Privacy policy
Effective from: 4 November 2026.
This policy provides the information required by Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). It also sets out the service provider details required by Article 6 of the Croatian Electronic Commerce Act and Article 21 of the Companies Act. The Croatian version is the authoritative one.
1. Controller and service provider details
IT Sektor d.o.o., Barutana 15, 32100 Vinkovci, Croatia
OIB (company ID): 47743795742 · registered with the Commercial Court in Osijek, MBS 030106097
Share capital: EUR 2,654.46 (HRK 20,000.00), paid in full · Management: Matko Cikač, director
IBAN: HR4823400091110412394, Privredna banka Zagreb d.d.
Email: info@itsektor.hr · Phone: +385 98 548 456
2. Data protection officer
We have not appointed a data protection officer, because Article 37 GDPR does not require one. For any data protection question, write to info@itsektor.hr or to the address above.
3. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering an enquiry sent via the form, email or phone | name, company, email, phone (optional), area of interest, message | steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for enquiries on behalf of a company, legitimate interest in business communication (Art. 6(1)(f)) | up to 2 years from the last communication if no business relationship follows |
| Concluding and performing contracts with clients | identification and contact details of the client or its contact person, project details, invoicing data | performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) under accounting and tax law | the term of the contract, then statutory periods: accounting documents generally 11 years (Accounting Act) |
| Website visit statistics (Google Analytics 4) | pseudonymous device identifier (cookie), pages visited, referral source, device and browser type, approximate city- or country-level location | your consent (Art. 6(1)(a) GDPR and Art. 43(4) of the Croatian Electronic Communications Act), which you can withdraw at any time | cookies up to 2 years; data in Google Analytics at most 14 months |
| Website security and operation (server logs) | IP address, date and time of access, requested URL, browser data | legitimate interest in the security and proper functioning of the website (Art. 6(1)(f)) | short term, according to the hosting provider’s settings, unless logs are needed to investigate a security incident |
The form does not ask for consent, because we use the data only to answer your enquiry. We do not use it for newsletters or marketing and do not share it with third parties for advertising.
4. Cookies and local storage
Without your consent, we store on your device only what the site needs to work and to remember your choice. Analytics cookies are set only after you click “Accept analytics”. “Reject” and “Accept analytics” are equally prominent. You can withdraw consent as easily as you gave it, via the “Cookie settings” link in the footer of every page. Withdrawing consent deletes the analytics cookies. We keep your choice for 12 months and then ask again. Until you consent, Google Analytics runs in Consent Mode without setting cookies.
| Name | Type and set by | Purpose | Duration |
|---|---|---|---|
| PH_HPXY_CHECK | cookie, hosting provider (strictly necessary) | protects the server against malicious traffic | end of session |
| its_consent, its_consent_t | browser local storage, IT Sektor (strictly necessary) | remembers your analytics choice and when you made it | 12 months |
| _ga | cookie, Google Analytics (consent only) | distinguishes visitors for statistics | 2 years |
| _ga_RYMQQ6K25M | cookie, Google Analytics (consent only) | keeps session state for statistics | 2 years |
Fonts are served from our own server, not from Google’s servers.
5. Sources of data and whether providing it is mandatory
We receive data directly from you or, for contact persons, from the company you work for. Providing data is not a statutory requirement. Without a name, email and message we cannot answer your enquiry, and without contract data we cannot conclude a contract.
6. Recipients and processors
- Hosting of the website and of email on itsektor.hr: Infonet (infonet.hr), servers in Croatia.
- Receiving enquiries: form messages are forwarded to the management’s mailbox with Google.
- Visit statistics (consent only): Google Analytics.
- For both Google services, the processor is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
- External accounting and legal advisers, to the extent their service requires and under a duty of confidentiality.
- Public authorities, where the law requires (e.g. the Tax Administration, courts).
Our processors act under a contract or data processing terms in line with Article 28 GDPR. We do not sell personal data.
7. Transfers outside the European Economic Area
Google may also process data in the United States. Such transfers rely on the European Commission’s adequacy decision (EU) 2023/1795 (EU–US Data Privacy Framework), under which Google LLC is certified, and in the alternative on the Commission’s standard contractual clauses (Articles 45 and 46 GDPR).
8. Automated decision-making
We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR).
9. Your rights
You have the right to access your data and obtain a copy (Art. 15), to rectification (Art. 16), to erasure except where we must keep data by law (Art. 17), to restriction of processing (Art. 18), and to portability of data you gave us on the basis of consent or a contract (Art. 20). You can withdraw your analytics consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).
Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. We will then stop, unless we demonstrate compelling legitimate grounds or the processing is needed for legal claims.
Send requests to info@itsektor.hr or by post. We respond free of charge, at the latest within one month. In exceptional cases this period can be extended by two further months, and we will tell you if so (Art. 12 GDPR). We may ask you to confirm your identity first.
10. Right to lodge a complaint
You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr, tel. +385 1 4609 000, azop.hr. You may also complain to the supervisory authority of the EU member state where you live or work.
11. Security
The website is served only over an encrypted connection (HTTPS). The form is protected against automated submissions, and the address that receives enquiries is not visible on the site. We notify AZOP of personal data breaches and, where required, the people affected (Articles 33 and 34 GDPR).
12. Applicable law and changes
Regulation (EU) 2016/679; Act on the Implementation of the GDPR (NN 42/18); Electronic Communications Act (NN 76/22 as amended); Electronic Commerce Act (NN 173/03 as amended, most recently NN 67/25); Companies Act.
We update this policy when our processing or the law changes. The current version is always published on this page.