Privacy Statement

Last updated: August 11, 2026

1. Introduction

Your privacy is important to us. This Privacy Statement explains how SOUV collects, uses, stores, shares and protects personal data when you visit our website, purchase SOUV products, create an account, activate or claim a SOUV, upload memories, use our digital services or otherwise interact with us.

SOUV is operated by:

Digital Innovations d.o.o.
Obala 2/8
20270 Vela Luka
Croatia
VAT ID: HR11234155833

Digital Innovations d.o.o. acts as the data controller for the processing described in this Privacy Statement.

This Privacy Statement applies to the SOUV website, online shop, SOUV activation and scanning experience, user accounts, digital memory experiences and other related services collectively referred to as the “Services.”

2. Personal Data We Collect

The personal data we process depends on how you interact with SOUV.

Account and identification information

When you create or access a SOUV account, we may process:

Name
Email address
Account identifier
Profile information
Authentication information
Information provided through Google or Apple sign-in

If you use Apple's private email relay functionality, we may receive the private relay email address provided by Apple instead of your personal email address.

We do not receive or store your Google or Apple account password.

SOUV activation and memory information

When you activate, claim or use a SOUV, we may process:

SOUV identifier or token
Activation and claim information
Date and time of activation
Photos and videos you upload
Messages, descriptions or notes you add
Locations you choose to associate with your memories
Timeline information
Information required to generate features such as memory recaps
Technical metadata related to uploaded files

Your personal SOUV memory content is private by default.

We do not provide your private photographs, videos, messages or other private memory content to tourist boards, museums, destinations, events, retailers or other SOUV partners unless you intentionally use a feature that enables sharing or disclosure is required by law.

Online shop and order information

When you purchase SOUV products through our online shop, we may process:

Name and surname
Email address
Telephone number
Billing address
Delivery address
Products ordered
Quantity
Order value
Discounts
Payment status
Transaction identifiers
Delivery information
Refund or cancellation information
Communication relating to your order

Payment card information is processed by our payment service providers. SOUV does not store complete payment card numbers or card security codes.

Contact and support information

When you contact us, we may process:

Name
Email address
Telephone number
Company or organisation name
Message content
Support requests
Correspondence with us

Technical and usage information

When you access or use our Services, we may automatically process certain technical information, including:

IP address
Browser type
Device type
Operating system
Language settings
Date and time of access
Pages and features used
SOUV scans and interactions
Authentication events
Error and security logs
Shopping activity, including product views, cart activity and purchases
Advertising and campaign attribution information, where permitted

Location information

Certain SOUV features may allow you to use your location, for example to find nearby SOUV locations, shops, attractions or points of interest.

Where required, precise location information is accessed only with your permission.

You may also voluntarily associate a location with a memory, trip or other content stored in your SOUV account.

3. Camera and Media Access

Certain features may request access to your device's camera, photographs or media library.

These permissions may be used to:

Scan QR codes
Take photographs
Select photographs or videos from your device
Upload photographs or videos to your SOUV memory
Provide other functionality initiated by you

Camera and media access occurs only when you choose to use functionality requiring it.

You can revoke these permissions through your browser or device settings.

4. How We Use Personal Data

We may use personal data to:

Create and manage SOUV accounts
Authenticate users
Activate and claim SOUV products
Store and display users' digital memories
Provide SOUV collections, timelines and recap functionality
Operate and maintain the SOUV platform
Process online purchases
Process payments
Arrange product delivery
Manage returns, refunds and customer requests
Communicate about accounts, orders and Services
Provide customer support
Detect and prevent fraud, abuse and security incidents
Maintain the security and reliability of our Services
Measure product activation and usage
Improve SOUV products and Services
Understand how users interact with our website and shop
Measure marketing and advertising performance
Send marketing communications where permitted
Comply with accounting, tax and other legal obligations
Establish, exercise or defend legal claims

We do not sell personal data.

5. Legal Bases for Processing

We process personal data only where we have a valid legal basis under applicable data protection law.

Performance of a contract

We process personal data where necessary to provide SOUV Services requested by you, including:

Creating and managing your account
Claiming and managing a SOUV
Storing your memories
Providing collections, timelines and recap functionality
Processing online orders
Processing payments
Delivering purchased products
Managing returns or refunds
Providing contractual customer support

Compliance with legal obligations

We process certain information where required to comply with applicable laws, including accounting, tax, consumer protection and other regulatory obligations.

Legitimate interests

We may process personal data where necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.

These interests may include:

Maintaining and improving our Services
Protecting the security of the SOUV platform
Preventing fraud and abuse
Troubleshooting technical issues
Maintaining business records
Responding to enquiries
Understanding aggregated product usage
Establishing or defending legal claims

Consent

Where required by law, we rely on your consent for activities such as:

Non-essential analytics technologies
Advertising and marketing tracking technologies
Certain marketing communications
Access to precise device location
Other optional device permissions or processing activities

You may withdraw your consent at any time. Withdrawal of consent does not affect processing lawfully carried out before withdrawal.

6. Photos, Videos and Personal Memories

SOUV allows users to store personal memories connected to physical SOUV products.

This may include photographs, videos, messages, locations and other content uploaded by the user.

Private memory content is used to provide the memory-storage and related SOUV functionality requested by you.

We do not use your private photographs, videos or personal messages to create advertising audiences or for behavioural advertising.

We do not provide private memory content to SOUV partners for their marketing purposes.

SOUV personnel and service providers may technically access stored content only where reasonably necessary to operate, secure, maintain or support the Services, respond to a request from you, investigate misuse or comply with applicable law.

You are responsible for ensuring that you have the right to upload content to SOUV, including content containing other individuals.

7. Partner Editions and Engagement Statistics

Certain SOUV products are created in cooperation with destinations, museums, cultural institutions, events, tourist boards, attractions, retailers or other organisations.

These partners may receive statistical information about the performance and use of their SOUV edition, such as:

Number of SOUV products distributed
Number or percentage of products activated
Number of scans
Engagement with partner or destination content
Return visits
Aggregated usage statistics

Where reasonably possible, this information is provided in aggregated or de-identified form.

Partners do not receive access to users' private photographs, videos, personal messages or private memory collections solely because a user owns or activates their SOUV edition.

8. Online Purchases and Payments

When you purchase products through the SOUV online shop, we process the information necessary to complete your transaction.

Payment information may be transmitted directly to our payment processing providers.

Payment providers may process information including payment method, transaction details, device information and fraud-prevention information according to their own privacy practices.

SOUV may receive information such as whether a transaction was successful or declined, transaction identifiers, payment amount and refund status.

We do not store complete payment card details.

9. Delivery and Fulfilment

Where physical products are ordered for delivery, necessary personal data may be shared with delivery, postal, courier or fulfilment providers.

This may include:

Name
Delivery address
Telephone number
Email address
Information necessary to identify and deliver the shipment

These providers receive only the information reasonably necessary to perform the requested delivery or fulfilment service.

10. Authentication Providers

SOUV may allow you to create or access your account using third-party authentication services such as Google or Apple.

When you choose one of these methods, the authentication provider may send us limited account information necessary to authenticate you, such as:

Name
Email address
Provider account identifier

Your interaction with the authentication provider is also subject to that provider's privacy practices.

11. Cookies and Similar Technologies

SOUV uses cookies and similar technologies to operate and improve its website and Services.

These technologies may be used for:

Essential website functionality
Authentication
Security
Remembering settings
Shopping cart functionality
Performance measurement
Analytics
Advertising measurement
Campaign attribution

Strictly necessary technologies may be used without consent where permitted by applicable law.

Non-essential analytics, advertising and similar tracking technologies are used where required only after the appropriate consent has been obtained.

You can manage or withdraw your cookie preferences through the cookie settings available on our website.

Further details about specific technologies may be provided in our Cookie Policy or cookie preference interface.

12. Analytics and Advertising

Where permitted and, where required, based on your consent, we may use analytics and advertising services to understand how users interact with SOUV and to measure the effectiveness of advertising campaigns.

Information processed for these purposes may include:

Page views
Product views
SOUV shop interactions
Cart activity
Checkout activity
Purchases
Transaction value
Campaign information
Device and browser information
Online identifiers

Private SOUV memory content, including your personal photographs, videos and messages, is not provided to advertising platforms for advertising purposes.

You may withdraw consent to non-essential analytics or advertising technologies through our cookie settings.

13. Security and Fraud Prevention

We may process technical, transaction and account information to protect SOUV, its users and its systems.

This may include processing necessary to:

Detect suspicious activity
Prevent fraudulent payments
Prevent unauthorised account access
Prevent automated abuse or spam
Investigate security incidents
Protect the integrity of our Services

We may use third-party security, fraud-prevention or bot-detection services for these purposes.

14. Information Sharing

We do not sell personal data.

We may share personal data with third parties where reasonably necessary to provide and operate our Services.

Recipients may include:

Cloud hosting and infrastructure providers
Database and storage providers
Authentication providers
Payment processors
Delivery and fulfilment providers
Email and communication providers
Analytics providers
Advertising platforms, where permitted
Security and fraud-prevention providers
IT and software service providers
Accountants, lawyers, auditors and professional advisers
Public authorities, regulators or courts where required by law

Service providers acting on our behalf are required to process personal data only for authorised purposes and subject to appropriate data protection and security obligations.

We may also disclose personal data in connection with a corporate restructuring, merger, acquisition, financing, investment or sale of all or part of our business, subject to applicable legal requirements and safeguards.

15. International Data Transfers

Some of our service providers may process personal data outside Croatia or the European Economic Area.

Where personal data is transferred outside the European Economic Area, we ensure that an appropriate lawful transfer mechanism is used where required.

This may include:

A European Commission adequacy decision
The EU-U.S. Data Privacy Framework where applicable
European Commission Standard Contractual Clauses
Other legally recognised safeguards

Additional safeguards may be implemented where necessary to ensure an appropriate level of protection.

16. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to comply with legal, contractual and regulatory requirements.

SOUV accounts and memories

Account information and memories are retained for as long as necessary to provide the SOUV memory service.

SOUV is designed as a long-term memory service and may retain user memories for extended periods so they remain accessible to the user.

Users may request deletion of their personal data and memories subject to applicable legal requirements and limitations.

Order and accounting information

Order, invoice, payment and accounting information may be retained for the periods required by applicable accounting, tax and other legislation.

Customer support

Customer support requests and correspondence may be retained for as long as reasonably necessary to resolve the request and subsequently for record-keeping, dispute-resolution and legal purposes.

Marketing information

Where marketing processing is based on consent, relevant information is retained until consent is withdrawn or the information is no longer necessary.

We may retain limited information necessary to record and respect an unsubscribe or marketing objection.

Security and technical information

Security logs, technical logs and similar information are retained only for as long as reasonably necessary for security, fraud prevention, troubleshooting and legal purposes.

Backups

Deleted information may remain temporarily in backup systems until the relevant backup is automatically overwritten or securely deleted.

17. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against:

Unauthorised access
Accidental loss
Unlawful disclosure
Alteration
Destruction
Misuse

These measures may include encryption, authentication controls, access restrictions, logging, backups, security monitoring and restrictions on access by employees and service providers.

Although we take reasonable measures to protect personal data, no electronic storage or transmission system can guarantee absolute security.

18. Your Data Protection Rights

Subject to applicable law, you may have the right to:

Request access to your personal data
Obtain a copy of your personal data
Request correction of inaccurate or incomplete personal data
Request deletion of your personal data
Request restriction of processing
Object to processing based on legitimate interests
Object at any time to direct marketing
Request data portability where applicable
Withdraw consent where processing is based on consent
Lodge a complaint with a competent data protection authority

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

We may need to verify your identity before processing certain requests.

19. Automated Decision-Making

SOUV does not currently use solely automated decision-making that produces legal effects or similarly significant effects on users within the meaning of Article 22 of the GDPR.

Payment, security or fraud-prevention service providers may use automated systems as part of their services.

If we introduce automated decision-making subject to specific legal requirements in the future, we will provide the information and safeguards required by applicable law.

20. Children's Privacy

SOUV account Services are not intended for children under the age of 16.

We do not knowingly collect personal data directly from children under the age of 16 where parental or guardian authorisation would be required by applicable law.

If we become aware that personal data relating to a child has been collected unlawfully, we will take appropriate steps to delete or otherwise appropriately process that information.

Parents or guardians who believe that a child has provided personal data to SOUV unlawfully may contact us.

21. Providing Personal Data

Certain personal data is necessary to provide particular SOUV Services.

For example:

Account information is necessary to create and maintain a SOUV account
Certain information is necessary to claim and associate a SOUV with an account
Delivery and contact information is necessary to fulfil an online order
Payment-related information is necessary to complete a purchase

If required information is not provided, we may be unable to provide the relevant Service or complete the requested transaction.

Optional functionality, such as precise location access or marketing communications, is not required for the basic use of SOUV unless otherwise clearly indicated.

22. Third-Party Websites and Services

Our Services may contain links to websites, platforms or services operated by third parties.

When you independently interact with those services, the relevant third party may process personal data according to its own privacy policy and terms.

We are not responsible for the independent privacy practices of third-party websites or services.

23. Changes to This Privacy Statement

We may update this Privacy Statement from time to time to reflect changes to our Services, technology, business operations or legal requirements.

The latest version will be published on the SOUV website with an updated “Last updated” date.

Where required by law, we will provide additional notice of material changes.

24. Contact

For questions regarding this Privacy Statement, our processing of personal data or the exercise of your data protection rights, you can contact: