and we do not share it with anyone for their own marketing.

3.2 We share data with the following companies, which process it on our behalf or as independent controllers:

  • Squarespace Ireland Limited and Squarespace, Inc. Website hosting, forms, analytics, online store and email marketing. squarespace.com/privacy

  • Stripe Payment processing for pattern sales. stripe.com/privacy

  • Meta Platforms, Inc. and Meta Platforms Ireland Limited Advertising measurement through the Meta Pixel. facebook.com/privacy/policy

  • Pinterest, Inc. and Pinterest Europe Ltd. Advertising measurement through the Pinterest tag, and the save buttons on images. policy.pinterest.com/en/privacy-policy

  • Google LLC and Google Ireland Limited Analytics, reCAPTCHA spam protection, Fonts and embedded YouTube video. policies.google.com/privacy

3.3 We may also disclose personal data if the law requires it, if a court or public authority orders it, or if we need to establish, exercise or defend a legal claim.

3.4 If the business is ever sold or transferred, personal data may transfer with it. You will be told before that happens, and this policy will be updated.

4. INTERNATIONAL TRANSFERS

4.1 Some of the companies listed in section 3 are based in the United States or store data there. That means your personal data may be transferred outside the European Economic Area.

4.2 Where that happens, the transfer is protected by one or both of the following safeguards:

  • The EU Commission's Standard Contractual Clauses, which are contractual protections approved by the European Commission.

  • The EU-US Data Privacy Framework, where the company receiving the data is certified under it.

4.3 You can ask us for more detail about the safeguards that apply to a particular transfer. Email lorenav.zg@gmail.com.

5. HOW LONG WE KEEP DATA

5.1 We keep personal data only as long as we need it, then delete it.

What How long we keep it Waitlist and newsletter subscribers Until you unsubscribe or ask to be removed. We then delete your details within 3 months. If you have not opened an email from us in 3 years, we remove you anyway. Form messages and email enquiries 2 years from our last contact with you, unless the exchange becomes part of a contract or a dispute. Order records, invoices and payment records 11 years from the end of the financial year the sale falls in, because Croatian accounting law requires it. Website analytics data Squarespace and Google Analytics hold this under their own retention periods. Cookie lifetimes are listed in our Cookie Policy. Advertising measurement data Meta and Pinterest hold this under their own retention periods, described in their privacy policies. Cookies on your device For the periods listed in our Cookie Policy, or until you delete them.

5.2 If you ask us to delete your data and we are required by law to keep part of it, such as an invoice, we keep only that part and delete the rest.

6. YOUR RIGHTS

6.1 If you are in the European Economic Area or the United Kingdom, you have the following rights over your personal data:

  • Access. You can ask for a copy of the personal data we hold about you.

  • Correction. You can ask us to fix data that is wrong or incomplete.

  • Deletion. You can ask us to delete your data. This is sometimes called the right to be forgotten.

  • Restriction. You can ask us to pause how we use your data while a question about it is resolved.

  • Objection. You can object to processing we carry out on the basis of legitimate interest. You can object to direct marketing at any time, and we will stop.

  • Portability. You can ask us to send the data you gave us to you, or to another provider, in a common machine-readable format.

  • Withdraw consent. Where we rely on your consent, you can withdraw it at any time. That does not affect anything we did before you withdrew it.

  • Automated decisions. We do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal effects for you.

6.2 To use any of these rights, email lorenav.zg@gmail.com. We reply within one month. If your request is complicated we may need two further months, and we will tell you if that happens.

6.3 We do not charge for this. If a request is clearly unfounded or repetitive, we may charge a reasonable fee or refuse it, and we will explain why.

6.4 We may ask you to confirm your identity before we act, so that we do not hand your data to someone else.

6.5 Complaints. If you think we have handled your data badly, please tell us first at lorenav.zg@gmail.com so we can put it right. You also have the right to complain to a supervisory authority:

  • In Croatia: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr

  • In the United Kingdom: Information Commissioner's Office, ico.org.uk

  • Elsewhere in the EEA: the data protection authority of the country you live in.

7. CALIFORNIA RESIDENTS

7.1 If you live in California, the California Consumer Privacy Act as amended by the CPRA gives you these rights:

  • Right to know what personal information we have collected about you, where it came from, why we collected it, and who we shared it with.

  • Right to delete the personal information we hold about you, subject to legal exceptions.

  • Right to correct personal information that is inaccurate.

  • Right to opt out of the sale or sharing of personal information, and of targeted advertising.

  • Right not to be discriminated against for using any of these rights. We will not give you a worse price or a worse service.

7.2 We do not sell personal information for money. The Meta Pixel and the Pinterest tag may count as "sharing" personal information for cross-context behavioural advertising under California law. You can opt out of this by refusing marketing cookies in our cookie banner, or by emailing lorenav.zg@gmail.com.

7.3 The categories of personal information we collect are identifiers such as name, email address and IP address, commercial information such as purchase records, and internet activity such as pages viewed. Section 2 explains why we collect each one, and section 3 says who receives it.

7.4 We do not knowingly collect or sell the personal information of anyone under 16.

7.5 To make a request, email lorenav.zg@gmail.com. An authorised agent may act for you if they give us written proof of permission.

8. COOKIES

8.1 This website uses cookies and similar technologies. Necessary cookies are always on, because the site cannot be served to you securely without them. Analytics and marketing cookies are placed only after you accept them in the cookie banner.

8.2 Our Cookie Policy lists every cookie by name, says what it does and how long it lasts, and explains how to change or withdraw your choice.

9. CHILDREN

9.1 This website is meant for adults. We do not knowingly collect personal data from anyone under 16.

9.2 If you believe a child has given us their data, email lorenav.zg@gmail.com and we will delete it.

10. SECURITY

10.1 We take reasonable steps to keep your data safe. The website runs over an encrypted HTTPS connection, access to our Squarespace and Stripe accounts is protected by strong passwords and two-factor authentication, and we limit who can see your data to people who need to.

10.2 No website can promise perfect security. If a data breach happens and it puts your rights at risk, we will tell you and the supervisory authority as the law requires.

11. CHANGES TO THIS POLICY

11.1 We update this policy when we change how we work, when we add a new tool, or when the law changes.

11.2 The date at the top shows when it was last updated. If a change matters to you, we will say so on the website or by email.

11.3 Please check this page from time to time.

12. CONTACT

For any question about this policy, about your data, or to use any of the rights described above: