Privacy Policy

Last updated: November 4, 2026.

1. Data Controller

Splajser Servis d.o.o., OIB: 79497569112, Dragojla Kušlana 2, 10000 Zagreb, Croatia (hereinafter: "Splajser", "we"). Contact: info@splajser.com, +385 95 888 8888.

Splajser processes personal data in accordance with the General Data Protection Regulation (EU 2016/679, hereinafter: GDPR) and applicable Croatian data protection legislation.

2. Data We Collect and Purposes

2.1 Contact Form

The contact form collects: name, email address, phone (optional), and message text. Messages are sent to info@splajser.com via SMTP. Email content is retained for 90 days and then automatically deleted.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — responding to visitor inquiries.

2.2 Session Cookie

The website uses a cookie named "session" with a 30-day sliding expiry. This cookie is necessary for website functionality and cannot be declined. It holds only a session identifier, with none of your name or anything else you have given us; the identifier itself is personal data and is processed as described in this policy. The security token is derived from the session on each request and is stored nowhere.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — website security.

2.3 Rate Limiting

IP addresses are temporarily stored in server memory (60-second window) solely to protect forms from abuse.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — system security.

2.4 Website analytics

If you accept analytics cookies, we measure traffic with Matomo, installed on our own server (analitika.rezidual.rs). Matomo records which pages you visit, where you arrived from, an approximate location derived from your IP address, and basic browser and device details. The data stays on our server, is not passed to any third party, and is not used for advertising or profiling. If you decline analytics, Matomo does not measure your visit and sets no cookies.

If you accept analytics, Matomo sets the cookies "_pk_id" (13 months) and "_pk_ses" (30 minutes). The "consent" cookie (12 months) stores your choice itself and is strictly necessary. You can change your choice at any time from the link in the page footer.

Legal basis: consent (Art. 6(1)(a) GDPR).

3. Product Catalog

The website features a product catalog for informational purposes only. There is no online purchasing, shopping cart, or ordering system. Browsing the catalog does not require the collection of personal data.

4. Third Parties and Data Transfers

4.1 Cloudflare Turnstile

The contact form uses Cloudflare Turnstile for bot protection. Cloudflare, Inc. (USA) processes the visitor's IP address and browser data. Cloudflare is certified under the EU-US Data Privacy Framework, which is the basis for the transfer to the USA under the European Commission’s adequacy decision (Art. 45 GDPR). More information: Cloudflare Privacy Policy.

4.2 Fonts

The website uses the JetBrains Mono font hosted on its own server. Fonts are not loaded from external services and the visitor's IP address is not sent to third parties for font loading.

4.3 Google Maps

The contact page displays a Google Maps embed via iframe. Google LLC (USA) receives the visitor's IP address when the map loads.

4.4 FontAwesome

Icons are loaded from fluid.rezidual.rs, our own CDN. No data is passed to any third party through it.

5. International Data Transfers

Personal data is transferred to the USA via Cloudflare and Google services (see section 4). Both providers are certified under the EU-US Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR). We do not transfer personal data to third countries outside this framework.

If a provider loses its certification under that framework, or the framework ceases to apply, the transfer continues on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), and if that is not possible either we stop using the service.

6. Data Retention

Contact messages (sent-mail record): the body of the message is deleted 90 days after sending. The recipient address, the subject and the time of sending remain in the record as a log of mail sent. The message itself also stays in the recipient’s mailbox under our internal mail retention practice.
Session data: until session expiry (30 days of inactivity).
Rate limiting data: 60 seconds, in server memory only.
Cookie consent record: when you accept or decline analytics in the banner, we record the choice itself, your IP address, your browser’s user agent and the time of the choice, and keep that for 3 years so that we can demonstrate consent was given or refused. Legal basis: the obligation to be able to demonstrate consent (Art. 7(1) GDPR).
Invoices and the records behind quotations and sales: 11 years, under tax and accounting law.

7. Your Rights

Under the GDPR, you have the right to:

access your personal data (Art. 15 GDPR);
rectification of inaccurate data (Art. 16 GDPR);
erasure of your data (Art. 17 GDPR);
restriction of processing (Art. 18 GDPR);
data portability (Art. 20 GDPR);
object to processing based on legitimate interest (Art. 21 GDPR);
withdraw your consent at any time where processing is based on consent (Art. 7(3) GDPR). You withdraw consent for analytics from the link in the page footer; withdrawal does not affect the lawfulness of processing carried out beforehand.

Send requests to: info@splajser.com. We will respond within 30 days (Art. 12(3) GDPR).

8. Right to Complain

If you believe your data is being processed unlawfully, you have the right to file a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

9. Data Protection Officer

Given the scope and nature of our personal data processing, we are not required to appoint a Data Protection Officer under Art. 37 GDPR. For any questions regarding personal data protection, please contact info@splajser.com.

10. Data Security

We implement appropriate technical and organizational measures to protect your data. All communication with the website is encrypted via HTTPS. Access to the database is restricted to the application layer.

11. Automated Decision-Making

We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.