This privacy policy describes how EKO ELEKTRO VOD d.o.o. ("we", "us" or the "Company") collects, uses and protects the personal data of visitors to this website, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian GDPR Implementation Act (NN 42/18).
1. Data controller
The controller of personal data is:
EKO ELEKTRO VOD d.o.o.
Pavla Štoosa 10a, 10360 Zagreb, Croatia
OIB (tax ID): 35955468622
E-mail: info@ekoelektrovod.eu
Phone: +385 98 38 97 97
For any questions regarding personal data protection, you can contact us at the e-mail address above.
2. What personal data we collect
This website collects the minimum amount of data required for its operation:
2.1 Contact form
When you use the contact form on our site, we collect the data you voluntarily enter:
- First and last name
- E-mail address
- Phone number
- Type of inquiry
- Message content
Form data is sent to our server for processing (Cloudflare Worker), which forwards it as an e-mail message to our address info@ekoelektrovod.eu via the Resend e-mail delivery service. Form data is not stored in a database on the website - the permanent record of your inquiry is the message received in our business mailbox.
2.2 Communication via WhatsApp
If you contact us via the WhatsApp link on the site, the communication takes place directly through the WhatsApp platform. Meta Platforms Ireland Limited processes that data according to its own privacy policy. We do not store or control the data WhatsApp collects.
2.3 Technical data (hosting)
This site is hosted on the Cloudflare Pages platform. Cloudflare automatically processes certain technical data to deliver content and protect against malicious traffic:
- IP address
- Browser type and version
- Operating system
- Date and time of access
- Requested page
This data is processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) to ensure the security and functioning of the website. Cloudflare, Inc. is a US company that provides appropriate safeguards for data transfers in accordance with the EU-U.S. Data Privacy Framework.
2.4 Spam protection (Cloudflare Turnstile)
The contact form uses Cloudflare Turnstile, a service that distinguishes humans from automated programs (bots), to prevent abuse of the form. Turnstile processes technical browser and device signals (including the IP address) and is loaded from the Cloudflare domain challenges.cloudflare.com. The validity of the Turnstile check is additionally verified on our server before the inquiry is processed. Processing is based on legitimate interest (Art. 6(1)(f) GDPR) in protecting against abuse and unwanted messages.
3. Cookies
This website does not set cookies of its own. Cloudflare, as the hosting and Turnstile form-protection provider, may set strictly necessary security cookies (e.g. __cf_bm) to protect against automated attacks and ensure the site functions properly.
These cookies fall into the category of strictly necessary cookies, which are exempt from the consent requirement under Art. 5(3) of Directive 2002/58/EC (ePrivacy Directive).
We do not use analytics, marketing or third-party tracking cookies.
For the contact form to work properly we use temporary browser storage (sessionStorage) so that the data you entered is not lost if an error occurs during submission. That data stays exclusively on your device, is not sent to anyone and is automatically deleted when you close the browser tab.
4. Purpose and legal basis of processing
| Activity | Purpose | Legal basis (GDPR) |
|---|---|---|
| Contact form | Responding to your inquiry | Art. 6(1)(b) - performance of a contract / pre-contractual steps |
| Cloudflare Turnstile (form protection) | Preventing automated abuse of the contact form | Art. 6(1)(f) - legitimate interest |
| WhatsApp communication | Responding to your inquiry | Art. 6(1)(b) - performance of a contract / pre-contractual steps |
| Technical data (Cloudflare) | Site security and operation | Art. 6(1)(f) - legitimate interest |
| Security cookies | Protection against malicious traffic | Art. 6(1)(f) - legitimate interest |
5. Sharing data with third parties
We do not sell, trade or otherwise transfer your personal data to third parties, except in the following cases:
- Cloudflare, Inc. - provider of hosting, form processing (Worker) and Turnstile protection. Cloudflare may process technical data in line with its obligations as a data processor. More information: Cloudflare privacy policy.
- Resend (resend.com) - the e-mail delivery service through which contact-form messages reach our mailbox. Resend processes form data as a data processor; it is a US company and the transfer is protected by appropriate safeguards (standard contractual clauses). More information: Resend privacy policy.
- Meta Platforms Ireland Limited - only if you contact us via WhatsApp. More information: WhatsApp privacy policy.
- Legal obligation - if we are legally required to disclose data to competent authorities.
6. Third-party content
This website does not load content from external servers - all fonts, icons and styles are hosted locally on the same server. We do not use external tracking or analytics services. The only exception is the Cloudflare infrastructure: delivery of the site itself and the Turnstile protection of the contact form, which is loaded from the domain challenges.cloudflare.com.
7. Data retention
We keep personal data only as long as necessary to fulfil the purpose for which it was collected:
- Contact inquiries: we keep communication data until the end of the business relationship, and no longer than 2 years after the last contact, unless longer retention is required by legal obligations.
- Technical data: Cloudflare automatically deletes access logs in accordance with its own retention rules.
- E-mail delivery logs (Resend): kept for a limited time in accordance with the provider's rules.
8. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15) - the right to ask whether we process your data and to access it.
- Right to rectification (Art. 16) - the right to request correction of inaccurate data.
- Right to erasure (Art. 17) - the right to request deletion of your data ("right to be forgotten").
- Right to restriction of processing (Art. 18) - the right to request restriction of processing in certain cases.
- Right to data portability (Art. 20) - the right to receive your data in a structured format.
- Right to object (Art. 21) - the right to object to processing based on legitimate interest.
To exercise your rights, contact us at: info@ekoelektrovod.eu
You also have the right to lodge a complaint with the supervisory authority:
Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136, 10000 Zagreb, Croatia
azop.hr
9. Data security
We apply appropriate technical and organisational measures to protect your data, including:
- SSL/TLS encryption (HTTPS) for all communication with the website
- Cloudflare DDoS protection and Web Application Firewall (WAF)
- Cloudflare Turnstile protection of the contact form, with server-side validation
- Locally hosted site resources (no external tracking or analytics services)
- Security HTTP headers (Content-Security-Policy, HSTS, X-Frame-Options)
10. Changes to this privacy policy
We reserve the right to amend this privacy policy at any time. Any change takes effect upon publication on this page. We recommend reviewing this page from time to time to stay informed of any changes.
Date of last change: July 2026