Privacy policy

Last updated October 2026

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter: GDPR) and the Croatian Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/18), Shtruca, obrt za marketing i poslovne usluge, Ratarska ulica 69, 10110 Zagreb, Croatia, OIB 80772036739 (hereinafter: Shtruca, we or us), as the controller of personal data, has adopted this Privacy Policy.

This Policy explains how we collect, use and protect personal data in connection with the website www.shtruca.agency and our services. Its aim is to inform visitors, clients, partners and anyone who contacts us (hereinafter: data subjects) clearly and transparently about how their personal data is processed and what rights they have.

As controller, Shtruca decides why and how your personal data is processed, and we are committed to protecting and respecting your privacy. Please read this Policy carefully.

Who to contact

For any question about this Policy or your personal data, please contact us:

  • Shtruca, obrt za marketing i poslovne usluge
  • Ratarska ulica 69, 10110 Zagreb, Croatia
  • Email: [email protected]

When and how we collect personal data

We collect personal data when it is needed to respond to your requests, to provide our services or for the purposes of our business:

  • When you visit the website, our hosting provider automatically records technical data needed to deliver the pages and keep them secure, such as your IP address (which is also personal data), the date and time of access, the page requested and your browser type.
  • If you allow it in the cookie widget, we collect information about how you use the website (pages viewed, clicks, device, browser, operating system, language settings and approximate location) through Google Tag Manager and Google Analytics, and, if you allow marketing cookies, through advertising measurement tools.
  • When you contact us by email or through the contact form, we process your name, email address, the topic you choose, your message and any other information you decide to send us. The contact form does not store anything on the website: it opens your own email app with the message ready to send, and the message reaches us as an ordinary email.
  • When you contact us through social networks, we process the information you make available to us in your message or enquiry.
  • When you become our client, we process the contact and billing details needed to agree on, carry out and invoice the work.
  • When you send us an open job application, we process your name, contact details, qualifications, work experience and any other information contained in the application.

We process these categories of data on the basis of your consent (analytics and marketing cookies, given through the cookie widget), our legitimate interest (storage that is necessary for the website to work and be secure, and answering enquiries), steps taken at your request before entering into a contract and the performance of a contract, or to meet our legal obligations under Croatian law.

Where processing is based on your consent, you can withdraw it at any time: change your choice under in the website footer, or write to us at [email protected]. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Some information is required to provide what you ask for. If you do not provide it, we may not be able to answer your enquiry or carry out the requested service.

We do not use your personal data for direct marketing unless you have agreed to it. We treat your personal data as confidential, and it is protected by Shtruca and our trusted partners.

Which data we use and why

The typical categories of data we collect directly from you are your name, email address and the content of your message. We process personal data in order to:

  • answer your enquiries and handle your requests as efficiently as possible,
  • prepare offers and enter into and perform contracts with our clients,
  • issue invoices and meet our accounting and tax obligations,
  • keep the website working, secure and available,
  • produce statistics about the use of the website (with your consent),
  • measure and improve our advertising campaigns (with your consent),
  • improve the quality of our content, functionality and services.

If we ever want to use your data for a new purpose, we will inform you before that processing begins.

Your privacy rights

At any time, you have the right to ask Shtruca to:

Give you access to your personal data

You can ask which of your personal data we use and request access to it. You have the right to know the purposes of processing, the categories of data we hold, the recipients or categories of recipients we share it with, how long we keep it and, where the data was not collected from you, its source. You can also ask for a copy of some or all of the personal data we hold about you.

Correct inaccurate data

We want your personal data to be accurate and up to date. You can ask us to correct or remove information you believe is wrong or out of date.

Erase your personal data

You can ask us to stop processing or to erase your personal data. If we need the data to perform a contract with you, we may then no longer be able to perform it. If we must keep the data to meet a legal obligation (for example, tax obligations), we may not be able to fulfil the request.

Restrict processing

You can ask us to restrict processing if you contest the accuracy of the data, if we no longer need the data but you need it to establish, exercise or defend legal claims, or if you have objected to processing based on our legitimate interest.

Object to processing

You have the right to object to processing that is based on our legitimate interest.

Transfer your data (data portability)

Where processing is based on your consent or a contract and is carried out by automated means, you can ask us to transfer your data to another controller.

How to exercise your rights

To exercise any of these rights, please contact us at [email protected] or at the address given above. If you believe your rights have not been respected, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), Selska cesta 136, HR-10000 Zagreb, email: [email protected].

Where and how we store your data

We store personal data in a secure environment and protect it against unauthorised access, disclosure, use, alteration or destruction. Data is kept in our secure IT systems and, in some cases, on the servers of trusted service providers located in the European Union.

We apply reasonable administrative, technical and physical safeguards, and only authorised persons who are bound by confidentiality have access to personal data.

We keep personal data only as long as it is needed for the purposes described in this Policy, and no longer than the law requires or allows (see “How long we keep your data”). Where you have given consent, we process the data until you withdraw it. If you raise a justified objection to processing based on legitimate interest, we will stop that processing.

If court, administrative or out-of-court proceedings have been started, personal data may be kept until those proceedings end, including any period for appeals.

Do we share data with third parties?

We never share your personal data with third parties except for the purposes described in this Policy. We share data with trusted service providers who process it on our behalf, such as our hosting, email and IT providers, and, if you allow analytics or marketing cookies, Google. These providers may use the data only according to our instructions and only for the purpose we have defined, and they are contractually required to protect it and keep it confidential.

Data is stored on servers in the European Union or in countries that ensure an adequate level of protection under EU law. Some providers, such as Google, may process data outside the European Union. On 10 July 2023 the European Commission adopted an adequacy decision under Article 45 of the GDPR for the EU–US Data Privacy Framework, which allows personal data to be transferred to US companies certified under that Framework. Where a provider is not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and additional safeguards.

We review our service providers regularly to make sure that personal data continues to be protected in line with applicable regulations.

How long we keep your data

We do not keep personal data longer than needed for the purpose for which it was collected:

  • enquiries and related correspondence: up to 3 years after our last contact, unless they lead to a contract,
  • contracts and client correspondence: for the duration of the contract and up to 3 years after it ends, or longer where the law requires,
  • invoices and other accounting records: 11 years, as required by Croatian law,
  • job applications: up to 1 year, unless you agree to a longer period,
  • records of requests to exercise your privacy rights: permanently,
  • consent choices made in the cookie widget: up to 12 months, after which we ask again,
  • analytics data in Google Analytics: up to 14 months.

For more detail about retention periods, contact us at [email protected].

Cookies

To keep the website working and, with your consent, to understand how it is used, Shtruca uses cookies and similar technologies (such as your browser's local storage). Until you make a choice in the cookie widget, only what is strictly necessary is used; Google Tag Manager runs in Consent Mode, so Google tags do not store analytics or advertising cookies without your permission.

  • Necessary: shtruca-consent (local storage, Shtruca) remembers your cookie choice. Kept until you change it or clear your browser data.
  • Analytics (only with consent): _ga and _ga_<ID> (Google Analytics) distinguish visitors and sessions. Kept up to 2 years.
  • Marketing (only with consent): _gcl_au and similar cookies (Google Ads) measure advertising conversions. Kept up to 90 days. If further advertising tools are added through Google Tag Manager, they will also run only with marketing consent.

You can change or withdraw your consent at any time under in the website footer. More about cookies is in our Terms of Use.

Other websites and social networks

Other websites that can be reached from our website have their own privacy policies and their own rules for collecting and using data. Shtruca is not responsible for how third parties operate.

If you contact us through social networks such as Facebook, Instagram or LinkedIn, we can see your messages and posts there. We do not store personal data from those messages or process it further, except for the purposes described in this Policy. The platforms process your data under their own policies:

If you are not satisfied with how a platform processes your data, you can contact its data protection officer, its lead supervisory authority (the Irish Data Protection Commission) or the Croatian Personal Data Protection Agency.

Entry into force and changes

This Privacy Policy takes effect when it is published on the website. Shtruca may amend or supplement it, and any changes will be published on this page.