Privacy Policy

1. Controller and scope

The controller for the processing relating to our own business is HRWC d.o.o. za računalno programiranje, Mljetska 98, 31000 Osijek, Republic of Croatia, OIB (Croatian personal identification number) 85177259948 (hereinafter: HRWC). For questions about personal data and to exercise your rights, contact us at info@hrwc.hr or by post at the above address.

This policy applies to visitors to HRWC’s website, persons who contact us, prospective clients, clients and their representatives. The public website enables contact by e-mail, by telephone and through a link to WhatsApp; it has no user accounts, no enquiry form and no online payment. The internal CRM serves HRWC’s business.

When, on a client’s documented instructions, we process personal data for the client’s project, we as a rule act as a processor. For such processing, the purposes are determined by the client, and the client’s privacy notice and the data processing agreement apply. The mere fact that we do not review the client’s orders or forms does not rule out processing by way of storage or hosting.

2. What data we collect and from which sources

Depending on the contact and the service, we process first name and surname, business role, organisation name, e-mail address, telephone number, business address, details for quotes and invoices, correspondence, project instructions and files provided. The OIB and other mandatory details are collected when they are needed for a contract, an invoice or statutory records.

In the operation of the website and systems, hosting providers may process the IP address, the time of the request, technical data about the device and browser, and logs needed for content delivery and security. We do not ask for payment card details or their security codes by e-mail or WhatsApp.

We obtain data directly from you, from the organisation you represent or through a referral. We also find prospective business contacts manually in public business profiles on Google Maps. We record the necessary contact details and the source; the public posting of contact details does not in itself constitute consent to marketing.

We do not ask for special categories of personal data, data relating to criminal convictions or personal data of children for the ordinary contracting of services. Please do not send us data that is not needed for the agreed work.

3. Responding to enquiries and performing services

To respond to enquiries, prepare quotes and perform a contract with a natural person, for example a sole trader (obrtnik), we process the necessary data under Article 6(1)(b) GDPR. For representatives of companies, the basis is legitimate interest in communicating and pursuing a business relationship with the organisation they represent, under point (f).

For issuing and retaining invoices and for other tax and accounting obligations, the basis is a legal obligation under point (c). For the proportionate protection of systems, the prevention of abuse and the establishment or defence of legal claims, the basis is legitimate interest under point (f) or, where one exists, a specific legal obligation.

Providing the data needed for a contract or an invoice may be a contractual or statutory requirement. If you do not provide it, we may be unable to prepare a quote, perform the service or issue a correct invoice. Additional consent to marketing is not a condition of purchase.

4. Business offers and the right to object

When presenting our services to Croatian businesses, we establish the appropriate basis and the applicable rules for the channel before making contact. Where we process personal data on the basis of legitimate interest, the purpose is an individual, relevant business offer, subject to an assessment of necessity, the person’s expectations and the impact on their rights.

We do not automatically apply the special rules for messages to legal persons to sole traders and other natural persons. Where prior consent is required for e-mail or another channel, we request and document it before sending a marketing message. In a quote requested following a conversation, we use the contact details only to the agreed extent.

If we did not obtain the data directly from you, we provide information about the source, the purpose and your rights at the latest at the first contact, and otherwise within the time limits of Article 14 GDPR, as a rule within one month of collection, or earlier on the first disclosure of the data.

You may object to marketing at any time by replying to an e-mail, during a conversation or by a message to info@hrwc.hr. Once you object, we stop processing for that purpose. We keep a minimal do-not-contact record so that we do not contact you again. Such a request does not prevent necessary communication about a service already contracted.

5. Who may receive data

Within HRWC, access to client information is reserved for the authorised owner/developer; employees do not have access. Infrastructure providers and their authorised personnel may process data to the extent necessary for providing services, support or security, or for meeting their legal obligations.

We use Vercel Inc. for hosting on the Pro plan. Our own CRM uses Supabase, whose contracting provider is Supabase Pte. Ltd., for its database. Plus Hosting Grupa d.o.o. provides the business e-mail service and domain registration/management. The corresponding agreements and processing terms apply to the services actually used.

Data needed for a domain may be passed on to the registrar and the competent registry in accordance with the registration rules. If we engage an accountant, a legal adviser or another necessary professional service provider, only the data needed for that purpose is disclosed, and on an appropriate basis. Competent authorities may receive data where the law or a lawful request so requires.

If you contact us via WhatsApp, that external service processes data under the rules that apply to your account and communication. The link is not a condition for contacting us; you can use e-mail or telephone. We do not sell personal data. We do not enter client files containing personal data into generative AI tools.

6. International transfers

Vercel and Supabase use international infrastructure and sub-processors; processing or access may involve countries outside the EEA, including the USA and Singapore. The contractual chain of Plus (Plus Hosting Grupa d.o.o.) may also include providers outside the EEA. We do not guarantee that all data is processed exclusively in Croatia, nor does the choice of a database region in itself provide such a guarantee.

A transfer outside the EEA must have a basis under Chapter V GDPR. Where applicable, an adequacy decision is relied on; in other cases, the European Commission’s standard contractual clauses and the necessary supplementary measures following an assessment of the circumstances. The published Vercel and Supabase data processing agreements provide mechanisms for international transfers. HRWC is responsible for ensuring that they apply to its own processing.

You may request information about the specific recipients, locations and applicable safeguards, as well as a copy of the relevant safeguards, at info@hrwc.hr. When providing it, we may protect confidential information that is not necessary for understanding the protection of your rights.

7. Retention periods

We do not keep personal data indefinitely merely because it was once collected. We keep enquiries that did not lead to a contract for up to 12 months from the last substantive communication, unless a specific procedure is still ongoing. We keep inactive contacts collected for a business offer for a maximum of 6 months from collection if no relationship has been established and no continuation of communication has been requested.

We keep data needed for an active service for as long as the service lasts. On completion, we hand over or delete unnecessary working copies at the latest within 30 days, in compliance with the agreed processing specification. We keep minimal documentation of the contract, the acceptance and key communications, for the purpose of legal claims, for up to 5 years after the end of the relationship, subject to a review of necessity; that period does not automatically apply to all project attachments.

We keep accounting documents used for bookkeeping for at least 11 years, or longer where a special regulation so requires. Periods are calculated in accordance with the applicable accounting rules. If there is a specific dispute, supervisory procedure or other retention obligation, we retain only the relevant data for as long as that need exists, with restricted access.

A minimal do-not-contact record for marketing is retained for as long as it is needed to respect the objection while marketing is carried out; the need is reviewed at least annually. Evidence of consent and of the handling of requests is kept to the extent and for the duration necessary to demonstrate lawfulness and to defend specific claims.

Technical logs and backups are retained according to the limited cycle of the relevant service, the security purpose, the need to investigate incidents and the applicable legal obligations. The actual cycle depends on the type of resource and the provider; information on the retention period for a specific record is available on request. Once the purpose has expired, data is deleted or irreversibly anonymised. Data in protected copies is not used for ordinary business; after a restore, the applicable deletions are carried out again.

8. Security and confidentiality

HRWC applies technical and organisational measures appropriate to the risk, including access restriction, protection of credentials, secure transmission, system maintenance and incident handling. Providers are required to give appropriate data protection commitments. No system can guarantee absolute security.

This policy does not constitute a guarantee of any particular frequency of backups of a client’s website. The scope of backup and restore is agreed in the quote or the technical specification. Statutory obligations regarding security and the handling of breaches apply irrespective of this.

9. Rights under the GDPR

You may request access to your own data and a copy, rectification of inaccuracies, erasure and restriction of processing where the conditions are met. The right to data portability applies where automated processing is based on consent or a contract. You may object to processing based on legitimate interest on grounds relating to your particular situation; for direct marketing, the objection is given effect without any further balancing of interests.

Where processing is based on consent, you may withdraw it at any time, as easily as it was given. Withdrawal does not affect the lawfulness of prior processing. A request for erasure does not override justified statutory retention obligations or processing needed for legal claims.

Send your request to info@hrwc.hr. We verify identity proportionately, without routinely asking for a copy of an identity card. We respond without undue delay, as a rule within one month. We explain within the first month any permitted extension by a maximum of two further months on account of the complexity or number of requests. Handling requests is, as a rule, free of charge.

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) using the contact details at azop.hr, regardless of whether you have contacted HRWC first, and use other legal remedies provided by law. We do not make decisions with legal or similarly significant effects based solely on automated processing or profiling.

10. Cookies and external links

Technical requests to the hosting service may include personal data even when the website has no form or user account. Special rules apply to storing data on, or accessing data on, a device: strictly necessary technologies are used only within the scope of the statutory exemption, and optional analytics, advertising or similar technologies may be activated only with the necessary prior consent.

If optional technologies are introduced, an up-to-date description of the provider, the purpose and the duration, a choice to accept or refuse, and a simple way to withdraw that choice must be available before activation. Merely continuing to browse, or paying for a service, does not constitute such consent. Communication after opening WhatsApp or another external service is also subject to the rules of that service.

11. Availability of the policy and changes

Version 2.0, drawn up on 11 October 2026. This policy is intended for publication and for provision before a contract is concluded. Receipt or payment of a quote may confirm that the policy was available to you, but it does not replace any separate consent that is required and does not limit your statutory rights.

We update the policy when the purposes, providers, manner of processing or regulations change. The current version is available on HRWC’s website; we give notice of material changes in an appropriate manner. A change to the text alone does not provide a basis for new processing that requires additional information or consent.