Personal data protection
Privacy notice
In accordance with Article 13 of the General Data Protection Regulation (GDPR), this notice explains which personal data I collect through the website https://web.mentoro.hr, why, how long I keep it and what your rights are.
Translation
This is an English translation for your convenience. In case of any discrepancy, the Croatian version prevails.
1. Data controller
MENTORO, obrt za poduku i poučavanje, owner Jurica Ljevaković
Školska ulica 64, 34551 Lipik, Croatia
OIB (tax number): 32776063403
Email: obrtmentoro@gmail.com
Questions about personal data protection and requests to exercise your rights can be sent to the email address above or by post to the registered office. The business is not required to appoint a data protection officer.
2. What data I collect
Contact form and email
When you send an inquiry, I process only the data needed to reply:
- your name,
- your email address,
- the selected service,
- the content of your message and any details you include in it (e.g. your business name or the address of your existing website).
Please do not include information in your message that is not needed for the inquiry, in particular health data or data about other people.
Technical data and abuse prevention
To protect the form from automated submissions (spam), the server program briefly checks, in working memory only, how many inquiries have been sent from your IP address. This information is not stored permanently and is deleted after one hour at the latest. The hosting provider (Cloudflare) processes technical access data (IP address, time, requested page, browser type) for security and protection against attacks, as with any website.
Cookie-free visitor statistics
For basic visitor statistics (number of visits, most-read pages, device type, country), I use Cloudflare Web Analytics. This service does not set cookies, does not store anything on your device, does not track you across other websites and does not create visitor profiles. I only see aggregate figures, not data about individual visitors.
Light or dark theme
If you switch between the light and dark theme on the website, your choice is stored only in your browser (localStorage), so that the website remembers the look you selected. This information is not sent to me or to third parties, and you can delete it by clearing the website data in your browser.
3. Purpose and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your inquiry and preparing a quote at your request | Art. 6(1)(b): steps taken at the request of the data subject prior to entering into a contract |
| Performing the agreed service (building or updating a website, communication) | Art. 6(1)(b): performance of a contract |
| Issuing invoices and keeping business records | Art. 6(1)(c): legal obligation (tax and accounting regulations) |
| Protecting the form from spam and abuse; website security | Art. 6(1)(f): legitimate interest in website security |
| Aggregate, cookie-free visitor statistics | Art. 6(1)(f): legitimate interest in understanding how the website is used |
Sending an inquiry is voluntary, but I cannot reply without your name, email address and message. I do not ask for consent to send an inquiry, because the processing is based on your request for a reply. I do not use your data for promotional messages, I do not sell it, and I do not carry out automated decision-making or profiling.
4. Recipients
Only the owner of the business has access to the data. For technical operation, I use the following service providers, who process data on my behalf and according to my instructions:
- Cloudflare, Inc.: website hosting, protection against attacks, forwarding inquiries from the contact form by email, and cookie-free visitor statistics. Cloudflare may also process data outside the European Economic Area, including in the USA. Such transfers are based on the European Commission's adequacy decision (EU–US Data Privacy Framework) and standard contractual clauses.
- Google (Gmail), whose mailbox receives the inquiries. Google may also process data outside the European Economic Area, including in the USA, on the same legal basis.
The Instagram link leads to the social network's website. If you open it, Meta is responsible for processing data on Instagram, according to its own privacy policy. This website does not embed any content from Instagram.
Data may be disclosed to the competent authorities only when required by law.
5. How long I keep data
- Inquiries that do not lead to a collaboration are deleted no later than 12 months after the last communication.
- Communication related to an agreed service is kept for the duration of the collaboration and until the deadlines for any complaints and claims have expired.
- Invoices and accounting records are kept for the periods required by tax and accounting regulations.
- The count of inquiries from an IP address is deleted automatically after one hour at the latest.
6. Your rights
Under the GDPR, you have the right:
- to access your personal data and receive a copy (Art. 15),
- to have inaccurate data corrected (Art. 16),
- to erasure when there is no longer a basis for processing (Art. 17),
- to restriction of processing (Art. 18),
- to data portability (Art. 20),
- to object to processing based on legitimate interest (Art. 21).
Send your request to obrtmentoro@gmail.com. I will reply without undue delay and within one month at the latest. To protect your data, I may ask you to confirm your identity.
If you believe that the processing of your data breaches the regulations, you have the right to lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop.hr.
7. Cookies
This website does not use cookies, tracking tools such as Google Analytics, marketing pixels or embedded third-party content. Fonts and files are loaded from the same server as the website. That is why the website does not show a cookie banner or ask for consent.
If I introduce non-essential cookies in the future, I will ask for your consent before setting them and update this notice.
8. Security
The website is served exclusively over an encrypted connection (HTTPS). Form data is not stored in a database; it is forwarded immediately by email. Access to the mailbox is protected and available only to the owner of the business.
9. Changes to this notice
I may update this notice if the way data is processed or the regulations change. The current version is always published on this page.
Last updated: 14 October 2026