Privacy Policy

1. Data controller

The data controller for your personal data is Orlyventa d.o.o., Ilica 256, 10000 Zagreb, Croatia, OIB: 78523461029. For all questions related to personal data processing, you can contact us at: dpo@orlyventa.com.

2. What data we collect

We collect the following categories of personal data:

• Identification data: name, surname, email address that you voluntarily provide through the contact form.
• Technical data: IP address, browser type, operating system, language settings, access date and time, automatically collected by our systems.
• Usage data: pages you visit, time spent on the website, clicks and interactions, collected through analytical tools (with your consent).
• Cookie data: cookie preferences and consent for specific processing categories, stored locally in your browser.

3. Legal basis and purpose of processing

We process your personal data based on the following legal bases under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)) — for analytical and marketing cookies and sending notifications.
• Legitimate interest (Art. 6(1)(f)) — for technical functioning of the website, security, and abuse prevention.
• Contract performance (Art. 6(1)(b)) — for processing your enquiries and communication through the contact form.

4. Sharing data with third parties

We do not sell or rent your data. Data may be shared with the following categories of recipients:

• Google LLC (Google Analytics, Google Ads) — for traffic measurement and displaying relevant advertisements, with your consent in accordance with Google Consent Mode v2.
• Hosting service providers — for technical functioning and security of the website.
• Competent authorities — when required by law or based on a court order.

5. International data transfers

Some of our service providers (e.g., Google) may process data outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards, including Standard Contractual Clauses (SCC) approved by the European Commission and certification mechanisms.

6. Your rights

Under the GDPR, you have the following rights:

• Right of access — request access to the personal data we process.
• Right of rectification — request correction of inaccurate or incomplete data.
• Right of erasure — request deletion of your personal data ('right to be forgotten').
• Right to restriction — request temporary restriction of processing.
• Right to data portability — request transfer of your data in a structured format.
• Right to object — object to processing based on legitimate interest.
• Right to withdraw consent — at any time, without affecting the lawfulness of previous processing.

To exercise your rights, contact us at: dpo@orlyventa.com. We will respond to your request within 30 days.

7. Data retention period

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected. Contact form data is retained for a maximum of 12 months from the last communication. Analytical data is retained in anonymised form.

8. Data security

We apply technical and organisational data protection measures, including SSL/TLS encryption, access controls, regular security audits, and pseudonymisation where possible.

9. Right to lodge a complaint

You have the right to lodge a complaint with the competent data protection authority — the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop.hr.

10. Changes to the privacy policy

We reserve the right to amend this Privacy Policy. Any significant changes will be published on this page with an updated date. We recommend regularly reviewing this page.