Privacy Policy

1. Controller

The controller of personal data on this website is DOO DAH, obrt za promidžbu, vl. Dubravka Švegar, Hrvatske bratske zajednice 33, 10410 Velika Gorica, Croatia, OIB 19470265567.

You can send requests and questions about personal data by post to that address or through the enquiry form.

2. Enquiries sent through the form

When you send an enquiry through the form on the Contact page, the following is stored:

• name,
• email address,
• brand or company, if you enter one,
• enquiry type, if you choose one,
• message,
• the time it was sent and the language of the form.

The data is used only to reply to your enquiry and to agree a possible collaboration. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) of the General Data Protection Regulation).

The enquiry is stored in the website’s database on the server that hosts the website. It can be seen only in the website’s administration, which requires a password. An enquiry is stored and confirmed without email: the website sends no email messages, neither to you nor to the owner.

Enquiries are kept for 12 months from receipt and are then deleted automatically.

3. Protecting the form and the administration

To prevent misuse, the website records:

• how many enquiries were sent from the same network: only a digest (hash) of the address is stored, not the address itself, and it is deleted after one day,
• attempts to sign in to the administration, in the same way and with the same period,
• a security log: the time, the kind of event (for example a rejected or too-fast form, a sign-in to the administration), the requested page address and the IP address, without the content of the form. Entries older than 90 days are deleted.

The legal basis is the legitimate interest in protecting the website and its visitors from misuse (Article 6(1)(f)).

4. Counting visits

The website counts visits itself, on its own server and in its own database, without cookies and without storing anything on your device. No third party receives this data. For every page view and each of five events, the following is stored:

• the time and day,
• the page and language,
• the device type (phone, tablet or computer),
• whether this is the first view of the visit, and the daily visit key (explained below),
• with the first view of a visit only: the domain of the site you came from (without the rest of its address), campaign tags from the link (utm_source, utm_medium, utm_campaign) if they are in the permitted form, the country as a two-letter code sent by Cloudflare, and the browser and operating-system family without a version (for example “Safari” and “iOS”),
• for events: which one happened (starting to write an enquiry, sending an enquiry, playing a video, opening a photograph in the gallery, clicking a social network link) and which video, photograph or network it concerns.

Not stored: the IP address, the full browser description, the full address of the site you came from, the content of the form, your name, your email address, or any identifier lasting longer than one day.

The daily visit key is calculated from the IP address, the device type and the browser and system families, together with a random key for that day and a secret server key. The IP address is used only at the moment of calculation and is not stored. The day’s key is deleted the next day; after that, keys from different days cannot be linked or recalculated. Several people on the same network with the same type of device and browser count as one visit on the same day.

The records are kept for 12 months and are then deleted automatically. The legal basis is the legitimate interest in understanding how the website is used (Article 6(1)(f)).

5. Cookies

The website sets only one cookie for visitors, dubravka_form, and only on the Contact page. It holds the enquiry form’s security token, not what you type. It is valid for the Contact page address only, is deleted when you close your browser and cannot be read by scripts (HttpOnly, SameSite=Strict, Secure). It is strictly necessary for sending an enquiry, so it does not require consent.

The website has no analytics, advertising or third-party cookies. More on the Cookies page.

6. Notifications about new enquiries

The owner can turn on notifications about new enquiries on her devices (Web Push). For each such device the website stores the delivery address assigned by the browser, the keys used to encrypt notifications, the device name, and the time and result of the last delivery.

The notification is delivered by the push service of the browser on the owner’s device (for example Google, Apple, Mozilla or Microsoft). Its content is sent encrypted, so the service cannot read it; it sees only which device a notification is sent to and when. A notification contains only “New enquiry” and the enquiry type from the form’s list, never your name, email address or message.

A subscription stops being valid when the owner turns notifications off, when the administration password or the notification key changes, or when the service reports that the device no longer exists. Its delivery address and keys are then deleted at once, and the device record after 30 days. The delivery log (without notification content) is kept for 90 days.

7. Recipients and hosting

Data is not sold or passed to third parties for advertising. The website loads no content from other websites: fonts, photographs and video are on its own server, and links to social networks are ordinary links.

• Hosting: the website, its database and the security log are on a server operated by Trik Web Design, which built and maintains the website. The server also keeps ordinary technical access logs (time, requested address, browser).
• Cloudflare, Inc. (USA) carries traffic to the server and protects it from misuse; in doing so it processes the IP address and technical details of every request. For transfers to the USA, Cloudflare’s Data Processing Addendum relies on the EU-U.S. Data Privacy Framework, in which Cloudflare participates, and on standard contractual clauses should that cease.
• The browser’s push service, for notifications to the owner, as described above.

8. Retention periods

Enquiries

12 months from receipt, then deleted automatically

Address digests (form and sign-in)

1 day

Security log

90 days

Visit-count records

12 months

Daily key for counting

until the next day

Notification devices

while turned on; turned off: 30 days; delivery log 90 days

Enquiry form cookie

dubravka_form, until the browser is closed

Backup copies of the database, where made, may contain deleted data until they are themselves replaced.

9. Your rights

You have the right to request access to your data, its correction or deletion, restriction of processing and portability of the data you sent through the form, and to object to processing based on legitimate interest. Send your request by post to the address in the first section or through the enquiry form. You will receive a reply without undue delay and at the latest within one month.

For visit-count records and address digests the website keeps nothing by which it could recognise you, so it usually cannot fulfil such a request for them (Article 11 of the Regulation).

If you believe your data is processed unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop.hr.

10. Automated decisions and changes

The website makes no automated decisions and does not profile visitors.

This policy changes when the processing changes; the version date is at the top of the page.