Privacy Policy

1. Data controller

The data controller is CRO-MECHANIX, obrt za razvoj softverskih rješenja, vl. Jura Tomorad (a Croatian sole proprietorship for the development of software solutions, owner Jura Tomorad).

Address: Ulica Ljudevita Gaja 1, Marija Bistrica, Republic of Croatia. MB (registration number): 99015340.

For any question about the processing of personal data, write to info@cro-mechanix.hr. Other CRO-MECHANIX contact details are published on the contact page.

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Zakon o provedbi Opće uredbe o zaštiti podataka (Act on the Implementation of the General Data Protection Regulation).

2. What data we process

We obtain personal data from the inquiries you send us through the inquiry form on the site or by email. The site has no chat.

When you send an inquiry through the form, we receive:

• first and last name
• email address
• company name
• phone number, if you provide it
• the service you select
• your message
• the address of the page from which you sent the inquiry
• attachments, if you add them

You can attach up to 5 files to the form, such as drawings, models and photos, of up to 50 MB each. Attachments may contain personal data, for example names or other details in the title blocks of drawings.

Each attachment is uploaded as soon as you select it and is stored in private Cloudflare R2 storage. Formspark does not receive the files themselves, only links for downloading them, which are protected by a signature and valid for 90 days.

When you send an inquiry by email, we receive:

• first and last name
• company name
• email address
• phone number, if you provide it
• the content of the inquiry and the attached technical documentation (drawings, operating conditions)

When you visit the site, the following are recorded automatically:

• IP address
• browser and device type
• date and time of access
• pages visited

This information is recorded in server logs.

3. Purposes and legal bases

We process personal data on the basis of Article 6(1) of the GDPR:

• point (b): steps taken at your request before entering into a contract, and performance of the contract, namely replying to an inquiry sent through the form or by email, together with any attached files, preparing the quotation and producing calculations and documentation
• point (f): legitimate interest in the security of the site, in protecting the inquiry form and uploads against spam, and in aggregate visit and speed statistics (Cloudflare Web Analytics)
• point (c): compliance with legal obligations, in particular accounting and tax obligations

4. Cookies

The site does not use cookies or marketing tools, so no cookie consent is required from you.

For visit statistics the site uses Cloudflare Web Analytics. This service sets no cookies, stores nothing in your browser and does not track you across other sites. It records aggregate visit data: the page you opened, the page you came from, browser and device type, country and page load time. It does not use your IP address for tracking. We only look at the data in aggregate, to follow visits and page speed.

When you send the inquiry form or upload an attachment, the spam-protection check briefly stores a technical value in your browser's session storage. This value is deleted when you close the tab and is not used for tracking.

5. Recipients and transfers outside the EEA

Personal data may be received by:

• IT service providers: website hosting, visit analytics, attachment storage, inquiry-form processing and spam protection, and email
• the bookkeeping service, to the extent required by tax obligations
• competent authorities, where the law requires it

We do not sell personal data or pass it on for marketing purposes.

Where an IT service provider processes data outside the European Economic Area (EEA), the transfer takes place under that provider's safeguards, for example standard contractual clauses or the EU-US Data Privacy Framework.

6. The client's project documentation

The technical documentation you send, such as drawings, operating conditions and specifications, is used only to handle your inquiry, prepare the quotation and carry out the contracted work.

We do not share the documentation with third parties without your permission. The exception is the notified body, where you ask for this as part of the contracted work.

7. Retention period

We keep personal data for as long as the purpose of processing requires. Where the rules on keeping business and accounting records require a longer period, we keep the data until that period ends.

Attachments sent through the form are deleted automatically from Cloudflare R2 storage after 90 days. Any copies of attachments we keep in email or in Formspark are retained like the rest of the inquiry, for the period set out in the previous paragraph.

8. Your rights

In relation to your personal data, you have the right to:

• access to the data
• rectification of inaccurate data
• erasure of the data
• restriction of processing
• data portability
• objection to processing

Send your request to info@cro-mechanix.hr.

9. Complaint to the Croatian Personal Data Protection Agency

If you believe that your personal data is being processed in breach of the law, you can lodge a complaint with the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), the Croatian Personal Data Protection Agency, Selska cesta 136, 10000 Zagreb, www.azop.hr.

10. Changes and effective date

Changes to this policy are published on this page with their effective date. This version is effective from 2 October 2026.

Use of the site is also governed by the terms of service.