Last updated: [DATE]
This Privacy Policy explains how [FULL NAME / TRADE NAME, e.g. Marko Kovač, Putnik Lik] (“I”, “we”, “MKPL”) collects and uses personal data when you visit putniklik.hr (the “Website”) or contact us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Croatian Act on the Implementation of the General Data Protection Regulation.
1. Who is responsible for your data (controller)
[FULL NAME / TRADE NAME]
[STREET AND NUMBER, POSTAL CODE, CITY, CROATIA]
OIB: [OIB]
Email: [CONTACT EMAIL]
Phone: [PHONE, optional]
We have not appointed a Data Protection Officer because we are not required to. For any privacy question, write to the email above.
2. What data we process, why, and on what legal basis
2.1 Visiting the Website (server logs)
When you open the Website, our hosting provider’s server automatically records technical data: IP address, date and time, requested page, browser type and version, operating system, referring page and the amount of data transferred.
- Purpose: delivering the Website, keeping it secure and stable, detecting abuse.
- Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in operating a secure website.
- Retention: [e.g. up to 30 days], then deleted or anonymised.
2.2 Contact form and email
If you write to us through the contact form or by email, we process your name, email address, the topic and the content of your message, and anything else you choose to send.
- Purpose: answering your enquiry and, if you ask, preparing an offer for a tour, course or other service.
- Legal basis: taking steps at your request before a contract (Art. 6(1)(b) GDPR) or, for general questions, our legitimate interest in answering you (Art. 6(1)(f)).
- Retention: until your enquiry is resolved, and then [e.g. 12 months] in case of follow-up questions. If it leads to a contract, we keep the data as long as accounting and tax law require (generally up to 11 years for invoices and accounting records).
2.3 Booking and guiding services
If you take part in a guided tour, course or another service, we may additionally collect the details needed to run it safely, such as contact details, emergency contact and, where relevant to safety, relevant health information you choose to share. Health information is special-category data and is processed only with your explicit consent (Art. 9(2)(a) GDPR) and only to the extent needed to protect your safety.
- Legal basis: performance of the contract (Art. 6(1)(b)), legal obligations such as accounting (Art. 6(1)(c)), and consent where stated.
- Retention: for the duration of the service and the legal retention periods that follow.
(Delete this section if you do not collect such data via the Website.)
2.4 Cookies and similar technologies
The Website uses a small number of cookies. Strictly necessary cookies do not need consent. Any other cookies (for example analytics) are set only after you agree in the cookie banner, and you can change your choice at any time via [LINK / “Cookie settings” in the footer]. Details are in our Cookie Policy: [LINK TO COOKIE POLICY, generated by your cookie plugin].
- Legal basis: Art. 6(1)(a) GDPR (consent) and the Croatian Electronic Communications Act.
2.5 Fonts and other third-party content
[Choose one:]
- (Option A, if fonts are hosted on the Website) The Website’s fonts are served from our own server. No data is sent to third parties for that purpose.
- (Option B, if Google Fonts are loaded from Google) The Website loads fonts from Google Fonts (Google Ireland Limited). Your IP address is transmitted to Google when the fonts are loaded. Legal basis: legitimate interest in a uniform, attractive presentation.
[If you embed maps, YouTube or social media, add a short paragraph for each: the provider, what data is sent, and that it happens only after consent.]
2.6 Blog comments and newsletter
[Delete if not applicable. If comments or a newsletter are enabled, describe: data collected (name, email, IP, comment), legal basis (consent), retention, and how to unsubscribe or have comments removed.]
3. Who receives your data
We share personal data only where necessary, with service providers who process it on our behalf under a data processing agreement, or where the law requires it:
- Hosting provider: [HOSTING COMPANY, COUNTRY]: hosts the Website and its logs.
- Email provider: [EMAIL PROVIDER, e.g. Google Workspace, Microsoft, your host]: delivers and stores email, including messages from the contact form.
- Cookie consent / analytics providers: [PLUGIN OR SERVICE NAME], only if used.
- Accountant / tax advisor and authorities: where required for accounting and legal obligations.
We do not sell your personal data.
4. Transfers outside the EU/EEA
We aim to keep data within the EU/EEA. If a provider processes data in a third country (for example the United States), we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework) or on Standard Contractual Clauses approved by the European Commission. [Confirm this against your providers or delete the section.]
5. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (“right to be forgotten”) (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting processing done before withdrawal (Art. 7(3)).
To use any of these rights, email [CONTACT EMAIL]. We will respond within one month. We may need to verify your identity first.
You also have the right to lodge a complaint with the supervisory authority. In Croatia this is the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr, www.azop.hr. If you live in another EU country, you may contact your local authority.
6. Security
We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access control, regular updates of the Website software and limiting access to those who need it. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.
7. Children
The Website is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we will delete it. Guided activities for minors require the involvement of a parent or guardian.
8. Automated decision-making
We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
9. Changes to this policy
We may update this Privacy Policy when the Website or the law changes. The current version is always available on this page, with the date of the last update at the top.
10. Contact
Questions about this policy or your data: [CONTACT EMAIL], [POSTAL ADDRESS].