Personal data protection

Privacy policy

This policy explains how Elektroinženjering Brodar d.o.o. processes personal data of website visitors and people submitting an inquiry, in accordance with Regulation (EU) 2016/679 (GDPR).

Last updated: 17 June 2026.

1. Data controller

Elektroinženjering Brodar d.o.o., Dr. Franje Tuđmana 14, 10431 Brezje, Croatia, company identification number 21963050893.

Privacy contact: eb@ei-brodar.hr. You may contact us at any time regarding the processing of your personal data.

2. Data we process

Full name — identification of the inquiry sender
Company name — project context assessment
Email address and phone number — follow-up communication
Project type and message content — responding to the specific inquiry
Technical data necessary for website security and operation (IP address, browser type, timestamp) — legal basis: legitimate interest (Art. 6(1)(f) GDPR)
Analytics data (aggregated page usage) — only with prior consent (Art. 6(1)(a) GDPR)

3. Purposes and legal bases

Contact form: processing is based on taking steps at the request of the data subject prior to a possible contract (Art. 6(1)(b) GDPR) — responding to the inquiry, preparing project communication.

Technical and security data: legitimate interest of the controller in the secure and reliable operation of the website (Art. 6(1)(f) GDPR). The data subject's interests do not override this legitimate interest as only a minimal set of technical data is collected.

Analytics data (Google Analytics 4): consent of the data subject (Art. 6(1)(a) GDPR). Analytics do not activate without prior explicit acceptance. Consent may be refused or withdrawn at any time without adverse consequences.

We do not carry out automated decision-making or profiling that would produce legal or similarly significant effects on data subjects (Art. 22 GDPR).

4. Contact form and Web3Forms

The contact form sends data through Web3Forms (Cybrr Inc., USA). Data is transmitted to this data processor to deliver the inquiry to the address linked to the configured access key. Web3Forms acts as a data processor under agreed terms.

Transfer of data to the USA is based on standard contractual clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

Do not submit special categories of personal data (Art. 9 GDPR) or confidential documents that are unnecessary for the initial inquiry.

5. Google Analytics 4

If analytics are accepted, Google Analytics 4 (Google LLC, USA) loads. Google acts as a data processor. Data is transferred to the USA on the basis of standard contractual clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and the EU–US Data Privacy Framework.

GA4 collects aggregated page usage data (pages viewed, session duration, geographic region). IP addresses are truncated (IP anonymisation is enabled). Analytics data is retained in the Google Analytics interface for up to 14 months.

Consent for analytics may be withdrawn at any time via the 'Change cookie settings' link at the bottom of this page.

6. Retention periods

Contact inquiry data is retained for no longer than 12 months after communication ends, unless longer retention is necessary for a contractual relationship, legal obligation or the establishment, exercise or defence of legal claims.

Technical and security website data is retained for no longer than 90 days.

Analytics data in the Google Analytics interface is retained for up to 14 months, after which Google automatically deletes older data.

7. Recipients and international transfers

Data may be available to authorised employees of Elektroinženjering Brodar d.o.o. and the following categories of data processors, to the extent necessary for the stated purposes:

Web3Forms (Cybrr Inc., USA) — delivery of contact inquiries; transfer basis: SCCs
Google LLC (USA) — Google Analytics 4, only with consent; transfer basis: SCCs and EU–US DPF
Google LLC (USA) — Google Fonts, typography loading on every visit; transfer basis: SCCs and EU–US DPF
Indian Type Foundry / Fontshare (api.fontshare.com) — typography loading on every visit; transfer basis: SCCs
Hosting provider — technical hosting of the website within the EEA

8. Your rights

Under the GDPR you have the following rights, which you may exercise by sending a request to eb@ei-brodar.hr:

Right of access to personal data (Art. 15 GDPR)
Right to rectification of inaccurate data (Art. 16 GDPR)
Right to erasure ('right to be forgotten') where conditions are met (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability in a machine-readable format (Art. 20 GDPR) — applicable to data provided on the basis of consent or contract
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR)
Right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or with the supervisory authority in your country of residence

9. Security and policy changes

We apply appropriate organisational and technical data protection measures, including HTTPS encryption in transit and access control for internal systems.

This policy may be updated when website functionality, service providers or legal requirements change. The date of the last update is shown at the top of this document.