Privacy

Privacy Policy

Last updated: 10 July 2026 · Document version 1.0

Legal documents

1. Data controller

The data controller is VSN j.d.o.o., Ulica jablanova 31, 31000 Osijek, Republic of Croatia. OIB: 83589860827. VAT ID: HR83589860827. For any privacy question please write to office@vsn.hr.

The company is not legally required to appoint a Data Protection Officer and does not currently have one.

2. Scope of this policy

This policy describes personal data processing that actually takes place on vsn.hr. It does not describe hypothetical or future processing.

3. Processing activities

3.1. Email and contact-form correspondence

Data categories: name, company, email, message content.
Purpose: to respond to your enquiry and, where applicable, take steps at your request before entering into a contract.
Legal basis: Art. 6(1)(b) GDPR — steps prior to entering into a contract; or Art. 6(1)(f) GDPR — legitimate interest in responding to business enquiries.
Recipients: authorised staff of the company and our email service provider.
Retention: up to 24 months after last communication, unless longer retention is required for contract performance or legal obligation.
Requirement: the data is necessary to process your enquiry; without it we cannot respond.

3.2. Technical logs (server / hosting logs)

Data categories: IP address, access time, browser, referrer, requested URL.
Purpose: technical operation, website security, detection and prevention of abuse.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in secure and stable operation of the website.
Retention: typically up to 30 days; longer only in case of a security incident.

3.3. Cookie consent records

Data categories: your choices per cookie category, policy version, timestamp.
Purpose: proof of consent and respecting your choices.
Legal basis: Art. 6(1)(c) GDPR — legal obligation of the controller.
Retention: up to 12 months or until you change your consent.
Storage: local browser storage; the data is not transmitted to our servers.

3.4. Analytics

We currently do not use analytics, marketing or advertising scripts from third parties. If we introduce such tools in the future they will load only after your prior consent and will be described in the Cookie Policy.

4. Recipients and processors

Hosting and CDN provider serving the website (processor).
Business email service provider (processor).

Processors act under a written agreement pursuant to Art. 28 GDPR. We do not sell personal data to third parties.

5. Transfers outside the EEA

We do not transfer personal data outside the European Economic Area. Where a processor uses infrastructure outside the EEA, transfers rely on appropriate safeguards (EU Standard Contractual Clauses).

6. Automated decision-making

We do not use automated decision-making or profiling with legal effect.

7. Your rights

right of access to your personal data;
right to rectification of inaccurate or incomplete data;
right to erasure (“right to be forgotten”);
right to restriction of processing;
right to object to processing based on legitimate interest;
right to data portability;
right to withdraw consent at any time, without affecting lawfulness of processing before withdrawal;
right to lodge a complaint with the supervisory authority — the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb.

To exercise your rights please write to office@vsn.hr. We will respond without undue delay and at the latest within one month of receiving your request.

8. Security

We apply appropriate technical and organisational measures: TLS/HTTPS, restricted access, input validation and regular system maintenance.

9. Changes to this policy

We may update this policy from time to time to reflect legislative or technical changes. The date of the last update and the document version are shown at the top of this page.