Legal
Privacy policy
This policy explains what personal data Maval Digital collects through this website and when you work with us, why we collect it, and what rights you have under the EU General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR.
1. Who is responsible
The controller of your personal data is:
Email: [email protected]
We are a small business and are not required to appoint a data protection officer. Please send any privacy question to the email address above.
2. What we collect and why
| Data | Purpose | Legal basis | How long we keep it |
|---|---|---|---|
| Name, email, business name and the message you send through the contact form or by email | To reply to you and prepare a proposal | Art. 6(1)(b) GDPR, steps at your request before a contract. For general questions, Art. 6(1)(f), our legitimate interest in answering | 12 months after our last contact, unless a contract follows |
| Contact and billing details, project content and correspondence | To deliver the agreed services and invoice them | Art. 6(1)(b) GDPR, contract. Art. 6(1)(c), legal obligations under accounting and tax law | For the duration of the contract, then invoices and accounting records for the periods Croatian accounting and tax law require |
| Name, email, phone number, time zone, the time you pick and any note, when you book a free call in our calendar | To arrange the call and send you a confirmation and calendar invite | Art. 6(1)(b) GDPR, steps at your request before a contract | 12 months after the call, unless a contract follows |
| Technical data: IP address, date and time, page requested, browser type | To deliver the website securely and fix errors | Art. 6(1)(f) GDPR, our legitimate interest in a secure, working website | Kept by our hosting provider in server logs for a short period, normally no longer than 30 days |
| Your cookie and language choices, stored in your browser | To remember whether you accepted or rejected optional storage, and which language you chose | Art. 6(1)(c) and (f) GDPR. Strictly necessary storage does not require consent | Cookie choice 12 months, language until you clear your browser storage |
| Anonymous visit statistics, only if analytics is switched on and you accept it | To see which pages are useful | Art. 6(1)(a) GDPR, your consent, which you can withdraw at any time | As described in the cookie banner and cookie policy |
If you message us on Instagram, Meta Platforms processes that data under its own privacy policy. We only see what you send us and use it to reply.
3. Who receives your data
We never sell your data. We share it only with service providers who help us run the business and who process it on our instructions under a data processing agreement:
- Website hosting:
- Contact form delivery:
- Email:
- Call booking: Cal.com, Inc. (USA), which runs our booking calendar for us. See also Cal.com's privacy policy.
- Our accountant, for invoices and bookkeeping
Where a provider processes data outside the EU or EEA, the transfer is based on an EU adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses.
4. Fonts, links and social media
This website loads its fonts from our own server, so visiting it doesn't send your data to Google or other font providers. There are no social media plugins or embedded third-party content. Links to Instagram and other sites only take you there when you click them, and those sites then apply their own privacy policies.
5. Your rights
You have the right to:
- get a copy of the personal data we hold about you (Art. 15 GDPR)
- have incorrect data corrected (Art. 16)
- have your data deleted where there's no reason to keep it (Art. 17)
- restrict how we use your data (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on our legitimate interests (Art. 21)
- withdraw any consent you gave, without affecting earlier processing (Art. 7(3))
Send your request to [email protected]. We reply within one month.
6. Complaints to the supervisory authority
If you think we handle your data unlawfully, you can complain to the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or to the authority in the EU country where you live or work.
7. Do you have to give us your data?
No. But without at least an email address we can't reply to your enquiry, and without billing details we can't enter into a contract with you.
8. Automated decisions
We don't use automated decision-making or profiling.
9. Security
This website uses an encrypted HTTPS connection. Access to your data is limited to the people and providers who need it to do their work.
10. Changes to this policy
We update this policy when our services or the law change. The date at the top shows the latest version.