SLF Projekt d.o.o. za projektiranje, nadzor i vještačenje u graditeljstvu, Bitoljska ulica 27, 10090 Zagreb, Croatia ("SLF Projekt" or "we"), is the controller of the personal data that we collect through the website www.slfprojekt.hr: data in the enquiries you send us, data about visits to the website and photographs of people published on the website. This notice provides the information required by Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016 ("GDPR").
We have not designated a data protection officer because none of the cases in Article 37(1) of the GDPR applies to us: we are not a public authority, and our core activities, design, construction supervision and expert opinions in construction, do not consist of regular and systematic monitoring of data subjects on a large scale or of large-scale processing of special categories of data or of data relating to criminal convictions. Please send any data protection questions to the email address above.
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Replying to an enquiry and preparing a quotation | full name, email address, company (if you provide it), selected type of service, content of the message and any data you include in it, language of the page, time of sending | steps taken at your request before entering into a contract (Article 6(1)(b) GDPR); where you send the enquiry on behalf of a company or another person: our legitimate interest in replying to a business enquiry and preparing a quotation (Article 6(1)(f)) | 12 months from the last communication; if the enquiry leads to a contract, it is kept in the project file for as long as the legislation on the retention of business records requires |
| Protecting the form against misuse and unsolicited messages | IP address from which the enquiry was sent (included in the email containing the enquiry); a hash (MD5) of the IP address and the time of sending, in a temporary file on the server | our legitimate interest in protecting the form and the server against misuse, including a limit of no more than five enquiries from one IP address per hour (Article 6(1)(f)) | IP address in the email: as for the enquiry; temporary file: entries older than one hour are disregarded and removed at the next enquiry from the same IP address, and the file is deleted when the server's temporary folder is cleared |
| Visit statistics (Google Analytics) | identifier from the Google Analytics cookie, pages visited, source of the visit, type of device and browser, approximate location (country, city) | your consent (Article 6(1)(a) GDPR and Article 43(4) of the Electronic Communications Act (Zakon o elektroničkim komunikacijama, Official Gazette NN 76/22, 14/24 and 45/26)) | cookies up to 2 years (see the Cookies page); data in Google Analytics event data 2 months, user data 14 months |
| Delivery and security of the website | IP address, time of access, requested page address, browser and device information | our legitimate interest in keeping the website available, delivering it correctly and protecting it against attacks (Article 6(1)(f)) | hosting provider's server logs: in line with the hosting provider's settings, for as long as is necessary for the operation and security of the server; Cloudflare: a limited period, in accordance with its data processing terms |
| Presenting the company, its team and completed work | photographs of employees and associates with their name, qualification and role; site photographs in which people can be recognised | consent of the person concerned (Article 6(1)(a)) or our legitimate interest in presenting the company, its team and completed work (Article 6(1)(f)) | until the end of employment or cooperation, or until consent is withdrawn or an objection is upheld |
The mandatory fields of the form are full name, email address and message; company and type of service are optional. Sending an enquiry is voluntary and is not a statutory or contractual requirement, but we cannot reply without the mandatory data. We do not need your consent to process the data in an enquiry, because the processing is based on your request for a reply or, where you write on behalf of a company, on our legitimate interest.
The enquiry is sent by email to [email protected], together with the language of the page, the time of sending and the IP address, and is kept in the company's mailbox. The form contains a hidden field that people do not see; if an automated program fills it in, the enquiry is discarded. If you write to us directly by email, we process the data in your message for the same purpose and on the same basis.
We load Google Analytics only after you click "Accept" in the cookie notice. The list of cookies, their duration and how to withdraw consent are set out on the Cookies page. According to Google's documentation, Google Analytics does not log or store the IP addresses of visitors from the European Union: it uses them only to derive an approximate location and then discards them. We do not use Google Signals, advertising or profiling.
We do not sell personal data and do not disclose it to anyone for advertising purposes.
Google and Cloudflare may also process data in the United States. The transfer is based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework (C(2023) 4745, OJ L 231, 20.9.2023), adopted under Article 45 of the GDPR. Google LLC and Cloudflare, Inc. state on their official websites that they are certified under that framework and, should the certification cease to apply, they may rely on the standard contractual clauses under Article 46 of the GDPR.
Concept Branch Ltd has its registered office in the United Kingdom. The European Commission has found that the United Kingdom ensures an adequate level of protection in Commission Implementing Decision (EU) 2021/1772 of 28 June 2021, as amended, adopted under Article 45 of the GDPR.
In the team section we publish photographs of employees and associates with their name, qualification and role, and on the home page and in the references we publish site photographs in which people can be recognised. Where publication is based on consent, you may withdraw it at any time; where it is based on legitimate interest, you may object. In either case, write to [email protected]: we will remove the photograph, or make the person in it unrecognisable, without undue delay.
Send your request to [email protected]. We reply without undue delay and in any event within one month of receiving the request; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, and we will inform you of any extension (Article 12(3)). Requests are handled free of charge, except where they are manifestly unfounded or excessive (Article 12(5)). If we have reasonable doubts about the identity of the person making the request, we may ask for additional information necessary to confirm it (Article 12(6)).
We do not make decisions based solely on automated processing and we do not carry out profiling (Article 22 GDPR).
The website is delivered over an encrypted connection (HTTPS), the form is protected against automated submissions and by a limit on the number of enquiries, and enquiries are kept in the company's password-protected mailbox (Article 32 GDPR).
If you believe that your data are being processed unlawfully, you may lodge a complaint with the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), the supervisory authority under Article 4(1) of the Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka, NN 42/18): Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, [email protected], www.azop.hr. You may also contact us first, but this is not a condition for lodging a complaint.
We amend this notice when the way we process data or the legislation changes. The current version is always published on this page, with the date of the last update.
In force from 14 October 2026.
Last updated: 14 October 2026
