Privacy policy

• Form details: your name, e-mail, phone, town and county, the service, the type of property, the approximate area, the timeframe, a description of the work and the photos or documents you attach. For samples, also the products, the number of samples and the delivery address; for a trade enquiry, the intended use. If you give them, also your company and its OIB.
• Submission and consent details: the time you sent the form, the version of the text you confirmed, your cookie choice at that moment, your IP address and browser details.
• Where the enquiry came from: the page you sent the form from, the page you arrived from and campaign tags (UTM), if any.
• Enquiries from ads: what you enter in a form in our ad on Facebook or Instagram, and the IDs of the form, the ad and the campaign.
• Correspondence and progress: the messages we exchange and our notes on the site visit, the quote and what was agreed.
• Use of the site: technical server logs and, only with your consent, data from analytics and advertising cookies, as described in the cookie policy.

Photos you attach are stored without their metadata, such as where they were taken. PDF documents are stored as you sent them.

• Replying to your enquiry, the site visit, survey, quote and samples: steps you asked for before a contract (Article 6(1)(b) GDPR). If you write on behalf of a company, we process your contact details on the basis of our legitimate interest in replying to that company (point (f)).
• Carrying out the work, sales and invoicing: the contract (point (b)) and our legal obligations, such as accounting and tax rules (point (c)).
• Submission and consent details, and where the enquiry came from: our legitimate interest in being able to show what you confirmed and in knowing which pages and campaigns bring enquiries (point (f)).
• News about our work and offers by e-mail: your consent (point (a)), only if you gave it in the quote form.
• Visit analytics and ad measurement (Google Analytics, Google Ads, Meta Pixel and Conversions API): your consent (point (a)), given in the cookie settings.
• Security of the site and our systems, protecting the forms from abuse, and backups: our legitimate interest (point (f)).
• Establishing and defending legal claims, for example over defects in completed work: our legitimate interest (point (f)).

If you have accepted marketing cookies and send an enquiry, our server reports it to Meta. It sends your e-mail, phone, first and last name, town and the country from the calling code of your phone number as a hash, along with your IP address, browser details, the IDs from the Meta cookies or the ad link, the page address, and the type of enquiry and service. Meta can then match the enquiry to an ad you saw; without that consent nothing is sent.

We do not sell your data. Only the people who handle enquiries for us see it, and these providers also receive it:

• OVHcloud (OVH): servers in the EU that run our enquiry system and database (Italy) and the mail server that sends our notifications and replies (Germany);
• Cloudflare, Inc.: delivering and protecting the site, carrying the forms to our server, protecting the forms (Turnstile) and storing encrypted backups in the EU;
• Google Ireland Limited: Google Tag Manager, Google Analytics and Google Ads, only with your consent;
• Meta Platforms Ireland Limited: Meta Pixel and Conversions API, only with your consent, and the forms in Facebook and Instagram ads that you fill in yourself.

OVHcloud and Cloudflare process data only on our instructions, as processors. For collecting and transmitting data through the Meta Pixel and the Conversions API, we and Meta are joint controllers (Article 26 GDPR); the essence of that arrangement is published at facebook.com/legal/controller_addendum. Google and Meta may also process data from their tools for their own purposes, as independent controllers, under their own policies (Google, Meta). Cloudflare also uses Turnstile data to improve its bot detection (Cloudflare).

We also disclose data to public authorities where the law requires it.

Our enquiry system, database, mail server and backups are in the EU. Cloudflare, Google and Meta may also process data outside the European Economic Area, in particular in the United States. Such transfers rely on the European Commission adequacy decision for the EU-US Data Privacy Framework, in which these companies take part, and on the standard contractual clauses of the European Commission.

• Enquiries: 24 months after the last change of their status. The system then automatically deletes the name, e-mail, phone, company and OIB, the description and messages, the delivery address, the IP address, browser details, notes and attachments. Only statistics without personal data remain: the type of enquiry, the service, the town, the area, the source and the dates.
• Enquiries that led to a contract: 10 years after the work was won, because of the statutory liability periods for completed work and the duty to keep business records. They are then deleted in the same way.
• Enquiries marked as spam: 30 days after being marked.
• Consent to news by e-mail: until you withdraw it, and at the latest until the details of the enquiry in which you gave it are deleted.
• Invoices and business records: as long as accounting and tax rules require.
• Backups: every night we store an encrypted copy of the database and files and keep it for up to 6 months, so deleted data can remain in backups for that long at most. If we restore a backup, we delete again everything deleted in the meantime.
• Server logs: only as long as needed for security and fixing faults.
• Cookies: your choice is remembered for 12 months; the other cookies and their lifetimes are listed in the cookie policy.

You have the right to access your data, to have it corrected or erased, to restrict its processing and to data portability. You can object to processing based on our legitimate interest. You can withdraw your consent at any time: for cookies with the "Cookie settings" link in the footer, and for news by e-mail with a message to [email protected]. Withdrawing consent does not affect the processing that took place before.

Send your request to [email protected] or by post to the business address. We reply without undue delay and within one month at the latest; a complex request may take up to two more months, and we will tell you if it does. We may ask you to confirm your identity first.

If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

There is no legal obligation to give us your data. The details marked as required in a form are needed to reply to your enquiry and prepare a quote; without them we cannot handle it. Consent to news by e-mail and accepting cookies are not conditions for sending an enquiry.

We do not take decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you. We only check automatically that a person sent the form and how many enquiries arrived from the same address in a short time. If your enquiry does not go through because of this, send it later or write to us by e-mail.

We change this policy when the way we process data changes. The date of the last change is shown on this page.