Privacy policy

1. Who is responsible

The controller of your personal data is SYMMETRIA d.o.o., Bolnička cesta 34E, 10090 Zagreb, Croatia, OIB 49942588956.

For any question about this policy or your personal data, please reach us through the contact form and mention “Privacy” in the subject.

2. What data we collect

• Contact form: your name, e-mail address, subject and message, plus anything else you choose to tell us.
• Server logs: IP address, date and time of the request, requested page, referring page, browser and device information.
• Cookies: strictly necessary cookies that keep the site working and secure, and analytics cookies only if you consent to them.
• Embedded map: when you open the contact page, a Google Maps map is loaded, and Google receives your IP address and browser information.

We do not ask for special categories of personal data. Please do not send such data through the contact form.

3. Why we use it and on what legal basis

• Answering your inquiry and preparing an offer — steps prior to entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in responding to messages (Art. 6(1)(f) GDPR).
• Running and securing the website — server logs and necessary cookies, based on our legitimate interest in a stable and secure site (Art. 6(1)(f) GDPR).
• Understanding how the site is used — analytics cookies, only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Showing our location — the embedded map, based on our legitimate interest in showing where our registered office is (Art. 6(1)(f) GDPR).
• Meeting legal obligations — for example accounting and tax rules, where they apply (Art. 6(1)(c) GDPR).

4. How long we keep it

Contact form messages are kept as long as needed to handle your inquiry and any follow-up. If no business relationship follows, we delete them when they are no longer needed, unless we must keep them to establish, exercise or defend legal claims.

Server logs are kept for a short period for security and troubleshooting and are then deleted automatically. Cookies expire as described in the cookie settings, and you can delete them in your browser at any time. Data that forms part of a contract or invoice is kept for the periods required by Croatian law.

5. Who receives your data

We do not sell personal data. We share it only with service providers that help us run the website, under data processing agreements and only as far as necessary:

• Hosting provider — stores the website, server logs and contact form messages on our behalf.
• Google — provides the embedded map on the contact page and, if you consent, analytics.

Where a provider processes data outside the European Economic Area, the transfer is protected by an adequacy decision or the European Commission’s standard contractual clauses. We may also disclose data to public authorities where the law requires it.

6. Cookies

Strictly necessary cookies are set without consent because the site cannot work properly without them. Analytics cookies are set only after you accept them, and you can change your choice at any time. You can also block or delete cookies in your browser settings; some parts of the site may then not work as intended.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy
• have inaccurate data corrected
• have your data erased, where there is no reason for us to keep it
• restrict processing in certain cases
• receive your data in a portable format, where processing is based on consent or contract
• object to processing based on our legitimate interests
• withdraw your consent at any time, without affecting processing carried out before withdrawal

To exercise any of these rights, contact us through the contact form. We will reply within one month and may ask you to confirm your identity first.

8. Supervisory authority

If you believe we process your personal data unlawfully, you can lodge a complaint with the Croatian data protection authority: Agencija za zaštitu osobnih podataka (AZOP), azop.hr. We would appreciate the chance to address your concern first.

9. Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access control and regular updates of the software that runs the site.

10. Changes to this policy

We may update this policy when our website or the law changes. The current version is always published on this page, with the date of the last update shown at the top.