Privacy Policy

1. Controller

The data controller responsible for the processing of personal data on this website is:

InSyBo d.o.o.
Bosanska 58, 10000 Zagreb, Croatia
OIB: 99932669234
MBS: 081536927
Registered at the Commercial Court in Zagreb
E-mail: info@insybo.hr
Phone: +385 95 700 6324

2. Scope of this Policy

This Privacy Policy describes how InSyBo d.o.o. collects, uses, and protects personal data of visitors to this website (insybo.hr) in accordance with EU Regulation 2016/679 (GDPR) and the Croatian Personal Data Protection Act (OG 42/2018).

3. Data we collect

3.1 Data you provide voluntarily

When you contact us via e-mail or phone, we collect:

Name and surname (if provided)
E-mail address
Phone number (if provided)
The content of your inquiry

3.2 Data collected automatically

If you consent to analytics cookies, we collect via Google Analytics:

Anonymised IP address
Browser type and version
Device type and operating system
Pages visited, time spent, and navigation patterns
Referral source (how you found our website)

This data is collected only with your explicit consent and is anonymised before processing.

4. Legal basis for processing

Purpose	Legal basis (GDPR Art.)
Responding to enquiries and business communication	Art. 6(1)(b) – contract performance / pre-contractual steps
Essential cookies (consent record)	Art. 6(1)(f) – legitimate interest (website security and functionality)
Analytics (Google Analytics)	Art. 6(1)(a) – explicit consent
Compliance with legal obligations	Art. 6(1)(c) – legal obligation

5. Data retention

Business enquiries: retained for as long as necessary to respond and up to 3 years thereafter for legitimate business interests
Analytics data: subject to Google's retention policy (up to 14 months by default)
Consent records: 180 days (stored in your browser via the cookie_consent_v1 cookie)

6. Data sharing and third parties

We do not sell, rent, or trade your personal data. We may share data only with:

Google LLC – for website analytics (only with your consent). Google is certified under the EU–US Data Privacy Framework.
Competent public authorities, if required by law.

7. International data transfers

Google Analytics may transfer data to the United States. Such transfers are protected by Google's adherence to the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), ensuring an adequate level of data protection.

8. Your rights

Under GDPR, you have the following rights regarding your personal data:

Right of access – request a copy of your personal data we hold
Right to rectification – request correction of inaccurate data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing based on legitimate interests
Right to withdraw consent at any time (without affecting prior processing)

To exercise any of these rights, contact us at info@insybo.hr. We will respond within 30 days.

9. Supervisory authority

You have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP):

Agencija za zaštitu osobnih podataka (AZOP)
Selska cesta 136, 10000 Zagreb, Croatia
Web: azop.hr
E-mail: azop@azop.hr

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction, in compliance with Article 32 of the GDPR.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "last updated" date. We encourage you to review this page periodically.