Privacy policy

1. Data controller and company details

The controller of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

2. Scope of this Policy and processing principles

This Policy applies to the processing of personal data related to the use of this website, communication through web forms and the other channels listed, and the use of the external services indicated. Personal data is processed lawfully, fairly and transparently, only for specified and legitimate purposes, and to the extent that is adequate and necessary for those purposes.

3. What data we process and for what purposes

• Contact and enquiries: data you enter in the contact form or send through other communication channels, such as your first name, last name, email address, phone number, company name and message content, is processed in order to respond to your enquiry, prepare an offer and for further business communication.
• Technical data: when you use the website, technical data may be processed, such as your IP address, the date and time of the request, the requested resource, browser and device information, and the logs needed for system stability, diagnostics and security.
• Analytics and measurement: with your consent, data on the use of the website may be processed to measure traffic, understand user behaviour and, where applicable, measure marketing activities.

4. Legal bases for processing

For data submitted through an enquiry, the legal basis depends on the content of the communication. Where the enquiry concerns an offer, product or service, processing may be based on taking steps at the request of the data subject prior to entering into a contract. For general business communication and responding to enquiries, processing may be based on the legitimate interest of the controller, provided that the interests or fundamental rights and freedoms of the data subject do not override that interest.

The processing of technical and security data may be based on the legitimate interest in ensuring the security, availability and stability of the website and protecting it from misuse.

Where consent is required for a particular processing operation, for example for optional analytics or marketing technologies or for marketing communication, processing is carried out on the basis of consent. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

5. Recipients and processors

Personal data may be accessible to authorised persons of the controller and to trusted service providers who process the data to the extent necessary to provide their services, for example hosting, email, maintenance, security and technical support providers, and the selected external service providers listed in this Policy. Data may be disclosed to the competent authorities where there is a legal obligation or another valid legal basis to do so.

6. External services

7. Transfers of data outside the EEA

Certain external service providers may, depending on their infrastructure and service configuration, process data outside the European Economic Area. Where such a transfer takes place, the controller must ensure that it is based on a mechanism permitted by the GDPR, for example an adequacy decision or appropriate safeguards such as standard contractual clauses, where applicable. Further information on specific transfers is available in the documentation of the selected service providers or from the controller on request.

8. Cookies and similar technologies

The website may use strictly necessary cookies and, where additional features are enabled, analytics, functional or marketing cookies and similar technologies. Cookies that are not necessary for the website to work should be used only after the user has made an appropriate choice or given consent, where required.

This website may use Complianz to manage consent and keep a record of cookies. The actual list of cookies depends on the website configuration and the results of the Complianz scan.

9. Retention periods

Personal data is kept only for as long as necessary to achieve the purpose for which it was collected, or for the period required by applicable legal obligations. Data from contact enquiries is kept for the time needed to handle the enquiry and the related business communication, unless there is a need or obligation to keep it longer, for example to prove business communication or to establish, exercise or defend legal claims. Data processed on the basis of consent is processed until consent is withdrawn or the purpose ceases, unless there is another valid legal basis for further storage.

10. Your rights

Depending on the circumstances and the legal basis for processing, data subjects may have the right to request access to their personal data, its rectification or erasure, restriction of processing, data portability, and the right to object to processing. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

A request to exercise your rights can be sent using the contact details in this Policy. Requests are answered without undue delay and, as a rule, within one month of receipt at the latest, with the possibility of extension where the conditions laid down in the GDPR are met.

11. Complaint to the supervisory authority

If you believe that the processing of your personal data infringes data protection rules, you have the right to lodge a complaint with the competent supervisory authority. In the Republic of Croatia, the competent authority is the Personal Data Protection Agency (AZOP).

12. Data security

The controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or other forms of unlawful processing, taking into account the nature of the processing, the available technology and the level of risk.

13. Changes to this Policy

This Policy may be updated from time to time to reflect changes in how the website works, the services used or applicable regulations. The date of the last update is given at the beginning of the document.