This policy explains what personal data webbART Studio ("we", "us", "our") collects through this website, why we collect it, how long we keep it, and the rights you have under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the Croatian Act on the Implementation of the GDPR, and other applicable data protection law.
Who we are (data controller)
The data controller responsible for the personal data described in this policy is:
- Name: Maja Rep Strafella, sole trader, trading as webbART studio (obrt za grafički dizajn i digitalne usluge)
- Registered address: Poljanska ulica 1, 23000 Zadar, Croatia
- Contact email: hello@webb-art.com
- OIB: 50108046696 · MBO: 99255758 · VAT ID: HR50108046696
We are not required to appoint a Data Protection Officer. For anything privacy-related, write to the email address above.
What data we collect
- Contact form — if you use the contact form, we process the name, email address and message you enter, plus anything else you choose to include. You provide this data yourself. Providing it is optional, but we cannot reply without a name and email address.
- Emails — if you write to us directly, we process your email address, name (if shown) and the content of your message.
- Basic server logs — like most websites, our hosting provider automatically records technical information such as your IP address, browser type and version, operating system, date and time of the request, the page requested and the referring page, for security and troubleshooting.
We do not ask for special categories of data (such as health, religious or biometric data) — please do not include any in your message. This website is aimed at businesses and individuals acting in a professional capacity and is not directed at children.
Why we process your data and on what legal basis
- Replying to your enquiry and, where relevant, preparing a quote or contract at your request: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and, for general enquiries, Art. 6(1)(f) GDPR (our legitimate interest in answering business enquiries).
- Server logs: Art. 6(1)(f) GDPR — our legitimate interest in keeping the website secure, preventing abuse and fixing technical faults.
- Invoicing and bookkeeping, if you become a client: Art. 6(1)(c) GDPR (legal obligations under Croatian accounting and tax law).
Where we rely on legitimate interest, we have weighed it against your rights and the impact on you is minimal; you can object at any time (see "Your rights"). We do not use your data for marketing or newsletters, and we do not carry out automated decision-making or profiling. If we ever want to send you marketing, we will ask for your consent first.
How long we keep your data
- Contact form messages and emails: only as long as needed to handle your enquiry and, if no project follows, for up to 12 months after our last communication, then deleted.
- Client records and invoices: for the period required by Croatian accounting and tax law.
- Server logs: according to our hosting provider’s retention period, typically a few weeks to a few months.
Who we share your data with
We do not sell or rent your personal data and we do not share it for marketing. Data may be processed on our behalf by service providers acting under a data processing agreement (Art. 28 GDPR):
- Our website hosting provider (Synnefo Systems d.o.o.), to run this website and keep server logs.
- Our email service provider (Synnefo Systems d.o.o.), which delivers and stores the messages you send us.
Where the law requires it, we may also disclose data to public authorities (for example tax authorities) or our accountant. We do not use third-party analytics, advertising or tracking services, and this website does not embed third-party content such as maps, videos or social media widgets.
Cookies and similar technologies
This website does not set any cookies, and does not use tracking, analytics, advertising or marketing technologies. The only thing stored on your device is a small record of your cookie choice:
- webbart_cookie_consent — stored in your browser’s local storage (not a cookie). Contents: whether you accepted or rejected optional categories, a timestamp and a version number. Purpose: to remember your choice so we do not ask again. It stays on your device and is never sent to us. It remains until you change your choice or clear your browser data.
Storing this record is strictly necessary to provide the function you requested and is exempt from the consent requirement of the ePrivacy Directive (2002/58/EC), as implemented in Croatia by the Electronic Communications Act.
The cookie banner includes an "Analytics" switch for future use. It is off by default and currently controls nothing, because no analytics service is installed. If we add analytics in the future, only visitors who have switched it on (or clicked "Accept all") will be measured, and this policy will be updated to name the service before it goes live.
All fonts used on this website are hosted on our own server, so no data about your visit is sent to an external font provider. The background music option is generated in your browser and does not involve any data transfer. Some portfolio items link to external websites, which have their own privacy policies.
You can change your choice at any time using the small settings icon in the bottom-left corner of the page.
International data transfers
Your data is processed within the European Economic Area. If this ever changes — for example, if we switch to a provider located outside the EEA — we will ensure appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses, and update this policy accordingly.
Security
This website is served over HTTPS, and we limit access to enquiries and client data to what is necessary for our work.
Your rights under GDPR
Under the GDPR, you have the right to:
- Access the personal data we hold about you (Art. 15)
- Correct inaccurate or incomplete data (Art. 16)
- Request erasure of your data — "right to be forgotten" (Art. 17)
- Restrict how we process your data (Art. 18)
- Receive your data in a portable format (Art. 20)
- Object to processing based on our legitimate interest (Art. 21)
- Withdraw consent at any time, where processing is based on consent, without affecting processing already carried out (Art. 7(3))
- Lodge a complaint with a supervisory authority. Our authority is the Croatian Personal Data Protection Agency (AZOP); you may also complain to the authority in the EU country where you live or work.
To exercise any of these rights, email hello@webb-art.com. We will respond within one month, free of charge, and may ask you to verify your identity first. We would appreciate the chance to resolve any concern with you before you complain to an authority, but you are never required to.
Changes to this policy
We may update this policy from time to time. Changes will be posted on this page with an updated "last updated" date.
Contact us
Questions about this policy or how we handle your data? Email us at hello@webb-art.com.