Privacy Policy

This Privacy Policy ("Policy") describes how Kodelab d.o.o. ("Kodelab," "we," "us," or "our") collects, uses, discloses, and safeguards your personal data when you visit the website kodelab.hr (the "Website"). It also outlines your rights regarding your personal data and explains how you can contact us about our data practices.

We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Who We Are

Kodelab d.o.o.

Cebini 28, Buzin
10010 Zagreb, Croatia
OIB: 99465081311

If you have any questions about this Policy or how we handle your personal data, please contact our Data Protection Officer (DPO):

2. Data We Collect and How We Use It

We may collect and process the following types of personal data:

• Contact Form Data: your name and email address and, if you choose to provide them, your company, phone number, the services you're interested in, budget range, how you heard about us, and your message.
• Device and Usage Data: such as IP addresses, browser type, operating system, language settings, and user behavior on our Website (collected via analytics cookies, only if you consent — see Section 6).
• Server and Security Data: when you visit the Website, our hosting provider automatically processes technical data such as your IP address, browser type, and the pages requested.

Purposes and Legal Bases

• Providing Information and Services: if you contact us, we use your data to respond to your inquiries. This processing is based on our legitimate interests or your consent, as applicable.
• Operating and Securing the Website: we use server and security data to deliver the Website, keep it secure, and prevent abuse — for example, the contact form temporarily holds IP addresses in memory, never stored permanently, to limit repeated submissions. The legal basis is our legitimate interest in a secure and functioning Website (Art. 6(1)(f) GDPR).
• Analytics and Improvements: if you accept analytics cookies, we use Google Analytics to collect pseudonymized usage data (e.g., pages visited, referring website, approximate location, device and browser type) to understand how our Website is used and to improve it. Our legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via Cookie settings in the footer of every page; withdrawal does not affect the lawfulness of processing carried out before it.

Providing your name and email address in the contact form is necessary for us to reply; all other fields are optional. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We only collect personal data that is necessary for the stated purposes and do not process it for any other purposes without your prior notice and, where required, consent.

3. Data Sharing and Transfers

We may share your personal data with:

• Service Providers: third-party vendors who assist us in providing and improving our services (e.g., hosting providers, analytics tools). Such service providers are subject to contractual obligations to ensure the confidentiality and security of your data.
• Google Analytics: provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), acting as our processor, and used only if you consent to analytics cookies. We also use Google Tag Manager, provided by the same company, to manage analytics tags on our Website; it is likewise loaded only if you consent. Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework. More information is available at policies.google.com.
• Legal and Regulatory Authorities: if required by law or to protect our rights and interests, we may disclose personal data to comply with a legal obligation or enforce legal claims.

If we transfer your personal data outside the European Economic Area (EEA), we will ensure appropriate safeguards (e.g., EU Standard Contractual Clauses) are in place to protect your data in accordance with the GDPR.

4. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected or as required by applicable laws. For example:

• Inquiries: if no business relationship follows, deleted no later than 24 months after our last correspondence. If we start working together, retained for as long as our contract and applicable accounting and tax laws require.
• Analytics Data: retained in Google Analytics for 2 months, after which it is deleted automatically.

We periodically review our retention periods to ensure they are appropriate and compliant with the law.

5. Your Rights Under the GDPR

You have the following rights regarding your personal data:

• Right of Access: obtain confirmation that we are processing your personal data and receive a copy.
• Right to Rectification: request that we correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): request deletion of your data if we have no lawful basis to continue processing it.
• Right to Restriction: in certain circumstances, request that we limit how we process your data.
• Right to Data Portability: receive your personal data in a structured, commonly used, and machine-readable format and request its transfer to another controller where technically feasible.
• Right to Object: object to certain processing activities based on our legitimate interests.
• Right to Withdraw Consent: if we process your personal data on the basis of consent, you can withdraw it at any time.

To exercise these rights, please contact us at dpo@kodelab.hr. We will respond to your requests as soon as possible and no later than 30 days from receipt. We may need additional information to verify your identity before processing your request.

If you believe that we have infringed your rights, you have the right to lodge a complaint with the relevant data protection authority. In Croatia, this is the Croatian Personal Data Protection Agency (AZOP). More information is available at azop.hr.

6. Cookies and Similar Technologies

We use analytics cookies only with your consent, and a small amount of browser storage to remember your choice. We do not use advertising or marketing cookies.

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help the Website remember your visits and preferences (e.g., language, login), making it easier to use and more useful to you. Cookies cannot be used to run programs or deliver viruses to your device.

Cookies and Storage We Use

• Strictly Necessary Storage: your cookie choice (Accept or Reject) is kept in your browser's local storage under the key kodelab-consent, so we don't ask again on every page. It is kept for 12 months, after which we ask again. This storage does not require consent.
• Analytics Cookies (only with your consent): Google Analytics sets _ga (distinguishes visitors) and _ga_6LLHZQWRXS (keeps track of the current session), each for up to 2 years. They are set only after you click Accept.

Managing Cookies

When you first visit our Website, we ask whether you accept analytics cookies. Google Analytics and Google Tag Manager are not loaded, and no analytics cookies are set, unless you click Accept. You can change or withdraw your choice at any time via Cookie settings, also available in the footer of every page. If you withdraw your consent, the analytics cookies are deleted. Rejecting analytics cookies does not affect how the Website works.

You can also block or delete cookies through your browser settings. More information on managing cookies is available at allaboutcookies.org.

7. Security Measures

We apply appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. Access to your personal data is limited to employees and service providers who need the data to perform their duties.

8. Links to Third-Party Websites and Social Media Features

Our Website may contain links to third-party websites or social media platforms. We have no control over their privacy practices and are not responsible for their policies or actions. We encourage you to review the privacy policies of any external sites you visit.

9. Changes to This Policy

We may update this Policy from time to time. The most current version will always be posted on this page, with the date of the last update. If we make material changes, we will highlight them on this page and update the date above.

Contact Us

If you have any questions or concerns about this Policy or our data practices, please contact us atdpo@kodelab.hr, or through our contact page.