Legal

Privacy Policy

Last updated: September 29, 2026

1. Data Controller

TERMO-ING d.o.o. za trgovinu i građevinarstvo, with registered office at Stinice 53, 21000 Split, HR, Tax ID (OIB): 62005854569, Company Reg. No. (MBS): 060036748, registered with Commercial Court in Split (hereinafter: „we”, „our company” or „data controller”).

Contact for data protection inquiries: prodaja@termo-ing.hr.

2. What Data We Collect

2.1 Inquiry Form

When you fill out the inquiry form on our website, we collect: full name, email address, phone number (optional), subject (optional), and message. This data is used solely to respond to your inquiry.

2.2 Analytics (Rybbit)

We use Rybbit Analytics, a cookieless analytics tool that does not set cookies or collect personal data. Only anonymized data is collected: pages viewed, time on site, referral source, screen resolution, browser language. This data is aggregated and cannot be linked to an individual.

2.3 Functional Cookies

Our website uses only one functional cookie: NEXT_LOCALE, which remembers your language preference (Croatian or English). This cookie does not track your behavior and is not shared with third parties.

3. Purpose of Processing

We process personal data for the following purposes:

  • Responding to your inquiry (name, email, phone, message)
  • Improving user experience (anonymized analytics)
  • Remembering language preference (functional cookie)
  • Complying with legal obligations (e.g., retaining accounting records)

4. Legal Basis

  • Legitimate interest (Art. 6(1)(f) GDPR): responding to inquiries, anonymized analytics, functional cookie.
  • Performance of a contract / pre-contractual steps (Art. 6(1)(b) GDPR): processing inquiries that precede a business relationship.
  • Legal obligation (Art. 6(1)(c) GDPR): retaining data in accordance with accounting and tax regulations.
  • Consent (Art. 6(1)(a) GDPR): where you have given explicit consent for a specific processing activity (e.g., newsletter if introduced).

5. Third Parties

We share your personal data only with the following service providers acting as data processors:

  • PayloadCMS: self-hosted CMS and database (PostgreSQL) on our own server within the EU.
  • Rybbit Analytics: cookieless analytics; processes only anonymized data.
  • Hosting provider: our web server is located within the EU.
  • WhatsApp: when you click the WhatsApp contact link, you are redirected to the WhatsApp platform.

6. Data Retention

Inquiry form data is retained for a maximum of 2 years from the date of receipt, after which it is anonymized or deleted. Data processed on the basis of a legal obligation is retained in accordance with applicable regulations (e.g., accounting records: 11 years). Analytics data is aggregated and retained indefinitely.

7. Your Rights

As a data subject, you have the following rights under the GDPR:

  • Right of access: request information on whether we process your personal data and access to that data.
  • Right to rectification: request correction of inaccurate or incomplete data.
  • Right to erasure („right to be forgotten”): request deletion of personal data.
  • Right to restriction of processing: request restriction of processing.
  • Right to data portability: request transfer of data to another controller.
  • Right to object: object to the processing of your personal data.

To exercise any of these rights, contact us at prodaja@termo-ing.hr. We will respond within 30 days.

8. Right to Complain

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the supervisory authority: the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, email: azop@azop.hr.

9. Cookies

Our website uses only one functional cookie: NEXT_LOCALE, which remembers language preference. This cookie is necessary for the proper functioning of the bilingual website.

We do not use: analytics cookies, marketing cookies, tracking cookies, or third-party cookies. Rybbit Analytics is a cookieless tool.

10. Children's Data

Our website is not intended for children under the age of 16, and we do not knowingly collect their personal data.

11. International Transfers

All personal data is processed and stored on servers within the European Union. We do not transfer data internationally outside the EU.

12. Changes

This privacy policy may be updated from time to time. We will notify you of significant changes via our website.