Privacy Policy

01Data controller

The controller of the personal data collected through this website is:

Name

FUTURES, obrt za usluge, vl. Blagica Guljaš Tomac, Našice, Ulica kralja Tomislava 11c

Owner

Blagica Guljaš Tomac

Registered office

Ulica kralja Tomislava 11c, 31500 Našice, Croatia

OIB (Croatian tax ID)

35349739718

Trade register no. (MB)

99280426

E-mail

obrtfutures@gmail.com

The business has not appointed a data protection officer because the conditions of Article 37 of the General Data Protection Regulation (GDPR) are not met. For any question about how your data is processed, write to the e-mail address above.

02What data I collect

Data you enter yourself in the enquiry form:

• first and last name
• e-mail address
• company or business name (optional)
• approximate budget (optional)
• type of project and the content of your message

Data generated automatically: the provider that hosts this website records technical access logs (IP address, browser type, time and requested address). These logs are used solely for security and for fixing faults.

Anonymous visit statistics: the website uses Umami Cloud, which records the pages visited, the address you came from, the type of device, browser and operating system, and your approximate country. According to the provider, Umami sets no cookies, does not store your IP address or other personal data, and does not follow you across other websites. It respects the “Do Not Track” setting of your browser.

I do not collect special categories of personal data (health, religion, political opinions and the like) and I ask you not to enter them in the form.

03Purpose and legal basis

Purpose

Replying to your enquiry and preparing a possible quote

Legal basis

Taking steps at your request before entering into a contract — Art. 6(1)(b) GDPR

Purpose

Performing a contract, issuing invoices and keeping business accounts

Legal basis

Performance of a contract — Art. 6(1)(b) and legal obligation — Art. 6(1)(c) GDPR

Purpose

Security of the website and prevention of abuse (technical logs)

Legal basis

Legitimate interest — Art. 6(1)(f) GDPR

Purpose

Anonymous visit statistics to improve the website

Legal basis

Legitimate interest — Art. 6(1)(f) GDPR

I do not send newsletters or marketing messages. If that ever changes, I will ask for your explicit consent, which you can withdraw at any time.

04How long I keep data

• Enquiries that do not lead to a collaboration — at most 12 months after the last communication, then deleted.
• Contract and accounting documents — 11 years from the end of the financial year, in accordance with the Croatian Accounting Act.
• Technical access logs — according to the hosting provider's rules (Vercel), short-term and only for security and diagnostics.
• Anonymous visit statistics — contain no personal data; kept in Umami for as long as they are needed to review traffic.

05Who else has access to the data

I do not sell or exchange your data. Only processors that are technically necessary for me have access, and only to the extent needed to provide their service:

Website hosting

Vercel Inc., United States

Form processing

Formspree, Inc., United States

E-mail

Google Ireland Limited (Gmail)

Visit statistics

Umami Software, Inc., United States

Data processing agreements have been concluded with the processors in accordance with Article 28 GDPR.

Transfers outside the European Economic Area: by using the services of Vercel, Formspree, Umami and Google, data may be transferred to the United States. The transfer is based on the European Commission's standard contractual clauses and on the EU–US Data Privacy Framework.

I may disclose data to competent authorities if they request it on a legal basis.

06Your rights

You have the right at any time to:

• request access to the data I hold about you
• request correction of inaccurate or completion of incomplete data
• request erasure of your data (the “right to be forgotten”)
• request restriction of processing
• object to processing based on legitimate interest
• request data portability in a machine-readable format
• withdraw consent, where processing is based on consent, without affecting the lawfulness of processing before withdrawal

Send your request to obrtfutures@gmail.com. I reply within one month at the latest. The request is free of charge unless it is manifestly unfounded or excessive.

If you believe I process your data in breach of the rules, you have the right to lodge a complaint with the supervisory authority:

Supervisory authority

Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr, www.azop.hr

You may also lodge a complaint with the supervisory authority in the EU Member State where you live or work.

07Cookies and tracking

This website does not set cookies. According to the provider, Umami does not use cookies or store data on your device either.

Visits are measured with Umami Cloud (Umami Software, Inc., USA). When the page opens, your browser therefore connects to the server cloud.umami.is / gateway.umami.is and sends it anonymous visit data (page, referrer, device and browser type, language, approximate country). If you do not want your visit measured, switch on the “Do Not Track” setting in your browser or block the script cloud.umami.is — the website works the same.

There are no social-media pixels, no advertising scripts and no behaviour-tracking tools (screen recording, click maps).

Fonts are embedded directly in the page, so your browser does not connect to Google Fonts. Apart from Umami and the sending of the form (Formspree), the page does not contact any other external server when it opens.

The language of the page is determined from your browser settings or from the page address and is not stored on your device.

Because no cookies or on-device storage are used and the statistics are anonymous, this website shows no cookie consent banner. If I introduce tools in the future that require it, this policy will be changed before they start and your consent will be requested.

08Automated decision-making

I do not carry out automated decision-making or profiling within the meaning of Article 22 GDPR.

Every enquiry is read and answered by a human.

If, as part of a project, I build automation systems or AI agents that process the data of your customers, I act as the processor and you act as the controller. The rights and obligations are governed by a separate data processing agreement.

09Security

The website is served over an encrypted HTTPS connection. Only I have access to enquiries, with two-factor authentication on the services I use. Data is not stored on devices without disk encryption.

No system is absolutely secure. In the event of a personal data breach that poses a risk to your rights, I will notify AZOP within 72 hours and you without undue delay if the risk is high.

10Changes to this policy

I may change this policy when the way data is processed or the regulations change. The date of the last update is shown at the top of the page. Material changes are announced on the home page and, if I have your contact details and we are working together, directly by e-mail.