Privacy Policy — 234 d.o.o.

Effective date: 8 August 2025

This Privacy Policy applies to www.234.hr, owned and operated by 234 d.o.o. (“234,” “we,” or “us”). It explains how we collect, use, disclose, and safeguard your personal data when you visit our website or use our services.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Croatian laws.

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

2.1 Automatically Collected Data

When you visit our website, we collect limited technical and usage data via Google Analytics (with IP anonymisation enabled):

Technical data: anonymised IP address, browser type, device type, operating system.

Usage data: pages visited, visit duration, referral source.

Cookies: only those necessary for site functionality and anonymised analytics (set only after your consent).

2.2 Data You Provide via Contact Form

When you contact us, we collect the following data:

1. Email address (required to reply).

2. Any other information you choose to include (e.g., name, phone number).

We use this data solely to respond to your inquiry.

3. Purposes and Legal Bases for Processing

Purpose of Processing	Legal Basis under GDPR
Operating and securing our website (essential cookies, hosting)	Legitimate interests (Art. 6(1)(f))
Responding to contact form inquiries	Legitimate interests (Art. 6(1)(f)) or steps before entering a contract (Art. 6(1)(b))
Web analytics (Google Analytics, non-essential cookies)	Consent (Art. 6(1)(a))
Fraud prevention and internal analytics	Legitimate interests (Art. 6(1)(f))
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))

4. Cookies and Analytics

We use Google Analytics with IP anonymisation enabled. Google acts as our data processor under the Google Data Processing Terms.

Non-essential cookies (analytics) are set only after your explicit consent via our cookie banner.

You can withdraw consent at any time via our Cookie settings at the bottom of the page or by adjusting your browser settings.

Essential cookies cannot be disabled as they are necessary for site operation.

For more details, see Google’s Privacy Policy.

5. Your Rights Under GDPR

If you are in the EU/EEA, you have the right to:

1. Access your personal data.

2. Rectify inaccurate or incomplete data.

3. Request erasure (“right to be forgotten”).

4. Restrict processing.

5. Data portability (receive your data in a machine-readable format).

6. Object to processing based on legitimate interests or direct marketing.

7. Lodge a complaint with a supervisory authority (in Croatia: AZOP).

We respond to all valid requests within 1 month (extendable to 3 months for complex cases). To exercise your rights, contact mail@234.hr.

6. Data Retention

Analytics data: retained in Google Analytics for 14 months, then deleted or aggregated.

Contact form data: retained for 12 months after resolution, unless required longer by law.

7. International Data Transfers

Your data may be processed outside the EU/EEA (e.g., in the United States). We ensure adequate protection through:

1. Standard Contractual Clauses approved by the European Commission.

2. Other safeguards as required by GDPR.

8. Data Security

We use:

1. SSL encryption.

2. Firewalls and access controls.

3. Regular system monitoring.

While no system is 100% secure, we act promptly in case of incidents.

9. Data Breach Notification

If a personal data breach poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals within 72 hours in accordance with GDPR.

10. Disclosure to Third Parties

We do not sell or rent your data. We may share it with:

1. Trusted service providers (e.g., hosting, analytics) bound by GDPR-compliant agreements.

2. Authorities if legally required.

3. Parties in a merger, acquisition, or asset sale (with prior notice).

11. Children’s Privacy

We do not knowingly collect data from anyone under 16 years old, in line with Croatian law on digital consent (Article 19 of the Croatian Act on the Implementation of the GDPR).

12. Annex — Google Looker Studio Reports

Our website may include links or redirects to third-party platforms, such as Google Looker Studio, through which our clients can access analytics data on ad impressions, revenue, and CPM generated via Google Ad Manager:

Such data is stored and processed only on Google’s servers.

We may temporarily access this data for troubleshooting or reporting purposes.

Google is an independent data controller for this processing.

The use of these links and services is based on contractual necessity for providing reporting services to our clients and our legitimate interest in service delivery.

13. Contact

14. Changes to This Policy

We may update this policy from time to time. The updated version will be posted here with a new effective date.

Last updated: 8 August 2025.