Legal
Document 2 of 6
Privacy policy
How Version2 j.d.o.o. processes personal data under the GDPR.
- Last updated
- Sections
- 10
Contents
This Privacy Policy explains how Version2 j.d.o.o. processes personal data when you visit our website, contact us or use our products and services. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Croatian Act on the Implementation of the GDPR (Zakon o provedbi Opće uredbe o zaštiti podataka).
Version2 j.d.o.o. za digitalni marketing Novigradska ulica 21, 23000 Zadar, Croatia OIB: 91496405628 Email: office@version2.hr
Further company details are on our Legal notice page.
We have not appointed a Data Protection Officer because we are not required to under Article 37 of the GDPR. Please send any data protection request to office@version2.hr.
We process personal data only where we have a legal basis under Article 6(1) of the GDPR. The sections below describe each processing activity.
a) Contact and Enquiries
| Details | |
|---|---|
| Data | Name, email address, phone number if you give it, message content |
| Purpose | Responding to your enquiry, preparing quotes, pre-contractual communication |
| Legal basis | Art. 6(1)(b) GDPR: steps taken at your request before entering into a contract |
| Retention | 2 years from submission; if a contract follows, the retention period for orders applies |
b) Career Applications
| Details | |
|---|---|
| Data | Name, email address, the role you apply for, your answers, work samples and links you submit, our assessment notes, and technical connection data (IP address) |
| Purpose | Assessing your application and contacting you about it |
| Legal basis | Art. 6(1)(a) GDPR: your consent, given when you submit the application. You can withdraw it at any time by writing to office@version2.hr |
| Retention | For the duration of the recruitment process. Six months after submission we delete data we no longer need, unless you agree to a longer period or we need it to establish, exercise or defend legal claims |
Decisions about applications are made by people. We do not make decisions based solely on automated processing within the meaning of Article 22 of the GDPR.
c) Orders and Contracts (including Digital Business Cards)
| Details | |
|---|---|
| Data | Name, email address, phone number, billing and delivery address, company details, order details, the content you provide for your order (for example a design brief, artwork or logo), and payment status |
| Purpose | Performing the contract: producing and delivering products, providing services, setting up access to our digital profile app, invoicing and customer support |
| Legal basis | Art. 6(1)(b) GDPR: performance of a contract. Art. 6(1)(c) GDPR: accounting and tax obligations |
| Retention | For the duration of the contract and afterwards for the periods required by accounting and tax law (generally 11 years for accounting records). Artwork and logo files supplied for printing are deleted within 90 days after the order is delivered, unless we need them longer to handle a complaint |
d) Payments
Card payments are processed by Stripe. We do not receive or store your full card details. Stripe processes payment data as an independent controller under its own privacy policy. If you pay by bank transfer, the payment details shown on your transfer are kept with your order records.
e) Free Website Analysis and Free Security Check
| Details | |
|---|---|
| Data | The website address you submit; if you ask for a report or result by email, also your name, email address, any message you add and the report or result we prepare; technical connection data (IP address) |
| Purpose | Providing the analysis or check you request and following up on your request |
| Legal basis | Art. 6(1)(b) GDPR: providing the service you request. Art. 6(1)(f) GDPR: our legitimate interest in following up on enquiries we receive |
| Retention | Up to 2 years from your request |
f) Cybersecurity Services
| Details | |
|---|---|
| Data | Name, email address, company, the website the service covers, your confirmation that you are authorised to order work on that website (with the time and IP address of the confirmation), and payment status |
| Purpose | Providing and billing the service, and keeping evidence that the work was authorised |
| Legal basis | Art. 6(1)(b) GDPR: performance of a contract. Art. 6(1)(c) GDPR: accounting obligations. Art. 6(1)(f) GDPR: our legitimate interest in being able to prove that the work was authorised |
| Retention | As for orders and contracts in section (c) |
g) AI Chat Assistant
| Details | |
|---|---|
| Data | The content of your conversation, the time of the conversation, a session identifier and technical connection data (IP address). You do not need to give any personal data to use the chat |
| Purpose | Answering your questions about our services, and protecting the chat against abuse |
| Legal basis | Art. 6(1)(f) GDPR: our legitimate interest in answering visitors' questions and keeping the service secure |
| Retention | Up to 6 months after the conversation ends |
The chat assistant is an AI system, not a person, and it is labelled as such (Article 50 of the EU AI Act). Its answers are generated with the help of an AI service provider (see section 3).
h) Website Analytics
| Details | |
|---|---|
| Data | Pages visited, interactions, session identifiers, device and browser type, approximate location, how you reached our website (for example a campaign or referring site) |
| Purpose | Understanding how our website is used and which pages and campaigns lead to enquiries and orders, so we can improve the website and our marketing |
| Legal basis | Art. 6(1)(a) GDPR: your consent, given in our cookie settings |
| Retention | Our own analytics data: up to 90 days. Google Analytics: 14 months |
We use Google Analytics and our own analytics. With your consent, we may link the campaign that brought you to our website with an enquiry or order you later submit, and send pseudonymous event data about that outcome (for example that an order was placed, and its value) to Google Analytics.
i) Advertising Measurement (Google Ads and Meta)
| Details | |
|---|---|
| Data | Cookie and advertising click identifiers, pages visited, conversion events (for example an enquiry sent or an order placed) and technical browser information |
| Purpose | Measuring the results of our advertising and building audiences for our own campaigns on Google and Meta |
| Legal basis | Art. 6(1)(a) GDPR: your consent, given in the marketing category of our cookie settings |
| Retention | Cookies expire within 3 months. Statistics in our advertising accounts are aggregated |
With your consent, this data may also be sent to Meta from our server (Conversions API). Google and Meta also process this data as independent controllers for their own purposes, as described in their privacy policies. If you do not enable the marketing category, this processing does not take place.
j) Cookie Settings
| Details | |
|---|---|
| Data | Your cookie choices and when you made them |
| Purpose | Respecting your choices on later visits |
| Legal basis | Art. 6(1)(c) GDPR: our obligation under the ePrivacy Directive (2002/58/EC) and the Croatian Electronic Communications Act |
| Retention | Stored in your browser until you change your choices or clear your site data |
Details are in our Cookie policy.
k) Business Contacts from Public Sources
| Details | |
|---|---|
| Data | Business name, business address, business phone number, publicly listed business email address, links to official business profiles, public ratings and reviews, the name of the owner or responsible person where it is published with the business, and our notes on the business's public presence |
| Sources | Publicly available sources, such as the business's own website, map listings, advertising libraries, official registers and business directories. We may use data service providers to search these sources |
| Purpose | Contacting a business individually with a proposal that relates to its work, keeping a record of whom we have contacted, and honouring requests not to be contacted again |
| Legal basis | Art. 6(1)(f) GDPR: our legitimate interest in offering our services to businesses whose work the proposal concerns. We contact businesses by letter, through official business profiles or by email; we send unsolicited email only to legal persons at publicly listed business addresses, as permitted by the Croatian Electronic Communications Act |
| Retention | Data about a business we did not contact, or that did not reply, is deleted within 90 days. If you reply, your message is kept as an enquiry (section a). If you ask us not to contact you again, we keep only the business name, domain or address and the date of your request, so that we can respect it |
A website proposal we prepare for a business is published at an unlisted address that is not indexed by search engines and is clearly marked as our proposal, not the business's official website. We remove it on request, and no later than 90 days after it was made if we do not agree to work together. You can object to this processing at any time by replying to our message or writing to office@version2.hr.
We disclose personal data only to the extent necessary for the purposes described above, to the following categories of recipients:
| Recipient | Purpose |
|---|---|
| Hosting, infrastructure and network security providers | Operating, protecting and backing up our website and systems |
| Email and communication service providers | Sending and receiving email and messages |
| AI service providers | Generating chat assistant answers and supporting us in preparing replies, analyses and proposals |
| Data service providers | Searching public business sources (section 2k) |
| Stripe Payments Europe, Ltd. | Payment processing, as an independent controller |
| Google Ireland Ltd. | Analytics and advertising measurement, with your consent |
| Meta Platforms Ireland Ltd. | Advertising measurement, with your consent |
| Accountants, legal advisers and public authorities | Where required for accounting, legal advice or by law |
Service providers that process personal data on our behalf may use it only for the purposes described above. You can ask us for the names of the specific recipients of your data at office@version2.hr.
We do not sell personal data.
Some of our service providers, or their sub-processors, are located outside the European Union and the European Economic Area, mainly in the United States. We transfer personal data outside the EU/EEA only where the requirements of Chapter V of the GDPR are met, in particular on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses. You can request information about the safeguards used at office@version2.hr.
Under the GDPR you have the right to:
- access your personal data (Art. 15)
- rectification of inaccurate data (Art. 16)
- erasure (Art. 17)
- restriction of processing (Art. 18)
- data portability (Art. 20)
- object to processing based on our legitimate interest (Art. 21)
- withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3))
To exercise your rights, write to office@version2.hr. Exercising your rights is free of charge. We may ask you to confirm your identity. We respond within the time limits set by Article 12 of the GDPR: within one month, which may be extended by two further months where necessary, in which case we will let you know.
You also have the right to lodge a complaint with the supervisory authority:
Agencija za zaštitu osobnih podataka (AZOP) Selska cesta 136, 10000 Zagreb, Croatia azop.hr
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
We use appropriate technical and organisational measures to protect personal data, taking into account the nature of the data and the risks involved. If a personal data breach occurs, we notify the supervisory authority and, where required, the affected persons, in accordance with Articles 33 and 34 of the GDPR.
Our website and services are not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.
We may update this Privacy Policy when our processing or the applicable law changes. The "Last updated" date at the top of this page shows when it was last changed. If we intend to use personal data for a new purpose, we will inform you before doing so, as required by the GDPR.
Version2 j.d.o.o. za digitalni marketing Novigradska ulica 21, 23000 Zadar, Croatia Email: office@version2.hr
Related policies: