Privacy Policy

1. Introduction

This Privacy Policy explains how Syntera d.o.o. (hereinafter: "Syntera", "we" or "us") collects, uses and protects the personal data of visitors to the website www.syntera.hr (hereinafter: the "Website").

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the "General Data Protection Regulation" or "GDPR"), the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/18) and the Electronic Communications Act.

The Website is presentational in nature. We do not offer user accounts, we do not sell anything through the Website, and we do not carry out profiling or automated decision-making.

2. Data controller

The controller of personal data is:

For any questions about the processing of personal data and the exercise of your rights under this Policy, you can contact us at the email address above.

3. What data we collect and why

3.1. Data recorded automatically during a visit

Each time you visit the Website, the server automatically records the technical data necessary to deliver content and keep the system secure:

• IP address in shortened or full form
• date and time of access
• requested address (URL) and response status code
• type and version of web browser and operating system
• amount of data transferred

Purpose of processing: delivering the Website's content, ensuring technical stability and security, and detecting and preventing misuse.

Legal basis: the controller's legitimate interest in the Website working properly and securely (Article 6(1)(f) GDPR).

Retention period: [NUMBER] days, after which the logs are deleted automatically, unless a particular log is needed to investigate a security incident.

3.2. Data you provide to us

If you contact us by email or phone, we will process the data you provide — typically your first and last name, email address, phone number and the content of your message.

Purpose of processing: responding to your enquiry and maintaining correspondence.

Legal basis: legitimate interest in communicating with people who contact us, or taking steps at your request prior to entering into a contract where the enquiry concerns potential business cooperation (Article 6(1)(f) and (b) GDPR).

Retention period: until the communication has ended, unless longer retention is required to fulfil legal obligations or to protect legal claims.

3.3. What we do not do

We do not use analytics or marketing cookies on the Website, we do not track visitors across websites, we do not display ads and we do not sell personal data to third parties. We do not use personal data for automated decision-making or for profiling within the meaning of Article 22 GDPR.

4. Cookies

Cookies are small text files stored on your device when you visit a website.

The Website uses only strictly necessary cookies — those without which the Website cannot work properly or which are needed to provide a service you have explicitly requested. Under the Electronic Communications Act and the opinion of the Croatian Personal Data Protection Agency, such cookies do not require your consent.

You can delete or block cookies at any time in your browser settings. Blocking necessary cookies may prevent parts of the Website from working properly.

If we introduce analytics or marketing cookies in the future, we will ask for your consent before setting them and update this Policy beforehand.

5. Data recipients

We do not sell, rent or exchange personal data with third parties for marketing purposes.

Data may be accessed only by:

• employees and associates who need the data to perform their tasks, subject to a confidentiality obligation;
• processors who perform certain technical services for us — primarily the Website hosting provider and the email service provider. We have concluded data processing agreements with them in accordance with Article 28 GDPR;
• competent authorities, where we are required by law to provide them with data.

A list of processors is available on request at info@syntera.com.

6. Transfers outside the European Economic Area

As a rule, we process data within the European Economic Area (EEA).

If a processor processes data outside the EEA, we transfer it only with appropriate safeguards under Chapter V GDPR — on the basis of a European Commission adequacy decision or standard contractual clauses. You can request a copy of the safeguards applied at info@syntera.com.

7. Your rights

In relation to the processing of your personal data, you have the following rights:

• right of access — confirmation of whether your data is being processed and a copy of that data;
• right to rectification — correction of inaccurate and completion of incomplete data;
• right to erasure ("right to be forgotten") — erasure of data when it is no longer needed for the purposes for which it was collected or when the processing has no valid legal basis;
• right to restriction of processing — in the cases set out in Article 18 GDPR;
• right to data portability — receiving your data in a structured, commonly used and machine-readable format, where processing is based on consent or a contract and carried out by automated means;
• right to object — to processing based on legitimate interest, in which case we will stop processing unless we demonstrate compelling legitimate grounds to continue;
• right to withdraw consent — where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

You can submit a request to [privatnost@syntera.hr] or by post to our registered office. We will respond without undue delay and at the latest within one month of receiving the request. This period may be extended by a further two months depending on the complexity and number of requests, in which case we will inform you.

To protect your data, we may ask for additional information needed to confirm your identity.

8. Right to lodge a complaint

If you believe that our processing of your personal data violates data protection regulations, you have the right to lodge a complaint with the supervisory authority:

Croatian Personal Data Protection Agency (AZOP)

Ulica Metela Ožegovića 16, 10000 Zagreb

Phone: +385 1 4609 000

Email: azop@azop.hr

Web: www.azop.hr

You may also lodge a complaint with the supervisory authority of the Member State in which you have your habitual residence or place of work.

9. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss or disclosure. These include encryption of traffic between your browser and the Website (TLS/HTTPS), restricting access to data on a need-to-know basis, regular software updates and backups.

Please note that no method of transmitting data over the internet is completely secure, and we cannot guarantee absolute security.

10. Minors

The Website is not intended for persons under the age of 16, and we do not knowingly collect their personal data. If we learn that we have collected such data without the consent of the holder of parental responsibility, we will delete it without delay.

11. Changes to this Privacy Policy

We may amend this Policy from time to time to reflect changes in regulations or in the way the Website operates. The current version is always published on the Website, together with its effective date.

We will notify you in an appropriate manner of any material changes affecting your rights before they take effect.